www.rd.com Open in urlscan Pro
2606:4700:4400::6812:268d Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://click.email.rd.com/?qs=917f410ab7c4bef8b7babac08d9946c3cbb1213d6032daf4fa239673abbd4bcd743b06d6c63496a73f515ae6a574...
Effective URL:
https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD9572...
Submission: On August 09 via manual (August 9th 2022, 7:23:35 pm UTC) from US — Scanned from DE

Summary HTTP 365 Redirects Links 48 Behaviour Indicators

Summary

This website contacted 97 IPs in 8 countries across 66 domains to perform 365 HTTP transactions. The main IP is 2606:4700:4400::6812:268d, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.rd.com. The Cisco Umbrella rank of the primary domain is 46673.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on May 19th 2022. Valid for: a year.

This is the only time www.rd.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	13.111.148.19 13.111.148.19	22606 (EXACT-7) (EXACT-7)
79	2606:4700:440... 2606:4700:4400::6812:268d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	108.138.4.10 108.138.4.10	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:82b::2008	15169 (GOOGLE) (GOOGLE)
13	23.35.237.151 23.35.237.151	16625 (AKAMAI-AS) (AKAMAI-AS)
1	184.51.9.197 184.51.9.197	16625 (AKAMAI-AS) (AKAMAI-AS)
1	151.139.128.11 151.139.128.11	20446 (STACKPATH...) (STACKPATH-CDN)
2	2606:4700:20:... 2606:4700:20::681a:79b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a03:2880:f00... 2a03:2880:f007:8:face:b00c:0:1	32934 (FACEBOOK) (FACEBOOK)
2	2600:9000:230... 2600:9000:2304:e400:8:8845:1500:93a1	16509 (AMAZON-02) (AMAZON-02)
1	23.75.240.210 23.75.240.210	16625 (AKAMAI-AS) (AKAMAI-AS)
3 5	2600:9000:206... 2600:9000:206e:8600:1:a3fa:7cc0:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2606:4700:303... 2606:4700:3035::6815:29f3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:451	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:813::2002	15169 (GOOGLE) (GOOGLE)
2	99.86.240.124 99.86.240.124	16509 (AMAZON-02) (AMAZON-02)
1	2600:1f14:600... 2600:1f14:600:6e02:985c:c802:57ac:7531	16509 (AMAZON-02) (AMAZON-02)
2	54.226.61.34 54.226.61.34	14618 (AMAZON-AES) (AMAZON-AES)
1 3	2600:9000:225... 2600:9000:225e:6c00:1:a3fa:7cc0:93a1	16509 (AMAZON-02) (AMAZON-02)
3	2600:9000:230... 2600:9000:2304:3000:e:5a70:ca4f:f701	16509 (AMAZON-02) (AMAZON-02)
13	152.199.23.151 152.199.23.151	15133 (EDGECAST) (EDGECAST)
2 5	13.32.99.21 13.32.99.21	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:440... 2606:4700:440e::6812:2fe6	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a00:1450:400... 2a00:1450:400e:80f::200a	15169 (GOOGLE) (GOOGLE)
1	18.132.175.146 18.132.175.146	16509 (AMAZON-02) (AMAZON-02)
3	35.190.59.101 35.190.59.101	15169 (GOOGLE) (GOOGLE)
3	35.201.67.47 35.201.67.47	15169 (GOOGLE) (GOOGLE)
2	35.190.91.160 35.190.91.160	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82f::2003	15169 (GOOGLE) (GOOGLE)
15	2a04:4e42:200... 2a04:4e42:200::626	54113 (FASTLY) (FASTLY)
1	34.120.253.250 34.120.253.250	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	2a02:26f0:dc:... 2a02:26f0:dc:181::1931	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
9	142.250.186.162 142.250.186.162	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:80e::200e	15169 (GOOGLE) (GOOGLE)
1	20.50.2.28 20.50.2.28	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2a04:4e42:400... 2a04:4e42:400::485	54113 (FASTLY) (FASTLY)
3	104.96.148.107 104.96.148.107	16625 (AKAMAI-AS) (AKAMAI-AS)
1	143.204.89.32 143.204.89.32	16509 (AMAZON-02) (AMAZON-02)
2	151.101.129.194 151.101.129.194	54113 (FASTLY) (FASTLY)
2	18.203.105.247 18.203.105.247	16509 (AMAZON-02) (AMAZON-02)
3	2a03:2880:f12... 2a03:2880:f12d:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	34.120.117.212 34.120.117.212	15169 (GOOGLE) (GOOGLE)
9	52.213.82.126 52.213.82.126	16509 (AMAZON-02) (AMAZON-02)
1	152.199.22.243 152.199.22.243	15133 (EDGECAST) (EDGECAST)
2	2a00:1450:400... 2a00:1450:400e:80e::200a	15169 (GOOGLE) (GOOGLE)
5	34.98.72.95 34.98.72.95	15169 (GOOGLE) (GOOGLE)
1	13.32.99.122 13.32.99.122	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:400c:c09::9b	15169 (GOOGLE) (GOOGLE)
1 1	2600:1f18:730... 2600:1f18:730:b150:64a4:fa7e:99c4:8411	14618 (AMAZON-AES) (AMAZON-AES)
1	34.230.119.25 34.230.119.25	14618 (AMAZON-AES) (AMAZON-AES)
2 6	2a00:1450:400... 2a00:1450:4001:80b::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80e::2003	15169 (GOOGLE) (GOOGLE)
1	13.32.121.60 13.32.121.60	16509 (AMAZON-02) (AMAZON-02)
2	18.156.195.47 18.156.195.47	16509 (AMAZON-02) (AMAZON-02)
3	104.18.18.126 104.18.18.126	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	3.65.16.214 3.65.16.214	16509 (AMAZON-02) (AMAZON-02)
3	185.64.189.112 185.64.189.112	62713 (AS-PUBMATIC) (AS-PUBMATIC)
3	3.122.72.35 3.122.72.35	16509 (AMAZON-02) (AMAZON-02)
7	37.252.173.215 37.252.173.215	29990 (ASN-APPNEX) (ASN-APPNEX)
1	34.111.8.32 34.111.8.32	15169 (GOOGLE) (GOOGLE)
3	23.47.212.208 23.47.212.208	16625 (AKAMAI-AS) (AKAMAI-AS)
1	54.146.208.95 54.146.208.95	14618 (AMAZON-AES) (AMAZON-AES)
1	23.36.162.26 23.36.162.26	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
7	77.245.57.72 77.245.57.72	36057 (WEBAIR-IN...) (WEBAIR-INTERNET-MTL)
1	104.96.145.101 104.96.145.101	16625 (AKAMAI-AS) (AKAMAI-AS)
6	3.65.165.22 3.65.165.22	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:440... 2606:4700:4400::ac40:99f1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:800::2006	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:830::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:809::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:812::2002	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:831::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:806::2001	15169 (GOOGLE) (GOOGLE)
2	2602:803:c003... 2602:803:c003:200::41	26667 (RUBICONPR...) (RUBICONPROJECT)
2	3.121.8.16 3.121.8.16	16509 (AMAZON-02) (AMAZON-02)
19	2a00:1450:400... 2a00:1450:4001:80f::2001	15169 (GOOGLE) (GOOGLE)
2	52.57.125.17 52.57.125.17	16509 (AMAZON-02) (AMAZON-02)
4	151.101.194.133 151.101.194.133	54113 (FASTLY) (FASTLY)
1	143.204.89.57 143.204.89.57	16509 (AMAZON-02) (AMAZON-02)
1	34.120.133.55 34.120.133.55	() ()
3	184.51.9.34 184.51.9.34	() ()
3	23.35.236.188 23.35.236.188	() ()
2	23.205.235.133 23.205.235.133	() ()
3	76.223.111.18 76.223.111.18	() ()
3	23.35.236.247 23.35.236.247	() ()
1	69.173.144.165 69.173.144.165	() ()
6 18	104.18.19.126 104.18.19.126	() ()
1	185.64.190.78 185.64.190.78	() ()
3 6	209.54.182.161 209.54.182.161	() ()
3 6	142.250.185.66 142.250.185.66	() ()
3	3.33.220.150 3.33.220.150	() ()
2 2	34.254.16.176 34.254.16.176	() ()
1 1	2606:4700::68... 2606:4700::6813:ad6c	() ()
3 4	151.101.194.49 151.101.194.49	() ()
1	37.157.6.252 37.157.6.252	() ()
3	2606:4700::68... 2606:4700::6812:d4c	() ()
1 1	2620:116:800d... 2620:116:800d:21:ef75:8280:f209:5ba1	() ()
1	2a05:d018:d29... 2a05:d018:d29:3605:c111:9aee:7bd3:6707	() ()
2 3	104.96.159.65 104.96.159.65	() ()
1 1	185.183.112.148 185.183.112.148	() ()
1	18.194.56.109 18.194.56.109	() ()
1	54.243.198.75 54.243.198.75	() ()
365	97

1 13.111.148.19 (United States) 1 redirects

ASN22606 (EXACT-7, US)
PTR: click.email.rd.com

click.email.rd.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

79 2606:4700:4400::6812:268d (United States)

ASN13335 (CLOUDFLARENET, US)

www.rd.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 108.138.4.10 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-4-10.fra56.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 23.35.237.151 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-35-237-151.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
px.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 184.51.9.197 (Vienna, Austria)

ASN16625 (AKAMAI-AS, US)
PTR: a184-51-9-197.deploy.static.akamaitechnologies.com

s.ntv.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.139.128.11 (United States)

ASN20446 (STACKPATH-CDN, US)

s.skimresources.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:20::681a:79b (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.brandmetrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f007:8:face:b00c:0:1 (Vienna, Austria)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2304:e400:8:8845:1500:93a1 (United States)

ASN16509 (AMAZON-02, US)

b-code.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.75.240.210 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-75-240-210.deploy.static.akamaitechnologies.com

micro.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2600:9000:206e:8600:1:a3fa:7cc0:93a1 (United States) 3 redirects

ASN16509 (AMAZON-02, US)

cdn.jwplayer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:3035::6815:29f3 (United States)

ASN13335 (CLOUDFLARENET, US)

tags.catapultx.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:451 (United States)

ASN13335 (CLOUDFLARENET, US)

d82f7a30-751a-4689-b7e9-19336a89ab46.edge.permutive.app	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 99.86.240.124 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-240-124.vie50.r.cloudfront.net

cdn.p-n.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f14:600:6e02:985c:c802:57ac:7531 (Boardman, United States)

ASN16509 (AMAZON-02, US)

aamapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.226.61.34 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-226-61-34.compute-1.amazonaws.com

tracking.skyword.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:225e:6c00:1:a3fa:7cc0:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

content.jwplatform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:2304:3000:e:5a70:ca4f:f701 (United States)

ASN16509 (AMAZON-02, US)

cdn.flipboard.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 152.199.23.151 (United States)

ASN15133 (EDGECAST, US)

widget.beop.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 13.32.99.21 (United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-21.fra60.r.cloudfront.net

sb.scorecardresearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:440e::6812:2fe6 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:400e:80f::200a (Ireland)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.132.175.146 (London, United Kingdom)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-132-175-146.eu-west-2.compute.amazonaws.com

mb.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.190.59.101 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 101.59.190.35.bc.googleusercontent.com

r.skimresources.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.201.67.47 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 47.67.201.35.bc.googleusercontent.com

t.skimresources.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.190.91.160 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 160.91.190.35.bc.googleusercontent.com

p.skimresources.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2a04:4e42:200::626 (United States)

ASN54113 (FASTLY, US)

assets-jpcust.jwpsrv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ssl.p.jwpcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
prd.jwpltx.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.120.253.250 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 250.253.120.34.bc.googleusercontent.com

tag.bounceexchange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:dc:181::1931 (Vienna, Austria)

ASN20940 (AKAMAI-ASN1, NL)

s.pinimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 142.250.186.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80e::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 20.50.2.28 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

collector.brandmetrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:400::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.96.148.107 (Vienna, Austria)

ASN16625 (AKAMAI-AS, US)
PTR: a104-96-148-107.deploy.static.akamaitechnologies.com

c.aaxads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
l3.aaxads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.89.32 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-89-32.fra50.r.cloudfront.net

ats.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.129.194 (United States)

ASN54113 (FASTLY, US)

confiant-integrations.global.ssl.fastly.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.203.105.247 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-203-105-247.eu-west-1.compute.amazonaws.com

s.beop.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f12d:83:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.120.117.212 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 212.117.120.34.bc.googleusercontent.com

ls.skimresources.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 52.213.82.126 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-213-82-126.eu-west-1.compute.amazonaws.com

t.beop.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
contents-tracking.beop.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
data.beop.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 152.199.22.243 (United States)

ASN15133 (EDGECAST, US)

entitlements.jwplayer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400e:80e::200a (Ireland)

ASN15169 (GOOGLE, US)

imasdk.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 34.98.72.95 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 95.72.98.34.bc.googleusercontent.com

assets.bounceexchange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.99.122 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-122.fra60.r.cloudfront.net

geo.privacymanager.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c09::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:730:b150:64a4:fa7e:99c4:8411 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)

rp.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.230.119.25 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-230-119-25.compute-1.amazonaws.com

rp4.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:80b::2004 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.121.60 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-121-60.fra60.r.cloudfront.net

context.iris.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.156.195.47 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com

c2shb.pubgw.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.18.18.126 (None, )

ASN13335 (CLOUDFLARENET, US)

htlb.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.65.16.214 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-65-16-214.eu-central-1.compute.amazonaws.com

prebid-server.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.64.189.112 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

hbopenbid.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 3.122.72.35 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-122-72-35.eu-central-1.compute.amazonaws.com

tlx.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 37.252.173.215 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.111.8.32 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 32.8.111.34.bc.googleusercontent.com

api.bounceexchange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.47.212.208 (Vienna, Austria)

ASN16625 (AKAMAI-AS, US)
PTR: a23-47-212-208.deploy.static.akamaitechnologies.com

ct.pinterest.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.146.208.95 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-146-208-95.compute-1.amazonaws.com

i.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.36.162.26 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-36-162-26.deploy.static.akamaitechnologies.com

sli.rd.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 77.245.57.72 (United States)

ASN36057 (WEBAIR-INTERNET-MTL, US)

sync.adkernel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.96.145.101 (Vienna, Austria)

ASN16625 (AKAMAI-AS, US)
PTR: a104-96-145-101.deploy.static.akamaitechnologies.com

www.aaxdetect.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 3.65.165.22 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-65-165-22.eu-central-1.compute.amazonaws.com

prebid-a.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:99f1 (United States)

ASN13335 (CLOUDFLARENET, US)

videodam.tmbi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:800::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:830::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:809::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:831::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

23b1a0822ba1831bce09eec41594b818.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2602:803:c003:200::41 (Amsterdam, Netherlands)

ASN26667 (RUBICONPROJECT, US)

fastlane.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.121.8.16 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-121-8-16.eu-central-1.compute.amazonaws.com

krk.kargo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 2a00:1450:4001:80f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.57.125.17 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-57-125-17.eu-central-1.compute.amazonaws.com

protected-by.clarium.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 151.101.194.133 (United States)

ASN54113 (FASTLY, US)

cdn.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.89.57 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-89-57.fra50.r.cloudfront.net

check.analytics.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.120.133.55 (None, )

ASN- ()

api.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 184.51.9.34 (None, )

ASN- ()

ads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.35.236.188 (None, )

ASN- ()

acdn.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.205.235.133 (None, )

ASN- ()

eus.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 76.223.111.18 (None, )

ASN- ()

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.35.236.247 (None, )

ASN- ()

js-sec.indexww.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.165 (None, )

ASN- ()

token.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 104.18.19.126 (None, ) 6 redirects

ASN- ()

ssum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
r.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.64.190.78 (None, )

ASN- ()

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 209.54.182.161 (None, ) 3 redirects

ASN- ()

s.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.250.185.66 (None, ) 3 redirects

ASN- ()

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 3.33.220.150 (None, )

ASN- ()

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.254.16.176 (None, ) 2 redirects

ASN- ()

d.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6813:ad6c (None, ) 1 redirects

ASN- ()

csync.loopme.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 151.101.194.49 (None, ) 3 redirects

ASN- ()

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.157.6.252 (None, )

ASN- ()

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6812:d4c (None, )

ASN- ()

cdn.indexww.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:116:800d:21:ef75:8280:f209:5ba1 (None, ) 1 redirects

ASN- ()

pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:d018:d29:3605:c111:9aee:7bd3:6707 (None, )

ASN- ()

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.96.159.65 (None, ) 2 redirects

ASN- ()

px.owneriq.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.183.112.148 (None, ) 1 redirects

ASN- ()

sync.adotmob.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.194.56.109 (None, )

ASN- ()

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.243.198.75 (None, )

ASN- ()

rtb.adentifi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
81	rd.com 1 redirects click.email.rd.com — Cisco Umbrella Rank: 356533 www.rd.com — Cisco Umbrella Rank: 46673 sli.rd.com — Cisco Umbrella Rank: 118140	455 KB
24	beop.io widget.beop.io — Cisco Umbrella Rank: 20551 s.beop.io — Cisco Umbrella Rank: 20726 t.beop.io — Cisco Umbrella Rank: 20729 contents-tracking.beop.io — Cisco Umbrella Rank: 45777 data.beop.io — Cisco Umbrella Rank: 69148	170 KB
21	casalemedia.com 6 redirects htlb.casalemedia.com — Cisco Umbrella Rank: 560 ssum-sec.casalemedia.com r.casalemedia.com dsum-sec.casalemedia.com	16 KB
18	doubleclick.net 3 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 222 stats.g.doubleclick.net — Cisco Umbrella Rank: 118 pubads.g.doubleclick.net — Cisco Umbrella Rank: 489 googleads.g.doubleclick.net — Cisco Umbrella Rank: 55 cm.g.doubleclick.net	156 KB
16	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 124 23b1a0822ba1831bce09eec41594b818.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 160	136 KB
14	moatads.com z.moatads.com — Cisco Umbrella Rank: 442 mb.moatads.com — Cisco Umbrella Rank: 670 px.moatads.com — Cisco Umbrella Rank: 468	93 KB
14	amazon-adsystem.com 3 redirects c.amazon-adsystem.com — Cisco Umbrella Rank: 323 s.amazon-adsystem.com	50 KB
13	rubiconproject.com micro.rubiconproject.com — Cisco Umbrella Rank: 3187 prebid-server.rubiconproject.com — Cisco Umbrella Rank: 1092 prebid-a.rubiconproject.com — Cisco Umbrella Rank: 2687 fastlane.rubiconproject.com — Cisco Umbrella Rank: 528 eus.rubiconproject.com token.rubiconproject.com	118 KB
11	skimresources.com s.skimresources.com — Cisco Umbrella Rank: 2603 r.skimresources.com — Cisco Umbrella Rank: 2491 t.skimresources.com — Cisco Umbrella Rank: 2585 p.skimresources.com — Cisco Umbrella Rank: 3492 ls.skimresources.com — Cisco Umbrella Rank: 5992	22 KB
10	ampproject.org cdn.ampproject.org — Cisco Umbrella Rank: 374	217 KB
10	adnxs.com ib.adnxs.com — Cisco Umbrella Rank: 238 acdn.adnxs.com	57 KB
9	google.com 2 redirects www.google.com — Cisco Umbrella Rank: 10 adservice.google.com — Cisco Umbrella Rank: 98	2 KB
8	jwpcdn.com ssl.p.jwpcdn.com — Cisco Umbrella Rank: 2541	270 KB
7	adkernel.com sync.adkernel.com — Cisco Umbrella Rank: 3032	763 B
7	pubmatic.com hbopenbid.pubmatic.com — Cisco Umbrella Rank: 518 ads.pubmatic.com image6.pubmatic.com	18 KB
7	bounceexchange.com tag.bounceexchange.com — Cisco Umbrella Rank: 2795 assets.bounceexchange.com — Cisco Umbrella Rank: 2300 api.bounceexchange.com — Cisco Umbrella Rank: 2625	193 KB
6	indexww.com js-sec.indexww.com cdn.indexww.com	6 KB
6	3lift.com tlx.3lift.com — Cisco Umbrella Rank: 652 eb2.3lift.com	2 KB
6	jwplayer.com 3 redirects cdn.jwplayer.com — Cisco Umbrella Rank: 2350 entitlements.jwplayer.com — Cisco Umbrella Rank: 3472	48 KB
5	gstatic.com fonts.gstatic.com www.gstatic.com	91 KB
5	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 67 imasdk.googleapis.com — Cisco Umbrella Rank: 448	333 KB
5	scorecardresearch.com 2 redirects sb.scorecardresearch.com — Cisco Umbrella Rank: 145	56 KB
5	liadm.com 1 redirects b-code.liadm.com — Cisco Umbrella Rank: 3458 rp.liadm.com — Cisco Umbrella Rank: 1709 rp4.liadm.com — Cisco Umbrella Rank: 8285 i.liadm.com — Cisco Umbrella Rank: 576	18 KB
4	everesttech.net 3 redirects sync-tm.everesttech.net	1 KB
4	krxd.net cdn.krxd.net — Cisco Umbrella Rank: 1419	8 KB
4	jwpsrv.com assets-jpcust.jwpsrv.com — Cisco Umbrella Rank: 3255	59 KB
3	owneriq.net 2 redirects px.owneriq.net	1 KB
3	adsrvr.org match.adsrvr.org	793 B
3	jwpltx.com prd.jwpltx.com — Cisco Umbrella Rank: 2846	148 B
3	pinterest.com ct.pinterest.com — Cisco Umbrella Rank: 763	2 KB
3	yahoo.com c2shb.pubgw.yahoo.com — Cisco Umbrella Rank: 910 pr-bh.ybp.yahoo.com	1 KB
3	google.de www.google.de — Cisco Umbrella Rank: 5596 adservice.google.de — Cisco Umbrella Rank: 8117	1 KB
3	facebook.com www.facebook.com — Cisco Umbrella Rank: 100	416 B
3	rlcdn.com ats.rlcdn.com — Cisco Umbrella Rank: 1366 check.analytics.rlcdn.com — Cisco Umbrella Rank: 3881 api.rlcdn.com	38 KB
3	aaxads.com c.aaxads.com — Cisco Umbrella Rank: 2620 l3.aaxads.com — Cisco Umbrella Rank: 3912	144 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 52	20 KB
3	flipboard.com cdn.flipboard.com — Cisco Umbrella Rank: 6530	6 KB
3	jwplatform.com 1 redirects content.jwplatform.com — Cisco Umbrella Rank: 3556	64 KB
3	brandmetrics.com cdn.brandmetrics.com — Cisco Umbrella Rank: 3260 collector.brandmetrics.com — Cisco Umbrella Rank: 4333	17 KB
2	adroll.com 2 redirects d.adroll.com	223 B
2	clarium.io protected-by.clarium.io — Cisco Umbrella Rank: 1824	690 B
2	kargo.com krk.kargo.com — Cisco Umbrella Rank: 2368	1 KB
2	fastly.net confiant-integrations.global.ssl.fastly.net — Cisco Umbrella Rank: 1354	98 KB
2	pinimg.com s.pinimg.com — Cisco Umbrella Rank: 756	20 KB
2	skyword.com tracking.skyword.com — Cisco Umbrella Rank: 47078	4 KB
2	p-n.io cdn.p-n.io — Cisco Umbrella Rank: 4423	52 KB
2	catapultx.com tags.catapultx.com — Cisco Umbrella Rank: 19272	12 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 155	111 KB
1	adentifi.com rtb.adentifi.com	35 B
1	bidswitch.net x.bidswitch.net	220 B
1	adotmob.com 1 redirects sync.adotmob.com	307 B
1	quantserve.com 1 redirects pixel.quantserve.com	505 B
1	adform.net c1.adform.net	331 B
1	loopme.me 1 redirects csync.loopme.me	431 B
1	2mdn.net s0.2mdn.net — Cisco Umbrella Rank: 289	17 KB
1	tmbi.com videodam.tmbi.com — Cisco Umbrella Rank: 46900	2 KB
1	aaxdetect.com www.aaxdetect.com — Cisco Umbrella Rank: 5473	323 B
1	iris.tv context.iris.tv — Cisco Umbrella Rank: 9020	550 B
1	privacymanager.io geo.privacymanager.io — Cisco Umbrella Rank: 1424	596 B
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 423	1 KB
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 1249	5 KB
1	aamapi.com aamapi.com — Cisco Umbrella Rank: 22248	180 B
1	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 187	29 KB
1	permutive.app d82f7a30-751a-4689-b7e9-19336a89ab46.edge.permutive.app — Cisco Umbrella Rank: 39820
1	ntv.io s.ntv.io — Cisco Umbrella Rank: 2841	135 KB
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 94	41 KB
365	66

	Domain	Requested by
79	www.rd.com	www.rd.com static.cloudflareinsights.com
13	widget.beop.io	www.rd.com widget.beop.io
12	dsum-sec.casalemedia.com	3 redirects r.casalemedia.com
10	px.moatads.com
10	cdn.ampproject.org	confiant-integrations.global.ssl.fastly.net
9	tpc.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com www.rd.com confiant-integrations.global.ssl.fastly.net
8	ssl.p.jwpcdn.com	cdn.jwplayer.com
8	securepubads.g.doubleclick.net	www.googletagservices.com securepubads.g.doubleclick.net www.rd.com
8	c.amazon-adsystem.com	www.rd.com c.amazon-adsystem.com
7	sync.adkernel.com	www.rd.com
7	ib.adnxs.com	micro.rubiconproject.com acdn.adnxs.com
6	cm.g.doubleclick.net	3 redirects r.casalemedia.com
6	s.amazon-adsystem.com	3 redirects r.casalemedia.com
6	pagead2.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com
6	prebid-a.rubiconproject.com	micro.rubiconproject.com
6	www.google.com	2 redirects www.rd.com tpc.googlesyndication.com
5	assets.bounceexchange.com	tag.bounceexchange.com assets.bounceexchange.com
5	sb.scorecardresearch.com	2 redirects www.rd.com
5	cdn.jwplayer.com	3 redirects www.rd.com cdn.jwplayer.com
4	sync-tm.everesttech.net	3 redirects r.casalemedia.com
4	cdn.krxd.net	z.moatads.com cdn.krxd.net
4	contents-tracking.beop.io	widget.beop.io
4	assets-jpcust.jwpsrv.com	www.rd.com
3	px.owneriq.net	2 redirects r.casalemedia.com
3	cdn.indexww.com	r.casalemedia.com
3	match.adsrvr.org	r.casalemedia.com
3	r.casalemedia.com	js-sec.indexww.com
3	ssum-sec.casalemedia.com	3 redirects
3	js-sec.indexww.com	micro.rubiconproject.com
3	eb2.3lift.com	micro.rubiconproject.com
3	acdn.adnxs.com	micro.rubiconproject.com
3	ads.pubmatic.com	micro.rubiconproject.com
3	www.gstatic.com	cdn.jwplayer.com www.gstatic.com
3	adservice.google.com	imasdk.googleapis.com securepubads.g.doubleclick.net
3	prd.jwpltx.com	www.rd.com
3	ct.pinterest.com	s.pinimg.com www.rd.com
3	tlx.3lift.com	micro.rubiconproject.com
3	hbopenbid.pubmatic.com	micro.rubiconproject.com
3	htlb.casalemedia.com	micro.rubiconproject.com
3	t.beop.io	widget.beop.io
3	www.facebook.com	www.rd.com
3	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
3	t.skimresources.com	www.rd.com s.skimresources.com
3	r.skimresources.com	s.skimresources.com
3	fonts.googleapis.com	www.rd.com client
3	cdn.flipboard.com	www.rd.com
3	content.jwplatform.com	1 redirects www.rd.com cdn.jwplayer.com
3	z.moatads.com	www.rd.com z.moatads.com
2	d.adroll.com	2 redirects
2	eus.rubiconproject.com	micro.rubiconproject.com eus.rubiconproject.com
2	googleads.g.doubleclick.net	www.rd.com
2	protected-by.clarium.io
2	krk.kargo.com	micro.rubiconproject.com
2	fastlane.rubiconproject.com	micro.rubiconproject.com
2	adservice.google.de	securepubads.g.doubleclick.net
2	data.beop.io	widget.beop.io
2	c2shb.pubgw.yahoo.com	micro.rubiconproject.com
2	imasdk.googleapis.com	cdn.jwplayer.com imasdk.googleapis.com
2	ls.skimresources.com	s.skimresources.com
2	s.beop.io	widget.beop.io
2	confiant-integrations.global.ssl.fastly.net	www.rd.com confiant-integrations.global.ssl.fastly.net
2	c.aaxads.com	www.rd.com
2	s.pinimg.com	www.rd.com s.pinimg.com
2	fonts.gstatic.com	fonts.googleapis.com
2	p.skimresources.com	www.rd.com
2	tracking.skyword.com	www.rd.com
2	cdn.p-n.io	www.rd.com cdn.p-n.io
2	tags.catapultx.com	www.rd.com tags.catapultx.com
2	b-code.liadm.com	www.rd.com b-code.liadm.com
2	connect.facebook.net	www.rd.com connect.facebook.net
2	cdn.brandmetrics.com	www.rd.com cdn.brandmetrics.com
1	rtb.adentifi.com	r.casalemedia.com
1	x.bidswitch.net	r.casalemedia.com
1	sync.adotmob.com	1 redirects
1	pr-bh.ybp.yahoo.com	r.casalemedia.com
1	pixel.quantserve.com	1 redirects
1	c1.adform.net	r.casalemedia.com
1	csync.loopme.me	1 redirects
1	image6.pubmatic.com	ads.pubmatic.com
1	token.rubiconproject.com	eus.rubiconproject.com
1	api.rlcdn.com	micro.rubiconproject.com
1	check.analytics.rlcdn.com	micro.rubiconproject.com
1	23b1a0822ba1831bce09eec41594b818.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	pubads.g.doubleclick.net	imasdk.googleapis.com
1	s0.2mdn.net	imasdk.googleapis.com
1	videodam.tmbi.com	www.rd.com
1	l3.aaxads.com	www.rd.com
1	www.aaxdetect.com	www.rd.com
1	sli.rd.com	www.rd.com
1	i.liadm.com	b-code.liadm.com
1	api.bounceexchange.com	assets.bounceexchange.com
1	prebid-server.rubiconproject.com	micro.rubiconproject.com
1	context.iris.tv	www.rd.com
1	www.google.de	www.rd.com
1	rp4.liadm.com	www.rd.com
1	rp.liadm.com	1 redirects
1	stats.g.doubleclick.net	www.google-analytics.com
1	geo.privacymanager.io	ats.rlcdn.com
1	entitlements.jwplayer.com	cdn.jwplayer.com
1	ats.rlcdn.com	www.rd.com
1	cdn.jsdelivr.net	micro.rubiconproject.com
1	collector.brandmetrics.com	cdn.brandmetrics.com
1	tag.bounceexchange.com	www.rd.com
1	mb.moatads.com	z.moatads.com
1	static.cloudflareinsights.com	www.rd.com
1	aamapi.com	www.rd.com
1	www.googletagservices.com	www.rd.com
1	d82f7a30-751a-4689-b7e9-19336a89ab46.edge.permutive.app	www.rd.com
1	micro.rubiconproject.com	www.rd.com
1	s.skimresources.com	www.rd.com
1	s.ntv.io	www.rd.com
1	www.googletagmanager.com	www.rd.com
1	click.email.rd.com	1 redirects
365	113

This site contains links to these domains. Also see Links.

Domain
share.flipboard.com
order.readersdigest.com
thehealthy.com
www.thehealthy.com
www.staysafeonline.org
www.foster.com
www.thesslstore.com
securitytech.org
www.keepersecurity.com
brij.it
www.optiv.com
securitynerd.com
www.facebook.com
twitter.com
www.pinterest.com
www.youtube.com
instagram.com
www.tasteofhome.com
www.familyhandyman.com
www.birdsandblooms.com
www.liferichpublishing.com
www.trustedmediabrands.com
w1.buysub.com
www.google.com
www.apple.com
www.mozilla.org
www.microsoft.com
shop.rd.com
www.instagram.com

Subject Issuer	Validity	Valid
rd.com Cloudflare Inc ECC CA-3	`2022-05-19` - `2023-05-18`	a year	crt.sh
c.amazon-adsystem.com Amazon	`2022-05-09` - `2023-04-18`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-07-18` - `2022-10-10`	3 months	crt.sh
moatads.com DigiCert SHA2 Secure Server CA	`2021-11-27` - `2022-11-29`	a year	crt.sh
*.ntv.io DigiCert SHA2 Secure Server CA	`2021-12-04` - `2022-12-06`	a year	crt.sh
*.skimresources.com DigiCert SHA2 Secure Server CA	`2021-09-27` - `2022-10-28`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-05-15` - `2023-05-15`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-05-19` - `2022-08-17`	3 months	crt.sh
*.liadm.com Amazon	`2022-01-31` - `2023-03-01`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2022-03-17` - `2023-04-04`	a year	crt.sh
jwplayer.com Amazon	`2021-12-29` - `2023-01-25`	a year	crt.sh
permutive.app Cloudflare Inc ECC CA-3	`2022-07-15` - `2022-10-13`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-07-18` - `2022-10-10`	3 months	crt.sh
pushlycdn.com Amazon	`2022-02-14` - `2023-03-15`	a year	crt.sh
aamapi.com Amazon	`2022-03-24` - `2023-04-22`	a year	crt.sh
*.skyword.com Amazon	`2021-09-15` - `2022-10-14`	a year	crt.sh
*.flipboard.com Amazon	`2022-06-14` - `2023-07-13`	a year	crt.sh
*.beop.io Gandi Standard SSL CA 2	`2022-03-09` - `2023-03-13`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-07-18` - `2022-10-10`	3 months	crt.sh
*.moatads.com DigiCert TLS RSA SHA256 2020 CA1	`2022-06-13` - `2023-07-05`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2022-07-18` - `2022-10-10`	3 months	crt.sh
tag.bounceexchange.com R3	`2022-07-28` - `2022-10-26`	3 months	crt.sh
*.pinterest.com DigiCert TLS RSA SHA256 2020 CA1	`2022-08-01` - `2023-08-08`	a year	crt.sh
*.scorecardresearch.com Amazon	`2022-01-29` - `2023-02-27`	a year	crt.sh
*.brandmetrics.com Go Daddy Secure Certificate Authority - G2	`2022-06-11` - `2023-06-11`	a year	crt.sh
*.jwplayer.com GlobalSign Atlas R3 DV TLS CA 2022 Q1	`2022-02-22` - `2023-03-26`	a year	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2022 Q1	`2022-03-21` - `2023-04-22`	a year	crt.sh
*.aaxads.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-03-11` - `2023-03-15`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2022-02-03` - `2023-02-25`	a year	crt.sh
*.freetls.fastly.net GlobalSign Atlas R3 DV TLS CA 2022 Q2	`2022-05-04` - `2023-06-05`	a year	crt.sh
entitlements.jwplayer.com GeoTrust TLS DV RSA Mixed SHA256 2020 CA-1	`2022-06-07` - `2023-05-31`	a year	crt.sh
assets.bounceexchange.com GTS CA 1D4	`2022-08-07` - `2022-11-05`	3 months	crt.sh
*.privacymanager.io Amazon	`2021-09-25` - `2022-10-24`	a year	crt.sh
www.google.com GTS CA 1C3	`2022-07-18` - `2022-10-10`	3 months	crt.sh
www.google.de GTS CA 1C3	`2022-07-18` - `2022-10-10`	3 months	crt.sh
iris.tv Amazon	`2021-09-12` - `2022-10-11`	a year	crt.sh
web.ssp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2022-08-02` - `2023-01-25`	6 months	crt.sh
*.pubmatic.com DigiCert Baltimore TLS RSA SHA256 2020 CA1	`2022-06-13` - `2023-07-14`	a year	crt.sh
*.3lift.com Amazon	`2022-05-13` - `2023-06-11`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2022-02-11` - `2023-03-14`	a year	crt.sh
*.wunderkind.co R3	`2022-06-14` - `2022-09-12`	3 months	crt.sh
sli.rd.com R3	`2022-06-03` - `2022-09-01`	3 months	crt.sh
*.adkernel.com AlphaSSL CA - SHA256 - G2	`2021-12-30` - `2023-01-31`	a year	crt.sh
*.aaxdetect.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-03-11` - `2023-03-15`	a year	crt.sh
tmbi.com Cloudflare Inc ECC CA-3	`2022-06-08` - `2023-06-07`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2022-07-18` - `2022-10-10`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-07-18` - `2022-10-10`	3 months	crt.sh
*.google.de GTS CA 1C3	`2022-07-18` - `2022-10-10`	3 months	crt.sh
*.dev.kargo.com Amazon	`2022-03-01` - `2023-03-29`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-07-18` - `2022-10-10`	3 months	crt.sh
misc-sni.google.com GTS CA 1C3	`2022-07-18` - `2022-10-10`	3 months	crt.sh
protected-by.clarium.io Gandi Standard SSL CA 2	`2022-04-10` - `2023-04-26`	a year	crt.sh
cdn.krxd.net DigiCert TLS RSA SHA256 2020 CA1	`2021-12-30` - `2022-12-29`	a year	crt.sh
analytics.rlcdn.com Amazon	`2022-07-27` - `2023-08-25`	a year	crt.sh
cdn.adnxs.com GeoTrust RSA CA 2018	`2021-12-10` - `2022-12-09`	a year	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2021-12-12` - `2022-12-13`	a year	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2022-03-31` - `2023-05-02`	a year	crt.sh
track.adform.net DigiCert TLS RSA SHA256 2020 CA1	`2021-09-06` - `2022-10-07`	a year	crt.sh
*.ybp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2022-06-14` - `2022-12-07`	6 months	crt.sh
*.bidswitch.net Sectigo RSA Domain Validation Secure Server CA	`2022-04-05` - `2023-05-04`	a year	crt.sh
adentifi.com Amazon	`2022-08-05` - `2023-09-03`	a year	crt.sh

This page contains 36 frames:

Primary Page: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Frame ID: 887D6DBDDD0EDBBB04F66C0240BE3A9B
Requests: 284 HTTP requests in this frame

Frame: https://z.moatads.com/hd09824092/iframe.html
Frame ID: BE40C681FCF912AF10806A604D4CC603
Requests: 1 HTTP requests in this frame

Frame: https://t.skimresources.com/api/v2/robots.txt?__skimjs_preflight__please_ignore__=true&rnd=0.0611224118064666
Frame ID: EAE631A81AC0968DE91D3436EE095FCC
Requests: 1 HTTP requests in this frame

Frame: https://assets.bounceexchange.com/assets/bounce/local_storage_frame16.min.html
Frame ID: 5F46E5752EE7119C2A34EC541BAD6D97
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 45690D732F5D891D9551DEADB41936D7
Requests: 1 HTTP requests in this frame

Frame: https://i.liadm.com/s/c/a-00x0?s=&cim=&ps=true&ls=true&duid=0ee7014c2aeb--01ga20zpschj125jhf3w3yrftz&ppid=0&euns=1&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&
Frame ID: 8D1603FC14B0D508EF5677D2D19BC6C7
Requests: 1 HTTP requests in this frame

Frame: https://sync.adkernel.com/user-sync?zone=147357&r=https%3A%2F%2Fdemand.catapultx.com%2Fsync%3Fakuid%3Dhttps%3A%2F%2Fwww.rd.com%7C%7BUID%7D
Frame ID: 55300AB69E3B780BB5974C8F77F14C3E
Requests: 1 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.524.0_en.html
Frame ID: AFBDAF93A0C46E8B13BBCB078AFD4CD2
Requests: 2 HTTP requests in this frame

Frame: https://ct.pinterest.com/ct.html
Frame ID: 9F42C1ED8CFB1102BED7C440D95DDBF1
Requests: 1 HTTP requests in this frame

Frame: https://23b1a0822ba1831bce09eec41594b818.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 425F440CA901F7830E5D3FA8CAB07F39
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: BA801D444ECA32368A76AF918045D5DB
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 675FC098D15448730822C81FD2835A83
Requests: 2 HTTP requests in this frame

Frame: https://sync.adkernel.com/user-sync?zone=147357&r=https%3A%2F%2Fdemand.catapultx.com%2Fsync%3Fakuid%3Dhttps%3A%2F%2Fwww.rd.com%7C%7BUID%7D
Frame ID: 4E82D1EA0B226B70097F47174AA4D32E
Requests: 1 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012207221643000/amp4ads-v0.mjs
Frame ID: 054AEE0A72BB7DA7A5F1467F28FF6965
Requests: 13 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012207221643000/amp4ads-v0.mjs
Frame ID: 4014F73CA27CC115B0B0C9C56282DAC7
Requests: 13 HTTP requests in this frame

Frame: https://sync.adkernel.com/user-sync?zone=147357&r=https%3A%2F%2Fdemand.catapultx.com%2Fsync%3Fakuid%3Dhttps%3A%2F%2Fwww.rd.com%7C%7BUID%7D
Frame ID: 48B6BAE1B78D2165BDE3A93F0E47EBB6
Requests: 1 HTTP requests in this frame

Frame: https://sync.adkernel.com/user-sync?zone=147357&r=https%3A%2F%2Fdemand.catapultx.com%2Fsync%3Fakuid%3Dhttps%3A%2F%2Fwww.rd.com%7C%7BUID%7D
Frame ID: 7FAA2B80B49794940059A6667B28737A
Requests: 1 HTTP requests in this frame

Frame: https://sync.adkernel.com/user-sync?zone=147357&r=https%3A%2F%2Fdemand.catapultx.com%2Fsync%3Fakuid%3Dhttps%3A%2F%2Fwww.rd.com%7C%7BUID%7D
Frame ID: 8531D6F6ACA821E27C900CDDF8AE2EAD
Requests: 1 HTTP requests in this frame

Frame: https://sync.adkernel.com/user-sync?zone=147357&r=https%3A%2F%2Fdemand.catapultx.com%2Fsync%3Fakuid%3Dhttps%3A%2F%2Fwww.rd.com%7C%7BUID%7D
Frame ID: 3068DDF2A649ED02B205B108EF4507B9
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=160830
Frame ID: AC7E42A165D7BEC7E511EE24CDAA2291
Requests: 2 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=160830
Frame ID: 4200E6FC131982564B32AEE19BAEAEAB
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: C31A3AFC560DF4CA8DEB48968A3E8BC7
Requests: 3 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html
Frame ID: 6AF2BC996C67B72A9AED63A34476E518
Requests: 3 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=160830
Frame ID: 876154D70C213724C0A4A79C465DC777
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync
Frame ID: 8B29AAB369D07EDF7F7BA59C45EC0E94
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync
Frame ID: 5EC211845962FD72C9F371393C22D957
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync
Frame ID: 37AFE7D6315BACA06456FEDA7AF7BCB5
Requests: 1 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: B493B7C9E256E7EBFA1C404E7C55D3DD
Requests: 1 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: 91B2161D20042810B793A9029DB6423D
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 6F46B7750789524D1B1E5BBBC6EAF41E
Requests: 3 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: ED2844804AFB41DE51C0CC62D44AF414
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: B69F7D268E89A8C8B692A797F3FB5C48
Requests: 3 HTTP requests in this frame

Frame: https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Frame ID: B4212A6892899319C3F22F63C560FD8E
Requests: 10 HTTP requests in this frame

Frame: https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Frame ID: 9973703A00C0D76D3F9F8993E6D475FA
Requests: 10 HTTP requests in this frame

Frame: https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Frame ID: AE06DE0FBEBC21968EBBE01B8485B62A
Requests: 10 HTTP requests in this frame

Frame: https://sync.adkernel.com/user-sync?zone=147357&r=https%3A%2F%2Fdemand.catapultx.com%2Fsync%3Fakuid%3Dhttps%3A%2F%2Fwww.rd.com%7C%7BUID%7D
Frame ID: 599F1D192AD8C36893C31171F35E1461
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

How to Identify a Fake QR Code—and Avoid Being Scammed

Page URL History Show full URLs

https://click.email.rd.com/?qs=917f410ab7c4bef8b7babac08d9946c3cbb1213d6032daf4fa239673abbd4bcd743b06d6... HTTP 302
https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehi... Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Yoast SEO (SEO) Expand

Overall confidence: 100%
Detected patterns

<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

DoubleClick for Publishers (DFP) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googletagservices\.com/tag/js/gpt(?:_mobile)?\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Moat (Analytics) Expand

Overall confidence: 100%
Detected patterns

moatads\.com

Prebid (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.com/[^"]*(?:prebid|/pb\.js)

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

TrackJs (Analytics) Expand

Overall confidence: 100%
Detected patterns

tracker\.js

Underscore.js (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

underscore.*\.js(?:\?ver=([\d.]+))?

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

365
Requests

93 %
HTTPS

37 %
IPv6

66
Domains

113
Subdomains

97
IPs

8
Countries

3413 kB
Transfer

10949 kB
Size

28
Cookies

48 Outgoing links

These are links going to different origins than the main page.

URL: https://share.flipboard.com/bookmarklet/popout?v=2&title=How%20to%20Identify%20a%20Fake%20QR%20Code%E2%80%94and%20Avoid%20Being%20Scammed&url=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&t=1660073007693&utm_campaign=tools&utm_medium=article-share&utm_source=www.rd.com
Title: <img src="https://cdn.flipboard.com/badges/flipboard_mrrw.png" alt="Flipboard" width="32" height="32" />

Search URL Search Domain Scan URL

URL: https://order.readersdigest.com/servlet/OrdersGateway?cds_mag_code=RDA&cds_page_id=256318&int_campaign=rda_20220426_headerright&cds_response_key=IB7ADU104&int_source=direct&int_medium=rd.com&int_placement=headerright
Title: Subscribe Now

Search URL Search Domain Scan URL

URL: https://order.readersdigest.com/servlet/GiftsGateway?cds_mag_code=RDA&cds_page_id=259214&int_campaign=rda_20220426_headerright_gift&cds_response_key=IB7AAU103&int_source=direct&int_medium=rd.com&int_placement=headerright
Title: Give a Gift

Search URL Search Domain Scan URL

URL: https://order.readersdigest.com/servlet/GiftsGateway?cds_mag_code=RDA&cds_page_id=259214&int_campaign=rda_20220426_desktop_mainnavdropdown_gift&cds_response_key=IB7AAU104&int_source=direct&int_medium=rd.com&int_placement=mainnavdropdown
Title: Give a gift

Search URL Search Domain Scan URL

URL: https://order.readersdigest.com/servlet/OrdersGateway?cds_mag_code=RDA&cds_page_id=256318&int_campaign=rda_20220426_desktop_mainnavdropdown&cds_response_key=IB7ADU106&int_source=direct&int_medium=rd.com&int_placement=mainnavdropdown
Title: SUBSCRIBE

Search URL Search Domain Scan URL

URL: https://order.readersdigest.com/servlet/GiftsGateway?cds_mag_code=LRD&cds_page_id=259217&int_campaign=lrd_20220426_desktop_mainnavdropdown_gift&cds_response_key=IB7AAU102&int_source=direct&int_medium=rd.com&int_placement=mainnavdropdown
Title: Give a gift

Search URL Search Domain Scan URL

URL: https://order.readersdigest.com/servlet/OrdersGateway?cds_mag_code=LRD&cds_page_id=256319&int_campaign=lrd_20220426_desktop_mainnavdropdown&cds_response_key=IB7ADU102&int_source=direct&int_medium=rd.com&int_placement=mainnavdropdown
Title: SUBSCRIBE

Search URL Search Domain Scan URL

URL: https://thehealthy.com/

Search URL Search Domain Scan URL

URL: https://order.readersdigest.com/servlet/OrdersGateway?cds_mag_code=RDA&cds_page_id=256318&int_campaign=rda_20220426_mobile_mainnavdropdown&cds_response_key=IB7ADU107&int_source=direct&int_medium=rd.com&int_placement=mainnavdropdown
Title: Subscribe

Search URL Search Domain Scan URL

URL: https://order.readersdigest.com/servlet/OrdersGateway?cds_mag_code=LRD&cds_page_id=256319&int_campaign=lrd_20220426_mobile_mainnavdropdown&cds_response_key=IB7ADU103&int_source=direct&int_medium=rd.com&int_placement=mainnavdropdown
Title: RD Large Print

Search URL Search Domain Scan URL

URL: https://www.thehealthy.com/
Title: The Healthy

Search URL Search Domain Scan URL

URL: https://order.readersdigest.com/servlet/OrdersGateway?cds_mag_code=RDA&cds_page_id=256318&int_campaign=rda_20220101_mainnav&cds_response_key=IB7ADU102&int_source=direct&int_medium=rd.com&int_placement=mainnav
Title: Subscribe

Search URL Search Domain Scan URL

URL: https://share.flipboard.com/bookmarklet/popout?v=2&title=How%20to%20Identify%20a%20Fake%20QR%20Code%E2%80%94and%20Avoid%20Being%20Scammed&url=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&t=1660073007694&utm_campaign=tools&utm_medium=article-share&utm_source=www.rd.com
Title: <img src="https://cdn.flipboard.com/badges/flipboard_mrrw.png" alt="Flipboard" width="32" height="32" />

Search URL Search Domain Scan URL

URL: https://www.staysafeonline.org/
Title: National Cybersecurity Alliance

Search URL Search Domain Scan URL

URL: https://www.foster.com/people-eva-novick
Title: Eva Novick

Search URL Search Domain Scan URL

URL: https://www.thesslstore.com/management/casey-crane-content-marketer.aspx
Title: Casey Crane

Search URL Search Domain Scan URL

URL: https://securitytech.org/
Title: SecurityTech

Search URL Search Domain Scan URL

URL: https://www.keepersecurity.com/
Title: Keeper Security

Search URL Search Domain Scan URL

URL: https://brij.it/blog/meet-our-cto-co-founder-zack-morrison
Title: Zack Morrison

Search URL Search Domain Scan URL

URL: http://www.optiv.com/
Title: Optiv Security

Search URL Search Domain Scan URL

URL: https://securitynerd.com/author/kristen/
Title: Kristen Bolig

Search URL Search Domain Scan URL

URL: https://www.facebook.com/ReadersDigest

Search URL Search Domain Scan URL

URL: https://twitter.com/readersdigest

Search URL Search Domain Scan URL

URL: https://www.pinterest.com/readersdigest/

Search URL Search Domain Scan URL

URL: https://www.youtube.com/readersdigest

Search URL Search Domain Scan URL

URL: https://instagram.com/readersdigest

Search URL Search Domain Scan URL

URL: https://order.readersdigest.com/servlet/OrdersGateway?cds_mag_code=RDA&cds_page_id=256318&int_campaign=rda_20220101_footermagazine&cds_response_key=IB7BDU102&int_source=direct&int_medium=rd.com&int_placement=footer
Title: Subscribe

Search URL Search Domain Scan URL

URL: https://www.tasteofhome.com/
Title: Taste of Home

Search URL Search Domain Scan URL

URL: https://www.familyhandyman.com/
Title: Family Handyman

Search URL Search Domain Scan URL

URL: https://www.birdsandblooms.com/
Title: Birds & Blooms

Search URL Search Domain Scan URL

URL: https://www.liferichpublishing.com/en
Title: LifeRich Publishing

Search URL Search Domain Scan URL

URL: https://www.trustedmediabrands.com/brands/readers-digest/
Title: Advertise with Us

Search URL Search Domain Scan URL

URL: https://w1.buysub.com/pubs/RD/RDA/index.jsp?cds_page_id=69616&cds_mag_code=RDA
Title: Customer Service

Search URL Search Domain Scan URL

URL: https://www.trustedmediabrands.com/privacy-policy/
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.trustedmediabrands.com/ca-privacy-notice/
Title: Your CA Privacy Rights

Search URL Search Domain Scan URL

URL: https://www.trustedmediabrands.com/ccpa-form-ca-residents
Title: Do Not Sell My Personal Information – CA Residents

Search URL Search Domain Scan URL

URL: https://www.trustedmediabrands.com/our-commitment-to-accessibility/
Title: Accessibility Statement

Search URL Search Domain Scan URL

URL: https://www.trustedmediabrands.com/privacy-policy/#advertising
Title: About Ads

Search URL Search Domain Scan URL

URL: https://order.readersdigest.com/servlet/OrdersGateway?cds_mag_code=RDA&cds_page_id=256318&int_campaign=rda_20220101_footerright&cds_response_key=IB7BDU101&int_source=direct&int_medium=rd.com&int_placement=footer
Title: <img src="https://www.rd.com/wp-content/uploads/2010/04/nl-subscribe-mag.png" alt="Subscribe to Reader's Digest" loading="lazy" style="width:95px" width="95" height="41">

Search URL Search Domain Scan URL

URL: https://www.google.com/chrome/
Title: Google Chrome

Search URL Search Domain Scan URL

URL: https://www.apple.com/safari/
Title: Apple Safari

Search URL Search Domain Scan URL

URL: https://www.mozilla.org/en-US/firefox/
Title: Mozilla Firefox

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-us/edge
Title: Microsoft Edge

Search URL Search Domain Scan URL

URL: https://shop.rd.com/?sourcekeyc=1B1Y7ZZXSC&sourcekeys=1B1Y7ZZXSS&sourcekeym=IX7QDU14M&int_campaign=srda_20220101_hamburger&int_source=direct&int_medium=rd.com&int_placement=hamburger
Title: Shop

Search URL Search Domain Scan URL

URL: https://order.readersdigest.com/servlet/OrdersGateway?cds_mag_code=RDA&cds_page_id=256318&int_campaign=rda_20220101_hamburger&cds_response_key=IB7RDU101&int_source=direct&int_medium=rd.com&int_placement=hamburger
Title: Subscribe

Search URL Search Domain Scan URL

URL: https://www.facebook.com/ReadersDigest/
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.instagram.com/readersdigest/
Title: Instagram

Search URL Search Domain Scan URL

URL: https://twitter.com/readersdigest/
Title: Twitter

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://click.email.rd.com/?qs=917f410ab7c4bef8b7babac08d9946c3cbb1213d6032daf4fa239673abbd4bcd743b06d6c63496a73f515ae6a574612255a97ff3073ce17c HTTP 302
https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 84

https://sb.scorecardresearch.com/c2/plugins/streamingtag_plugin_jwplayer.js?ver=1.0.0 HTTP 302
https://sb.scorecardresearch.com/internal-c2/default/streamingtag_plugin_jwplayer.js

Request Chain 109

https://content.jwplatform.com/thumbs/RO5TLTlb.jpg HTTP 302
https://assets-jpcust.jwpsrv.com/thumbnails/n76fan2z-720.jpg

Request Chain 113

https://sb.scorecardresearch.com/cs/6034767/beacon.js HTTP 302
https://sb.scorecardresearch.com/internal-cs/default/beacon.js

Request Chain 179

https://rp.liadm.com/j?dtstmp=1660073008049&aid=a-00x0&se=e30&duid=0ee7014c2aeb--01ga20zpschj125jhf3w3yrftz&tna=v2.4.0&pu=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&wpn=lc-bundle&c=PHRpdGxlPkhvdyB0byBJZGVudGlmeSBhIEZha2UgUVIgQ29kZeKAlGFuZCBBdm9pZCBCZWluZyBTY2FtbWVkPC90aXRsZT48bWV0YSBuYW1lPSJkZXNjcmlwdGlvbiIgY29udGVudD0iSGVyZSdzIHdoYXQgZXhwZXJ0cyBzYXkgeW91IG5lZWQgdG8ga25vdyBpbiBvcmRlciB0byBhdm9pZCBhIGZha2UgUVIgY29kZSwgd2hpY2ggY3JpbWluYWxzIHVzZSB0byBzY2FtIHVuc3VzcGVjdGluZyBwZW9wbGUuIj48bGluayByZWw9ImNhbm9uaWNhbCIgaHJlZj0iaHR0cHM6Ly93d3cucmQuY29tL2FydGljbGUvZmFrZS1xci1jb2RlLyI-PGgxIGNsYXNzPSJwb3N0LXRpdGxlIj4KCQlIb3cgdG8gU3BvdCBhIEZha2UgUVIgQ29kZSBhbmQgQXZvaWQgR2V0dGluZyBTY2FtbWVkCTwvaDE- HTTP 302
https://rp4.liadm.com/j?dtstmp=1660073008049&aid=a-00x0&se=e30&duid=0ee7014c2aeb--01ga20zpschj125jhf3w3yrftz&tna=v2.4.0&pu=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&wpn=lc-bundle&c=PHRpdGxlPkhvdyB0byBJZGVudGlmeSBhIEZha2UgUVIgQ29kZeKAlGFuZCBBdm9pZCBCZWluZyBTY2FtbWVkPC90aXRsZT48bWV0YSBuYW1lPSJkZXNjcmlwdGlvbiIgY29udGVudD0iSGVyZSdzIHdoYXQgZXhwZXJ0cyBzYXkgeW91IG5lZWQgdG8ga25vdyBpbiBvcmRlciB0byBhdm9pZCBhIGZha2UgUVIgY29kZSwgd2hpY2ggY3JpbWluYWxzIHVzZSB0byBzY2FtIHVuc3VzcGVjdGluZyBwZW9wbGUuIj48bGluayByZWw9ImNhbm9uaWNhbCIgaHJlZj0iaHR0cHM6Ly93d3cucmQuY29tL2FydGljbGUvZmFrZS1xci1jb2RlLyI-PGgxIGNsYXNzPSJwb3N0LXRpdGxlIj4KCQlIb3cgdG8gU3BvdCBhIEZha2UgUVIgQ29kZSBhbmQgQXZvaWQgR2V0dGluZyBTY2FtbWVkCTwvaDE-&i6=MmEwMDpjOTg6MjA1MDphMDA3OjI6Ojk%3D&n3pc=true

Request Chain 228

https://cdn.jwplayer.com/tracks/NJNdQPcH.vtt HTTP 301
https://assets-jpcust.jwpsrv.com/tracks/NJNdQPcH.vtt

Request Chain 230

https://cdn.jwplayer.com/strips/RO5TLTlb-120.vtt HTTP 301
https://assets-jpcust.jwpsrv.com/strips/RO5TLTlb-120.vtt

Request Chain 282

https://cdn.jwplayer.com/v2/media/cfnX7XUU/poster.jpg?width=120 HTTP 302
https://assets-jpcust.jwpsrv.com/thumbnails/yz9d1p83-120.jpg

Request Chain 300

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 319

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 354

https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F HTTP 302
https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1

Request Chain 355

https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F HTTP 302
https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1

Request Chain 356

https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F HTTP 302
https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1

Request Chain 358

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YvK0NzrGOeGmU0LD8cr2ngAABKAAAAIB HTTP 302
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YvK0NzrGOeGmU0LD8cr2ngAABKAAAAIB&dcc=t

Request Chain 361

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D&gdpr=1 HTTP 302
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=YvK0N-r3DcYxD-QdVdyGMAAA HTTP 302
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEILv9csDXJ4f2nkE39MqTfY&google_cver=1&gdpr=1

Request Chain 362

https://d.adroll.com/cm/index/ssp?gdpr=1 HTTP 302
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=105&external_user_id=0

Request Chain 363

https://csync.loopme.me/?redirect=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D24%26external_user_id%3D%7Bviewer_token%7D&us_privacy=&gdpr=1&gdpr_consent= HTTP 307
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=24&external_user_id=8721f6f4-d062-4b3a-b332-ab0eccc76274&us_privacy=null&gdpr_consent=null&gdpr=1

Request Chain 364

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D&gdpr=1 HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D&gdpr=1&_test=YvK0NwAFOBu1mwBC HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YvK0NwAFOBu1mwBC&gdpr=1&_test=YvK0NwAFOBu1mwBC

Request Chain 368

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D&gdpr=1 HTTP 302
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=YvK0N-r3DcYxD-QdVdyGMAAA HTTP 302
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEILv9csDXJ4f2nkE39MqTfY&google_cver=1&gdpr=1

Request Chain 370

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YvK0NzrGOeGmU0LD8cr2ngAABKAAAAIB HTTP 302
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YvK0NzrGOeGmU0LD8cr2ngAABKAAAAIB&dcc=t

Request Chain 371

https://pixel.quantserve.com/pixel/p-Z8PuJEk6U7Hyq.gif?idmatch=0&gdpr=1 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&&external_user_id=ugdj9u4BNvOhB2H26VMo8rRWMfehBTL2tAPi11IF

Request Chain 373

https://d.adroll.com/cm/index/ssp?gdpr=1 HTTP 302
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=105&external_user_id=0

Request Chain 374

https://px.owneriq.net/eucm/p/cc?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D31%26external_user_id%3D(OIQ_UUID) HTTP 302
https://px.owneriq.net/ecc?redir=https%3a%2f%2fdsum-sec.casalemedia.com%2fcrum%3fcm_dsp_id%3d31%26external_user_id%3dQ7133594152001168672&uid=Q7133594152001168672&ref=%2Feucm%2Fp%2Fcc HTTP 302
https://px.owneriq.net/noop?ct=image%2Fgif

Request Chain 377

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YvK0N_r3DcYxD_QdVdyGMAAABKEAAAAB HTTP 302
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YvK0N_r3DcYxD_QdVdyGMAAABKEAAAAB&dcc=t

Request Chain 379

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D&gdpr=1 HTTP 302
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=YvK0N-r3DcYxD-QdVdyGMAAA HTTP 302
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEILv9csDXJ4f2nkE39MqTfY&google_cver=1&gdpr=1

Request Chain 380

https://sync.adotmob.com/cookie/indexexchange?r=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D13%26external_user_id%3D%7bamob_user_id%7d%26expiration%3D%5bEXPIRATION%5d&gdpr=1 HTTP 302
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=13&external_user_id=%7Bamob_user_id%7D&expiration=[EXPIRATION]&gdpr=1

Request Chain 382

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D&gdpr=1 HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D&gdpr=1&_test=YvK0NwAFOYzRJgA0

365 HTTP transactions
25 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.rd.com/article/fake-qr-code/
Redirect Chain

https://click.email.rd.com/?qs=917f410ab7c4bef8b7babac08d9946c3cbb1213d6032daf4fa239673abbd4bcd743b06d6c63496a73f515ae6a574612255a97ff3073ce17c
https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e83...

563 KB
89 KB

98ms
23ms

Document
text/html

2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b202f2a7fae6fd09ff47455af24fa930f65cec69067211835d0d2c223fd95066

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 97
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=57600
cf-cache-status: HIT
cf-ray: 7382ddc7e8ee6928-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Tue, 09 Aug 2022 19:23:27 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
last-modified: Tue, 09 Aug 2022 19:19:34 GMT
referrer-policy: no-referrer-when-downgrade
server: cloudflare
strict-transport-security: max-age=0; includeSubDomains; preload
vary: Accept-Encoding
x-cache: MISS
x-cache-hits: 0
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-hosted-by: 45AIR.COM
x-xss-protection: 1; mode=block

Redirect headers

Cache-Control: private
Connection: close
Content-Length: 345
Content-Type: text/html; charset=utf-8
Date: Tue, 09 Aug 2022 19:23:26 GMT
Location: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10

GET
H2 200 header.css
www.rd.com/wp-content/themes/bumblebee/ 50 KB
8 KB 26ms
23ms Stylesheet
text/css 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/themes/bumblebee/header.css?ver=2.0.8

Requested by

Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4a3dbe01c6d50d8264cc5c9b01a48a659ca032ba9c1260903e4242975e518cff

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 18438
cf-polished: origSize=51556
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:05:13 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfca69-c964"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc8192d6928-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H2 200 dashicons.min.css
www.rd.com/wp-includes/css/ 58 KB
34 KB 28ms
25ms Stylesheet
text/css 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-includes/css/dashicons.min.css?ver=5.9

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 18051
x-cache: MISS
x-cache-hits: 0
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Fri, 15 Jul 2022 08:34:57 GMT
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62d126b1-e688"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains; preload
content-type: text/css
vary: Accept-Encoding
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc8192f6928-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H2 200 style.css
www.rd.com/wp-content/themes/bumblebee/ 53 KB
12 KB 60ms
58ms Stylesheet
text/css 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/themes/bumblebee/style.css?ver=1.12.11

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8b79630ec15683d0ed35aa5f175a2809a776c2f8075ec8b363ffec4b6c7b5b3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 18438
cf-polished: origSize=68027
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:05:12 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfca68-109bb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc819306928-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H2 200 style.min.css
www.rd.com/wp-includes/css/dist/block-library/ 77 KB
11 KB 24ms
23ms Stylesheet
text/css 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-includes/css/dist/block-library/style.min.css?ver=5.9

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7b6fef0a63424245b31b293b1a3bfd074c9da482e28fb9e920e1cf306e54e8a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 18417
x-cache: MISS
x-cache-hits: 0
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Fri, 15 Jul 2022 08:34:57 GMT
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62d126b1-1357b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains; preload
content-type: text/css
vary: Accept-Encoding
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc819316928-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 140 KB
39 KB 50ms
9ms Script
application/javascript 108.138.4.10
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.4.10 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-4-10.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b95939599754deb2250672a0ecba1494e7af2352a3598695df9684d77f953d73

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Tue, 09 Aug 2022 19:04:08 GMT
content-encoding: gzip
last-modified: Thu, 30 Jun 2022 20:51:38 GMT
server: AmazonS3
age: 1159
etag: W/"72916dde70b34122b394074010b382ce"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 d7433132a7c6595c9aab2dc2272e7060.cloudfront.net (CloudFront), 1.1 bfb5bffe90e3b0e760933a7a07d850ba.cloudfront.net (CloudFront)
cache-control: public, max-age=3600
x-amz-cf-pop: FRA60-P1, FRA56-P6
x-amz-cf-id: _rY3aLzHGGsO7iW44pYk2o29t1MePic-StXyAHPdsqlXLzWXwbYh1A==

GET
H3 200 widget-options.css
www.rd.com/wp-content/plugins/widget-options/assets/css/ 1 KB
656 B 40ms
39ms Stylesheet
text/css 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/widget-options/assets/css/widget-options.css

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8704f607741a4e0a4d82cf024d026c9e7c1d65241250c2223f31dca29a07dc15

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 18051
cf-polished: origSize=1046
x-cache: MISS
last-modified: Tue, 11 Jan 2022 18:25:08 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"61ddcb84-416"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc83dd35c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 wp-applaud.css
www.rd.com/wp-content/plugins/wp-applaud/assets/styles/ 401 B
542 B 46ms
45ms Stylesheet
text/css 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/wp-applaud/assets/styles/wp-applaud.css?ver=5.9

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d2dd397f2f81170f2fd0bd5cee8f455e200894e9e2a81a114c29aa7b6856d744

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 18051
cf-polished: origSize=1111
x-cache: MISS
last-modified: Fri, 30 Aug 2019 21:21:58 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"5d699376-457"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc83dd65c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 popovers.css
www.rd.com/wp-content/plugins/easyazon/addition/components/popovers/resources/ 806 B
730 B 40ms
39ms Stylesheet
text/css 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/easyazon/addition/components/popovers/resources/popovers.css?ver=5.0.1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a221b8ec55e0d82883699663672c218c4de02207132f344a6440d69df7094b7d

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 18417
cf-polished: origSize=962
x-cache: MISS
last-modified: Tue, 24 Aug 2021 07:04:30 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"612499fe-3c2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc83dd75c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 style.min.css
www.rd.com/wp-content/plugins/easy-table-of-contents/vendor/icomoon/ 438 B
565 B 40ms
39ms Stylesheet
text/css 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/easy-table-of-contents/vendor/icomoon/style.min.css?ver=2.0.17

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b88fca268e1352a0922f301c6b88f0499606c01faa8d0718de11a8153a5edc3a

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 18051
x-cache: MISS
x-cache-hits: 0
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 30 Mar 2020 17:10:48 GMT
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"5e822818-1b6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains; preload
content-type: text/css
vary: Accept-Encoding
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc83dd85c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 screen.min.css
www.rd.com/wp-content/plugins/easy-table-of-contents/assets/css/ 5 KB
2 KB 40ms
39ms Stylesheet
text/css 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/easy-table-of-contents/assets/css/screen.min.css?ver=2.0.17

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

22af5d3bf749542c2d95975186991b7b8c1e0766449c3fdeab55d57eb0d1ffdc

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 18051
x-cache: MISS
x-cache-hits: 0
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Fri, 22 Jan 2021 19:48:32 GMT
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"600b2c10-13ef"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains; preload
content-type: text/css
vary: Accept-Encoding
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc83dd95c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 facets-styles.min.css
www.rd.com/wp-content/plugins/elasticpress/dist/css/ 3 KB
2 KB 41ms
40ms Stylesheet
text/css 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/elasticpress/dist/css/facets-styles.min.css?ver=3.4.1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b5c3760ebad493fbb95c0ac2cbcdeca727826c3f9c78719d2964c62abca3c7a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 18417
x-cache: MISS
x-cache-hits: 0
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 09 Oct 2019 00:49:00 GMT
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"5d9d2e7c-bab"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains; preload
content-type: text/css
vary: Accept-Encoding
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc83dda5c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 taboola.css
www.rd.com/wp-content/plugins/pup-taboola/css/ 106 B
514 B 41ms
40ms Stylesheet
text/css 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/pup-taboola/css/taboola.css?ver=5.9

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ae97441771e91747997d983ff28bdb321a821846d2d6da01587f01d0fe33c5b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 18417
cf-polished: origSize=127
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:02:46 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc9d6-7f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc83ddb5c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 106 KB
41 KB 67ms
21ms Script
application/javascript 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-17041328-1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4d0aba5a5138c32ec4646ede6045102a63b38e602e846a5823561c8e4299ddb2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41881
x-xss-protection: 0
last-modified: Tue, 09 Aug 2022 18:34:21 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 09 Aug 2022 19:23:27 GMT

GET
H3 200 regenerator-runtime.min.js Show response
www.rd.com/wp-includes/js/dist/vendor/ 6 KB
3 KB 38ms
38ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a3e64300797e8078baa41dbc49e2affc1d2bedd04a470f0c929ed7fac698fbcd

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 18051
x-cache: MISS
x-cache-hits: 0
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Fri, 15 Jul 2022 08:34:57 GMT
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62d126b1-195e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains; preload
content-type: application/javascript
vary: Accept-Encoding
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc83ddf5c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 wp-polyfill.min.js Show response
www.rd.com/wp-includes/js/dist/vendor/ 19 KB
7 KB 60ms
47ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e20ddb9ed1fa044cb624f0253bb06b13c92ed9915063bd63a5806440c6b1ce7c

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 18051
x-cache: MISS
x-cache-hits: 0
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Fri, 15 Jul 2022 08:34:57 GMT
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62d126b1-4b3d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains; preload
content-type: application/javascript
vary: Accept-Encoding
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84def5c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 hooks.min.js Show response
www.rd.com/wp-includes/js/dist/ 6 KB
2 KB 42ms
29ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-includes/js/dist/hooks.min.js?ver=1e58c8c5a32b2e97491080c5b10dc71c

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e5935466216a250bb06338805b32ffb19eeda9042ead790ebc6e5dda27820adb

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 18051
x-cache: MISS
x-cache-hits: 0
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Fri, 15 Jul 2022 08:34:57 GMT
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62d126b1-163a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains; preload
content-type: application/javascript
vary: Accept-Encoding
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84df05c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 js-util-query.js Show response
www.rd.com/wp-content/mu-plugins/tmbi-js-utils/js/ 685 B
746 B 45ms
33ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/mu-plugins/tmbi-js-utils/js/js-util-query.js?ver=1.0.0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5b0602eeeb1484cc85d98733fb9441e16d91eb68beb26c19519ea7e61c1d48d0

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 18416
cf-polished: origSize=1104
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:03:08 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc9ec-450"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84df15c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H2 200 moatheader.js Show response
z.moatads.com/tmbiyieldheader910374028064/ 249 KB
86 KB 49ms
6ms Script
application/x-javascript 23.35.237.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/tmbiyieldheader910374028064/moatheader.js?ver=1.0.3
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-151.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: a2acf545701465b3ff3d92f1d80eae2743004fff551e072738e00372b14b903b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: gzip
last-modified: Thu, 04 Aug 2022 15:36:36 GMT
server: AmazonS3
x-amz-request-id: GQ9T6XRYSHCP80ZD
etag: "54974b64d7b24f9529e117fff9d417b8"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=12397
accept-ranges: bytes
content-length: 87460
x-amz-id-2: zDoERXO5BGoVvJ4eyObVVCRf62ABNLjJ1LlmTsO4jItZV9xFGxChBmTM3/O4gWk8XRFQFPn+QB4=

GET
H3 200 moat-timeout.js Show response
www.rd.com/wp-content/plugins/pup-moat-yield-intelligence-tool/js/ 1 KB
978 B 48ms
35ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/pup-moat-yield-intelligence-tool/js/moat-timeout.js?ver=1.0.3

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5577de66fefd6de448a833fd84d9a752e707cd52c7ff42ffdbbf8431d0551fa2

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 18051
cf-polished: origSize=2226
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:02:26 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc9c2-8b2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84df25c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 jquery.js Show response
www.rd.com/wp-includes/js/jquery/ 141 KB
42 KB 53ms
41ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-includes/js/jquery/jquery.js?ver=1.0.0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8a26f948122b1fe863bae3e65f7a64893e6e29e8e760ac075654174f96171cdd

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 18051
cf-polished: origSize=288600
x-cache: MISS
last-modified: Fri, 15 Jul 2022 08:34:57 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62d126b1-46758"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84df35c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H/1.1 200
OK load.js Show response
s.ntv.io/serve/ 472 KB
135 KB 129ms
56ms Script
application/x-javascript 184.51.9.197
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.ntv.io/serve/load.js?ver=1.0.0
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.51.9.197 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-51-9-197.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 0728797b523d2cd0d7cc032ec5db82405b7200fd35268aea06401ab5e10424da

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Tue, 09 Aug 2022 19:23:27 GMT
Content-Encoding: gzip
x-amz-request-id: 7ZP8C1EFYFEKB7WE
x-amz-server-side-encryption: AES256
Transfer-Encoding: chunked
Connection: keep-alive, Transfer-Encoding
x-amz-id-2: S/YyEYeT+6fU8xQOHu0MReReJzKbN86Y5gZa3Z4qqn/mKtMza9tGybw55vLbnNPOVhMGjCOrTmv2aVkmwxNSRw==
Last-Modified: Tue, 09 Aug 2022 14:09:15 GMT
Server: AmazonS3
ETag: "f71062ed51ccb1839fb0ea26f433a661"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

GET
H3 200 pinterest-pixels.js Show response
www.rd.com/wp-content/plugins/pup-pinterest-pixels/js/ 452 B
641 B 26ms
23ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/pup-pinterest-pixels/js/pinterest-pixels.js?ver=1.0.0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d02ab98a558ccea032a6a1bc2bfefd2b4a2a3a1aa9f3dad40c70d4486f87704a

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 17584
cf-polished: origSize=489
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:02:36 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc9cc-1e9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc98fb75c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H2 200 131817X1594237.skimlinks.js Show response
s.skimresources.com/js/ 56 KB
21 KB 105ms
12ms Script
application/octet-stream 151.139.128.11
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://s.skimresources.com/js/131817X1594237.skimlinks.js?ver=1.0.0
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 652d82ad34da02c9602d66332cfc52fb39b65da77c70a9faa518d859faf360b9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: gzip
last-modified: Thu, 19 May 2022 18:45:58 GMT
server: AmazonS3
x-amz-request-id: E1A3RY27KBHYN6FD
etag: "661d714e3ca1e6506ddb422dcbb04b0c"
x-hw: 1660073007.cds163.fr8.hn,1660073007.cds240.fr8.c
content-type: application/octet-stream
cache-control: max-age=3600
accept-ranges: bytes
content-length: 20729
x-amz-id-2: 6zthjTbzX58CHvgFRgi83gjSQMwLd6r4dGxmuE/g9JQP8meXZ4Ze/L56Kd43fb9gM87zDRn1iKE=

GET
H3 200 newsroom-post-script.js Show response
www.rd.com/wp-content/plugins/pup-taboola/js/ 1006 B
769 B 60ms
47ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/pup-taboola/js/newsroom-post-script.js?ver=1.0.0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

156653c0c2c026afc382bbbe02e0ac95ae4734401670cdb06e44665de0e46000

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 18416
cf-polished: origSize=1316
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:02:46 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc9d6-524"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84df45c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H2 200 rd.com.js Show response
cdn.brandmetrics.com/tag/a969c5a7d4e5408485948e8e11899567/ 5 KB
3 KB 48ms
18ms Script
text/javascript 2606:4700:20::681a:79b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.brandmetrics.com/tag/a969c5a7d4e5408485948e8e11899567/rd.com.js?ver=1.1
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:79b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f9cfcddf5665fbffe11d395ef61e9073a4c182dc9255c9f1154e4ec573b66815

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 09 Aug 2022 18:32:05 GMT
server: cloudflare
age: 3082
cf-polished: origSize=4800
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TlnOvKxI3wpp23Ns8gU%2FeO6ZwkqxlrZO4BeMfoseuFLdQQjSR4yRZ%2BMbLzTfIhWLlC5m6iiSHvgb2UyP8Ug%2FtgusAJZdcuDeHR6BtBmZ3Q4u1f1%2Bb6jtzs6nIHgDOro9JrWwXtPbPbXivB5jjHM8oCs4"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 7382ddc9a9f1bba9-FRA
cf-bgj: minify

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 100 KB
27 KB 73ms
19ms Script
application/x-javascript 2a03:2880:f007:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js?ver=2.0

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f007:8:face:b00c:0:1 Vienna, Austria, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e75555ca161f289d4830a84a1856b37a9cb0077f78af600fb47c67c135baa8fd

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 26506
x-xss-protection: 0
pragma: public
x-fb-debug: +3pIBuHZk60fCokY7Veq02HMRHnoPB027dmgfhOj9PbrB/UsVHzXEdzh/y/qTHaQVxCaMqpD1QsGnWm6k+9eQA==
x-fb-trip-id: 720026100
x-frame-options: DENY
date: Tue, 09 Aug 2022 19:23:27 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 a-00x0.min.js Show response
b-code.liadm.com/ 27 KB
10 KB 206ms
22ms Script
application/javascript 2600:9000:2304:e400:8:8845:1500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://b-code.liadm.com/a-00x0.min.js?ver=1.0
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2304:e400:8:8845:1500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 9aff82bb6bf217571cd2bfc3d1cee2b915056bfad051044e914352826c33d320

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 06:30:44 GMT
via: 1.1 af4c7c5690ef99c2d2945817a4e41504.cloudfront.net (CloudFront)
age: 46363
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=86400
x-amz-cf-pop: VIE50-P1
content-encoding: gzip
x-amz-cf-id: Tj8UWq54MS-ucWR3y40qVuADg6OXIRohqWRyEd7Uw64vG-g8ooH2LA==

GET
H2 200 10696.js Show response
micro.rubiconproject.com/prebid/dynamic/ 359 KB
105 KB 160ms
29ms Script
text/javascript 23.75.240.210
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://micro.rubiconproject.com/prebid/dynamic/10696.js?ver=1.0
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.75.240.210 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-75-240-210.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a6a06429105f522575f9dc82a176e6d7c505a29284c0529cfd141daa9d816e7c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: gzip
last-modified: Thu, 28 Jul 2022 16:47:32 GMT
server: Apache
vary: Accept-Encoding
edge-cache-tag: prod-prebid-10696_Readers_Digest_Desktop.js
content-type: text/javascript
access-control-expose-headers: x-trp-pba
cache-control: public, must-revalidate, max-age=0
content-length: 105958
x-trp-pba: {"ruleId":"4","rulePos":0,"ruleName":"Readers_Digest_Desktop","wrapperName":"10696_Readers_Digest_Desktop","isPrimary":true,"randomProb":61,"account":10696,"device":"desktop","country":"DE","host":"rd.com","isMobile":false,"isTablet":false,"reqHost":"micro.rubiconproject.com","referrer":["https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10"],"xForwardedFor":"","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36","query":"ver=1.0","ranAt":"2022-08-09T19:23:27.732Z","runId":"1660073007732-847","wrapperPath":"/prebid/10696_Readers_Digest_Desktop.js","redirectUrl":"/prebid/get-wrapper/Readers_Digest_Desktop/10696_Readers_Digest_Desktop.js"}
expires: Wed, 10 Aug 2022 17:52:44 GMT

GET
H3 200 tmbi-prebid.js Show response
www.rd.com/wp-content/plugins/tmbi-prebid/js/ 872 B
827 B 45ms
33ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/tmbi-prebid/js/tmbi-prebid.js?ver=1.1.0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0ad93024412465f56e8b0aa134d2a4dda848d68e23b5c20d12125f38f6a488c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 17566
cf-polished: origSize=1948
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:03:47 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfca13-79c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84df55c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 wp-applaud.js Show response
www.rd.com/wp-content/plugins/wp-applaud/assets/scripts/ 856 B
798 B 76ms
64ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/wp-applaud/assets/scripts/wp-applaud.js?ver=5.9

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b991004bf766883ecf36d27ff836b327b64abbca550239430fe9641b2fcc61d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 18051
cf-polished: origSize=1202
x-cache: MISS
last-modified: Fri, 30 Aug 2019 21:21:58 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"5d699376-4b2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84df65c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 permutive-tracking.js Show response
www.rd.com/wp-content/plugins/tmbi-permutive/js/ 1 KB
869 B 45ms
33ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/tmbi-permutive/js/permutive-tracking.js?ver=1.0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1fc1943ad73b34c7ecc7fc573e931cef2eeca1c68ebc90ae8c3a8f4162319965

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 18051
cf-polished: origSize=1486
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:03:41 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfca0d-5ce"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84df95c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 permutive-identifier.js Show response
www.rd.com/wp-content/plugins/tmbi-permutive/js/ 1 KB
876 B 46ms
34ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/tmbi-permutive/js/permutive-identifier.js?ver=1.0.0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d1f6b58a8b32dea13acb29a386dab49f87293729abd1835672433d087bf29d6f

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 18051
cf-polished: origSize=2294
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:03:41 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfca0d-8f6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84dfb5c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 permutive-video.js Show response
www.rd.com/wp-content/plugins/pup-video/js/ 8 KB
2 KB 83ms
72ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/pup-video/js/permutive-video.js?ver=1.0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

de7826b311a111b9a3ca8f37f1455eb43a548fa7189c46d39118543bd87173af

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 18051
cf-polished: origSize=11133
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:02:48 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc9d8-2b7d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84dfe5c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 clap-count-fix.js Show response
www.rd.com/wp-content/plugins/pup-applaud-helper/assets/js/ 867 B
772 B 59ms
48ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/pup-applaud-helper/assets/js/clap-count-fix.js?ver=1.0.0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

da9507cb1a3616e1442336158dcd9d6cfca240745ebe2a04e538e0e04cf11224

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 18051
cf-polished: origSize=1888
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:01:53 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc9a1-760"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84dff5c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H2 200 Qrhs7tJs.js Show response
cdn.jwplayer.com/libraries/ 115 KB
41 KB 116ms
35ms Script
text/javascript 2600:9000:206e:8600:1:a3fa:7cc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.jwplayer.com/libraries/Qrhs7tJs.js?ver=1.0.0
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206e:8600:1:a3fa:7cc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty /
Resource Hash: 970c55fcc93e289ca0d0328c445d35475008515b6800407ab73dcf689089f6f9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:05 GMT
content-encoding: gzip
server: openresty
age: 22
x-cache: Hit from cloudfront
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=180
x-amz-cf-pop: VIE50-C1
content-length: 41150
via: 1.1 b48fca327a980187d93a198e7530195c.cloudfront.net (CloudFront)
x-amz-cf-id: C-exYTrFetZhUoN62AOgWxPkw5A4x4qtLooEezP5GqjC-UcpyQDFsg==

GET
H2 200 bootstrapper Show response
tags.catapultx.com/ 18 KB
4 KB 69ms
16ms Script
application/javascript 2606:4700:3035::6815:29f3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.catapultx.com/bootstrapper?ver=1.0.0
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6815:29f3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 9399dab3e383fdc22b2d578596ba65980795310122106ce73252718dea66ef7e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 141
x-powered-by: Express
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 08 Aug 2022 13:10:16 GMT
server: cloudflare
etag: W/"56"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wUbOk8ZKFlAMLe9DZUEe1v%2BcCFvcYUcyCdLZkC1HAa80A%2F7Hr71vCxnGofP8ALAxEnsVSYetnUAW1f3WvSK6E4Ox5wzkXy0ICKo1Hh1QAaaAEuE0btlpq1aVSRVM527WVvhfpfMw%2BKpxercT0Oe8238%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=180
cf-ray: 7382ddc89b6d5c14-FRA

GET
H3 200 ad-stack.js Show response
www.rd.com/wp-content/plugins/pup-ad-stack/js/ 17 KB
5 KB 45ms
34ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/pup-ad-stack/js/ad-stack.js?ver=5.3.3

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4f6848f45929db24af962e27c4c96a44bd7e3bb4cdc8274e613315bb6e6eb435

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 18051
cf-polished: origSize=29587
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:01:47 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc99b-7393"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84e015c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 tmbi-a9-header-bidder.js Show response
www.rd.com/wp-content/plugins/pup-a9-header-bidder/js/ 2 KB
1 KB 35ms
31ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/pup-a9-header-bidder/js/tmbi-a9-header-bidder.js?ver=1.0.1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c5e24ad5cb560937b7ff087c5e6b7e5b5ee15e866d0725e1385fe98ad6268df6

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 18050
cf-polished: origSize=3101
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:01:48 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc99c-c1d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc98fbb5c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H2 403 d82f7a30-751a-4689-b7e9-19336a89ab46-web.js
d82f7a30-751a-4689-b7e9-19336a89ab46.edge.permutive.app/ 0
0 45ms
14ms Script
text/html 2606:4700::6812:451
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://d82f7a30-751a-4689-b7e9-19336a89ab46.edge.permutive.app/d82f7a30-751a-4689-b7e9-19336a89ab46-web.js
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:451 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 83 KB
29 KB 62ms
24ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ec15f98604211de09a04020860148a98124296e8ce00c461f5fded4eb0ff9d47

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28617
x-xss-protection: 0
server: sffe
etag: "1298 / 525 of 1000 / last-modified: 1660043424"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 09 Aug 2022 19:23:27 GMT

GET
H2 200 pushly-sdk.min.js Show response
cdn.p-n.io/ 219 KB
49 KB 107ms
22ms Script
application/javascript 99.86.240.124
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.p-n.io/pushly-sdk.min.js?domain_key=UQBO2QHQjsCWyyYZTALbCo47hmWzrEGU5rSy
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.240.124 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-240-124.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b6c2fd209cd3b56d6fc439c1191bf3aaff5cafc1ccc47d3f367e32f8180a37d1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:10:26 GMT
content-encoding: gzip
last-modified: Tue, 09 Aug 2022 14:20:16 GMT
server: AmazonS3
age: 789
etag: W/"bc93a07177539bb59e158f212b647647"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 2b5d1dff3c8eb4e504487382e1188d98.cloudfront.net (CloudFront)
cache-control: max-age=900
x-amz-cf-pop: VIE50-C1
x-amz-cf-id: 5dsGiObWVkE6Z0Ld61ueRcrK9BK3YfM4Zf8FWI8OX6EGojYgOFgBZw==

GET
H2 200 init-544opt5lxrll43mnvky.js Show response
aamapi.com/api/ 1 B
180 B 516ms
168ms Script
text/javascript 2600:1f14:600:6e02:985c:c802:57ac:7531
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://aamapi.com/api/init-544opt5lxrll43mnvky.js
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f14:600:6e02:985c:c802:57ac:7531 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty /
Resource Hash: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 09 Aug 2022 19:23:28 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: text/javascript
server: openresty
content-encoding: gzip
expires: -1

GET
H/1.1 200 tracker.js Show response
tracking.skyword.com/ 3 KB
4 KB 419ms
96ms Script
text/javascript 54.226.61.34
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.skyword.com/tracker.js?contentId=281474980168929
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.226.61.34 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-226-61-34.compute-1.amazonaws.com
Software: /
Resource Hash: 3c9237f8569d7a3cbf7ab25bf871ad84aadc0098e254f3af2790c05c6a98fea3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Tue, 09 Aug 2022 19:23:27 GMT
Connection: keep-alive
Content-Length: 3553
Content-Type: text/javascript;charset=ISO-8859-1

GET
H3 200 brand.css
www.rd.com/wp-content/plugins/pup-first-published-taxonomy/css/ 366 B
563 B 58ms
48ms Stylesheet
text/css 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/pup-first-published-taxonomy/css/brand.css?ver=1.0.0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6dd1548d9bc310301ca3828e82a2f684d5ed2a799b37f53a79cc0a023da80d01

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 17566
cf-polished: origSize=443
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:02:14 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc9b6-1bb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84e035c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 content-card-inserter.css
www.rd.com/wp-content/plugins/pup-content-card/css/ 1 KB
870 B 58ms
48ms Stylesheet
text/css 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/pup-content-card/css/content-card-inserter.css?ver=1.0.2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cc094ffe53f9cc289462d2bd847678bb257c47a9fd48389c837d09d90f1176d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 16962
cf-polished: origSize=1589
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:02:01 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc9a9-635"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84e045c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 footer.css
www.rd.com/wp-content/themes/bumblebee/ 17 KB
6 KB 44ms
35ms Stylesheet
text/css 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/themes/bumblebee/footer.css?ver=2.0.8

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

71e5b6eb041cb505cab8acbb09548b57aa00ad344594519d2e3f8857a9687020

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 17566
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:05:13 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfca69-4325"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84e055c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 referral-tracking.js Show response
www.rd.com/wp-content/plugins/pup-referral-tracking/js/ 620 B
678 B 58ms
48ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/pup-referral-tracking/js/referral-tracking.js?ver=1.1.0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f2b86ff090038df34b053747723c34ff9a00de105a79dbc9011697aaabf58a4f

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 17566
cf-polished: origSize=1402
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:02:37 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc9cd-57a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84e075c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 comment-reply.min.js Show response
www.rd.com/wp-includes/js/ 3 KB
2 KB 45ms
36ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-includes/js/comment-reply.min.js?ver=5.9

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a10b9570a1c7858442b42f1cd48b69a191638269f37e4046607bf5fe188e38bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 13482
x-cache: MISS
x-cache-hits: 0
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Fri, 15 Jul 2022 08:34:57 GMT
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62d126b1-ba3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains; preload
content-type: application/javascript
vary: Accept-Encoding
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84e095c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 comscore-mmx.js Show response
www.rd.com/wp-content/plugins/pup-comscore/js/ 608 B
708 B 46ms
36ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/pup-comscore/js/comscore-mmx.js?ver=1.0.0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

db0b2a9340137033881412a37a10f61ac49ca9017206bf08511d9d8fc0688dae

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 17592
cf-polished: origSize=706
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:02:00 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc9a8-2c2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84e0a5c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 lazy-load.js Show response
www.rd.com/wp-content/plugins/pup-nativo/assets/js/dist/ 4 KB
2 KB 59ms
49ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/pup-nativo/assets/js/dist/lazy-load.js?ver=1.0.0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

51ac5b2d4d716f7fe76fb278275cda1184b8fcb2c18f64ee55842076bcdfdb93

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 17592
cf-polished: origSize=4227
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:02:30 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc9c6-1083"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84e0b5c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 skimlinks-nofollow.js Show response
www.rd.com/wp-content/plugins/pup-skimlinks/js/ 1 KB
868 B 60ms
50ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/pup-skimlinks/js/skimlinks-nofollow.js?ver=1.0.0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b8197cfb30b45b71af2f3bc2a64401b589ceb23b3d0b18b4e6dfffae7befcedf

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 17592
cf-polished: origSize=2014
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:02:41 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc9d1-7de"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84e0c5c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H2 200 moatplugin.js Show response
z.moatads.com/jwplayerplugin0938452/ 4 KB
2 KB 50ms
12ms Script
application/x-javascript 23.35.237.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/jwplayerplugin0938452/moatplugin.js?ver=2.0.3
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-151.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 0d910cc1aa24413aaeef9f2cb52c3ed8bc4a06e823fc1d2d26f75667a0233764

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

unused62: 8096267
date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: gzip
last-modified: Tue, 10 Apr 2018 14:31:58 GMT
server: AmazonS3
x-amz-request-id: F8F7E6737A91EC25
etag: "30b375ad7de497af4a70858611be5346"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=24751
accept-ranges: bytes
content-length: 1908
x-amz-id-2: yMeZt+EjQ3Y8jfe5j21KsxvmG5L9xRb6WnaNQ/AEQYSnKaUcbe0/2VOS97pjBag7kq+1oj1g2lo=

GET
H2 200 wjcpcdaI.js Show response
content.jwplatform.com/libraries/ 126 KB
44 KB 47ms
8ms Script
text/javascript 2600:9000:225e:6c00:1:a3fa:7cc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://content.jwplatform.com/libraries/wjcpcdaI.js?ver=2.0.3
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225e:6c00:1:a3fa:7cc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty /
Resource Hash: 90ac9971a59a7ac433772a4b628bad74e71017647687c7b9e55a0ed2bf90736d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:22:36 GMT
content-encoding: gzip
server: openresty
age: 51
x-cache: Hit from cloudfront
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=180
x-amz-cf-pop: FRA60-P4
content-length: 44623
via: 1.1 d81b69368e6f8be2907e338480e58682.cloudfront.net (CloudFront)
x-amz-cf-id: Lw-4AS9kNUwVBmQq1Dl9toaSkENCqMwwJvISAluVI5il3ZLHra-xYA==

GET
H3 200 a9-video-bidder.js Show response
www.rd.com/wp-content/plugins/pup-video/js/ 976 B
897 B 45ms
36ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/pup-video/js/a9-video-bidder.js?ver=2.0.3

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7070c9402db323126f9422de0f47be9a29cda05bfe1dafe1af07306ca666b8f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 17592
cf-polished: origSize=1595
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:02:48 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc9d8-63b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84e0d5c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 digitaldata.js Show response
www.rd.com/wp-content/plugins/tmbi-data-analytics/js/ 3 KB
1 KB 59ms
51ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/tmbi-data-analytics/js/digitaldata.js?ver=1.0.10

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

71795f168f858d2b071378a3a6b78556eea59f816aaafaeffe8eb55ffdcf97bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 17591
cf-polished: origSize=4664
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:02:59 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc9e3-1238"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84e0f5c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 GlobalCommon.js Show response
www.rd.com/wp-content/plugins/tmbi-data-analytics/js/ 3 KB
1 KB 71ms
63ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/tmbi-data-analytics/js/GlobalCommon.js?ver=1.0.10

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5de2f269f121423a6e49c66c14466a779cd693fd6faeff3e04152024be81139c

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 17591
cf-polished: origSize=3117
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:02:59 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc9e3-c2d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84e105c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 Common.js Show response
www.rd.com/wp-content/plugins/tmbi-data-analytics/js/GoogleAnalytics/ 10 KB
3 KB 59ms
51ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/tmbi-data-analytics/js/GoogleAnalytics/Common.js?ver=1.0.10

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f29595049d8fe1e75b1c0d062c5436594a18730673c161bc96e7200ba3026083

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 17591
cf-polished: origSize=12496
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:02:59 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc9e3-30d0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84e125c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 EngagementEvent.js Show response
www.rd.com/wp-content/plugins/tmbi-data-analytics/js/GoogleAnalytics/ 7 KB
2 KB 44ms
37ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/tmbi-data-analytics/js/GoogleAnalytics/EngagementEvent.js?ver=1.0.10

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a32b280803f80b434b6b9b12f856f921d71e98275415fdb71a8f59b742cd7eb5

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 17591
cf-polished: origSize=9918
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:02:59 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc9e3-26be"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84e135c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 analytics.js Show response
www.rd.com/wp-content/plugins/tmbi-data-analytics/js/ 5 KB
2 KB 59ms
52ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/tmbi-data-analytics/js/analytics.js?ver=1.0.10

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9545822056572ccf35b6c6781374ef73bdee236004959748700ea7d644e0199d

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 17591
cf-polished: origSize=7383
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:02:59 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc9e3-1cd7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84e155c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 AccountEvent.js Show response
www.rd.com/wp-content/plugins/tmbi-data-analytics/js/GoogleAnalytics/ 1 KB
751 B 60ms
52ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/tmbi-data-analytics/js/GoogleAnalytics/AccountEvent.js?ver=1.0.10

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

59b92dc54ec59de5e855231a626d0dce05e8a050b0f33ad1ddeda966a930ad43

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 17591
cf-polished: origSize=1872
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:02:59 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc9e3-750"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84e175c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 CartEvent.js Show response
www.rd.com/wp-content/plugins/tmbi-data-analytics/js/GoogleAnalytics/ 5 KB
1 KB 71ms
63ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/tmbi-data-analytics/js/GoogleAnalytics/CartEvent.js?ver=1.0.10

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

08bc22c85c4246a31747bd1dc24007bf53be94f4e527e387ab0a1d81c637c3a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 17591
cf-polished: origSize=6686
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:02:59 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc9e3-1a1e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84e185c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 PrivacySetting.js Show response
www.rd.com/wp-content/plugins/tmbi-data-analytics/js/GoogleAnalytics/ 2 KB
823 B 71ms
63ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/tmbi-data-analytics/js/GoogleAnalytics/PrivacySetting.js?ver=1.0.10

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

56e914584f77a21cf28171f6545abb9ec3246de4b923724d855d84cb1243a156

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 17590
cf-polished: origSize=2157
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:02:59 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc9e3-86d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84e1a5c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 SearchEvent.js Show response
www.rd.com/wp-content/plugins/tmbi-data-analytics/js/GoogleAnalytics/ 908 B
734 B 72ms
65ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/tmbi-data-analytics/js/GoogleAnalytics/SearchEvent.js?ver=1.0.10

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0156d148a5d904d8a4b276d8cae5b77667e05ae546fa3b441e3116aca02ee6c8

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 17590
cf-polished: origSize=1212
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:02:59 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc9e3-4bc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84e1c5c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 openweb-analytics.js Show response
www.rd.com/wp-content/plugins/tmbi-data-analytics/js/ 2 KB
874 B 75ms
68ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/tmbi-data-analytics/js/openweb-analytics.js?ver=1.0.10

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9cc5de9fdb0201569f2566a0cf00f15a0fae5a4260c3982c1fcf679d5811dbde

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 17590
cf-polished: origSize=2672
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:02:59 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc9e3-a70"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84e1e5c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 links.js Show response
www.rd.com/wp-content/plugins/easyazon/addition/components/localization/links/resources/ 653 B
700 B 59ms
52ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/easyazon/addition/components/localization/links/resources/links.js?ver=5.0.1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

91c00cb18c492812180645a760c3e76b611b3dfb8576de93a0fa453aee1b078d

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 17590
cf-polished: origSize=797
x-cache: MISS
last-modified: Tue, 24 Aug 2021 07:04:30 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"612499fe-31d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84e1f5c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 popovers.js Show response
www.rd.com/wp-content/plugins/easyazon/addition/components/popovers/resources/ 2 KB
1 KB 75ms
68ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/easyazon/addition/components/popovers/resources/popovers.js?ver=5.0.1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3f186210f22d15c9e99282bbc6f351ba7aa14966802f184537dfe273d695e826

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 17590
cf-polished: origSize=2678
x-cache: MISS
last-modified: Tue, 24 Aug 2021 07:04:30 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"612499fe-a76"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84e215c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 slinky.min.js Show response
www.rd.com/wp-content/themes/bumblebee/js/util/ 4 KB
2 KB 59ms
52ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/themes/bumblebee/js/util/slinky.min.js?ver=4.1.0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1574db55dfbb34c01542fd1ef72942c1f9cd0aaf7a3ce135e0deb2e55dfdd486

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 17590
x-cache: MISS
x-cache-hits: 0
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Tue, 26 Jul 2022 11:01:45 GMT
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc999-1110"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains; preload
content-type: application/javascript
vary: Accept-Encoding
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84e225c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 navigation.js Show response
www.rd.com/wp-content/themes/bumblebee/js/ 4 KB
2 KB 64ms
57ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/themes/bumblebee/js/navigation.js?ver=1.2.0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4e421a0440b56149be838fad25420517bb36fc7135f18783835ddf6e73c29899

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 17589
cf-polished: origSize=6167
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:01:45 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc999-1817"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84e255c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 navigation-2021.js Show response
www.rd.com/wp-content/themes/bumblebee/js/ 3 KB
1 KB 64ms
57ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/themes/bumblebee/js/navigation-2021.js?ver=1.3.0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

67753bf8ff944e4b146d4d08aa0bf0ebcb1618994bc9384aeda849996d09c17c

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 17589
cf-polished: origSize=4201
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:01:45 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc999-1069"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84e265c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 sticky-header.js Show response
www.rd.com/wp-content/themes/bumblebee/js/ 2 KB
1 KB 64ms
58ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/themes/bumblebee/js/sticky-header.js?ver=1.0.2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

889f28c7e0ff9ec3b2fb1f2cbdbe7c0d4a5a09a34406d76e89f8416b5cbd8457

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 17589
cf-polished: origSize=2251
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:01:45 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc999-8cb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84e285c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 IE11-check.js Show response
www.rd.com/wp-content/themes/bumblebee/js/ 283 B
571 B 65ms
58ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/themes/bumblebee/js/IE11-check.js?ver=1.0.2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a2e0a910385671a83ecc18e58bc12839a21260839514e18ab1862a6012008890

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 17589
cf-polished: origSize=346
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:01:45 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc999-15a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84e2a5c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 newsletter-module.js Show response
www.rd.com/wp-content/themes/bumblebee/js/ 3 KB
1 KB 65ms
58ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/themes/bumblebee/js/newsletter-module.js?ver=1.1.1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

25debee90474604a5599e170d42a4c9bf6133d9aa6384ea3f1748a1106dafff6

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 17589
cf-polished: origSize=4210
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:01:45 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc999-1072"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84e2d5c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 underscore.min.js Show response
www.rd.com/wp-includes/js/ 19 KB
8 KB 65ms
58ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-includes/js/underscore.min.js?ver=1.13.1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4f6366518c3d992d6a9a3aee342675532822d6b1d66217df7b284bb450dbb99a

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 17589
x-cache: MISS
x-cache-hits: 0
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Fri, 15 Jul 2022 08:34:57 GMT
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62d126b1-4a7d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains; preload
content-type: application/javascript
vary: Accept-Encoding
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84e305c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 facets-script.min.js Show response
www.rd.com/wp-content/plugins/elasticpress/dist/js/ 126 KB
42 KB 65ms
59ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/elasticpress/dist/js/facets-script.min.js?ver=3.4.1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

819f3136b7fa1d732f05ec1d9c773bed9bdcdb09e936fe964ae8fb70f29912f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 17589
x-cache: MISS
x-cache-hits: 0
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 19 Dec 2019 03:53:18 GMT
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"5dfaf42e-1f8e1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains; preload
content-type: application/javascript
vary: Accept-Encoding
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84e315c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 smart-tag.js Show response
www.rd.com/wp-content/plugins/pup-bx/js/ 264 B
555 B 69ms
63ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/pup-bx/js/smart-tag.js?ver=1.0.0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

435b827b100268bdb32cc3ffabf94331103010fd2d1ba26890fc639d53a1b525

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 17589
cf-polished: origSize=341
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:01:55 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc9a3-155"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84e345c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 taboola_loader_async.js Show response
www.rd.com/wp-content/plugins/pup-taboola/js/ 1 KB
876 B 77ms
71ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/pup-taboola/js/taboola_loader_async.js?ver=1.1.0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2c34e56c8477ca237b6ca14153f7187aa724b0ba5f764e28b91b3f7bbeb2a762

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 18412
cf-polished: origSize=1353
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:02:46 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc9d6-549"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84e355c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 video-utils.js Show response
www.rd.com/wp-content/plugins/pup-video/js/ 5 KB
2 KB 69ms
63ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/pup-video/js/video-utils.js?ver=2.0.3

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2b59b7362e2f136f8eb50ee9ed29dbb5ca434c1067cb56de2cf9808679028929

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 17588
cf-polished: origSize=8233
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:02:48 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc9d8-2029"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84e375c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 jw-player.js Show response
www.rd.com/wp-content/plugins/pup-video/js/ 13 KB
5 KB 70ms
63ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/pup-video/js/jw-player.js?ver=2.0.3

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b0e385c1e349d9f04e3f2d4df39f992f5d0115630e27c67e672296b947e4ebb3

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 17588
cf-polished: origSize=23867
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:02:48 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc9d8-5d3b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84e3a5c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 catapultx-tags.js Show response
www.rd.com/wp-content/plugins/tmbi-catapultx/js/ 840 B
785 B 72ms
66ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/tmbi-catapultx/js/catapultx-tags.js?ver=1.0.0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4dd22a866cf7fa613e4a25f4e152e8d2f89e3e677c440e52c14e660927610e1d

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 17588
cf-polished: origSize=1310
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:03:48 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfca14-51e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84e3b5c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 social-share-sticky.js Show response
www.rd.com/wp-content/themes/bumblebee/js/ 2 KB
955 B 72ms
66ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/themes/bumblebee/js/social-share-sticky.js?ver=1.0.0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1d982282f0397d47ade6971a4fcc4510e48818e69b8d0a1f841ef7c2719d13de

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 18051
cf-polished: origSize=2371
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:01:45 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc999-943"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84e3c5c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 social-share-rf.js Show response
www.rd.com/wp-content/themes/bumblebee/js/ 2 KB
1 KB 72ms
66ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/themes/bumblebee/js/social-share-rf.js?ver=5.9

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

38ecfd35f3df13ac05900016fbb5975080b2856f6029ad5455203c0f5550c8ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 18051
cf-polished: origSize=3142
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:01:45 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc999-c46"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84e3d5c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H2 200 flbuttons.min.js Show response
cdn.flipboard.com/web/buttons/js/ 7 KB
4 KB 93ms
18ms Script
text/html 2600:9000:2304:3000:e:5a70:ca4f:f701
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.flipboard.com/web/buttons/js/flbuttons.min.js?ver=2017-10-10
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2304:3000:e:5a70:ca4f:f701 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f039e32c9e62cd2acc5bf02dec7282686e6f41be6b01bfa249f9590cda747cba

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Mon, 08 Aug 2022 23:12:12 GMT
content-encoding: gzip
last-modified: Wed, 23 Dec 2020 17:43:48 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1608743508/ctime:1608745368/gid:1000/gname:ubuntu/md5:e9b04ad509ffb00302d9625f75774548/mode:33204/mtime:1608745368/uid:1000/uname:ubuntu
age: 72679
etag: W/"e9b04ad509ffb00302d9625f75774548"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/html
via: 1.1 ac02b9a9a93754a9f85004c4c9792fee.cloudfront.net (CloudFront)
x-amz-cf-pop: VIE50-P1
x-amz-cf-id: zfhSLiRw0rnlWe6bbk-76HCtepk0yoT21IGtug3s7Wt8NEwYHNwiQg==

GET
H3 200 tmbi-prebid-video.js Show response
www.rd.com/wp-content/plugins/tmbi-prebid/js/ 1020 B
898 B 72ms
66ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/tmbi-prebid/js/tmbi-prebid-video.js?ver=1.1.0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

da3db457741823b2b3579b647a3d800eee052062f99208c8ca15c490bc4e142a

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 17587
cf-polished: origSize=2313
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:03:47 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfca13-909"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84e3e5c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H2 200 sdk.js Show response
widget.beop.io/ 4 KB
3 KB 89ms
6ms Script
application/javascript 152.199.23.151
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://widget.beop.io/sdk.js?ver=1.0.0

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.199.23.151 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frd/E2BB) /

Resource Hash

b8d99817a8b892853ac7152f6db0c094fc8e1a06a841da6c7e2a095ce1349cc3

Security Headers

Name	Value
Content-Security-Policy	frame-src ;script-src 'unsafe-inline' .pingdom.net www.youtube.com platform.twitter.com .instagram.com .beop.io .beopinion.com js.stripe.com service.mtcaptcha.com service2.mtcaptcha.com;font-src .beop.io .beopinion.com;frame-ancestors .beop.io *.beopinion.com

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

content-security-policy: frame-src *;script-src 'unsafe-inline' *.pingdom.net www.youtube.com platform.twitter.com *.instagram.com *.beop.io *.beopinion.com js.stripe.com service.mtcaptcha.com service2.mtcaptcha.com;font-src *.beop.io *.beopinion.com;frame-ancestors *.beop.io *.beopinion.com
content-encoding: gzip
etag: "10e8-1y6OZQrEfo/erHdkBrQHGSHT9sk+gzip"
age: 172
x-cache: HIT
content-length: 2274
x-ocdn-accept-language: de
last-modified: Tue, 09 Aug 2022 19:20:35 GMT
server: ECAcc (frd/E2BB)
date: Tue, 09 Aug 2022 19:23:27 GMT
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=300
expires: Tue, 09 Aug 2022 19:28:27 GMT

GET
H2

200

streamingtag_plugin_jwplayer.js Show response
sb.scorecardresearch.com/internal-c2/default/
Redirect Chain

https://sb.scorecardresearch.com/c2/plugins/streamingtag_plugin_jwplayer.js?ver=1.0.0
https://sb.scorecardresearch.com/internal-c2/default/streamingtag_plugin_jwplayer.js

210 KB
53 KB

10ms
8ms

Script
application/javascript

13.32.99.21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.scorecardresearch.com/internal-c2/default/streamingtag_plugin_jwplayer.js
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: H2
Server: 13.32.99.21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-21.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 96281150fc4b153640ffd15f9ce9a133ee631aecb0f955cd67974e72af74ae64

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:15:08 GMT
content-encoding: gzip
etag: W/"45e1b1186d270bf042fe7ed57882f85b"
last-modified: Thu, 24 Feb 2022 15:25:16 GMT
server: AmazonS3
age: 504
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 ab21b6436bc1d51d57b228ad39b1fa54.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P3
x-amz-cf-id: OQZ3iAM_fNF_ur96uUg3hP09swKdJ60l1NnXnI9t_YzlKIYbUyCRKg==

Redirect headers

location: /internal-c2/default/streamingtag_plugin_jwplayer.js
date: Tue, 09 Aug 2022 19:23:27 GMT
via: 1.1 ab21b6436bc1d51d57b228ad39b1fa54.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P3
content-length: 0
x-amz-cf-id: I-5aQlOcqXOKZm8AXPJV5EBgzXDhqI1ORzXKt0rkgQr4pzFlUIU0lQ==
x-cache: Miss from cloudfront

GET
H3 200 jw-player-comscore.js Show response
www.rd.com/wp-content/plugins/pup-comscore/js/ 748 B
819 B 72ms
66ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/pup-comscore/js/jw-player-comscore.js?ver=1.0.0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7658233cbe36b832efda5b9a27f917453114586626666ed6142b0c50a2e8fcef

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 17587
cf-polished: origSize=1197
x-cache: MISS
last-modified: Tue, 26 Jul 2022 11:02:00 GMT
x-cache-hits: 0
strict-transport-security: max-age=0; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc9a8-4ad"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc84e3f5c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 lazyload.min.js Show response
www.rd.com/wp-content/plugins/rocket-lazy-load/assets/js/16.1/ 8 KB
3 KB 23ms
20ms Script
application/javascript 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/wp-content/plugins/rocket-lazy-load/assets/js/16.1/lazyload.min.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6e86a52a9858206302e32036d89907e3ac87762055e7f9c6364aec33221b3e41

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 17581
x-cache: MISS
x-cache-hits: 0
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 19 Aug 2020 15:24:08 GMT
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"5f3d4418-1ed2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains; preload
content-type: application/javascript
vary: Accept-Encoding
x-hosted-by: 45AIR.COM
cf-ray: 7382ddc98fbc5c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H2 200 v652eace1692a40cfa3763df669d7439c1639079717194 Show response
static.cloudflareinsights.com/beacon.min.js/ 14 KB
5 KB 88ms
58ms Script
text/javascript 2606:4700:440e::6812:2fe6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/v652eace1692a40cfa3763df669d7439c1639079717194
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:440e::6812:2fe6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fd0a1ac929c11b08e819fe4b0a18c5574012c44f09de8987c6be99a0f055a505

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Origin: https://www.rd.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: gzip
last-modified: Thu, 09 Dec 2021 19:55:17 GMT
server: cloudflare
etag: W/2021.12.0
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 7382ddca290b9125-FRA

GET
H2 200 css2
fonts.googleapis.com/ 14 KB
840 B 63ms
18ms Stylesheet
text/css 2a00:1450:400e:80f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,400;0,500;0,600;0,700;1,400;1,500;1,600;1,700&display=swap

Requested by

Host: www.rd.com
URL: https://www.rd.com/wp-content/themes/bumblebee/style.css?ver=1.12.11

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400e:80f::200a , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

5bbc49b8e4b608dd8d1539e5f394825fa16220f5ba9d25d502c4493e690e75ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/wp-content/themes/bumblebee/style.css?ver=1.12.11
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 09 Aug 2022 18:24:53 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 09 Aug 2022 19:23:27 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 09 Aug 2022 19:23:27 GMT

GET
H2 200 css2
fonts.googleapis.com/ 3 KB
974 B 62ms
17ms Stylesheet
text/css 2a00:1450:400e:80f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Unna:ital,wght@0,400;0,700;1,400;1,700&display=swap

Requested by

Host: www.rd.com
URL: https://www.rd.com/wp-content/themes/bumblebee/style.css?ver=1.12.11

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400e:80f::200a , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

351846a513b381063c0b9916ede4a812391bd06c3465763c65fc166123b7e4fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/wp-content/themes/bumblebee/style.css?ver=1.12.11
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 09 Aug 2022 19:21:59 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 09 Aug 2022 19:23:27 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 09 Aug 2022 19:23:27 GMT

GET
H2 200 v2 Show response
mb.moatads.com/yi/ 646 B
820 B 287ms
37ms Script
text/html 18.132.175.146
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mb.moatads.com/yi/v2?ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2Fz(lKm3GFlNUU%2Cu%5Bh_GcS%25%5BHvLU%5B4(K%2B%7BgeFWl_%3DNqUXR%3A%3D%2BAxMn%3Ch%2CyenA8p%2FHm%24%60%233P(ry5*ZRocMp1tq%5BN%7Bq%60RP%3CG.ceFW%7CoG%22mxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CC%24%3D!!tmxgk~GDgxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7B%2CNr1U*%26ujMUU9%3C%24kBjqI&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C2%2C2%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-v3N3MykstXpuUX885ljPGlx1P1tMeAYh8VIp1Vf7AbESGfrl5%2FmliBNlAlwWxmRnpyWz&rs=1-GKKOVythgEwLgg%3D%3D&sc=1&os=1-6g%3D%3D&qp=10000&is=&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&pcode=tmbiyieldheader910374028064&rx=51276775722&callback=MoatNadoAllJsonpRequest_14687775
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/tmbiyieldheader910374028064/moatheader.js?ver=1.0.3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.132.175.146 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-132-175-146.eu-west-2.compute.amazonaws.com
Software: Microsoft-IIS/6.0 /
Resource Hash: c7f7fbc513e55c62a48a2d2349d1d5a48ffc8698c3688f38737965632e6a463c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
cache-control: max-age=900
server: Microsoft-IIS/6.0
timing-allow-origin: *
etag: "11811e945bde234198efcf19e2b955b401e72b35"
content-length: 646
content-type: text/html; charset=UTF-8

GET
H2 200 iframe.html Show response
z.moatads.com/hd09824092/ Frame BE40 1 KB
2 KB 7ms
7ms Document
text/html 23.35.237.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/hd09824092/iframe.html
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/tmbiyieldheader910374028064/moatheader.js?ver=1.0.3
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-151.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 49d65831c7e98a7d885d223699a41198204329efff9d1904c8af71323f613d68

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=442
content-length: 1374
content-type: text/html
date: Tue, 09 Aug 2022 19:23:27 GMT
etag: "4a9cbc2e5bc164313dace42a58bef141"
last-modified: Tue, 26 Jan 2021 22:41:39 GMT
server: AmazonS3
unused62: 8096267
x-amz-id-2: bLl72GtpcxM8rSKIodQlKgK0BRPdEbxIV8PPGYh9PcLqpR363i0Z1TjhY7+mRyWYYTxnhPRiG5Y=
x-amz-request-id: A3423FE5772816F0

POST
H2 200 / Show response
r.skimresources.com/api/ 177 B
382 B 56ms
19ms XHR
application/json 35.190.59.101
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r.skimresources.com/api/

Requested by

Host: s.skimresources.com
URL: https://s.skimresources.com/js/131817X1594237.skimlinks.js?ver=1.0.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.190.59.101 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

101.59.190.35.bc.googleusercontent.com

Software

openresty/1.11.2.5 /

Resource Hash

715bc6bf84352aa0f104c41c531e14948fd1d4fe2eafbd85d3c59862ce8b3d86

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: openresty/1.11.2.5
strict-transport-security: max-age=31536000
content-type: application/json
access-control-allow-origin: https://www.rd.com
vary: Accept-Encoding
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
via: 1.1 google

GET
H2 206 robots.txt
t.skimresources.com/api/v2/ Frame EAE6 0
134 B 87ms
21ms Image
text/plain 35.201.67.47
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.skimresources.com/api/v2/robots.txt?__skimjs_preflight__please_ignore__=true&rnd=0.0611224118064666
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.67.47 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 47.67.201.35.bc.googleusercontent.com
Software: Python/3.7 aiohttp/3.5.4 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
via: 1.1 google
server: Python/3.7 aiohttp/3.5.4
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/plain charset=UTF-8

GET
H2 200 px.gif
p.skimresources.com/ 43 B
276 B 78ms
19ms Image
image/gif 35.190.91.160
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.skimresources.com/px.gif?ch=1&rn=8.568215198847453
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.91.160 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 160.91.190.35.bc.googleusercontent.com
Software: Skimlinks Pixel 1.0 /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
via: 1.1 google
server: Skimlinks Pixel 1.0
p3p: policyref="http://skimlinks.com/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
content-type: image/gif

GET
H2 200 px.gif
p.skimresources.com/ 43 B
102 B 18ms
18ms Image
image/gif 35.190.91.160
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.skimresources.com/px.gif?ch=2&rn=8.568215198847453
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.91.160 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 160.91.190.35.bc.googleusercontent.com
Software: Skimlinks Pixel 1.0 /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
via: 1.1 google
server: Skimlinks Pixel 1.0
p3p: policyref="http://skimlinks.com/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
content-type: image/gif

GET
H3 200 cx-bootstrapper-init Show response
tags.catapultx.com/cxo/ 39 KB
9 KB 41ms
26ms Script
application/javascript 2606:4700:3035::6815:29f3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.catapultx.com/cxo/cx-bootstrapper-init
Requested by: Host: tags.catapultx.com
URL: https://tags.catapultx.com/bootstrapper?ver=1.0.0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:29f3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: f0005c4930117c882abab233a3dc18ff04b76f8cb9ea86bed294c1a7a4464ec4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 135
x-powered-by: Express
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 08 Aug 2022 13:10:16 GMT
server: cloudflare
etag: W/"56"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cI5NjwMMVZEosIjg9PyjSYOSV96wTCdDv90hEqEFRByOFDDsO1tNTMJGEUitFi2x5D8Ke8ea9sMjLVG7hNfXYiSHkpvN8FKlkIV5Q6TUJ%2Bwf%2FEb6DaZrHwLTtVuFeW6aL6E6XEFItkLU1yKjR1lYfs4%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=180
cf-ray: 7382ddc9aaa5bbeb-FRA

GET
DATA 200
OK truncated
/ 66 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 13709eb92cc8d30ddca86cac6a763b4e40a4a5d6a338ce79e4220d91fe24c36a

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 66 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 483784ecdf80ccaffd50869e23e2efdbeed9343b1b4c7dae837667e4984a68a7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 10 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9b268fa9e727fb03331446edd6222f2f4e7c2bdb242b14939e4b5cacf4e7be9a

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 66 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 11e5934d20c6bd213399fe63dc8de240747a0b49a7f782aec6981d6a66e08282

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v25/ 30 KB
30 KB 67ms
31ms Font
font/woff2 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v25/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,400;0,500;0,600;0,700;1,400;1,500;1,600;1,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ae919a7c9f25f0fd97fc18e398ae8e453fcaae487e4a4cb4f896e7fecde4a780

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.rd.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 17:46:43 GMT
x-content-type-options: nosniff
age: 5804
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30928
x-xss-protection: 0
last-modified: Mon, 11 Jul 2022 18:57:39 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 09 Aug 2023 17:46:43 GMT

GET
DATA 200
OK truncated
/ 67 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b0b68a2820314b9d471468ca2fcb17de112c4c864f048e50d593f054962f2c9d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 52b31d95b3be7d837502b15107ad1edf7f9c3ce42773ce65361336dde7597ab6

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 66 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b9544dbbc4559751f0ceafc848716911393670f4e5bd8ae18e952d7d08bd346b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 thehealthy-logo.svg
www.rd.com/wp-content/uploads/2021/09/ 3 KB
2 KB 23ms
22ms Image
image/svg+xml 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.rd.com/wp-content/uploads/2021/09/thehealthy-logo.svg

Requested by

Host: www.rd.com
URL: https://www.rd.com/wp-content/themes/bumblebee/header.css?ver=2.0.8

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

52b31d95b3be7d837502b15107ad1edf7f9c3ce42773ce65361336dde7597ab6

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/wp-content/themes/bumblebee/header.css?ver=2.0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 8360704
x-vc-enabled: true
x-vc-ttl: 5256000
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Tue, 21 Sep 2021 07:31:49 GMT
server: cloudflare
etag: W/"61498a65-b4e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains; preload
content-type: image/svg+xml
vary: Accept-Encoding
cache-control: public, max-age=315360000
cf-ray: 7382ddc9aff85c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: eae3e60047cc587e0cbdd516d13add26d0e42b1d276fc09225053066fbfae8df

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0660862c3bbbb31cd2e4a79c5b9ba036356e35e5c80ce5b7b66cc06c93865162

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bfcc2143b6f0635117b7354d9c0965778cd10168c10ca661d0ce42af30820951

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2

200

n76fan2z-720.jpg
assets-jpcust.jwpsrv.com/thumbnails/
Redirect Chain

https://content.jwplatform.com/thumbs/RO5TLTlb.jpg
https://assets-jpcust.jwpsrv.com/thumbnails/n76fan2z-720.jpg

57 KB
53 KB

155ms
97ms

Image
image/jpeg

2a04:4e42:200::626
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-jpcust.jwpsrv.com/thumbnails/n76fan2z-720.jpg
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: H2
Server: 2a04:4e42:200::626 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 7cc0fa02d75d6ee0ba9502901af69fcd18d64aca7c88bd272a8e2b6dfe40f5c3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: gzip
age: 356
x-cache: HIT, HIT
content-length: 54466
x-served-by: cache-iad-kcgs7200030-IAD, cache-fra19164-FRA
access-control-allow-origin: *
last-modified: Fri, 03 Jan 2020 17:38:07 GMT
server: nginx
x-timer: S1660073008.819977,VS0,VE89
etag: "1dade7a4ee4b4d6ba8ebd917d2c65fe4"
vary: Accept-Encoding
content-type: image/jpeg
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=900
accept-ranges: bytes
access-control-allow-headers: accept-encoding, cache-control, origin, dnt, accept-language
x-cache-hits: 1, 1

Redirect headers

date: Tue, 09 Aug 2022 19:23:27 GMT
via: 1.1 d81b69368e6f8be2907e338480e58682.cloudfront.net (CloudFront)
server: openresty
x-amz-cf-pop: FRA60-P4
location: https://assets-jpcust.jwpsrv.com/thumbnails/n76fan2z-720.jpg
access-control-allow-methods: GET
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=180, max-stale=180
x-cache: Miss from cloudfront
access-control-allow-headers: accept-encoding, cache-control, origin, dnt, accept-language
content-length: 0
x-amz-cf-id: 9d1kCZdZ8ANtMeKJq7qRUTD3jIGhBf-acGvPLylxCCpg9PktWtG_dQ==

GET
H2 200 JTUQjIg1_i6t8kCHKm459WxRyS7m.woff2
fonts.gstatic.com/s/montserrat/v25/ 31 KB
32 KB 40ms
24ms Font
font/woff2 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v25/JTUQjIg1_i6t8kCHKm459WxRyS7m.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,400;0,500;0,600;0,700;1,400;1,500;1,600;1,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

33befdbbb24930584f5ac94ea3117adcd56518f20ab1619d05de83ffd1821d38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.rd.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Wed, 03 Aug 2022 04:47:18 GMT
x-content-type-options: nosniff
age: 570969
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31760
x-xss-protection: 0
last-modified: Mon, 11 Jul 2022 18:54:16 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 03 Aug 2023 04:47:18 GMT

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3a48ba6d11055a2a6f840befa14e603650d8ca3d752e16daccd828d3869fb791

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 66 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9629c59fb5d325a2fdf7324f731f6e8a4ee507af7d1bd260a4d290ee69c4d17c

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2

200

beacon.js Show response
sb.scorecardresearch.com/internal-cs/default/
Redirect Chain

https://sb.scorecardresearch.com/cs/6034767/beacon.js
https://sb.scorecardresearch.com/internal-cs/default/beacon.js

4 KB
2 KB

8ms
8ms

Script
application/javascript

13.32.99.21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.scorecardresearch.com/internal-cs/default/beacon.js
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: H2
Server: 13.32.99.21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-21.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6838420e13959ecffe73d3576ee2125a66c9315237394a23e3dd4a5181e80cda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:15:58 GMT
content-encoding: gzip
etag: W/"5b0f9f0704a703b8da651007721fac57"
last-modified: Thu, 04 Mar 2021 13:31:34 GMT
server: AmazonS3
age: 450
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 ab21b6436bc1d51d57b228ad39b1fa54.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P3
x-amz-cf-id: DH33pTJBR06C09VnkxxYKHKSvaFeruzp4ZrF8k8HnOltOX2FUPoBbw==

Redirect headers

location: /internal-cs/default/beacon.js
date: Tue, 09 Aug 2022 19:23:27 GMT
via: 1.1 ab21b6436bc1d51d57b228ad39b1fa54.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P3
content-length: 0
x-amz-cf-id: Naq9-E18lkJdaNvUZdghLIs_jbAIzSXwmtwYFj45BWVi1PrkRBvvkA==
x-cache: Miss from cloudfront

GET
DATA 200
OK truncated
/ 390 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ed03606264f99e9e2b49861b119a5378d9c52f9bec0d56e9bf8f4a2afd0f05b5

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf8

GET
DATA 200
OK truncated
/ 511 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d669534a76a01823b9c2c53e150cb5cbdf338e7e2e80e4c429b12935137d793a

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf8

GET
DATA 200
OK truncated
/ 728 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 636d6f07b3e1c54521a32a4e40f9c889ef8fb235f024bcabd94cdb73f0b04901

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf8

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5726835a9449b924da62bf34cbe26cd64307f3c9159914f82fee7cab41aaf306

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf8

GET
DATA 200
OK truncated
/ 957 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f05e7cffaf25f8189d7f982960a21a7d99610b50102854ee49ff597f95cfc466

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf8

GET
DATA 200
OK truncated
/ 558 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5893c1ccc8413220bf8a158af5a06e45ec294fe853348dd19b68f221ba4833f5

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf8

GET
H2 200 i.js Show response
tag.bounceexchange.com/948/ 22 KB
8 KB 92ms
17ms Script
text/plain 34.120.253.250
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.bounceexchange.com/948/i.js
Requested by: Host: www.rd.com
URL: https://www.rd.com/wp-content/plugins/pup-bx/js/smart-tag.js?ver=1.0.0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.253.250 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 250.253.120.34.bc.googleusercontent.com
Software: istio-envoy /
Resource Hash: 783929bb93fcbbea66a9c287a1ec14fda946e3062133e0339a743cd28ad09191

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:06 GMT
content-encoding: gzip
age: 21
x-envoy-upstream-service-time: 2
x-region: us-central1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8090
access-control-allow-origin: *
server: istio-envoy
etag: 1f76ca4f97387a
vary: Accept-Encoding
content-type: text/plain; charset=utf-8
via: 1.1 google
cache-control: public,max-age=60
timing-allow-origin: *
link: <https://assets.bounceexchange.com>; rel=dns-prefetch, <https://events.bouncex.net>; rel=dns-prefetch, <https://api.bounceexchange.com>; rel=preconnect

GET
H2 200 clear.gif
cdn.flipboard.com/dev_O/ 43 B
492 B 28ms
27ms Image
image/gif 2600:9000:2304:3000:e:5a70:ca4f:f701
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.flipboard.com/dev_O/clear.gif?utm_source=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2304:3000:e:5a70:ca4f:f701 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 17:01:00 GMT
via: 1.1 ac02b9a9a93754a9f85004c4c9792fee.cloudfront.net (CloudFront)
last-modified: Wed, 23 Dec 2020 17:41:53 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1608745226/ctime:1608745224/gid:20/gname:staff/md5:ad4b0f606e0f8465bc4c4c170b37e1a3/mode:33188/mtime:1608745180/uid:501/uname:greg
age: 29054
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/gif
x-amz-cf-pop: VIE50-P1
accept-ranges: bytes
content-length: 43
x-amz-cf-id: C6WVCHQoVG9q3bxnHtEJtBWFsLj23LfQITu0UnI25c5WajSBpdo-nw==

GET
H2 200 core.js Show response
s.pinimg.com/ct/ 1 KB
1 KB 300ms
176ms Script
application/javascript 2a02:26f0:dc:181::1931
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s.pinimg.com/ct/core.js
Requested by: Host: www.rd.com
URL: https://www.rd.com/wp-content/plugins/pup-pinterest-pixels/js/pinterest-pixels.js?ver=1.0.0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:dc:181::1931 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: a67117312ce631cdfc251dfbb90058bc01e3849deb0cd7fed130745b5813d1b2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

akamai-x-true-ttl: 7200
x-cdn: akamai
etag: "2dda33348480d93c64a825f2616f03ce"
vary: Accept-Encoding, Origin
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: max-age=7200
accept-ranges: bytes
content-length: 1142
access-control-expose-headers: X-CDN

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1b06e1c6d409d4a667970959397d39f5ddbf9803cbf7f9acb70fe00b8127cf4f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 23 KB
0 Image
image/jpg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ddfea4688644106797f10d32994fd83c3508ba7090bf893c430c8cd2e573d8c6

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type: image/jpg

GET
DATA 200
OK truncated
/ 11 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2bef08bfc4f5df889affb046f13acf8a5aba7d656918647bedc7c98eade9ffe4

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 65568.js Show response
cdn.brandmetrics.com/scripts/bundle/ 43 KB
14 KB 29ms
29ms Script
text/javascript 2606:4700:20::681a:79b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.brandmetrics.com/scripts/bundle/65568.js?sid=bb2eaa01-5010-43e2-98c9-38c3cb56a353&toploc=www.rd.com
Requested by: Host: cdn.brandmetrics.com
URL: https://cdn.brandmetrics.com/tag/a969c5a7d4e5408485948e8e11899567/rd.com.js?ver=1.1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:79b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cb3f12f81184edd76efed5fe35a5c4ed281ff579e30ff9b13936a184afbc8cde

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 09 Aug 2022 18:32:06 GMT
server: cloudflare
age: 3081
cf-polished: origSize=45116
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XD%2BF2LTYUO5y1NDqYX4Is1RfFnQzWNtKJ30h5UgzH1FkDi21y8h5vcsmKFpq0Iq0Z%2BED0OoAbEsVdJ0NZB7GTOstKLpwfxLhewicdo%2B3NQe1%2B9Sq0VUBzMPccNLpGkGSn%2BCx3EmV1Kszocy9ML01GZXq"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 7382ddca5b21bba9-FRA
cf-bgj: minify

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 2 KB
2 KB 106ms
105ms XHR
application/json 108.138.4.10
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=3235&u=https%3A%2F%2Fwww.rd.com
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.4.10 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-4-10.fra56.r.cloudfront.net
Software: Server /
Resource Hash: 493bd9e02b4ac1dad8c1bb0d1448512d4ce80ac0d66b27d47cb46638cbbad8ba

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
via: 1.1 bfb5bffe90e3b0e760933a7a07d850ba.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P6
x-cache: Miss from cloudfront
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www.rd.com
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
content-length: 2090
x-amz-cf-id: iduSTKTb4RyGj1cNooTWhNU4_XGioVyj97j5mC7qJ1b1Avp4hxlhwg==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 26ms
10ms XHR
application/javascript 108.138.4.10
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.4.10 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-4-10.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-amz-version-id: JXufo2ctue2uysHllG2MRpKE8F0E4.a0
content-encoding: gzip
etag: W/"a4d296427fc806b21335359e398c025c"
age: 75822
x-cache: Hit from cloudfront
access-control-max-age: 3000
access-control-allow-origin: *
last-modified: Wed, 03 Aug 2022 22:19:11 GMT
server: AmazonS3
date: Mon, 08 Aug 2022 22:20:06 GMT
vary: Accept-Encoding,Origin
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: FRA56-P6
x-amz-cf-id: tCefEXPBuAkLYv0eldl6chopLGQBeCM7d2WmnAK2BQYDNj-fYieD5w==

GET
H3 200 1468910830064549 Show response
connect.facebook.net/signals/config/ 293 KB
84 KB 42ms
21ms Script
application/x-javascript 2a03:2880:f007:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1468910830064549?v=2.9.73&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js?ver=2.0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f007:8:face:b00c:0:1 Vienna, Austria, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5315b3b69ad428d90ce6485dc31a8f0a06bfd2579b1c34120992aacd3bda5556

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 85959
x-xss-protection: 0
pragma: public
x-fb-debug: 0XCvc7w84kFSDq4fewHLBt/13hKASO6Jk223ilhm96KUJ++d5CeYZ6Z/9FVSPjCpnrINnLpPbqxP7j9Y8v90TA==
x-frame-options: DENY
date: Tue, 09 Aug 2022 19:23:27 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 pubads_impl_2022080401.js Show response
securepubads.g.doubleclick.net/gpt/ 381 KB
130 KB 58ms
14ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080401.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

sffe /

Resource Hash

e9c45dea6d149ac4de08c8a5af38836a97d0c08144d2f1858247748b29615da3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 16:10:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 11563
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 132985
x-xss-protection: 0
last-modified: Thu, 04 Aug 2022 08:38:16 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 09 Aug 2023 16:10:44 GMT

GET
H2 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 282 B
776 B 94ms
33ms XHR
application/json 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.rd.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

cafe /

Resource Hash

fc0c4893ccbfbb1c266374313522a0ff2383a73b9de5280299af809169650cf2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 140
x-xss-protection: 0
expires: Tue, 09 Aug 2022 19:23:27 GMT

GET
H3 200 facebook-letter-logo.svg
www.rd.com/wp-content/plugins/pup-social-share//images/ 750 B
827 B 20ms
17ms Image
image/svg+xml 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.rd.com/wp-content/plugins/pup-social-share//images/facebook-letter-logo.svg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6c1bfdb14d27bda31dfee5f766c56a12bf8a618d7fb24cb9c0c539a35b2090b5

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 17351
x-cache: MISS
x-cache-hits: 0
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Tue, 26 Jul 2022 11:02:45 GMT
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc9d5-2ee"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains; preload
content-type: image/svg+xml
vary: Accept-Encoding
x-hosted-by: 45AIR.COM
cf-ray: 7382ddca79365c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H2 200 flipboard_mrrw.png
cdn.flipboard.com/badges/ 1 KB
2 KB 21ms
16ms Image
image/png 2600:9000:2304:3000:e:5a70:ca4f:f701
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.flipboard.com/badges/flipboard_mrrw.png
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2304:3000:e:5a70:ca4f:f701 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 06b975b2cad4370629c5bb9f5b74f395b9dec39b45fe771396f1b47733b0f56d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 18:45:49 GMT
via: 1.1 ac02b9a9a93754a9f85004c4c9792fee.cloudfront.net (CloudFront)
last-modified: Wed, 07 Feb 2018 22:03:54 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1518040941/ctime:1518040834/gid:20/gname:staff/md5:6cb843c4059c54d852c96651d66e5364/mode:33152/mtime:1518064798/uid:502/uname:jlee
age: 2275
etag: "6cb843c4059c54d852c96651d66e5364"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
x-amz-cf-pop: VIE50-P1
accept-ranges: bytes
content-length: 1194
x-amz-cf-id: RNZkHTDh2CySH1uA2QVPHlSZ-HNjAYUk3Z_s0s9pXN1RbdK1QHqo5w==

GET
H3 200 twitter-logo.svg
www.rd.com/wp-content/plugins/pup-social-share/images/ 1 KB
1 KB 22ms
20ms Image
image/svg+xml 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.rd.com/wp-content/plugins/pup-social-share/images/twitter-logo.svg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

37c9dcde8c4a0a5a7dcf5210b9f7cc93a1cbedfe367593480bcd0e383dbb60c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 17351
x-cache: MISS
x-cache-hits: 0
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Tue, 26 Jul 2022 11:02:45 GMT
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc9d5-57e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains; preload
content-type: image/svg+xml
vary: Accept-Encoding
x-hosted-by: 45AIR.COM
cf-ray: 7382ddca79375c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 pinterest-social-visual-website-logotype.svg
www.rd.com/wp-content/plugins/pup-social-share/images/ 1 KB
1 KB 21ms
18ms Image
image/svg+xml 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.rd.com/wp-content/plugins/pup-social-share/images/pinterest-social-visual-website-logotype.svg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1b371fe7914ea1f48622b928d3677af13d177e4e9595fc1d3395d8024f682762

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 17351
x-cache: MISS
x-cache-hits: 0
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Tue, 26 Jul 2022 11:02:45 GMT
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc9d5-565"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains; preload
content-type: image/svg+xml
vary: Accept-Encoding
x-hosted-by: 45AIR.COM
cf-ray: 7382ddca79385c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 envelope.svg
www.rd.com/wp-content/plugins/pup-social-share/images/ 1 KB
1 KB 28ms
25ms Image
image/svg+xml 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.rd.com/wp-content/plugins/pup-social-share/images/envelope.svg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b2bad1e576aa96df171e492e3119d2da02486866a4fcb62a0ba57a8f5ff1d394

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 17351
x-cache: MISS
x-cache-hits: 0
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Tue, 26 Jul 2022 11:02:45 GMT
server: cloudflare
cache-control: public, max-age=315360000
etag: W/"62dfc9d5-4f0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains; preload
content-type: image/svg+xml
vary: Accept-Encoding
x-hosted-by: 45AIR.COM
cf-ray: 7382ddca79395c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 107199Stathis.jpeg
www.rd.com/wp-content/uploads/2022/02/ 1 KB
1 KB 25ms
23ms Image
image/jpeg 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.rd.com/wp-content/uploads/2022/02/107199Stathis.jpeg?fit=33,50

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

50c1032bb1dd33cb368ac2f7c4ec1ded198f264f359381130d55e68a80567f1a

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 124088
x-powered-by: Express
x-vc-enabled: true
x-cloud-trace-context: 3fd6951968bfd8ce89c84a9a7295b172
x-vc-ttl: 5256000
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1043
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: W/"514-cfEr7njJCspRGhbloYycs8ySRdM"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains; preload
content-type: image/jpeg
vary: Accept-Encoding
cache-control: public, max-age=315360000
cf-polished: degrade=85, origSize=1300
accept-ranges: bytes
cf-ray: 7382ddca793b5c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 How-to-Spot-a-Fake-QR-Code-and-Avoid-Getting-Scammed-rd.com-getty-images-1042136224-1.jpg
www.rd.com/wp-content/uploads/2022/04/ 97 KB
97 KB 28ms
25ms Image
image/jpeg 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.rd.com/wp-content/uploads/2022/04/How-to-Spot-a-Fake-QR-Code-and-Avoid-Getting-Scammed-rd.com-getty-images-1042136224-1.jpg?resize=700,467

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

73048b6bc2bedb279c486de3365377836e5b75bf7e2a4919ff7576a936c9ccd5

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 23628
x-powered-by: Express
x-vc-enabled: true
x-cloud-trace-context: ccee4c269aec2f18c1ee8ffaf36697b4
x-vc-ttl: 5256000
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 98832
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: W/"1a4a8-ezKS7Q+Vca4MTDNoTVs6XRpQ1Xo"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains; preload
content-type: image/jpeg
vary: Accept-Encoding
cache-control: public, max-age=315360000
cf-polished: degrade=85, origSize=107688
accept-ranges: bytes
cf-ray: 7382ddca793d5c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 GettyImages-152892935.jpg
www.rd.com/wp-content/uploads/2022/07/ 5 KB
6 KB 32ms
30ms Image
image/jpeg 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.rd.com/wp-content/uploads/2022/07/GettyImages-152892935.jpg?resize=150,150

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

bdaeb78e6d2060e6cb329c9d4f359ef32521bffb3699826aeb6f53a54ef2c2bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 74648
x-powered-by: Express
x-vc-enabled: true
x-cloud-trace-context: 8cd5e2efdbdba4c74e04c266b248b3de
x-vc-ttl: 5256000
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 5178
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: W/"3ce4-2lIsqxQCNnaf5abwqOB8PAdfGzE"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains; preload
content-type: image/jpeg
vary: Accept-Encoding
cache-control: public, max-age=315360000
cf-polished: degrade=85, origSize=15588
accept-ranges: bytes
cf-ray: 7382ddca793e5c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 GettyImages-1164950561-e1658851551692.jpg
www.rd.com/wp-content/uploads/2022/07/ 7 KB
7 KB 30ms
28ms Image
image/jpeg 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.rd.com/wp-content/uploads/2022/07/GettyImages-1164950561-e1658851551692.jpg?resize=150,150

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

66f6e17d40054e4a5d8e5f90e8e93ca8b1b31e9964cb9b790eaad980ecd6b875

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 98817
x-powered-by: Express
x-vc-enabled: true
x-cloud-trace-context: 73360e708799678659e754ac1be964d1
x-vc-ttl: 5256000
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 6925
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: W/"1c5e-4TL3s73O+zWxxlLQGQ5DrSLM1z8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains; preload
content-type: image/jpeg
vary: Accept-Encoding
cache-control: public, max-age=315360000
cf-polished: degrade=85, origSize=7262
accept-ranges: bytes
cf-ray: 7382ddca793f5c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H3 200 iPhone-Disabled-FT-GettyImages-via-apple.jpg
www.rd.com/wp-content/uploads/2022/06/ 3 KB
4 KB 30ms
28ms Image
image/jpeg 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.rd.com/wp-content/uploads/2022/06/iPhone-Disabled-FT-GettyImages-via-apple.jpg?resize=150,150

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

68284555b7929bc8140442a4a4ed0b4180d085bbfb5d2171554def907421f8f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 88588
x-powered-by: Express
x-vc-enabled: true
x-cloud-trace-context: 895562e37cc65edf574ec61495b7b395
x-vc-ttl: 5256000
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 3294
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: W/"65e5-m6aybPlT1nNgXgVT+2HbDJ6g/qM"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains; preload
content-type: image/jpeg
vary: Accept-Encoding
cache-control: public, max-age=315360000
cf-polished: degrade=85, origSize=26085
accept-ranges: bytes
cf-ray: 7382ddca79405c68-FRA
expires: Fri, 06 Aug 2032 19:23:27 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 48ms
13ms Script
text/javascript 2a00:1450:4001:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-17041328-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Apr 2022 21:02:38 GMT
server: Golfe2
age: 1287
date: Tue, 09 Aug 2022 19:02:00 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Tue, 09 Aug 2022 21:02:00 GMT

GET
H2 204 b
sb.scorecardresearch.com/ 0
190 B 9ms
9ms Image
text/plain 13.32.99.21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/b?c1=2&c2=6034767&ajax_url=https%3A%2F%2Fwww.rd.com%2Fwp-admin%2Fadmin-ajax.php&cs_it=b2&cv=3.8.0.210223&ns__t=1660073007756&ns_c=UTF-8&c7=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&c8=How%20to%20Identify%20a%20Fake%20QR%20Code%E2%80%94and%20Avoid%20Being%20Scammed&c9=
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-21.fra60.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
via: 1.1 ab21b6436bc1d51d57b228ad39b1fa54.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P3
x-amz-cf-id: pbLBetd1J0OeRPT0oWlZmav5Mb7izBg5HH9QlyiSDJmPXzrq0TRKfA==
x-cache: Miss from cloudfront

GET
H2 200 c.js Show response
collector.brandmetrics.com/ 0
76 B 236ms
19ms Script
text/javascript 20.50.2.28
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://collector.brandmetrics.com/c.js?siteid=bb2eaa01-5010-43e2-98c9-38c3cb56a353&toploc=www.rd.com&rnd=1315138
Requested by: Host: cdn.brandmetrics.com
URL: https://cdn.brandmetrics.com/scripts/bundle/65568.js?sid=bb2eaa01-5010-43e2-98c9-38c3cb56a353&toploc=www.rd.com
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.50.2.28 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-length: 0
content-type: text/javascript;charset=utf-8

GET
H2 200 8cdea80cc4922c6071ce.js Show response
widget.beop.io/en/public/chunks/9.6.96/ 53 KB
15 KB 9ms
7ms Script
application/javascript 152.199.23.151
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://widget.beop.io/en/public/chunks/9.6.96/8cdea80cc4922c6071ce.js

Requested by

Host: widget.beop.io
URL: https://widget.beop.io/sdk.js?ver=1.0.0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.199.23.151 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frd/E2A7) /

Resource Hash

dbc32f33967798a78d4d23797bcac666b28f0c1c6ccafb52ab501b8f1f7f746c

Security Headers

Name	Value
Content-Security-Policy	frame-src ;script-src 'unsafe-inline' .pingdom.net www.youtube.com platform.twitter.com .instagram.com .beop.io .beopinion.com js.stripe.com service.mtcaptcha.com service2.mtcaptcha.com;font-src .beop.io .beopinion.com;frame-ancestors .beop.io *.beopinion.com

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

content-security-policy: frame-src *;script-src 'unsafe-inline' *.pingdom.net www.youtube.com platform.twitter.com *.instagram.com *.beop.io *.beopinion.com js.stripe.com service.mtcaptcha.com service2.mtcaptcha.com;font-src *.beop.io *.beopinion.com;frame-ancestors *.beop.io *.beopinion.com
content-encoding: gzip
etag: "d244-lQ8gtEKa9AporFfupyxjWmoH7Bs+gzip"
age: 715387
x-cache: HIT
content-length: 15033
x-ocdn-accept-language: de
last-modified: Mon, 01 Aug 2022 12:40:20 GMT
server: ECAcc (frd/E2A7)
date: Tue, 09 Aug 2022 19:23:27 GMT
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 09 Aug 2023 19:23:27 GMT

GET
H2 200 0bd906b837cebaeac8d1.js Show response
widget.beop.io/en/public/chunks/9.6.96/ 99 KB
27 KB 10ms
8ms Script
application/javascript 152.199.23.151
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://widget.beop.io/en/public/chunks/9.6.96/0bd906b837cebaeac8d1.js

Requested by

Host: widget.beop.io
URL: https://widget.beop.io/sdk.js?ver=1.0.0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.199.23.151 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frd/E2D7) /

Resource Hash

76d773cd2f21f406e1cbb6d8b1ca5251b82c35488f2f431c17571012b052009c

Security Headers

Name	Value
Content-Security-Policy	frame-src ;script-src 'unsafe-inline' .pingdom.net www.youtube.com platform.twitter.com .instagram.com .beop.io .beopinion.com js.stripe.com service.mtcaptcha.com service2.mtcaptcha.com;font-src .beop.io .beopinion.com;frame-ancestors .beop.io *.beopinion.com

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

content-security-policy: frame-src *;script-src 'unsafe-inline' *.pingdom.net www.youtube.com platform.twitter.com *.instagram.com *.beop.io *.beopinion.com js.stripe.com service.mtcaptcha.com service2.mtcaptcha.com;font-src *.beop.io *.beopinion.com;frame-ancestors *.beop.io *.beopinion.com
content-encoding: gzip
etag: "18ad5-SYqvNLRGVU94r8zI46QlPDfOQ3E+gzip"
age: 715387
x-cache: HIT
content-length: 27527
x-ocdn-accept-language: de
last-modified: Mon, 01 Aug 2022 12:40:20 GMT
server: ECAcc (frd/E2D7)
date: Tue, 09 Aug 2022 19:23:27 GMT
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 09 Aug 2023 19:23:27 GMT

POST
H3 200 / Show response
r.skimresources.com/api/ 270 B
202 B 37ms
22ms XHR
application/json 35.190.59.101
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r.skimresources.com/api/

Requested by

Host: s.skimresources.com
URL: https://s.skimresources.com/js/131817X1594237.skimlinks.js?ver=1.0.0

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.59.101 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

101.59.190.35.bc.googleusercontent.com

Software

openresty/1.11.2.5 /

Resource Hash

ec10b5df5cd1a0f9cbbe8a1743f6d768a9b4523513d356985ce8b3c9fd96d252

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: openresty/1.11.2.5
strict-transport-security: max-age=31536000
content-type: application/json
access-control-allow-origin: https://www.rd.com
vary: Accept-Encoding
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
via: 1.1 google

GET
H2 200 googima.js Show response
ssl.p.jwpcdn.com/player/v/8.25.8/ 75 KB
22 KB 50ms
6ms Script
application/javascript 2a04:4e42:200::626
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://ssl.p.jwpcdn.com/player/v/8.25.8/googima.js
Requested by: Host: cdn.jwplayer.com
URL: https://cdn.jwplayer.com/libraries/Qrhs7tJs.js?ver=1.0.0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::626 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 207794d67b4c418fb8c527238697f628074d9c9fcf5476ac96e8572781b50097

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: gzip
age: 11717
x-cache: HIT
content-length: 22390
via: 1.1 varnish
x-served-by: cache-fra19164-FRA
last-modified: Sat, 23 Jul 2022 00:14:27 GMT
server: AmazonS3
x-timer: S1660073008.826203,VS0,VE0
etag: "30fb542a548ed445a0de2b78b4dd9301"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400, immutable
accept-ranges: bytes
x-cache-hits: 6434

GET
H2 200 jwpsrv.js Show response
ssl.p.jwpcdn.com/player/v/8.25.8/ 62 KB
19 KB 28ms
8ms Script
application/javascript 2a04:4e42:200::626
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://ssl.p.jwpcdn.com/player/v/8.25.8/jwpsrv.js
Requested by: Host: cdn.jwplayer.com
URL: https://cdn.jwplayer.com/libraries/Qrhs7tJs.js?ver=1.0.0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::626 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8d8de3829d2383650a9308f175c7017fe6f3a60c3888d6d61e089f9b19141323

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: gzip
age: 233
x-cache: HIT
content-length: 18857
via: 1.1 varnish
x-served-by: cache-fra19164-FRA
last-modified: Mon, 01 Aug 2022 21:01:30 GMT
server: AmazonS3
x-timer: S1660073008.826395,VS0,VE0
etag: "662d21d9cc48caa9758882be57e10e92"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=900, immutable
accept-ranges: bytes
x-cache-hits: 384

GET
H2 200 jwplayer.core.controls.js Show response
ssl.p.jwpcdn.com/player/v/8.25.8/ 311 KB
81 KB 17ms
13ms Script
application/javascript 2a04:4e42:200::626
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://ssl.p.jwpcdn.com/player/v/8.25.8/jwplayer.core.controls.js
Requested by: Host: cdn.jwplayer.com
URL: https://cdn.jwplayer.com/libraries/Qrhs7tJs.js?ver=1.0.0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::626 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5efc6bad9022a5f98b4043a2e85a3233d84270d4f9cfb1cd65080a31b7640491

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: gzip
age: 1221302
x-cache: HIT
content-length: 83140
via: 1.1 varnish
x-served-by: cache-fra19164-FRA
last-modified: Sat, 23 Jul 2022 00:14:21 GMT
server: AmazonS3
x-timer: S1660073008.826415,VS0,VE0
etag: "62cc7b33d3f5907af77c4549ea792af8"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000, immutable
accept-ranges: bytes
x-cache-hits: 537002

GET
H2 200 RO5TLTlb Show response
cdn.jwplayer.com/v2/media/ 31 KB
6 KB 251ms
210ms XHR
application/json 2600:9000:206e:8600:1:a3fa:7cc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.jwplayer.com/v2/media/RO5TLTlb?page_domain=www.rd.com
Requested by: Host: cdn.jwplayer.com
URL: https://cdn.jwplayer.com/libraries/Qrhs7tJs.js?ver=1.0.0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206e:8600:1:a3fa:7cc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty /
Resource Hash: 0a0a852aa9b86a8b696dce2dd05d4d00a915b196b30aae0948af29fbcd3f54e6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: gzip
server: openresty
x-amz-cf-pop: VIE50-C1
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=180, max-stale=180
content-length: 5616
via: 1.1 7b574fc6db5d0840d90b97dd76cc56ec.cloudfront.net (CloudFront)
x-amz-cf-id: 61XPCcblu401FbbL0mNtnqoUt3dddKGDu7mgm3-VH4b0L5H-ALGeZg==
expires: Tue, 09 Aug 2022 19:26:27

GET
H2 200 latest.json Show response
cdn.jsdelivr.net/gh/prebid/currency-file@1/ 2 KB
1 KB 23ms
7ms XHR
application/json 2a04:4e42:400::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json?date=20220809

Requested by

Host: micro.rubiconproject.com
URL: https://micro.rubiconproject.com/prebid/dynamic/10696.js?ver=1.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:400::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

0b7fba521251654385f089e43a68263f57f89321da25dbd457e2595e8727e9d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 15753
x-jsd-version: 1.0.1426
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 930
etag: W/"667-l9ZtSTQ2X4oW5S0qDhy6+Xdvb/0"
x-served-by: cache-fra19160-FRA
x-jsd-version-type: version
date: Tue, 09 Aug 2022 19:23:27 GMT
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 aax.js Show response
c.aaxads.com/ 563 KB
144 KB 1177ms
1077ms Script
text/javascript 104.96.148.107
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://c.aaxads.com/aax.js?pub=AAX9HBI6S&hst=www.rd.com&ver=1.2

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.96.148.107 Vienna, Austria, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-96-148-107.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

58a96d162fc1324ff836fbc13751ab5a605802e98eace4e927e647bccf50cd63

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

strict-transport-security: max-age=604800
content-encoding: gzip
server: Apache
date: Tue, 09 Aug 2022 19:23:29 GMT
vary: Accept-Encoding
x-mnet-h: E
content-type: text/javascript; charset=utf-8
cache-control: max-age=1800
expires: Tue, 09 Aug 2022 19:53:29 GMT

GET
H2 200 ats.js Show response
ats.rlcdn.com/ 109 KB
38 KB 54ms
8ms Script
application/x-javascript 143.204.89.32
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ats.rlcdn.com/ats.js
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.89.32 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-89-32.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4b05d7f4339a505c65d2fcb1b21addd2a13a0c155ddf7ca766d1e7203b2b6cae

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-amz-version-id: qhkEQKrW4Gg_gxbK41emvSsDXWYdvDMl
content-encoding: gzip
etag: W/"148e21f812b555a13b2a9c6b616141f4"
age: 39514
x-amz-server-side-encryption: AES256
x-amz-meta-codebuild-buildarn: arn:aws:codebuild:eu-west-1:469675294282:build/ATSLibrary-prod:598424ed-c6de-48e8-8068-45662e39c3ce
x-cache: Hit from cloudfront
x-amz-meta-codebuild-content-md5: 58acf9e97c03c481f490be71338f7f57
last-modified: Tue, 17 May 2022 11:35:33 GMT
server: AmazonS3
date: Tue, 09 Aug 2022 08:24:54 GMT
vary: Accept-Encoding
x-amz-meta-codebuild-content-sha256: 57180e34d853b9e6be67670dae22a049fb237e6bca37c60f7ba138272a8487cc
via: 1.1 9128c49d19c76fd86ec4c647434ccb0a.cloudfront.net (CloudFront)
cache-control: must-revalidate,public,max-age=86400
x-amz-cf-pop: FRA50-C1
content-type: application/x-javascript
x-amz-cf-id: e8KYPNMqFGBeaSMcBejtvr4qL6UrezGd4vmomup0bRsOhkzkC_JBWA==

GET
H/1.1 200
OK config.js Show response
confiant-integrations.global.ssl.fastly.net/UHUmarOEMVcVXtck5m2mdlDjZQo/gpt_and_prebid/ 138 KB
33 KB 44ms
11ms Script
text/javascript 151.101.129.194
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://confiant-integrations.global.ssl.fastly.net/UHUmarOEMVcVXtck5m2mdlDjZQo/gpt_and_prebid/config.js
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.129.194 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9d3b9fae5871a5e5fffef79fb26b16e5e0789ac2dfa94c96f08cf2461e1360e5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Tue, 09 Aug 2022 19:23:27 GMT
Content-Encoding: gzip
Age: 2770
X-Cache: HIT
Connection: keep-alive
Content-Length: 32963
x-amz-id-2: 3rYLH1/MJRGLWNHnT3OjNrhlBRW5jli3el2rsyO3oBFZf63muF5jTWcMN/vwhq+QlAuTQJmzRYI=
X-Served-By: cache-fra19148-FRA
Last-Modified: Tue, 09 Aug 2022 18:14:59 GMT
Server: AmazonS3
X-Timer: S1660073008.921181,VS0,VE0
ETag: "39c656d50a0be874b2deaac33940765c"
x-amz-request-id: 17BXSKR0Q8MSE6F7
Via: 1.1 varnish
Accept-Ranges: bytes
Content-Type: text/javascript
X-Cache-Hits: 4

POST
H3 200 link Show response
t.skimresources.com/api/v2/ 22 B
44 B 37ms
23ms XHR
application/javascript 35.201.67.47
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://t.skimresources.com/api/v2/link

Requested by

Host: s.skimresources.com
URL: https://s.skimresources.com/js/131817X1594237.skimlinks.js?ver=1.0.0

Protocol

Security

QUIC, , AES_128_GCM

Server

35.201.67.47 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

47.67.201.35.bc.googleusercontent.com

Software

Python/3.7 aiohttp/3.5.4 /

Resource Hash

fcc83a5b6aef86420c1ad553167106df96bd0ff4192ffe52b1647599948edbcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-type: text/plain

Response headers

pragma: no-cache
date: Tue, 09 Aug 2022 19:23:27 GMT
via: 1.1 google
x-content-type-options: nosniff
server: Python/3.7 aiohttp/3.5.4
access-control-allow-headers: Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/plain; charset=utf-8, application/javascript
access-control-allow-origin: https://www.rd.com
cache-control: no-store, no-cache, must-revalidate
access-control-allow-credentials: true
warning: 299 - "Deprecated API"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 22

GET
DATA 200
OK truncated
/ 44 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bd25bde9fc4427cd6f3babcb8f888fe6174ca48881c103e243d4c6f83f30aab6

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type: image/webp

POST
H2 200 serve Show response
s.beop.io/ 11 KB
3 KB 148ms
85ms XHR
application/json 18.203.105.247
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.beop.io/serve?nuid=5d713d4d-69e8-4a0d-b851-27b7cd0e8c62&sdk_version=9.6.96
Requested by: Host: widget.beop.io
URL: https://widget.beop.io/en/public/chunks/9.6.96/8cdea80cc4922c6071ce.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.203.105.247 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-203-105-247.eu-west-1.compute.amazonaws.com
Software: nginx/1.20.0 /
Resource Hash: 59d4737a7d9349d2129c8df151acbb986ca2c3f77706af37a40545ab1f9c93fd

Request headers

Accept: application/json
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: https://www.rd.com
date: Tue, 09 Aug 2022 19:23:28 GMT
content-encoding: gzip
access-control-allow-credentials: true
server: nginx/1.20.0
access-control-allow-method: POST
content-type: application/json

OPTIONS
H2 200 serve
s.beop.io/ Frame 0
0 115ms
32ms Preflight
application/json 18.203.105.247
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.beop.io/serve?nuid=5d713d4d-69e8-4a0d-b851-27b7cd0e8c62&sdk_version=9.6.96
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.203.105.247 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-203-105-247.eu-west-1.compute.amazonaws.com
Software: nginx/1.20.0 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.rd.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type
access-control-allow-method: POST
access-control-allow-origin: https://www.rd.com
content-length: 0
content-type: application/json
date: Tue, 09 Aug 2022 19:23:28 GMT
server: nginx/1.20.0

GET
H2 200 sync-container.js Show response
b-code.liadm.com/ 6 KB
6 KB 19ms
19ms Script
application/javascript 2600:9000:2304:e400:8:8845:1500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://b-code.liadm.com/sync-container.js
Requested by: Host: b-code.liadm.com
URL: https://b-code.liadm.com/a-00x0.min.js?ver=1.0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2304:e400:8:8845:1500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 58a07739b05fec4d319e4d5c6b1fa4ac79e2a625e08ab3f303929b77fde5bdf4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-amz-version-id: WIo1DFPCLgnYZuB8yv1dFIDWe1bYBj2G
via: 1.1 af4c7c5690ef99c2d2945817a4e41504.cloudfront.net (CloudFront)
etag: "ae5e94de938b0387eda6df8f20da811a"
age: 971850
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 5904
last-modified: Tue, 10 May 2022 11:48:07 GMT
server: AmazonS3
date: Fri, 29 Jul 2022 13:26:01 GMT
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=2592000
x-amz-cf-pop: VIE50-P1
accept-ranges: bytes
x-amz-cf-id: pICsjG2crN0IRFdNAx295AUU9Ex3MeeBfTW3VLdkBZTm_Jvr4NNPcQ==

GET
H2 200 /
www.facebook.com/tr/ 44 B
297 B 41ms
8ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1468910830064549&ev=PageView&dl=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&rl=&if=false&ts=1660073007927&sw=1600&sh=1200&v=2.9.73&r=stable&ec=0&o=30&fbp=fb.1.1660073007925.1334434933&it=1660073007732&coo=false&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 44
expires: Tue, 09 Aug 2022 19:23:27 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
101 B 41ms
8ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1468910830064549&ev=ViewContent&dl=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&rl=&if=false&ts=1660073007929&sw=1600&sh=1200&v=2.9.73&r=stable&ec=1&o=30&fbp=fb.1.1660073007925.1334434933&it=1660073007732&coo=false&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 44
expires: Tue, 09 Aug 2022 19:23:27 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 56ms
26ms XHR
text/plain 2a00:1450:4001:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=275016625&t=pageview&_s=1&dl=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&ul=en-us&de=UTF-8&dt=How%20to%20Identify%20a%20Fake%20QR%20Code%E2%80%94and%20Avoid%20Being%20Scammed&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=4GBAAUABAAAAAC~&jid=1508486796&gjid=2099254888&cid=1301817763.1660073008&tid=UA-17041328-1&_gid=92080498.1660073008&_r=1&gtm=2ou880&cd4=https%3A%2F%2Fwww.rd.com&cd9=300&cd10=video%20article&cd11=1720480&cd12=How%20to%20Spot%20a%20Fake%20QR%20Code%20and%20Avoid%20Getting%20Scammed&cd13=Jaime%20Stathis&cd14=Personal%20Tech%2C%20Tech&cd15=2022-04-14&cd16=394948%2C%20973&cd24=rdu%3Avideo%20article%3AHow%20to%20Spot%20a%20Fake%20QR%20Code%20and%20Avoid%20Getting%20Scammed&cd29=47e0408c-fb17-40cc-a076-3e78b4eceb13&cd33=rd.com%2C%20Getty%20Images&cd34=not%20available&cd38=2022-08-03&cd39=0&cd43=rdu%3Avideo%20article%3AHow%20to%20Spot%20a%20Fake%20QR%20Code%20and%20Avoid%20Getting%20Scammed&cd44=personal-technology%2C%20technology&cd45=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&cd46=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F&cd57=technology&cd58=personal-technology&cd61=rd-com&cd63=&cd67=&cd71=TMBI%20Content%20Contractor&cd75=1301817763.1660073008&z=490428263

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 09 Aug 2022 19:23:27 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.rd.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 collect
www.google-analytics.com/ 35 B
55 B 54ms
27ms Ping
image/gif 2a00:1450:4001:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/collect

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 09 Aug 2022 19:23:27 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: https://www.rd.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 api Show response
ls.skimresources.com/ 2 B
22 B 36ms
21ms XHR
application/json 34.120.117.212
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ls.skimresources.com/api

Requested by

Host: s.skimresources.com
URL: https://s.skimresources.com/js/131817X1594237.skimlinks.js?ver=1.0.0

Protocol

Security

QUIC, , AES_128_GCM

Server

34.120.117.212 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

212.117.120.34.bc.googleusercontent.com

Software

Python/3.8 aiohttp/3.6.3 /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-type: application/json

Response headers

pragma: no-cache
date: Tue, 09 Aug 2022 19:23:28 GMT
via: 1.1 google
x-content-type-options: nosniff
server: Python/3.8 aiohttp/3.6.3
access-control-allow-headers: Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.rd.com
cache-control: no-store, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2

OPTIONS
H2 206 api
ls.skimresources.com/ Frame 0
0 86ms
19ms Preflight
text/plain 34.120.117.212
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ls.skimresources.com/api
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.117.212 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 212.117.120.34.bc.googleusercontent.com
Software: Python/3.8 aiohttp/3.6.3 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.rd.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://www.rd.com
access-control-max-age: 1728000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/plain charset=UTF-8
date: Tue, 09 Aug 2022 19:23:28 GMT
server: Python/3.8 aiohttp/3.6.3
via: 1.1 google

POST
H3 200 / Show response
r.skimresources.com/api/ 177 B
164 B 21ms
20ms XHR
application/json 35.190.59.101
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r.skimresources.com/api/

Requested by

Host: s.skimresources.com
URL: https://s.skimresources.com/js/131817X1594237.skimlinks.js?ver=1.0.0

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.59.101 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

101.59.190.35.bc.googleusercontent.com

Software

openresty/1.11.2.5 /

Resource Hash

715bc6bf84352aa0f104c41c531e14948fd1d4fe2eafbd85d3c59862ce8b3d86

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Tue, 09 Aug 2022 19:23:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: openresty/1.11.2.5
strict-transport-security: max-age=31536000
content-type: application/json
access-control-allow-origin: https://www.rd.com
vary: Accept-Encoding
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
via: 1.1 google

POST
H2 204 i
t.beop.io/ 0
136 B 164ms
31ms Ping
text/plain 52.213.82.126
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://t.beop.io/i?_ck=647f42724d976603e56a327f6d1bb4dc
Requested by: Host: widget.beop.io
URL: https://widget.beop.io/en/public/chunks/9.6.96/0bd906b837cebaeac8d1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.213.82.126 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-213-82-126.eu-west-1.compute.amazonaws.com
Software: http-kit /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://www.rd.com
date: Tue, 09 Aug 2022 19:23:28 GMT
access-control-allow-credentials: true
server: http-kit
access-control-expose-headers

POST
H2 204 i
t.beop.io/ 0
135 B 165ms
32ms Ping
text/plain 52.213.82.126
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://t.beop.io/i?_ck=03da477f62f4024ddf101727f9fad1de
Requested by: Host: widget.beop.io
URL: https://widget.beop.io/en/public/chunks/9.6.96/0bd906b837cebaeac8d1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.213.82.126 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-213-82-126.eu-west-1.compute.amazonaws.com
Software: http-kit /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://www.rd.com
date: Tue, 09 Aug 2022 19:23:28 GMT
access-control-allow-credentials: true
server: http-kit
access-control-expose-headers

GET
H2 200 UV3t3od4EeeD_gY3v_uBow.json Show response
entitlements.jwplayer.com/ 69 B
246 B 85ms
9ms XHR
application/json 152.199.22.243
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://entitlements.jwplayer.com/UV3t3od4EeeD_gY3v_uBow.json
Requested by: Host: cdn.jwplayer.com
URL: https://cdn.jwplayer.com/libraries/Qrhs7tJs.js?ver=1.0.0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.22.243 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frd/E2E8) /
Resource Hash: 5427e10c23520fbca480e8750c7e03dc2858eee594081879ea72a559bbd9fa81

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:28 GMT
content-encoding: gzip
last-modified: Tue, 09 Aug 2022 15:23:17 GMT
server: ECAcc (frd/E2E8)
age: 14411
vary: Accept-Encoding
x-cache: HIT
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=1800, s-maxage=15780
accept-ranges: bytes
content-length: 75

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ 375 KB
125 KB 64ms
23ms Script
text/javascript 2a00:1450:400e:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: cdn.jwplayer.com
URL: https://cdn.jwplayer.com/libraries/Qrhs7tJs.js?ver=1.0.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400e:80e::200a , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a64e083bdb3ff06c71a5ac92ecadf7a268e26dacf715baae6e84a6a3f3711366

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 127744
x-xss-protection: 0
expires: Tue, 09 Aug 2022 19:23:28 GMT

GET
H2 200 main_1bebab78e6b9a9bb3795d89a597c7a5f.br.js Show response
assets.bounceexchange.com/assets/smart-tag/versioned/ 332 KB
67 KB 64ms
15ms Script
text/javascript 34.98.72.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/main_1bebab78e6b9a9bb3795d89a597c7a5f.br.js
Requested by: Host: tag.bounceexchange.com
URL: https://tag.bounceexchange.com/948/i.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 9698d26296a1c7cc9eab2513fff3029368cfe795fc9ce1e198465a26b2bfcd76

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 04 Aug 2022 17:25:25 GMT
content-encoding: br
age: 439083
x-guploader-uploadid: ADPycdvlHPqrVbGFvQobzBAX_aemj6Js20H33tgDYAFvhOQRwORxt9VAgTbveXl6RSfwo3U_k2s-F4pOvDgqdYMWJfoE9ZGekBfX
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 67589
last-modified: Thu, 04 Aug 2022 17:25:13 GMT
server: UploadServer
etag: "3d6da52a97db411d7c868eda1d37751c"
x-goog-hash: crc32c=wK4n2w==, md5=PW2lKpfbQR18ho7aHTd1HA==
x-goog-generation: 1659633913560036
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000
x-goog-stored-content-length: 67589
accept-ranges: bytes
content-type: text/javascript
expires: Fri, 04 Aug 2023 17:25:25 GMT

GET
H/1.1 200
OK wrap.js Show response
confiant-integrations.global.ssl.fastly.net/gptprebidnative/202207121816/ 203 KB
65 KB 7ms
7ms Script
application/javascript 151.101.129.194
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202207121816/wrap.js
Requested by: Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/UHUmarOEMVcVXtck5m2mdlDjZQo/gpt_and_prebid/config.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.129.194 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 17dbb476b9e2ac4cd30bc27ff21cd2d44a4d2d188dcc9dfcc7b151e20d9c89bc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Tue, 09 Aug 2022 19:23:28 GMT
Content-Encoding: gzip
Age: 220
X-Cache: HIT
Connection: keep-alive
Content-Length: 66321
x-amz-id-2: tcMXavbRs8gbAT7kkTF/Qo9q2VElyc/imauoAcWysca1nCafRXzeTMo1xWWqrtOm/OY8SQpFc2s=
X-Served-By: cache-fra19148-FRA
Last-Modified: Tue, 12 Jul 2022 22:19:25 GMT
Server: AmazonS3
X-Timer: S1660073008.014152,VS0,VE0
ETag: "9fea69ac9affa12918d8b71094edcf4f"
x-amz-request-id: 8B712T2PMK0DQSBK
Via: 1.1 varnish
Cache-Control: public, max-age=900, stale-while-revalidate=3600
Accept-Ranges: bytes
Content-Type: application/javascript; charset=utf-8
X-Cache-Hits: 1359

GET
H2 200 / Show response
geo.privacymanager.io/ 30 B
596 B 46ms
7ms Fetch
application/json 13.32.99.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.privacymanager.io/
Requested by: Host: ats.rlcdn.com
URL: https://ats.rlcdn.com/ats.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.122 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-122.fra60.r.cloudfront.net
Software: /
Resource Hash: a57258a3f51dc6ee13ca490ab8e780ed443e5725a650e7f085f1c67325784461

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 01:05:04 GMT
via: 1.1 69cc5dd318e02cb1a7e8cb9951f553d8.cloudfront.net (CloudFront), 1.1 4612dc3b414cf2057f542e94733d59bc.cloudfront.net (CloudFront)
age: 65904
x-amzn-requestid: 8d2f9286-b699-407f-afa7-eeb91326d1df
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
content-type: application/json
access-control-allow-origin: *
x-amzn-trace-id: Root=1-62f1b2c0-7e3f68d7257fc6e02db9e00f;Sampled=0
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA56-P3, FRA60-P3
x-amz-apigw-id: WkjeDGHnDoEFZrA=
content-length: 30
x-amz-cf-id: iGT8td3lLITLTZYaZguvxcVMzhBG1DWOwfAvpCw4ThuSolIyouQK1w==
access-control-allow-headers: Content-Type,Authorization,X-Amz-Date,X-Api-Key,X-Amz-Security-Token

POST
H3 200 page Show response
t.skimresources.com/api/v2/ 22 B
43 B 32ms
31ms XHR
application/javascript 35.201.67.47
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://t.skimresources.com/api/v2/page

Requested by

Host: s.skimresources.com
URL: https://s.skimresources.com/js/131817X1594237.skimlinks.js?ver=1.0.0

Protocol

Security

QUIC, , AES_128_GCM

Server

35.201.67.47 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

47.67.201.35.bc.googleusercontent.com

Software

Python/3.7 aiohttp/3.5.4 /

Resource Hash

fcc83a5b6aef86420c1ad553167106df96bd0ff4192ffe52b1647599948edbcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-type: text/plain

Response headers

pragma: no-cache
date: Tue, 09 Aug 2022 19:23:28 GMT
via: 1.1 google
x-content-type-options: nosniff
server: Python/3.7 aiohttp/3.5.4
access-control-allow-headers: Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/plain; charset=utf-8, application/javascript
access-control-allow-origin: https://www.rd.com
cache-control: no-store, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 22

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
439 B 56ms
18ms XHR
text/plain 2a00:1450:400c:c09::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-17041328-1&cid=1301817763.1660073008&jid=1508486796&gjid=2099254888&_gid=92080498.1660073008&_u=4GBAAUAAAAAAAC~&z=75927105

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c09::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Tue, 09 Aug 2022 19:23:28 GMT
content-type: text/plain
access-control-allow-origin: https://www.rd.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pushly-sdk.min.css
cdn.p-n.io/ 27 KB
2 KB 19ms
18ms Stylesheet
text/css 99.86.240.124
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.p-n.io/pushly-sdk.min.css?domain_key=UQBO2QHQjsCWyyYZTALbCo47hmWzrEGU5rSy
Requested by: Host: cdn.p-n.io
URL: https://cdn.p-n.io/pushly-sdk.min.js?domain_key=UQBO2QHQjsCWyyYZTALbCo47hmWzrEGU5rSy
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.240.124 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-240-124.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d7471e3df1ba49ecc8acc2dc6d8c4c3619f1a8e094050bdb2432c1cb2548468d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Mon, 08 Aug 2022 20:31:53 GMT
content-encoding: gzip
last-modified: Tue, 28 Jun 2022 18:34:08 GMT
server: AmazonS3
age: 82296
etag: W/"f3cd76bbdf477b890d940ce319bd1d16"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
via: 1.1 2b5d1dff3c8eb4e504487382e1188d98.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-amz-cf-pop: VIE50-C1
x-amz-cf-id: gsvJzmk6LO9EVaaDEBO1b8KaIKfuxCMKHpvWJ80HuhZC9GvP-L81iQ==

GET
H2 200 provider.hlsjs.js Show response
ssl.p.jwpcdn.com/player/v/8.25.8/ 364 KB
106 KB 8ms
7ms Script
application/javascript 2a04:4e42:200::626
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://ssl.p.jwpcdn.com/player/v/8.25.8/provider.hlsjs.js
Requested by: Host: cdn.jwplayer.com
URL: https://cdn.jwplayer.com/libraries/Qrhs7tJs.js?ver=1.0.0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::626 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ea6a175eb6226f00c8b2c59c12fb502205c532256dda71b9c903a36124c736a1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:28 GMT
content-encoding: gzip
age: 1221268
x-cache: HIT
content-length: 108381
via: 1.1 varnish
x-served-by: cache-fra19164-FRA
last-modified: Sat, 23 Jul 2022 00:14:24 GMT
server: AmazonS3
x-timer: S1660073008.052328,VS0,VE0
etag: "2604af1871aa56882b5019b680cf55da"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000, immutable
accept-ranges: bytes
x-cache-hits: 338201

GET
H2

200

j Show response
rp4.liadm.com/
Redirect Chain

https://rp.liadm.com/j?dtstmp=1660073008049&aid=a-00x0&se=e30&duid=0ee7014c2aeb--01ga20zpschj125jhf3w3yrftz&tna=v2.4.0&pu=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26...
https://rp4.liadm.com/j?dtstmp=1660073008049&aid=a-00x0&se=e30&duid=0ee7014c2aeb--01ga20zpschj125jhf3w3yrftz&tna=v2.4.0&pu=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%2...

39 B
578 B

363ms
95ms

XHR
application/json

34.230.119.25
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://rp4.liadm.com/j?dtstmp=1660073008049&aid=a-00x0&se=e30&duid=0ee7014c2aeb--01ga20zpschj125jhf3w3yrftz&tna=v2.4.0&pu=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&wpn=lc-bundle&c=PHRpdGxlPkhvdyB0byBJZGVudGlmeSBhIEZha2UgUVIgQ29kZeKAlGFuZCBBdm9pZCBCZWluZyBTY2FtbWVkPC90aXRsZT48bWV0YSBuYW1lPSJkZXNjcmlwdGlvbiIgY29udGVudD0iSGVyZSdzIHdoYXQgZXhwZXJ0cyBzYXkgeW91IG5lZWQgdG8ga25vdyBpbiBvcmRlciB0byBhdm9pZCBhIGZha2UgUVIgY29kZSwgd2hpY2ggY3JpbWluYWxzIHVzZSB0byBzY2FtIHVuc3VzcGVjdGluZyBwZW9wbGUuIj48bGluayByZWw9ImNhbm9uaWNhbCIgaHJlZj0iaHR0cHM6Ly93d3cucmQuY29tL2FydGljbGUvZmFrZS1xci1jb2RlLyI-PGgxIGNsYXNzPSJwb3N0LXRpdGxlIj4KCQlIb3cgdG8gU3BvdCBhIEZha2UgUVIgQ29kZSBhbmQgQXZvaWQgR2V0dGluZyBTY2FtbWVkCTwvaDE-&i6=MmEwMDpjOTg6MjA1MDphMDA3OjI6Ojk%3D&n3pc=true

Requested by

Protocol

Server

34.230.119.25 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-230-119-25.compute-1.amazonaws.com

Software

Resource Hash

712ee4eb9657dcd072d7bbefefc6235ccf81828807c093390810a3d2af85586c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:28 GMT
x-pixel-event-id: 81c41abc-5b10-46ef-b46e-f2410dc31489
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
x-permitted-cross-domain-policies: master-only
x-frame-options: DENY
content-type: application/json
access-control-allow-origin: null
x-xss-protection: 1; mode=block
vary: Origin
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
trace-id: b4a2eb1b54478337
request-time: 0
content-length: 39
x-content-type-options: nosniff

Redirect headers

date: Tue, 09 Aug 2022 19:23:28 GMT
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
x-permitted-cross-domain-policies: master-only
location: https://rp4.liadm.com/j?dtstmp=1660073008049&aid=a-00x0&se=e30&duid=0ee7014c2aeb--01ga20zpschj125jhf3w3yrftz&tna=v2.4.0&pu=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&wpn=lc-bundle&c=PHRpdGxlPkhvdyB0byBJZGVudGlmeSBhIEZha2UgUVIgQ29kZeKAlGFuZCBBdm9pZCBCZWluZyBTY2FtbWVkPC90aXRsZT48bWV0YSBuYW1lPSJkZXNjcmlwdGlvbiIgY29udGVudD0iSGVyZSdzIHdoYXQgZXhwZXJ0cyBzYXkgeW91IG5lZWQgdG8ga25vdyBpbiBvcmRlciB0byBhdm9pZCBhIGZha2UgUVIgY29kZSwgd2hpY2ggY3JpbWluYWxzIHVzZSB0byBzY2FtIHVuc3VzcGVjdGluZyBwZW9wbGUuIj48bGluayByZWw9ImNhbm9uaWNhbCIgaHJlZj0iaHR0cHM6Ly93d3cucmQuY29tL2FydGljbGUvZmFrZS1xci1jb2RlLyI-PGgxIGNsYXNzPSJwb3N0LXRpdGxlIj4KCQlIb3cgdG8gU3BvdCBhIEZha2UgUVIgQ29kZSBhbmQgQXZvaWQgR2V0dGluZyBTY2FtbWVkCTwvaDE-&i6=MmEwMDpjOTg6MjA1MDphMDA3OjI6Ojk%3D&n3pc=true
x-frame-options: DENY
access-control-allow-origin: https://www.rd.com
x-xss-protection: 1; mode=block
vary: Origin
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
trace-id: cf01d25cdc90ab0d
request-time: 0
content-length: 0
x-content-type-options: nosniff

GET
H3 200 inbox_1cde94b71b040afa0e77bb964b3c16e3.br.js Show response
assets.bounceexchange.com/assets/smart-tag/versioned/ 71 KB
18 KB 52ms
24ms Script
text/javascript 34.98.72.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/inbox_1cde94b71b040afa0e77bb964b3c16e3.br.js
Requested by: Host: assets.bounceexchange.com
URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/main_1bebab78e6b9a9bb3795d89a597c7a5f.br.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 532cf7167d55ffff4ca4ee0d3913030f03ff89a34cda42c42b0b659ba446f932

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Sat, 30 Jul 2022 21:01:34 GMT
content-encoding: br
age: 858114
x-guploader-uploadid: ADPycdsLeh0QXv3YiM5zOAdA20QoTpx2PJl2wPevle0ZueOlAWW1CmguJsFTEFmzokMWjWgmHkIBBZ-bQ6KlO3nEw1WpYRfUtpl3
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18676
last-modified: Mon, 25 Jul 2022 15:26:24 GMT
server: UploadServer
etag: "88ccb13f6e684660e6546c08352c4cfa"
x-goog-hash: crc32c=TP4lGg==, md5=iMyxP25oRmDmVGwINSxM+g==
x-goog-generation: 1656622875439352
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000
x-goog-stored-content-length: 18676
accept-ranges: bytes
content-type: text/javascript
expires: Sun, 30 Jul 2023 21:01:34 GMT

GET
H3 200 onsite_0a4fa9159c2f775c6d4776e7817ff207.br.js Show response
assets.bounceexchange.com/assets/smart-tag/versioned/ 155 KB
33 KB 42ms
15ms Script
text/javascript 34.98.72.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/onsite_0a4fa9159c2f775c6d4776e7817ff207.br.js
Requested by: Host: assets.bounceexchange.com
URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/main_1bebab78e6b9a9bb3795d89a597c7a5f.br.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 26f15316e56b49f0b180996e246eb7b435ad0fc4aad547ed39bc5253764d89ee

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Wed, 03 Aug 2022 15:09:42 GMT
content-encoding: br
age: 533626
x-guploader-uploadid: ADPycdsRsUukNUzDvEkrA5Gz1Rlo4BXjOzQR2o_hSjvxIEAGdRV-mDFgH2k95cTsm8ubrlU7uook3wHVSaD0j2pynpYABQ
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33929
last-modified: Wed, 03 Aug 2022 15:09:34 GMT
server: UploadServer
etag: "28caec96c87cd95fca24276a0b977104"
x-goog-hash: crc32c=1cBgKQ==, md5=KMrslsh82V/KJCdqC5dxBA==
x-goog-generation: 1659539374851681
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000
x-goog-stored-content-length: 33929
accept-ranges: bytes
content-type: text/javascript
expires: Thu, 03 Aug 2023 15:09:42 GMT

GET
H3 200 ads_c29aaebca86db2c6c0c4eb6d4eec86a5.br.js Show response
assets.bounceexchange.com/assets/smart-tag/versioned/ 347 KB
65 KB 47ms
20ms Script
text/javascript 34.98.72.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/ads_c29aaebca86db2c6c0c4eb6d4eec86a5.br.js
Requested by: Host: assets.bounceexchange.com
URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/main_1bebab78e6b9a9bb3795d89a597c7a5f.br.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 8afbf08f34f262446fdb891795c984924d56e106d8ae491bd6644aefcaa39375

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 04 Aug 2022 17:25:11 GMT
content-encoding: br
age: 439097
x-guploader-uploadid: ADPycduFM-Y2D_d7rhWfM6j5-KCPh1metZdRDoiOUQ3J2ooopOQgrSpmETlkTu_ZWt9pYee-_ws19DUuTVpgVKxaydEw8Sk1tlUI
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: br
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66866
last-modified: Thu, 04 Aug 2022 17:25:04 GMT
server: UploadServer
etag: "66c698adddc2e568dd9d846d1267bbd5"
x-goog-hash: crc32c=QDEU5w==, md5=ZsaYrd3C5WjdnYRtEme71Q==
x-goog-generation: 1659633903984865
access-control-allow-origin: *
access-control-expose-headers: etag, Content-Type
cache-control: public,max-age=31536000
x-goog-stored-content-length: 66866
accept-ranges: bytes
content-type: text/javascript
expires: Fri, 04 Aug 2023 17:25:11 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
501 B 71ms
37ms Image
image/gif 2a00:1450:4001:80b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-17041328-1&cid=1301817763.1660073008&jid=1508486796&_u=4GBAAUAAAAAAAC~&z=1006557316

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 09 Aug 2022 19:23:28 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
501 B 91ms
38ms Image
image/gif 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-17041328-1&cid=1301817763.1660073008&jid=1508486796&_u=4GBAAUAAAAAAAC~&z=1006557316

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 09 Aug 2022 19:23:28 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 main.c99cd143.js Show response
s.pinimg.com/ct/lib/ 52 KB
18 KB 155ms
154ms Script
application/javascript 2a02:26f0:dc:181::1931
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s.pinimg.com/ct/lib/main.c99cd143.js
Requested by: Host: s.pinimg.com
URL: https://s.pinimg.com/ct/core.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:dc:181::1931 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: d6bc239a6993be3a5ed13249ff2d27e4e3bc80a30bbd6df2ff92b4db0ad1d996

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

akamai-x-true-ttl: 1209600
content-encoding: gzip
x-cdn: akamai
etag: "a05548af4f747ef476e354fcd30947ce"
vary: Accept-Encoding, Origin
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 18448
access-control-expose-headers: X-CDN

GET
H2 200 video_info Show response
context.iris.tv/ 208 B
550 B 40ms
9ms XHR
application/json 13.32.121.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://context.iris.tv/video_info?access_token=5d38e9c84530419979500ccbc4b220c0a81b74d8072b864294e4b0885774c608&client_token=MWEAN9DYLVRSBGA&platform_id=RO5TLTlb
Requested by: Host: www.rd.com
URL: https://www.rd.com/wp-includes/js/jquery/jquery.js?ver=1.0.0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.60 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-60.fra60.r.cloudfront.net
Software: Zer01ne /
Resource Hash: 6980c1b5df92b2b97f679ff77a41a041d04ab563c1ff81b9acea0e8785fb8fb5

Request headers

Accept: */*
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 18:23:52 GMT
via: 1.1 490f651effcacfa7d80143d3047d794e.cloudfront.net (CloudFront)
server: Zer01ne
age: 3576
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=3600, stale-while-revalidate=600, stale-if-error=600
x-amz-cf-pop: FRA60-P1
x-robots-tag: noindex, follow
x-amz-cf-id: oyirJAY4G-dMdIl0qhbiMH5bQWAkLT6P-lJs0b03XB-0SfT2zrmPjQ==

GET
H/1.1 200 tracker.gif
tracking.skyword.com/ 43 B
508 B 109ms
109ms Image
image/gif 54.226.61.34
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tracking.skyword.com/tracker.gif?_url=https%3A//www.rd.com/article/fake-qr-code/%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&_anonymize=no&_doNotTrack=no&_referer=&_cacheBust=1660073008109145b9&_contentId=281474980168929
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.226.61.34 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-226-61-34.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Tue, 09 Aug 2022 19:23:27 GMT
Connection: keep-alive
P3P: policyref="http://.skyword.com/w3c/p3p.xml", CP="PSAa PSDa ADMa DEVa OUR IND DSP NOI COR UNI NAV CURa COM INT"
Content-Length: 43
Content-Type: image/gif

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 64 B
532 B 49ms
48ms XHR
text/javascript 108.138.4.10
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.amazon-adsystem.com/e/dtb/bid?src=3235&u=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&pid=C3B2yxSmyB2Nx&cb=0&ws=1600x1200&v=8.1.0&t=1000&slots=%5B%7B%22id%22%3A%22video%22%2C%22mt%22%3A%22v%22%7D%5D&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.138.4.10 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-4-10.fra56.r.cloudfront.net

Software

Server /

Resource Hash

d278491b1de51ad826d16be5ab27b1746999c02d45200f107218427e34eed798

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:28 GMT
via: 1.1 bfb5bffe90e3b0e760933a7a07d850ba.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P6
x-amz-rid: Z3HZPDCKN31XB59EPRYD
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://www.rd.com
access-control-allow-credentials: true
permissions-policy: interest-cohort=()
strict-transport-security: max-age=47474747; includeSubDomains; preload
timing-allow-origin: *
content-length: 64
x-amz-cf-id: SIwx_hM3LkeAHXhS2hWXBSadhEAXvjc70pAkYZWrbFxuVnHe0ow5Nw==

GET
H2 200 59703b7e14197aeb1fe9.js Show response
widget.beop.io/en/public/chunks/9.6.96/ 6 KB
2 KB 10ms
10ms Script
application/javascript 152.199.23.151
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://widget.beop.io/en/public/chunks/9.6.96/59703b7e14197aeb1fe9.js

Requested by

Host: widget.beop.io
URL: https://widget.beop.io/sdk.js?ver=1.0.0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.199.23.151 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frd/E2D8) /

Resource Hash

12f8e16de96fcaba1aaf32802ef8583cee0ebbd534d4c9216cdd09964381b5f8

Security Headers

Name	Value
Content-Security-Policy	frame-src ;script-src 'unsafe-inline' .pingdom.net www.youtube.com platform.twitter.com .instagram.com .beop.io .beopinion.com js.stripe.com service.mtcaptcha.com service2.mtcaptcha.com;font-src .beop.io .beopinion.com;frame-ancestors .beop.io *.beopinion.com

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

content-security-policy: frame-src *;script-src 'unsafe-inline' *.pingdom.net www.youtube.com platform.twitter.com *.instagram.com *.beop.io *.beopinion.com js.stripe.com service.mtcaptcha.com service2.mtcaptcha.com;font-src *.beop.io *.beopinion.com;frame-ancestors *.beop.io *.beopinion.com
content-encoding: gzip
etag: "16dc-wD3215XuyBjWPHpNO96THirjDh0+gzip"
age: 715294
x-cache: HIT
content-length: 2425
x-ocdn-accept-language: de
last-modified: Mon, 01 Aug 2022 12:41:54 GMT
server: ECAcc (frd/E2D8)
date: Tue, 09 Aug 2022 19:23:28 GMT
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 09 Aug 2023 19:23:28 GMT

GET
H2 200 5e68e7ad13123c6f1486.js Show response
widget.beop.io/en/public/chunks/9.6.96/ 58 KB
15 KB 8ms
8ms Script
application/javascript 152.199.23.151
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://widget.beop.io/en/public/chunks/9.6.96/5e68e7ad13123c6f1486.js

Requested by

Host: widget.beop.io
URL: https://widget.beop.io/sdk.js?ver=1.0.0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.199.23.151 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frd/E2D1) /

Resource Hash

d838708f9080299078c167af8e85a8cba9b28e00c13491d28f332dda28881fca

Security Headers

Name	Value
Content-Security-Policy	frame-src ;script-src 'unsafe-inline' .pingdom.net www.youtube.com platform.twitter.com .instagram.com .beop.io .beopinion.com js.stripe.com service.mtcaptcha.com service2.mtcaptcha.com;font-src .beop.io .beopinion.com;frame-ancestors .beop.io *.beopinion.com

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

content-security-policy: frame-src *;script-src 'unsafe-inline' *.pingdom.net www.youtube.com platform.twitter.com *.instagram.com *.beop.io *.beopinion.com js.stripe.com service.mtcaptcha.com service2.mtcaptcha.com;font-src *.beop.io *.beopinion.com;frame-ancestors *.beop.io *.beopinion.com
content-encoding: gzip
etag: "e8bf-WVpirBrx0vBlFSCfkVyM3S9tlU4+gzip"
age: 715294
x-cache: HIT
content-length: 14950
x-ocdn-accept-language: de
last-modified: Mon, 01 Aug 2022 12:41:54 GMT
server: ECAcc (frd/E2D1)
date: Tue, 09 Aug 2022 19:23:28 GMT
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 09 Aug 2023 19:23:28 GMT

GET
H3 200 local_storage_frame16.min.html Show response
assets.bounceexchange.com/assets/bounce/ Frame 5F46 2 KB
1 KB 14ms
14ms Document
text/html 34.98.72.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.bounceexchange.com/assets/bounce/local_storage_frame16.min.html
Requested by: Host: assets.bounceexchange.com
URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/main_1bebab78e6b9a9bb3795d89a597c7a5f.br.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.72.95 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 95.72.98.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: f2f11e4d45030f1f21ec7d3ae67a65b83c4c67016fe861fbebdff04ca0c8cd60

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
access-control-expose-headers: etag Content-Type
age: 1791981
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public,max-age=31536000
content-encoding: gzip
content-length: 1055
content-type: text/html; charset=UTF-8
date: Wed, 20 Jul 2022 01:37:07 GMT
etag: "e011643ecd9bb3e6a134f0f2183b2b0e"
expires: Thu, 20 Jul 2023 01:37:07 GMT
last-modified: Tue, 19 Jul 2022 13:57:09 GMT
server: UploadServer
vary: Accept-Encoding
x-goog-generation: 1658239029272699
x-goog-hash: crc32c=G482cQ== md5=4BFkPs2bs+ahNPDyGDsrDg==
x-goog-metageneration: 1
x-goog-storage-class: MULTI_REGIONAL
x-goog-stored-content-encoding: gzip
x-goog-stored-content-length: 1055
x-guploader-uploadid: ADPycduA1Rb0jcDdfBxCcM7QIBlkifr_wxBPJNBGKhfz8yZlrN-aPXEKyDkiUOtbQxW5E-7aV033zIKyy3Wm7OMSk43Nlw

GET
H2 200 0dd47240a5f3135fae49.js Show response
widget.beop.io/en/public/chunks/9.6.96/ 132 KB
43 KB 10ms
10ms Script
application/javascript 152.199.23.151
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://widget.beop.io/en/public/chunks/9.6.96/0dd47240a5f3135fae49.js

Requested by

Host: widget.beop.io
URL: https://widget.beop.io/sdk.js?ver=1.0.0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.199.23.151 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frd/E2D4) /

Resource Hash

b423a0606a3921c194a4b9a7fae62b3c3767877fde6602c42428f10023f26d21

Security Headers

Name	Value
Content-Security-Policy	frame-src ;script-src 'unsafe-inline' .pingdom.net www.youtube.com platform.twitter.com .instagram.com .beop.io .beopinion.com js.stripe.com service.mtcaptcha.com service2.mtcaptcha.com;font-src .beop.io .beopinion.com;frame-ancestors .beop.io *.beopinion.com

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

content-security-policy: frame-src *;script-src 'unsafe-inline' *.pingdom.net www.youtube.com platform.twitter.com *.instagram.com *.beop.io *.beopinion.com js.stripe.com service.mtcaptcha.com service2.mtcaptcha.com;font-src *.beop.io *.beopinion.com;frame-ancestors *.beop.io *.beopinion.com
content-encoding: gzip
etag: "20e65-7RPSyapI3RKD65RpUNgNnsgpZpA+gzip"
age: 715294
x-cache: HIT
content-length: 43906
x-ocdn-accept-language: de
last-modified: Mon, 01 Aug 2022 12:41:54 GMT
server: ECAcc (frd/E2D4)
date: Tue, 09 Aug 2022 19:23:28 GMT
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 09 Aug 2023 19:23:28 GMT

GET
H2 200 97bc8a700c8c16f01d6e.js Show response
widget.beop.io/en/public/chunks/9.6.96/ 112 KB
29 KB 9ms
9ms Script
application/javascript 152.199.23.151
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://widget.beop.io/en/public/chunks/9.6.96/97bc8a700c8c16f01d6e.js

Requested by

Host: widget.beop.io
URL: https://widget.beop.io/sdk.js?ver=1.0.0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.199.23.151 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frd/E297) /

Resource Hash

c0b195905fdb73566a39eff0a966a34751098e677648810fae752c3a936584cc

Security Headers

Name	Value
Content-Security-Policy	frame-src ;script-src 'unsafe-inline' .pingdom.net www.youtube.com platform.twitter.com .instagram.com .beop.io .beopinion.com js.stripe.com service.mtcaptcha.com service2.mtcaptcha.com;font-src .beop.io .beopinion.com;frame-ancestors .beop.io *.beopinion.com

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

content-security-policy: frame-src *;script-src 'unsafe-inline' *.pingdom.net www.youtube.com platform.twitter.com *.instagram.com *.beop.io *.beopinion.com js.stripe.com service.mtcaptcha.com service2.mtcaptcha.com;font-src *.beop.io *.beopinion.com;frame-ancestors *.beop.io *.beopinion.com
content-encoding: gzip
etag: "1c10f-99u2R4Q9LGPGwyA/r6KDjtWhLog+gzip"
age: 715294
x-cache: HIT
content-length: 29225
x-ocdn-accept-language: de
last-modified: Mon, 01 Aug 2022 12:41:54 GMT
server: ECAcc (frd/E297)
date: Tue, 09 Aug 2022 19:23:28 GMT
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 09 Aug 2023 19:23:28 GMT

POST
H2 204 i
t.beop.io/ 0
135 B 31ms
31ms Ping
text/plain 52.213.82.126
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://t.beop.io/i?_ck=5c35d63ba50931ce4501c8ffca71fe63
Requested by: Host: widget.beop.io
URL: https://widget.beop.io/en/public/chunks/9.6.96/0bd906b837cebaeac8d1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.213.82.126 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-213-82-126.eu-west-1.compute.amazonaws.com
Software: http-kit /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://www.rd.com
date: Tue, 09 Aug 2022 19:23:28 GMT
access-control-allow-credentials: true
server: http-kit
access-control-expose-headers

POST
H2 204 i
contents-tracking.beop.io/ 0
135 B 90ms
31ms Ping
text/plain 52.213.82.126
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://contents-tracking.beop.io/i?_ck=4be77687368551657226eda7713264d1
Requested by: Host: widget.beop.io
URL: https://widget.beop.io/en/public/chunks/9.6.96/0bd906b837cebaeac8d1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.213.82.126 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-213-82-126.eu-west-1.compute.amazonaws.com
Software: http-kit /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://www.rd.com
date: Tue, 09 Aug 2022 19:23:28 GMT
access-control-allow-credentials: true
server: http-kit
access-control-expose-headers

OPTIONS
H2 200 PBJS
c2shb.pubgw.yahoo.com/admax/bid/partners/ Frame 0
0 93ms
9ms Preflight 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/admax/bid/partners/PBJS
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-openrtb-version
Access-Control-Request-Method: POST
Origin: https://www.rd.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With,Content-Type,X-Openrtb-Version
access-control-allow-methods: GET,POST,OPTIONS
access-control-allow-origin: https://www.rd.com
access-control-max-age: 600
age: 0
content-length: 0
date: Tue, 09 Aug 2022 19:23:28 GMT
server: ATS/9.1.10.25

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 36 B
637 B 124ms
89ms XHR
application/json 104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=681352&v=8.1&ac=j&sd=1&nf=1&r=%7B%22id%22%3A%2216c6755b9cbbf3%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A0%2C%22msi%22%3A0%2C%22mfu%22%3A0%2C%22bu%22%3A0%2C%22iu%22%3A1%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A1%2C%22ren%22%3Afalse%2C%22version%22%3A%226.24.2%22%2C%22userIds%22%3A%5B%5D%2C%22fpd%22%3Atrue%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%22252f1b19c495c1%22%2C%22ext%22%3A%7B%22siteID%22%3A%22681352%22%2C%22sid%22%3A%22640x480%22%7D%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%5D%2C%22context%22%3A%22instream%22%2C%22protocols%22%3A%5B2%2C3%2C5%2C6%5D%2C%22playerSize%22%3A%5B640%2C480%5D%2C%22maxduration%22%3A300%2C%22minduration%22%3A15%2C%22api%22%3A%5B2%5D%2C%22linearity%22%3A1%2C%22playbackmethod%22%3A%5B2%5D%2C%22placement%22%3A1%2C%22w%22%3A640%2C%22h%22%3A480%7D%7D%5D%2C%22at%22%3A1%2C%22user%22%3A%7B%22data%22%3A%5B%7B%22name%22%3A%22permutive.com%22%2C%22segment%22%3A%5B%5D%7D%5D%7D%7D
Requested by: Host: micro.rubiconproject.com
URL: https://micro.rubiconproject.com/prebid/dynamic/10696.js?ver=1.0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2df376a121504eb2a43ab52f31097cf60bf2127502f5ee165084c075642ccfd6

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 09 Aug 2022 19:23:28 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 36
pragma: no-cache
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E1D7%2Bd7Rn1f9fx1MGFq11rks%2BQFtP0B%2BCJrkcu0mGP%2Bk1d03g8cRuAw7zw2hwPO52A0oYERDO3LnX%2F4LQJbQGmiR3NepsYzBANjpZ1LOqbhkJ4XEgeUYpJN2phygJHKIdh%2FAbXa0"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://www.rd.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 7382ddcd9c595c80-FRA
expires: 0

POST
H2 200 auction Show response
prebid-server.rubiconproject.com/openrtb2/ 173 B
400 B 191ms
9ms XHR
application/json 3.65.16.214
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: micro.rubiconproject.com
URL: https://micro.rubiconproject.com/prebid/dynamic/10696.js?ver=1.0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.65.16.214 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-65-16-214.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 577c74b1ebd9b7a1c477f96620ef0c32ce5658e11dec9a564033c3ee57d3b76d

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 09 Aug 2022 19:23:28 GMT
content-encoding: gzip
x-prebid: pbs-java/1.96.0
content-type: application/json
access-control-allow-origin: https://www.rd.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 168
expires: 0

POST
H2 204 PBJS Show response
c2shb.pubgw.yahoo.com/admax/bid/partners/ 0
192 B 138ms
120ms XHR
text/plain 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/admax/bid/partners/PBJS
Requested by: Host: micro.rubiconproject.com
URL: https://micro.rubiconproject.com/prebid/dynamic/10696.js?ver=1.0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
x-openrtb-version: 2.5
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: https://www.rd.com
date: Tue, 09 Aug 2022 19:23:28 GMT
access-control-allow-credentials: true
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
113 B 1284ms
50ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: micro.rubiconproject.com
URL: https://micro.rubiconproject.com/prebid/dynamic/10696.js?ver=1.0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.rd.com
date: Tue, 09 Aug 2022 19:23:27 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
504 B 123ms
33ms XHR
application/json 3.122.72.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=6.24.2&referrer=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&tmax=2000

Requested by

Host: micro.rubiconproject.com
URL: https://micro.rubiconproject.com/prebid/dynamic/10696.js?ver=1.0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.122.72.35 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-122-72-35.eu-central-1.compute.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 09 Aug 2022 19:23:28 GMT
accept-ch: sec-ch-ua-platform,sec-ch-viewport-height,sec-ch-rtt,sec-ch-ua-arch,sec-ch-ua,sec-ch-ua-bitness,sec-ch-prefers-color-scheme,sec-ch-width,sec-ch-ect,user-agent,sec-ch-downlink,sec-ch-ua-mobile,sec-ch-save-data,sec-ch-device-memory,sec-ch-dpr,sec-ch-ua-full-version,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-viewport-width
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.rd.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 143 B
1 KB 133ms
112ms XHR
application/json 37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: micro.rubiconproject.com
URL: https://micro.rubiconproject.com/prebid/dynamic/10696.js?ver=1.0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

e0edfbf1d314a2d9637bf18245e19edb5c94d82367dbf711173ce58b7ae4e11a

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 09 Aug 2022 19:23:28 GMT
X-Proxy-Origin: 178.162.209.129; 178.162.209.129; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 79dde27d-cde5-4290-ad9f-d98e910eb44c
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.rd.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 143
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 init1.js Show response
api.bounceexchange.com/bounce/ 36 B
342 B 160ms
61ms Script
text/html 34.111.8.32
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.bounceexchange.com/bounce/init1.js?wklzs=1540&wklz=C4ewVgigvAZgrgOwMbAJYgQMhQZygRgDZCAGEgdgGYyAOAJnIFZNgAvEKEzAdwFMAjHKmC8A+qgAmUAJwAWGpgBOvHCAA2cNBgKkSAD3x0yS3jF6LliqNgCGatagQBzUXEVqoAC2DAADjgBSSgBBALoAMTDw7hiAOkUJWKQQAFsom0U0JDVeKJgbAGteAFoAR0Vi5IlciKDw0SQU3yCAEWUbCThfBLhAukJRAUlW9s7uzpwaaSM6OjCBlOHKFsY6fBJZEnneTyWW-EZg4PJCanC5cgBhFulGcjppS8IAURaWmmfn1eDwukvgxiMGgtYKyeaiAAK5hSAAkbDhPK1CDAkJRePheDQyBISDRAdJeBJ8LIqJt8PgkDBKIQkHR+OR+LI5PgJIRZIQaLwCTRKDRTiyYDQaLIJNJCOiuAA3VBCYANEAgAqoXhQALkABCYToamasyCoVm3j8fUYITCq0idAtMW48USyTSVoiGSyOXNEXyRTKFSqNQt5so9UautNbV4HS6PRN-UG-GGVuWo0jEymMzmToW8dDq3Wm3d4t2EgD+0Ox1OJHOJOut3ujxebw+XzoPz+AKBILBGch0LhCOLyNR6Mx2Nx+MJxNJJHJlOptPpjOZrPZnO5vP5EkFwtF4vWWrCly1ij3Zr1p4Ps14emPwSIunI8lx+B5apa2AVSpVas1s0l16-WpASVzFEEQEGvfI1BwGpzzoHA4H4RYfEJUQMFlGo5hCYBFDgaCtTgwQkEUVBfC0BBRBgVBlCLPUQggqCXxfTBJQyHAAG0XVQbIxGAABPXxeAAXVgOwoKYljWLUEAOlEfjFBgISDgoMTFDYnAHGqURqhIzwhLo3hlLYwDgNA3SRP05iVPYzJOJyUQEBsFJBKgGEQG4MISFAdyAGVfBAYB3JsdzwkKGoSAgAAldzLhAaoAoQaiSGCSUQHjEgAHFeB8RwnG8pAHMciQDKs10xDykQnBARQeKEkQkE8BB1BAJweKK1AUhsJxeDcNQhKNfx9QAegGm07SSVJht8SoMFA4ABq6SSOhwAa0wGjYBpc7hilAYofL84obGKYKvQi4pouqfb4uKJKUokYoMqy5wdrylICuKBIxpSYpOp8HjijajqVGKXM1mpWZZCB2IwF8JwirK3gKqqkDhByISipwXyEFUKjRA4rjTMg8zxOSBAZoaGxgCE54cCgknUDsbzQCIlQit8AGQL4pzcZyIrpOlIR+BR4SCbR+DEJECQUMx4QnKwnCioatAKLK9AyJwYByd6fHRIstjemywYJE60R+EUVyoMULXCcsmVRHR1DKst1qcFETxUl4VnOsdnXWI3XxREUAWQCQAohIV-3wwkFrvf4Gxg4o+xNPdySeMcknUe9-CcEI4jSPIyjCS98S0Nt3gUBVoTZNUey1C20vET+WrPCY6oYFYzPs5IlW86ox3kkVZUQIVUQ1AyTqhdE-hfE4TBMqn1iACIud4eeABp57hhGeNX+enDsHIqu313HO3qCMjq+eBMwEi8CXt8mgcGxkDEGAR6caxJU8GwoCAA
Requested by: Host: assets.bounceexchange.com
URL: https://assets.bounceexchange.com/assets/smart-tag/versioned/main_1bebab78e6b9a9bb3795d89a597c7a5f.br.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.8.32 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 32.8.111.34.bc.googleusercontent.com
Software: /
Resource Hash: fe3fcb884394be745dbd11141b6d780028a4d86106b6292d7502db096f582218

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:28 GMT
via: 1.1 google
x-envoy-upstream-service-time: 37
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-type: text/html; charset=UTF-8

GET
H2 200 / Show response
ct.pinterest.com/user/ 489 B
829 B 195ms
65ms XHR
application/json 23.47.212.208
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ct.pinterest.com/user/?tid=2613599177006&cb=1660073008297

Requested by

Host: s.pinimg.com
URL: https://s.pinimg.com/ct/lib/main.c99cd143.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.47.212.208 Vienna, Austria, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-47-212-208.deploy.static.akamaitechnologies.com

Software

Resource Hash

08d20a2ee48b6892026d9a264b4c45206ccb1018dfb5f1d643d6a10bbd2f974a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:28 GMT
content-encoding: gzip
vary: Accept-Encoding
x-cdn: akamai
akamai-grn: 0.17730617.1660073008.294c79f2
x-envoy-upstream-service-time: 4
x-pinterest-rid: 1532849161345962
pin-unauth: dWlkPU1UWmxORGc0TkdVdE5qTmpNaTAwTnpFNExXSTFOV1F0WVRnMU1EY3pOV015TVdNeA
access-control-allow-origin: https://www.rd.com
referrer-policy: origin
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
content-type: application/json; charset=utf-8
pragma: no-cache
access-control-expose-headers: Epik,Pin-Unauth
cache-control: no-cache,no-store,must-revalidate,max-age=0
access-control-allow-credentials: true
content-length: 351
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 css2
fonts.googleapis.com/ 3 KB
562 B 48ms
19ms Stylesheet
text/css 2a00:1450:400e:80f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Montserrat:wght@400;700&display=swap

Requested by

Host: client
URL: about:client

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400e:80f::200a , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

63e55165cb26efa3df20628f8c2dfc0b13e7d7e7629761fe9f43b34d5498ea46

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 09 Aug 2022 18:16:51 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 09 Aug 2022 19:23:28 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 09 Aug 2022 19:23:28 GMT

POST
H2 200 contents_commits Show response
data.beop.io/ 2 B
182 B 33ms
33ms XHR
application/json 52.213.82.126
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://data.beop.io/contents_commits?nuid=5d713d4d-69e8-4a0d-b851-27b7cd0e8c62&sdk_version=9.6.96
Requested by: Host: widget.beop.io
URL: https://widget.beop.io/en/public/chunks/9.6.96/8cdea80cc4922c6071ce.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.213.82.126 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-213-82-126.eu-west-1.compute.amazonaws.com
Software: http-kit /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Accept: application/json
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: https://www.rd.com
date: Tue, 09 Aug 2022 19:23:28 GMT
access-control-allow-credentials: true
server: http-kit
content-type: application/json; charset=utf-8
content-length: 2
access-control-expose-headers

OPTIONS
H2 200 contents_commits
data.beop.io/ Frame 0
0 138ms
32ms Preflight 52.213.82.126
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://data.beop.io/contents_commits?nuid=5d713d4d-69e8-4a0d-b851-27b7cd0e8c62&sdk_version=9.6.96
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.213.82.126 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-213-82-126.eu-west-1.compute.amazonaws.com
Software: http-kit /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.rd.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: https://www.rd.com
access-control-max-age: 86400
content-length: 9
date: Tue, 09 Aug 2022 19:23:28 GMT
server: http-kit

GET
H2 200 /
ct.pinterest.com/v3/ 35 B
334 B 193ms
66ms Image
image/gif 23.47.212.208
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ct.pinterest.com/v3/?tid=2613599177006&event=init&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1200%2C%22sw%22%3A1600%2C%22mh%22%3A%22c99cd143%22%2C%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22brands%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%2C%22uaFullVersion%22%3A%22%22%2C%22ecm_enabled%22%3Afalse%7D&cb=1660073008301

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.47.212.208 Vienna, Austria, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-47-212-208.deploy.static.akamaitechnologies.com

Software

Resource Hash

37b17c5135a176a9474521af147d96dfa1fb4ca0f43f00d1400bd1885be3ab9b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 09 Aug 2022 19:23:28 GMT
referrer-policy: origin
x-cdn: akamai
akamai-grn: 0.17730617.1660073008.294c79f9
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache,no-store,must-revalidate,max-age=0
x-envoy-upstream-service-time: 2
content-length: 35
x-pinterest-rid: 1199024406799732
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
DATA 200
OK truncated
/ 42 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type: image/gif

POST
H3 200 / Show response
www.facebook.com/tr/ Frame 4569 0
18 B 20ms
9ms Document
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://www.rd.com
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://www.rd.com
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Tue, 09 Aug 2022 19:23:28 GMT
priority: u=0
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2 200 b6b1a79947fb5abb872f.js Show response
widget.beop.io/en/public/chunks/9.6.96/ 13 KB
4 KB 13ms
11ms Script
application/javascript 152.199.23.151
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://widget.beop.io/en/public/chunks/9.6.96/b6b1a79947fb5abb872f.js

Requested by

Host: widget.beop.io
URL: https://widget.beop.io/sdk.js?ver=1.0.0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.199.23.151 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frd/E2CD) /

Resource Hash

f838b3467a329431f0fe6a00705cf5ae17609fc27843141faa62e6d0d21159fd

Security Headers

Name	Value
Content-Security-Policy	frame-src ;script-src 'unsafe-inline' .pingdom.net www.youtube.com platform.twitter.com .instagram.com .beop.io .beopinion.com js.stripe.com service.mtcaptcha.com service2.mtcaptcha.com;font-src .beop.io .beopinion.com;frame-ancestors .beop.io *.beopinion.com

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

content-security-policy: frame-src *;script-src 'unsafe-inline' *.pingdom.net www.youtube.com platform.twitter.com *.instagram.com *.beop.io *.beopinion.com js.stripe.com service.mtcaptcha.com service2.mtcaptcha.com;font-src *.beop.io *.beopinion.com;frame-ancestors *.beop.io *.beopinion.com
content-encoding: gzip
etag: "359e-lFEfeKz4LfD9hkFXy+ImBUpvB68+gzip"
age: 715273
x-cache: HIT
content-length: 4319
x-ocdn-accept-language: de
last-modified: Mon, 01 Aug 2022 12:42:15 GMT
server: ECAcc (frd/E2CD)
date: Tue, 09 Aug 2022 19:23:28 GMT
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 09 Aug 2023 19:23:28 GMT

GET
H2 200 4c4fd78e0d89ab7d5ed3.js Show response
widget.beop.io/en/public/chunks/9.6.96/ 10 KB
3 KB 13ms
12ms Script
application/javascript 152.199.23.151
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://widget.beop.io/en/public/chunks/9.6.96/4c4fd78e0d89ab7d5ed3.js

Requested by

Host: widget.beop.io
URL: https://widget.beop.io/sdk.js?ver=1.0.0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.199.23.151 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frd/E31C) /

Resource Hash

c978f89ecbf531f2b8bb903cab82fb0b0f1b44603dc1be644e028eebc655e89d

Security Headers

Name	Value
Content-Security-Policy	frame-src ;script-src 'unsafe-inline' .pingdom.net www.youtube.com platform.twitter.com .instagram.com .beop.io .beopinion.com js.stripe.com service.mtcaptcha.com service2.mtcaptcha.com;font-src .beop.io .beopinion.com;frame-ancestors .beop.io *.beopinion.com

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

content-security-policy: frame-src *;script-src 'unsafe-inline' *.pingdom.net www.youtube.com platform.twitter.com *.instagram.com *.beop.io *.beopinion.com js.stripe.com service.mtcaptcha.com service2.mtcaptcha.com;font-src *.beop.io *.beopinion.com;frame-ancestors *.beop.io *.beopinion.com
content-encoding: gzip
etag: "27d1-0Q5Aj7EerhR5FLKHrhtHe9s1pZc+gzip"
age: 715273
x-cache: HIT
content-length: 3164
x-ocdn-accept-language: de
last-modified: Mon, 01 Aug 2022 12:42:15 GMT
server: ECAcc (frd/E31C)
date: Tue, 09 Aug 2022 19:23:28 GMT
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 09 Aug 2023 19:23:28 GMT

GET
H2 200 a9c4ca6005a52f61d761.js Show response
widget.beop.io/en/public/chunks/9.6.96/ 7 KB
3 KB 10ms
8ms Script
application/javascript 152.199.23.151
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://widget.beop.io/en/public/chunks/9.6.96/a9c4ca6005a52f61d761.js

Requested by

Host: widget.beop.io
URL: https://widget.beop.io/sdk.js?ver=1.0.0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.199.23.151 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frd/E30A) /

Resource Hash

af783b2650aaeb43013aa489f72edfaf2c1b348ad47681537265264414a1a7ee

Security Headers

Name	Value
Content-Security-Policy	frame-src ;script-src 'unsafe-inline' .pingdom.net www.youtube.com platform.twitter.com .instagram.com .beop.io .beopinion.com js.stripe.com service.mtcaptcha.com service2.mtcaptcha.com;font-src .beop.io .beopinion.com;frame-ancestors .beop.io *.beopinion.com

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

content-security-policy: frame-src *;script-src 'unsafe-inline' *.pingdom.net www.youtube.com platform.twitter.com *.instagram.com *.beop.io *.beopinion.com js.stripe.com service.mtcaptcha.com service2.mtcaptcha.com;font-src *.beop.io *.beopinion.com;frame-ancestors *.beop.io *.beopinion.com
content-encoding: gzip
etag: "1cbf-zZ+jfvdFTDyQmYiInv+/0s1P5sU+gzip"
age: 715273
x-cache: HIT
content-length: 2798
x-ocdn-accept-language: de
last-modified: Mon, 01 Aug 2022 12:42:15 GMT
server: ECAcc (frd/E30A)
date: Tue, 09 Aug 2022 19:23:28 GMT
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 09 Aug 2023 19:23:28 GMT

GET
H2 200 f55e884e572ebe189378.js Show response
widget.beop.io/en/public/chunks/9.6.96/ 29 KB
9 KB 13ms
12ms Script
application/javascript 152.199.23.151
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://widget.beop.io/en/public/chunks/9.6.96/f55e884e572ebe189378.js

Requested by

Host: widget.beop.io
URL: https://widget.beop.io/sdk.js?ver=1.0.0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.199.23.151 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frd/E2EA) /

Resource Hash

58bc438e7e52302881247a70666f53af112ad1a706b4eb8935999132290f4c39

Security Headers

Name	Value
Content-Security-Policy	frame-src ;script-src 'unsafe-inline' .pingdom.net www.youtube.com platform.twitter.com .instagram.com .beop.io .beopinion.com js.stripe.com service.mtcaptcha.com service2.mtcaptcha.com;font-src .beop.io .beopinion.com;frame-ancestors .beop.io *.beopinion.com

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

content-security-policy: frame-src *;script-src 'unsafe-inline' *.pingdom.net www.youtube.com platform.twitter.com *.instagram.com *.beop.io *.beopinion.com js.stripe.com service.mtcaptcha.com service2.mtcaptcha.com;font-src *.beop.io *.beopinion.com;frame-ancestors *.beop.io *.beopinion.com
content-encoding: gzip
etag: "7462-yQXai/zJe8lu/f4TZroGA/cw3Jc+gzip"
age: 715273
x-cache: HIT
content-length: 9260
x-ocdn-accept-language: de
last-modified: Mon, 01 Aug 2022 12:42:15 GMT
server: ECAcc (frd/E2EA)
date: Tue, 09 Aug 2022 19:23:28 GMT
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 09 Aug 2023 19:23:28 GMT

GET
H2 200 68a5f7128f02fe73a19e.js Show response
widget.beop.io/en/public/chunks/9.6.96/ 15 KB
5 KB 10ms
9ms Script
application/javascript 152.199.23.151
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://widget.beop.io/en/public/chunks/9.6.96/68a5f7128f02fe73a19e.js

Requested by

Host: widget.beop.io
URL: https://widget.beop.io/sdk.js?ver=1.0.0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.199.23.151 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frd/E2F9) /

Resource Hash

345a8b8d3c375a4c3e1926696bf53c3912d32cf268b228572fd234ff7fcbaf4d

Security Headers

Name	Value
Content-Security-Policy	frame-src ;script-src 'unsafe-inline' .pingdom.net www.youtube.com platform.twitter.com .instagram.com .beop.io .beopinion.com js.stripe.com service.mtcaptcha.com service2.mtcaptcha.com;font-src .beop.io .beopinion.com;frame-ancestors .beop.io *.beopinion.com

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

content-security-policy: frame-src *;script-src 'unsafe-inline' *.pingdom.net www.youtube.com platform.twitter.com *.instagram.com *.beop.io *.beopinion.com js.stripe.com service.mtcaptcha.com service2.mtcaptcha.com;font-src *.beop.io *.beopinion.com;frame-ancestors *.beop.io *.beopinion.com
content-encoding: gzip
etag: "3b27-btvUXkabNoFw3g3kMuVhW8rqaT4+gzip"
age: 715273
x-cache: HIT
content-length: 5024
x-ocdn-accept-language: de
last-modified: Mon, 01 Aug 2022 12:42:15 GMT
server: ECAcc (frd/E2F9)
date: Tue, 09 Aug 2022 19:23:28 GMT
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 09 Aug 2023 19:23:28 GMT

GET
H2 200 54a3579e87e934bc33b0.js Show response
widget.beop.io/en/public/chunks/9.6.96/ 25 KB
8 KB 11ms
10ms Script
application/javascript 152.199.23.151
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://widget.beop.io/en/public/chunks/9.6.96/54a3579e87e934bc33b0.js

Requested by

Host: widget.beop.io
URL: https://widget.beop.io/sdk.js?ver=1.0.0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.199.23.151 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frd/E2DE) /

Resource Hash

502749d5b80e993b10e32816970a8f09da06d46d3abc4b897e333d34c6561a2a

Security Headers

Name	Value
Content-Security-Policy	frame-src ;script-src 'unsafe-inline' .pingdom.net www.youtube.com platform.twitter.com .instagram.com .beop.io .beopinion.com js.stripe.com service.mtcaptcha.com service2.mtcaptcha.com;font-src .beop.io .beopinion.com;frame-ancestors .beop.io *.beopinion.com

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

content-security-policy: frame-src *;script-src 'unsafe-inline' *.pingdom.net www.youtube.com platform.twitter.com *.instagram.com *.beop.io *.beopinion.com js.stripe.com service.mtcaptcha.com service2.mtcaptcha.com;font-src *.beop.io *.beopinion.com;frame-ancestors *.beop.io *.beopinion.com
content-encoding: gzip
etag: "6295-yXQIH6tKJZgnAf3YvSEdoa7wrTc+gzip"
age: 715273
x-cache: HIT
content-length: 7611
x-ocdn-accept-language: de
last-modified: Mon, 01 Aug 2022 12:42:15 GMT
server: ECAcc (frd/E2DE)
date: Tue, 09 Aug 2022 19:23:28 GMT
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 09 Aug 2023 19:23:28 GMT

POST
H2 204 i
contents-tracking.beop.io/ 0
135 B 32ms
31ms Ping
text/plain 52.213.82.126
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://contents-tracking.beop.io/i?_ck=29261b638b9ac4b5fc6e6cdf5deb3e48
Requested by: Host: widget.beop.io
URL: https://widget.beop.io/en/public/chunks/9.6.96/0bd906b837cebaeac8d1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.213.82.126 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-213-82-126.eu-west-1.compute.amazonaws.com
Software: http-kit /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://www.rd.com
date: Tue, 09 Aug 2022 19:23:28 GMT
access-control-allow-credentials: true
server: http-kit
access-control-expose-headers

POST
H2 204 i
contents-tracking.beop.io/ 0
135 B 32ms
32ms Ping
text/plain 52.213.82.126
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://contents-tracking.beop.io/i?_ck=1f19ca7a21aa758bd6a4d7967e6cc099
Requested by: Host: widget.beop.io
URL: https://widget.beop.io/en/public/chunks/9.6.96/0bd906b837cebaeac8d1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.213.82.126 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-213-82-126.eu-west-1.compute.amazonaws.com
Software: http-kit /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://www.rd.com
date: Tue, 09 Aug 2022 19:23:28 GMT
access-control-allow-credentials: true
server: http-kit
access-control-expose-headers

POST
H2 204 i
contents-tracking.beop.io/ 0
135 B 31ms
31ms Ping
text/plain 52.213.82.126
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://contents-tracking.beop.io/i?_ck=653b1b95d12f2bc1f6e301408ad1bdf3
Requested by: Host: widget.beop.io
URL: https://widget.beop.io/en/public/chunks/9.6.96/0bd906b837cebaeac8d1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.213.82.126 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-213-82-126.eu-west-1.compute.amazonaws.com
Software: http-kit /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://www.rd.com
date: Tue, 09 Aug 2022 19:23:28 GMT
access-control-allow-credentials: true
server: http-kit
access-control-expose-headers

GET
H/1.1 204
No Content a-00x0
i.liadm.com/s/c/ Frame 8D16 0
0 426ms
99ms Document
text/plain 54.146.208.95
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://i.liadm.com/s/c/a-00x0?s=&cim=&ps=true&ls=true&duid=0ee7014c2aeb--01ga20zpschj125jhf3w3yrftz&ppid=0&euns=1&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&

Requested by

Host: b-code.liadm.com
URL: https://b-code.liadm.com/sync-container.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.146.208.95 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-146-208-95.compute-1.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: keep-alive
Date: Tue, 09 Aug 2022 19:23:28 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains

GET
H/1.1 200
OK baker
sli.rd.com/ 19 B
359 B 252ms
17ms Image
image/gif 23.36.162.26
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sli.rd.com/baker?dtstmp=1660073009013
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.36.162.26 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-36-162-26.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 2d199b9d8dc7886837cbfd12c9e8ddae7e28f5c375d564b31bf732a320921435

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 09 Aug 2022 19:23:29 GMT
Cache-Control: max-age=0, no-cache, no-store
Expires: Tue, 09 Aug 2022 19:23:29 GMT
Connection: keep-alive
Content-Length: 19
Content-Type: image/gif

GET
H/1.1 200
OK user-sync Show response
sync.adkernel.com/ Frame 5530 0
109 B 114ms
13ms Document
text/plain 77.245.57.72
WEBAIR-INTERNET-MTL

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adkernel.com/user-sync?zone=147357&r=https%3A%2F%2Fdemand.catapultx.com%2Fsync%3Fakuid%3Dhttps%3A%2F%2Fwww.rd.com%7C%7BUID%7D
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 77.245.57.72 , United States, ASN36057 (WEBAIR-INTERNET-MTL, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: close
Content-Length: 0
Date: Tue, 09 Aug 2022 19:23:29 GMT
Server: nginx

GET
H2 200 pxusr.gif
c.aaxads.com/ 43 B
205 B 23ms
22ms Image
image/gif 104.96.148.107
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.aaxads.com/pxusr.gif

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.96.148.107 Vienna, Austria, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-96-148-107.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

8ac1703c1c34b2be426deda409d39258f82fae17f13e645f377f337a954aedde

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:29 GMT
last-modified: Mon, 26 Feb 2018 13:29:58 GMT
server: Apache
strict-transport-security: max-age=604800
content-type: image/gif
cache-control: max-age=414161
accept-ranges: bytes
content-length: 43
expires: Sun, 14 Aug 2022 14:26:10 GMT

GET
H/1.1 200
OK pxext.gif
www.aaxdetect.com/ 43 B
323 B 217ms
18ms Image
image/gif 104.96.145.101
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.aaxdetect.com/pxext.gif
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.96.145.101 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-96-145-101.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 8ac1703c1c34b2be426deda409d39258f82fae17f13e645f377f337a954aedde

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Tue, 09 Aug 2022 19:23:29 GMT
Last-Modified: Mon, 26 Feb 2018 13:29:58 GMT
Server: Apache
Content-Type: image/gif
Cache-Control: max-age=889534
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Sat, 20 Aug 2022 02:29:03 GMT

GET
H2 200 log
l3.aaxads.com/ 35 B
194 B 50ms
21ms Image
image/gif 104.96.148.107
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://l3.aaxads.com/log?___stu13p=aveoaamactga5dnnuee25ti2rm86bcrodqacb&lwbsh=AAX&wHos=265&dgw=desktop&flg=AAX9HBI6S&fw=FRANKFURT&ff=DE&xjg=4&dss=0&skw=1200&slg=8PR6YK195&gq=rd.com&vhuyqdph=ssp-serving-7d499c774d-s4h4l&vyu=080911_417_080911_378_ssp&vf=HE&yhuvlrq=4&yk=1200&yz=1600&yvlg=&ylg=00001660073009252029970147848632&vvsDeExfnhw=CONTROL&oz=0&gdss=green&lwbshlg=6&vg=1&dgeg=0&qsd=0&jgsu_hqi=1&fvha=0&jgivwu=Y-N&jgsu=1&fvvwu=&wfi_fps=&wfi_vwdwxv=&wfi_sus=&vxf=0&wfi_dsl=0&xvs_hqi=1&xvs_vwdwxv=0&xvs_ogi=&xvs_vwulqj=&xifd=-1&frssd_vwdwxv=&frssd_dssolhg=&lg_ghwdlov=&dewh=SSP_CLIENT_control&deg=2&fdeg=0&gdeg=2&ghqg=264&fhqg=31&hqg=55&gvwduw=32&fvwduw=31&vwduw=31&uhtxuo=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&nzui=
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.96.148.107 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-96-148-107.deploy.static.akamaitechnologies.com
Software: Jetty(9.4.35.v20201120) /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 09 Aug 2022 19:23:29 GMT
server: Jetty(9.4.35.v20201120)
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Tue, 09 Aug 2022 19:23:29 GMT

OPTIONS
H2 200 event
prebid-a.rubiconproject.com/ Frame 0
0 86ms
8ms Preflight 3.65.165.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-a.rubiconproject.com/event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.65.165.22 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-65-165-22.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.rd.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-max-age: 1800
allow: GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH
content-length: 0
date: Tue, 09 Aug 2022 19:23:29 GMT
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers

POST
H2 202 event Show response
prebid-a.rubiconproject.com/ 61 B
225 B 8ms
8ms XHR
application/json 3.65.165.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-a.rubiconproject.com/event
Requested by: Host: micro.rubiconproject.com
URL: https://micro.rubiconproject.com/prebid/dynamic/10696.js?ver=1.0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.65.165.22 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-65-165-22.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: edda75d7dc3a6104c5af0f926c5ae645ae25eb8c4f8a601c6d5293378e858a5c

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: *
date: Tue, 09 Aug 2022 19:23:29 GMT
content-length: 61
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type: application/json

GET
H2

200

NJNdQPcH.vtt Show response
assets-jpcust.jwpsrv.com/tracks/
Redirect Chain

https://cdn.jwplayer.com/tracks/NJNdQPcH.vtt
https://assets-jpcust.jwpsrv.com/tracks/NJNdQPcH.vtt

2 KB
1 KB

22ms
8ms

XHR
text/vtt

2a04:4e42:200::626
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://assets-jpcust.jwpsrv.com/tracks/NJNdQPcH.vtt
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: H2
Server: 2a04:4e42:200::626 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: cd3f35aac14379985ade61d3d71e2af7bc7dbf2a403caa4934c822e85f4ade43

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:29 GMT
content-encoding: gzip
age: 655
x-cache: HIT, HIT
content-length: 1052
x-served-by: cache-iad-kiad7000171-IAD, cache-fra19147-FRA
access-control-allow-origin: *
last-modified: Fri, 03 Jan 2020 17:41:12 GMT
server: nginx
x-timer: S1660073010.708102,VS0,VE1
etag: "d48b99389363db2111114e0cb0ff3e7e"
vary: Accept-Encoding
content-type: text/vtt
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
access-control-allow-headers: accept-encoding, cache-control, origin, dnt, accept-language
x-cache-hits: 1, 1

Redirect headers

date: Tue, 09 Aug 2022 19:23:29 GMT
via: 1.1 7b574fc6db5d0840d90b97dd76cc56ec.cloudfront.net (CloudFront)
server: openresty
x-amz-cf-pop: VIE50-C1
location: https://assets-jpcust.jwpsrv.com/tracks/NJNdQPcH.vtt
x-cache: Miss from cloudfront
content-type: text/html
access-control-allow-origin: *
content-length: 166
x-amz-cf-id: 6DPyqn8qlIcmZP13virj_Cy8piFuwMDDBO4qeUn8HnYPOaD4jNuJGA==

GET
H2 200 polyfills.webvtt.js Show response
ssl.p.jwpcdn.com/player/v/8.25.8/ 10 KB
4 KB 32ms
32ms Script
application/javascript 2a04:4e42:200::626
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://ssl.p.jwpcdn.com/player/v/8.25.8/polyfills.webvtt.js
Requested by: Host: cdn.jwplayer.com
URL: https://cdn.jwplayer.com/libraries/Qrhs7tJs.js?ver=1.0.0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::626 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3fb75dcca26d384c618e910e2328c32dabfd7a7b0bd3f4ee50bb8bf5065f0cb4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:29 GMT
content-encoding: gzip
age: 1221268
x-cache: HIT
content-length: 4401
via: 1.1 varnish
x-served-by: cache-fra19164-FRA
last-modified: Sat, 23 Jul 2022 00:14:23 GMT
server: AmazonS3
x-timer: S1660073010.559166,VS0,VE0
etag: "e6dd7045709ca909c18efe3b9f5bf103"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000, immutable
accept-ranges: bytes
x-cache-hits: 60010

GET
H2

200

RO5TLTlb-120.vtt Show response
assets-jpcust.jwpsrv.com/strips/
Redirect Chain

https://cdn.jwplayer.com/strips/RO5TLTlb-120.vtt
https://assets-jpcust.jwpsrv.com/strips/RO5TLTlb-120.vtt

3 KB
621 B

8ms
7ms

XHR
text/vtt

2a04:4e42:200::626
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://assets-jpcust.jwpsrv.com/strips/RO5TLTlb-120.vtt
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: H2
Server: 2a04:4e42:200::626 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: a6735e9f72eac896e917b31e6d7bdca60528f28ac6cab6b88251849347ba3f80

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:29 GMT
content-encoding: gzip
age: 414
x-cache: HIT, HIT
content-length: 465
x-served-by: cache-iad-kiad7000175-IAD, cache-fra19147-FRA
access-control-allow-origin: *
last-modified: Fri, 03 Jan 2020 17:32:48 GMT
server: nginx
x-timer: S1660073010.716462,VS0,VE1
etag: "a4e2d26563afe8272601a300529601a8"
vary: Accept-Encoding
content-type: text/vtt
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
access-control-allow-headers: accept-encoding, cache-control, origin, dnt, accept-language
x-cache-hits: 2, 1

Redirect headers

date: Tue, 09 Aug 2022 19:23:29 GMT
via: 1.1 7b574fc6db5d0840d90b97dd76cc56ec.cloudfront.net (CloudFront)
server: openresty
x-amz-cf-pop: VIE50-C1
location: https://assets-jpcust.jwpsrv.com/strips/RO5TLTlb-120.vtt
x-cache: Miss from cloudfront
content-type: text/html
access-control-allow-origin: *
content-length: 166
x-amz-cf-id: qZf77Oo3E4a8iQy_4TzXrXEpF6Pt4UyjHHM7TyKY0si57hzzS3nd3w==

GET
H2 200 provider.cast.js Show response
ssl.p.jwpcdn.com/player/v/8.25.8/ 30 KB
10 KB 8ms
7ms Script
application/javascript 2a04:4e42:200::626
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://ssl.p.jwpcdn.com/player/v/8.25.8/provider.cast.js
Requested by: Host: cdn.jwplayer.com
URL: https://cdn.jwplayer.com/libraries/Qrhs7tJs.js?ver=1.0.0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::626 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: afbeecfcb775ea87363f8eb7105a6ab60cb64eadb7a71a455cd52cc3cc8d5740

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:29 GMT
content-encoding: gzip
age: 1221382
x-cache: HIT
content-length: 9979
via: 1.1 varnish
x-served-by: cache-fra19164-FRA
last-modified: Sat, 23 Jul 2022 00:14:24 GMT
server: AmazonS3
x-timer: S1660073010.563424,VS0,VE0
etag: "3d9f8f127a9dd0a2a3789c6cb87c5c7a"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000, immutable
accept-ranges: bytes
x-cache-hits: 156030

GET
H2 200 related.js Show response
ssl.p.jwpcdn.com/player/v/8.25.8/ 106 KB
25 KB 8ms
7ms Script
application/javascript 2a04:4e42:200::626
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://ssl.p.jwpcdn.com/player/v/8.25.8/related.js
Requested by: Host: cdn.jwplayer.com
URL: https://cdn.jwplayer.com/libraries/Qrhs7tJs.js?ver=1.0.0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::626 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 388e31e7568caaf46c0e4ad833c001f35b03dfd85f820515132305b7eefd21c4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:29 GMT
content-encoding: gzip
age: 1221323
x-cache: HIT
content-length: 25400
via: 1.1 varnish
x-served-by: cache-fra19164-FRA
last-modified: Sat, 23 Jul 2022 00:14:26 GMT
server: AmazonS3
x-timer: S1660073010.563380,VS0,VE0
etag: "47dc8e43c13e8287b3f1b3b2822b8305"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000, immutable
accept-ranges: bytes
x-cache-hits: 386182

GET
H2 200 / Show response
videodam.tmbi.com/wp-json/wp/v2/video/ 3 KB
2 KB 100ms
24ms XHR
application/json 2606:4700:4400::ac40:99f1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://videodam.tmbi.com/wp-json/wp/v2/video/?jw_id=RO5TLTlb

Requested by

Host: www.rd.com
URL: https://www.rd.com/wp-includes/js/jquery/jquery.js?ver=1.0.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:99f1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

557e4d49c7f5f312a54c7eba0ee716186ca4087c0f69a3ddfc926cc43fd9a0a4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:29 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 826
x-cache: MISS
allow: GET
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
x-robots-tag: noindex
last-modified: Tue, 09 Aug 2022 19:09:43 GMT
server: cloudflare
x-wp-totalpages: 1
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Origin
access-control-allow-methods: OPTIONS, GET, POST, PUT, PATCH, DELETE
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.rd.com
access-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link
x-hosted-by: 45AIR.COM
x-wp-total: 1
access-control-allow-credentials: true
cf-ray: 7382ddd64aa99042-FRA
access-control-allow-headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
x-cache-hits: 0

GET
H3 200 bridge3.524.0_en.html Show response
imasdk.googleapis.com/js/core/ Frame AFBD 635 KB
205 KB 42ms
14ms Document
text/html 2a00:1450:400e:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.524.0_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400e:80e::200a , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6d0b5a63ca5e36540e2628599ba666ef0ac2bd34f8ea5f25c9a51b0e4c72fed2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 78645
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 210237
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
cross-origin-resource-policy: cross-origin
date: Mon, 08 Aug 2022 21:32:44 GMT
expires: Tue, 08 Aug 2023 21:32:44 GMT
last-modified: Fri, 05 Aug 2022 19:18:22 GMT
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 client.js Show response
s0.2mdn.net/instream/video/ 44 KB
17 KB 123ms
21ms Script
text/javascript 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/instream/video/client.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0bffc7261df1454c5e05475cda7d9e6647318dc6c3936767e1252bfe8849c54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16746
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 09 Aug 2022 19:23:29 GMT

GET
H2 204 ping.gif
prd.jwpltx.com/v1/jwplayer6/ 0
31 B 111ms
104ms Image
text/plain 2a04:4e42:200::626
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prd.jwpltx.com/v1/jwplayer6/ping.gif?h=-1129904353&e=e&n=2138125199241356&abc=0&abt=162_ad-iab-viewability_v4%2C128_sendDomainToFeedsOn&aid=UV3t3od4EeeD_gY3v_uBow&amp=0&ask=DPCwJXPi&at=1&c=1&ccp=0&cp=0&d=2&eb=0&ed=6&emi=1h7axzz1tf45&i=0&id=RO5TLTlb&lid=u4r8ty1qd50g&lsa=read&mt=1&pbd=1&pbr=1&pgi=iqaez5mo3opm&ph=1&pid=wjcpcdaI&pii=0&pl=383&plc=1&pli=1ald1dj1xy3x&pp=hlsjs&ppm=VOD&prc=1&ps=4&pss=1&pt=How%20to%20Identify%20a%20Fake%20QR%20Code%E2%80%94and%20Avoid%20Being%20Scammed&pu=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&pv=8.25.8&pyc=0&s=1&sdk=0&stc=1&stpe=0&t=Online%20Scams%20You%20Need%20to%20Be%20Aware%20of%20--%20and%20How%20to%20Avoid%20Them&tv=3.40.0&vb=0&vi=0&vl=90&wd=681&ab=1&cae=0&cb=1&cdid=jwp_bf81eb58eda08368b4b2e59740997918&cme=0&dd=0&flc=1&fv=&ga=0&lng=en-US&mk=hls&mu=https%3A%2F%2Fcdn.jwplayer.com%2Fmanifests%2FRO5TLTlb.m3u8&pbc=1&pd=2&pdr=&plng=en-US&plt=2800&pni=0&po=0&pogt=How%20to%20Spot%20a%20Fake%20QR%20Code%20and%20Avoid%20Getting%20Scammed&rf=%2F%2Fcontent.jwplatform.com%2Fv2%2Fplaylists%2FhFIGA5RR%3Frelated_media_id%3DMEDIAID&sp=0&st=1780&sa=1660073009561
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::626 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:29 GMT
via: 1.1 varnish
server: nginx
accept-ranges: bytes
x-served-by: cache-fra19164-FRA
x-cache: MISS
x-cache-hits: 0

GET
H2 204 ping.gif
prd.jwpltx.com/v1/clienta/ 0
35 B 100ms
94ms Image
text/plain 2a04:4e42:200::626
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prd.jwpltx.com/v1/clienta/ping.gif?h=1588195577&e=ar&n=0666155511067534&abc=0&abt=162_ad-iab-viewability_v4%2C128_sendDomainToFeedsOn&aid=UV3t3od4EeeD_gY3v_uBow&amp=0&ask=DPCwJXPi&at=1&c=1&ccp=0&cp=0&d=2&eb=0&ed=6&emi=1h7axzz1tf45&i=0&id=RO5TLTlb&lid=u4r8ty1qd50g&lsa=read&mt=1&pbd=1&pbr=1&pgi=iqaez5mo3opm&ph=1&pid=wjcpcdaI&pii=0&pl=383&plc=1&pli=1ald1dj1xy3x&pp=hlsjs&ppm=VOD&prc=1&ps=4&pss=1&pt=How%20to%20Identify%20a%20Fake%20QR%20Code%E2%80%94and%20Avoid%20Being%20Scammed&pu=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&pv=8.25.8&pyc=0&s=1&sdk=0&stc=1&stpe=0&t=Online%20Scams%20You%20Need%20to%20Be%20Aware%20of%20--%20and%20How%20to%20Avoid%20Them&tv=3.40.0&vb=0&vi=0&vl=90&wd=681&ab=1&abid=1vlxb4e18f8j&adi=1vlxb4e18f8j&apid=1vlxb4e18f8j&awi=1&awc=1&p=0&pc=0&pi=0&pr=0&vu=pubads.g.doubleclick.net&apr=1&apt=1&rtp=%7B%7D&vsrid=356d9888-29ef-4f40-b1c9-6b579f8f7a99&sa=1660073009582
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::626 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:29 GMT
via: 1.1 varnish
server: nginx
accept-ranges: bytes
x-served-by: cache-fra19164-FRA
x-cache: MISS
x-cache-hits: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 64ms
23ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.rd.com

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 09 Aug 2022 19:23:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 cast_sender.js Show response
www.gstatic.com/cv/js/sender/v1/ 4 KB
3 KB 66ms
29ms Script
text/javascript 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/cv/js/sender/v1/cast_sender.js?loadCastFramework=1

Requested by

Host: cdn.jwplayer.com
URL: https://cdn.jwplayer.com/libraries/Qrhs7tJs.js?ver=1.0.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cloudview
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2007
x-xss-protection: 0
last-modified: Tue, 16 Feb 2021 23:57:06 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="cloudview"
vary: Accept-Encoding
report-to: {"group":"cloudview","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cloudview"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 09 Aug 2022 19:23:29 GMT

GET
H2 200 hFIGA5RR Show response
content.jwplatform.com/v2/playlists/ 179 KB
20 KB 364ms
348ms XHR
application/json 2600:9000:225e:6c00:1:a3fa:7cc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://content.jwplatform.com/v2/playlists/hFIGA5RR?related_media_id=RO5TLTlb&page_domain=www.rd.com
Requested by: Host: cdn.jwplayer.com
URL: https://cdn.jwplayer.com/libraries/Qrhs7tJs.js?ver=1.0.0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225e:6c00:1:a3fa:7cc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty /
Resource Hash: 599c1a5d181f670117666d33f77c609474d56d0edbe95d60584dfd9ccceeeb21

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:29 GMT
content-encoding: gzip
server: openresty
x-amz-cf-pop: FRA60-P4
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=180, max-stale=180
content-length: 19655
via: 1.1 77517a7f5d9094d359ba5186c3bda1e6.cloudfront.net (CloudFront)
x-amz-cf-id: eMI0CkRX4y94kvFoCdwfs4U-fcgpOmuiXByPP1VvkDZnC8Jb__Ti8Q==
expires: Tue, 09 Aug 2022 19:26:29

GET
H3 200 cast_framework.js Show response
www.gstatic.com/cast/sdk/libs/sender/1.0/ 36 KB
12 KB 58ms
29ms Script
text/javascript 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/cast/sdk/libs/sender/1.0/cast_framework.js

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/cv/js/sender/v1/cast_sender.js?loadCastFramework=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cf016295997068c6cd58f52c4fca8fdec2806b76e09b12521fcf734e0fcbf5f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12390
x-xss-protection: 0
last-modified: Mon, 06 Jul 2020 23:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"chrome-dongle","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/chrome-dongle"}]}
content-type: text/javascript
cache-control: private, max-age=0
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="chrome-dongle"
expires: Tue, 09 Aug 2022 19:23:29 GMT

GET
H3 200 cast_sender.js Show response
www.gstatic.com/eureka/clank/104/ 52 KB
15 KB 42ms
14ms Script
text/javascript 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/eureka/clank/104/cast_sender.js

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/cv/js/sender/v1/cast_sender.js?loadCastFramework=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a35a51e32439cce8b4dd6734f65c18debec94ca81a30640b2ccaba988ce1639e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 11:21:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 28909
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cloudview-release
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15107
x-xss-protection: 0
last-modified: Mon, 30 May 2022 15:03:30 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="cloudview-release"
vary: Accept-Encoding
report-to: {"group":"cloudview-release","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cloudview-release"}]}
content-type: text/javascript
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Wed, 10 Aug 2022 11:21:40 GMT

GET
H2 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame AFBD 156 B
625 B 309ms
308ms XHR
text/xml 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?iu=%2F6178%2Frdg_desktop%2Fvideoarticle%2Fvideo&description_url=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&env=vp&correlator=2714801042288334&tfcd=0&npa=0&gdfp_req=1&output=xml_vast4&sz=640x480&cust_params=contentid%3D1720480%26vid%3DRO5TLTlb%26category%3Dpersonal-tech%252Ctech%26topic%3Dpersonal-tech%252Ctech%257C%26min_ad_duration%3D4000%26max_ad_duration%3D61000%26unviewed_position_start%3D1%26tc%3D%26refer%3D%26abt%3D%26pt%3Dvideo%2520article%26TMCM%3D47e0408c-fb17-40cc-a076-3e78b4eceb13%26permutive%3D%26tags%3DRDU%2CRDC%2Cskitish%26contentlength%3D102%26playlistpos%3D0%26context%3Dic_3909773%2Cic_6892597%2Cic_8691809%2Cic_9333605%2Cic_2611945%2Cic_4314757%2Cic_0526083%2Cic_5095749%2Cic_0181786%2Cic_8717611%26iris_id%3Diris_4986d2e4b613c73a%26hb_uuid%3Dundefined%26hb_cache_id%3Dundefined&vid_t=Online%20Scams%20You%20Need%20to%20Be%20Aware%20of%20--%20and%20How%20to%20Avoid%20Them&vpa=auto&vpmute=1&sdkv=h.3.524.0&osd=2&frm=0&vis=1&sdr=1&hl=en&afvsz=200x200%2C250x250%2C300x250%2C450x50%2C468x60%2C480x70&unviewed_position_start=1&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&u_so=l&ctv=0&mpt=jwplayer&mpv=8.25.8&sdki=44d&ptt=20&adk=3123515279&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.524.0&sid=B9BE30C3-1CF4-45D1-85D9-102632A1C9D0&nel=0&eid=44750824%2C44752711%2C44754420%2C44760950%2C44762904%2C44765701%2C44767130&url=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&dt=1660073009714&cookie_enabled=1&scor=4008698036708540&ged=ve4_td3_er1797.250.1950.550_vi0.0.1200.1600_vp0_eb16488

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.524.0_en.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

cafe /

Resource Hash

8cd629187427fdb93787d7156be7a32c391bb2a8da471bbaa274e806e48b36e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:30 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 113
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 vttparser.js Show response
ssl.p.jwpcdn.com/player/v/8.25.8/ 5 KB
2 KB 7ms
6ms Script
application/javascript 2a04:4e42:200::626
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://ssl.p.jwpcdn.com/player/v/8.25.8/vttparser.js
Requested by: Host: cdn.jwplayer.com
URL: https://cdn.jwplayer.com/libraries/Qrhs7tJs.js?ver=1.0.0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::626 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 667a3a80b42e66f81cf68082a3e194c3179667eedd361f5ac04296b45a23b1f8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:29 GMT
content-encoding: gzip
age: 1221268
x-cache: HIT
content-length: 2148
via: 1.1 varnish
x-served-by: cache-fra19164-FRA
last-modified: Sat, 23 Jul 2022 00:14:25 GMT
server: AmazonS3
x-timer: S1660073010.721663,VS0,VE0
etag: "94e59beeb38130e9a6b804615a8d112f"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000, immutable
accept-ranges: bytes
x-cache-hits: 44383

GET
H2 200 ct.html Show response
ct.pinterest.com/ Frame 9F42 519 B
634 B 59ms
59ms Document
text/html 23.47.212.208
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ct.pinterest.com/ct.html

Requested by

Host: s.pinimg.com
URL: https://s.pinimg.com/ct/lib/main.c99cd143.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.47.212.208 Vienna, Austria, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-47-212-208.deploy.static.akamaitechnologies.com

Software

Resource Hash

0af5349cb9f7625dc177ce8b0aec00e388266c2e6761c69f181ec6c2a5d6d130

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

akamai-grn: 0.17730617.1660073009.294c8579
cache-control: no-cache,no-store,must-revalidate,max-age=0
content-encoding: gzip
content-length: 307
content-type: text/html; charset=utf-8
date: Tue, 09 Aug 2022 19:23:29 GMT
expires: Sat, 01 Jan 2000 00:00:00 GMT
pragma: no-cache
referrer-policy: origin
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
vary: Accept-Encoding
x-cdn: akamai
x-envoy-upstream-service-time: 0
x-pinterest-rid: 1255039363049666

POST
H3 200 rum Show response
www.rd.com/cdn-cgi/ 0
163 B 17ms
9ms XHR
text/plain 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/v652eace1692a40cfa3763df669d7439c1639079717194

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
content-type: application/json

Response headers

date: Tue, 09 Aug 2022 19:23:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cloudflare
x-frame-options: DENY
access-control-allow-methods: POST,OPTIONS
content-type: text/plain
access-control-allow-origin: https://www.rd.com
access-control-max-age: 86400
access-control-allow-credentials: true
cf-ray: 7382ddd73c105c68-FRA
vary: Origin

POST
H3 200 rum Show response
www.rd.com/cdn-cgi/ 0
163 B 15ms
8ms XHR
text/plain 2606:4700:4400::6812:268d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rd.com/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/v652eace1692a40cfa3763df669d7439c1639079717194

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:4400::6812:268d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
content-type: application/json

Response headers

date: Tue, 09 Aug 2022 19:23:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cloudflare
x-frame-options: DENY
access-control-allow-methods: POST,OPTIONS
content-type: text/plain
access-control-allow-origin: https://www.rd.com
access-control-max-age: 86400
access-control-allow-credentials: true
cf-ray: 7382ddd73c1b5c68-FRA
vary: Origin

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 23 B
489 B 46ms
46ms XHR
text/javascript 108.138.4.10
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.amazon-adsystem.com/e/dtb/bid?src=3235&u=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&pid=C3B2yxSmyB2Nx&cb=1&ws=1600x1200&v=8.1.0&t=1000&slots=%5B%7B%22sd%22%3A%22ad62f2b3465a2e3%22%2C%22s%22%3A%5B%226x6%22%5D%2C%22sn%22%3A%22%2F6178%2Frdg_desktop%2Fvideoarticle%2Fin_image%22%7D%5D&cfgv=1&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.138.4.10 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-4-10.fra56.r.cloudfront.net

Software

Server /

Resource Hash

89b4aa9e9bf8516c2ab7b5134f65d47b02071637259a14c9f60dccc207e05ce4

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:29 GMT
via: 1.1 bfb5bffe90e3b0e760933a7a07d850ba.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P6
x-amz-rid: R21YPTRV540EHWCVB4X0
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://www.rd.com
access-control-allow-credentials: true
permissions-policy: interest-cohort=()
strict-transport-security: max-age=47474747; includeSubDomains; preload
timing-allow-origin: *
content-length: 23
x-amz-cf-id: PHrh_zSobHKB0op-oI14GzqMqSs75YaLbcx8j9Y40WynFdXXP8DMjg==

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 23 B
489 B 48ms
48ms XHR
text/javascript 108.138.4.10
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.amazon-adsystem.com/e/dtb/bid?src=3235&u=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&pid=C3B2yxSmyB2Nx&cb=2&ws=1600x1200&v=8.1.0&t=1000&slots=%5B%7B%22sd%22%3A%22ad62f2b3465a4b9%22%2C%22s%22%3A%5B%22970x250%22%2C%22970x90%22%2C%22728x90%22%2C%223x3%22%5D%2C%22sn%22%3A%22%2F6178%2Frdg_desktop%2Fvideoarticle%2Fprearticle%22%7D%5D&cfgv=1&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.138.4.10 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-4-10.fra56.r.cloudfront.net

Software

Server /

Resource Hash

5d7c7d25a0da74c0dd466120c3c09bd94cb982fc66ebc4a78675339f37323bf5

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:29 GMT
via: 1.1 bfb5bffe90e3b0e760933a7a07d850ba.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P6
x-amz-rid: DSGD87CWH64PTQZ944J3
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://www.rd.com
access-control-allow-credentials: true
permissions-policy: interest-cohort=()
strict-transport-security: max-age=47474747; includeSubDomains; preload
timing-allow-origin: *
content-length: 23
x-amz-cf-id: Cn54Ln_WTZrnygvjp0KQnpWmPMS4yh3JBOeFqH8s11AR9BBiM1d9SA==

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 23 B
488 B 48ms
48ms XHR
text/javascript 108.138.4.10
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.amazon-adsystem.com/e/dtb/bid?src=3235&u=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&pid=C3B2yxSmyB2Nx&cb=3&ws=1600x1200&v=8.1.0&t=1000&slots=%5B%7B%22sd%22%3A%22ad62f2b3465a9fb%22%2C%22s%22%3A%5B%224x4%22%5D%2C%22sn%22%3A%22%2F6178%2Frdg_desktop%2Fvideoarticle%2Fsponsor%22%7D%5D&cfgv=1&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.138.4.10 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-4-10.fra56.r.cloudfront.net

Software

Server /

Resource Hash

1c4777fe3a673a05492e27d08032cc91c23ac5389897c9235b09b8b0f5a74db3

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:29 GMT
via: 1.1 bfb5bffe90e3b0e760933a7a07d850ba.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P6
x-amz-rid: HM0GBM6EF1RSRM2T9TYA
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://www.rd.com
access-control-allow-credentials: true
permissions-policy: interest-cohort=()
strict-transport-security: max-age=47474747; includeSubDomains; preload
timing-allow-origin: *
content-length: 23
x-amz-cf-id: 79Bua5quer467l6RDGOeOEiYzhDaMicKnNcy20-0uHVFWMRRR3TjrQ==

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 23 B
488 B 47ms
46ms XHR
text/javascript 108.138.4.10
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.amazon-adsystem.com/e/dtb/bid?src=3235&u=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&pid=C3B2yxSmyB2Nx&cb=4&ws=1600x1200&v=8.1.0&t=1000&slots=%5B%7B%22sd%22%3A%22ad62f2b3468fbbb%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F6178%2Frdg_desktop%2Fvideoarticle%2Frail_1%22%7D%5D&cfgv=1&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.138.4.10 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-4-10.fra56.r.cloudfront.net

Software

Server /

Resource Hash

6139dddd3b6b6b847bccd476918dc8fb4f4f5a10908e5707c704f155e0918e84

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:29 GMT
via: 1.1 bfb5bffe90e3b0e760933a7a07d850ba.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P6
x-amz-rid: MG7NYEB98X8QVYRM7W6S
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://www.rd.com
access-control-allow-credentials: true
permissions-policy: interest-cohort=()
strict-transport-security: max-age=47474747; includeSubDomains; preload
timing-allow-origin: *
content-length: 23
x-amz-cf-id: iyI6XhC7UH-_ai58Kr5KsEKSOFl4Zg02Fdm_J7B_3p0ymnneW09rxg==

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 57ms
21ms Script
application/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.rd.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 09 Aug 2022 19:23:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 50ms
22ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.rd.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 09 Aug 2022 19:23:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 821 B
533 B 258ms
232ms XHR
text/plain 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2681189642686725&correlator=3508949709187126&eid=31068848%2C42531606&output=ldjh&gdfp_req=1&vrg=2022080401&ptt=17&impl=fifs&iu_parts=6178%2Crdg_desktop%2Cvideoarticle%2Cin_image&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=6x6&ifi=1&adks=3269095932&sfv=1-0-38&fsapi=false&prev_scp=pos%3Doop%26location%3Doop%26tf%3Datf%26amznbid%3D2%26amznp%3D2%26m_mv%3DslotNoSlotData%26m_gv%3DslotNoSlotData&eri=1&cust_params=m_data%3D1%26m_safety%3Dunsafe%26m_categories%3Dgv_crime%252Cmoat_unsafe%26m_mv%3DdataAvailable%26m_gv%3DdataAvailable%26permutive%3D%26refresh%3Don%26rtime%3D30%26rnum%3D10%26property%3D6178%26siteId%3Drdg%26pageType%3Darticle%26url%3D%252Farticle%252Ffake-qr-code%252F%253F_PermHash%253D51cf1b81525390c4bf0b4f5edb1d5a7cbfcc42c12dc4c1801b8355cce898ef8b%2526_cmp%253Dreaduprdus%2526_ebid%253Dreaduprdus892022%2526_mid%253D521040%2526ehid%253DDB356BBBE6FE17684FD8C92DA1FA9B3732BD102B%26keywords%3Dpersonal-tech%252Ctech%26category%3Dpersonal-tech%252Ctech%26topic%3Dpersonal-tech%252Ctech%26pt%3Dvideo-article%26platform%3Ddesktop%26theme%3Dnew%26contentID%3D1720480%26sponsors%3Dno_value%26source%3Doriginal_to_tmbi%26categories-v2%3Dpersonal_tech%252Ctech%26ep_custom_result%3Dno_value%26author%3Dsw-107199%26content_group%3Dno_value%26afc%3Dno%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26ebid%3D%26campaign%3D%26mid%3D%26TMCM%3D47e0408c-fb17-40cc-a076-3e78b4eceb13%26gdpr_cookie_accepted%3Dtrue%26refer%3D%26random%3D26%26page_depth%3D1%26nwltr%3Dreaduprdus892022&sc=1&cookie_enabled=1&abxe=1&dt=1660073009859&lmt=1660072774&dlt=1660073007367&idt=612&adxs=-12245933&adys=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&url=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&frm=20&vis=1&psz=1260x7108&msz=1600x0&fws=128&ohw=0&ga_vid=1301817763.1660073008&ga_sid=1660073010&ga_hid=275016625&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

cafe /

Resource Hash

db9f62325642bd8ba149e128efe54e4f5072a700daaa9b586fc7a55c35dffc5f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:30 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 503
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.rd.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 64ms
29ms XHR
application/json 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022080401&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9e17addb1f066c3734f03eb49f081c7439b817d4ce21cdafcf6ef5cd81c05e51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 09 Aug 2022 19:23:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11127
x-xss-protection: 0

GET
H2 200 container.html Show response
23b1a0822ba1831bce09eec41594b818.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 425F 6 KB
4 KB 111ms
22ms Document
text/html 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://23b1a0822ba1831bce09eec41594b818.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 09 Aug 2022 19:23:29 GMT
expires: Wed, 09 Aug 2023 19:23:29 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 430 B
259 B 248ms
235ms XHR
text/plain 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2681189642686725&correlator=3508949709187126&eid=31068848%2C42531606&output=ldjh&gdfp_req=1&vrg=2022080401&ptt=17&impl=fifs&iu_parts=6178%2Crdg_desktop%2Cvideoarticle%2Csponsor&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=4x4&ifi=2&adks=1096665005&sfv=1-0-38&fsapi=false&prev_scp=pos%3Dsponsor%26tf%3Datf%26amznbid%3D2%26amznp%3D2%26m_mv%3DslotNoSlotData%26m_gv%3DslotNoSlotData&eri=1&cust_params=m_data%3D1%26m_safety%3Dunsafe%26m_categories%3Dgv_crime%252Cmoat_unsafe%26m_mv%3DdataAvailable%26m_gv%3DdataAvailable%26permutive%3D%26refresh%3Don%26rtime%3D30%26rnum%3D10%26property%3D6178%26siteId%3Drdg%26pageType%3Darticle%26url%3D%252Farticle%252Ffake-qr-code%252F%253F_PermHash%253D51cf1b81525390c4bf0b4f5edb1d5a7cbfcc42c12dc4c1801b8355cce898ef8b%2526_cmp%253Dreaduprdus%2526_ebid%253Dreaduprdus892022%2526_mid%253D521040%2526ehid%253DDB356BBBE6FE17684FD8C92DA1FA9B3732BD102B%26keywords%3Dpersonal-tech%252Ctech%26category%3Dpersonal-tech%252Ctech%26topic%3Dpersonal-tech%252Ctech%26pt%3Dvideo-article%26platform%3Ddesktop%26theme%3Dnew%26contentID%3D1720480%26sponsors%3Dno_value%26source%3Doriginal_to_tmbi%26categories-v2%3Dpersonal_tech%252Ctech%26ep_custom_result%3Dno_value%26author%3Dsw-107199%26content_group%3Dno_value%26afc%3Dno%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26ebid%3D%26campaign%3D%26mid%3D%26TMCM%3D47e0408c-fb17-40cc-a076-3e78b4eceb13%26gdpr_cookie_accepted%3Dtrue%26refer%3D%26random%3D26%26page_depth%3D1%26nwltr%3Dreaduprdus892022&sc=1&cookie_enabled=1&abxe=1&dt=1660073009875&lmt=1660072774&dlt=1660073007367&idt=612&adxs=250&adys=582&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&url=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&frm=20&vis=1&psz=680x23&msz=680x0&fws=0&ohw=0&ga_vid=1301817763.1660073008&ga_sid=1660073010&ga_hid=275016625&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

cafe /

Resource Hash

a7b36a3eb9f17d8c9358746188338240677f6d27016bae8571902a078d12097e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:30 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 229
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.rd.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 cygnus Show response
htlb.casalemedia.com/ 37 B
576 B 139ms
129ms XHR
application/json 104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=681266&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%2213b552f7a4e4eb2%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A0%2C%22msi%22%3A0%2C%22mfu%22%3A0%2C%22bu%22%3A1%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A1%2C%22ren%22%3Afalse%2C%22version%22%3A%226.24.2%22%2C%22userIds%22%3A%5B%5D%2C%22err%22%3A%7B%222%22%3A1%7D%2C%22fpd%22%3Atrue%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%2215b02611ec95716%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A728%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22681266%22%2C%22sid%22%3A%22728x90%22%7D%7D%2C%7B%22w%22%3A970%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22681266%22%2C%22sid%22%3A%22970x250%22%7D%7D%2C%7B%22w%22%3A970%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22681266%22%2C%22sid%22%3A%22970x90%22%7D%7D%5D%7D%2C%22ext%22%3A%7B%22dfp_ad_unit_code%22%3A%22%2F6178%2Frdg_desktop%2Fvideoarticle%2Fprearticle%22%7D%7D%5D%2C%22at%22%3A1%2C%22user%22%3A%7B%22data%22%3A%5B%7B%22name%22%3A%22permutive.com%22%2C%22segment%22%3A%5B%5D%7D%5D%7D%7D
Requested by: Host: micro.rubiconproject.com
URL: https://micro.rubiconproject.com/prebid/dynamic/10696.js?ver=1.0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 917a63a19dac1348bb634d55b57bf5ae9217f1b6c740df56b9525aa5557e18ae

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 09 Aug 2022 19:23:30 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 37
pragma: no-cache
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3ptgqbqE%2BY38d9bYDG6%2B6VfqBVX2VRcggew0P%2BPo%2FSVnOeau3%2BccJf8JaQYakY2p6%2B93iyM1Lk3BqL9TUT%2BNHw0VyYZ%2BjK9UaIVFmMTzCbF34hZ%2B%2BeZhUaqiZD4OZ7M3JhXt1nHT"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://www.rd.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 7382ddd7daeb68ef-FRA
expires: 0

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
57 B 65ms
65ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: micro.rubiconproject.com
URL: https://micro.rubiconproject.com/prebid/dynamic/10696.js?ver=1.0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.rd.com
date: Tue, 09 Aug 2022 19:23:29 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 381 B
832 B 167ms
96ms XHR
application/json 2602:803:c003:200::41
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=10696&site_id=377204&zone_id=2077660&size_id=2&alt_size_ids=55%2C57&rf=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&tg_i.aupname=6178%2Frdg_desktop%2Fvideoarticle%2Fprearticle&tg_i.pbadslot=%2F6178%2Frdg_desktop%2Fvideoarticle%2Fprearticle&tk_flint=dmpbjs_v6.24.2&x_source.tid=04082271-ffd2-49e3-af8a-ffb54e5fd56f&l_pb_bid_id=2161c55535a0c8f&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.16612586942854168
Requested by: Host: micro.rubiconproject.com
URL: https://micro.rubiconproject.com/prebid/dynamic/10696.js?ver=1.0
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 2602:803:c003:200::41 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: a1f86938ee81bd0bbd42f427141e814075ba7d660a4cc66f85ff9254a1278cb2

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 09 Aug 2022 19:23:30 GMT
Server: nginx/1.21.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://www.rd.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 381
Expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
503 B 54ms
54ms XHR
application/json 3.122.72.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: micro.rubiconproject.com
URL: https://micro.rubiconproject.com/prebid/dynamic/10696.js?ver=1.0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.122.72.35 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-122-72-35.eu-central-1.compute.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 09 Aug 2022 19:23:29 GMT
accept-ch: sec-ch-ect,user-agent,sec-ch-downlink,sec-ch-ua-mobile,sec-ch-save-data,sec-ch-device-memory,sec-ch-dpr,sec-ch-ua-full-version,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-viewport-width,sec-ch-ua-platform,sec-ch-viewport-height,sec-ch-rtt,sec-ch-ua-arch,sec-ch-ua,sec-ch-ua-bitness,sec-ch-prefers-color-scheme,sec-ch-width
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.rd.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

GET
H/1.1 200
OK bid Show response
krk.kargo.com/api/v2/ 2 B
673 B 46ms
13ms XHR
application/json 3.121.8.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://krk.kargo.com/api/v2/bid?json=%7B%22sessionId%22%3A%22bf17bc4a-ada9-4f43-8f86-17bb85ca731a%22%2C%22requestCount%22%3A0%2C%22timeout%22%3A2000%2C%22currency%22%3A%22USD%22%2C%22cpmGranularity%22%3A1%2C%22timestamp%22%3A1660073009886%2C%22cpmRange%22%3A%7B%22floor%22%3A0%2C%22ceil%22%3A20%7D%2C%22bidIDs%22%3A%7B%22255cafb8f78ca5c%22%3A%22_yJl1S0NHuh%22%7D%2C%22bidSizes%22%3A%7B%22255cafb8f78ca5c%22%3A%5B%5B970%2C250%5D%2C%5B970%2C90%5D%2C%5B728%2C90%5D%5D%7D%2C%22prebidRawBidRequests%22%3A%5B%7B%22bidder%22%3A%22kargo%22%2C%22params%22%3A%7B%22placementId%22%3A%22_yJl1S0NHuh%22%7D%2C%22ortb2Imp%22%3A%7B%22ext%22%3A%7B%22data%22%3A%7B%22aupname%22%3A%226178%2Frdg_desktop%2Fvideoarticle%2Fprearticle%22%2C%22adserver%22%3A%7B%22name%22%3A%22gam%22%2C%22adslot%22%3A%22%2F6178%2Frdg_desktop%2Fvideoarticle%2Fprearticle%22%7D%2C%22pbadslot%22%3A%22%2F6178%2Frdg_desktop%2Fvideoarticle%2Fprearticle%22%7D%7D%7D%2C%22mediaTypes%22%3A%7B%22banner%22%3A%7B%22sizes%22%3A%5B%5B970%2C250%5D%2C%5B970%2C90%5D%2C%5B728%2C90%5D%5D%7D%7D%2C%22adUnitCode%22%3A%22ad62f2b3465a4b9%22%2C%22transactionId%22%3A%2204082271-ffd2-49e3-af8a-ffb54e5fd56f%22%2C%22sizes%22%3A%5B%5B970%2C250%5D%2C%5B970%2C90%5D%2C%5B728%2C90%5D%5D%2C%22bidId%22%3A%22255cafb8f78ca5c%22%2C%22bidderRequestId%22%3A%2224a50911266e646%22%2C%22auctionId%22%3A%22eeb708cb-e393-4f8f-845a-f7e5a8c8b6ee%22%2C%22src%22%3A%22client%22%2C%22bidRequestsCount%22%3A1%2C%22bidderRequestsCount%22%3A1%2C%22bidderWinsCount%22%3A0%7D%5D%2C%22userIDs%22%3A%7B%22crbIDs%22%3A%7B%7D%7D%2C%22pageURL%22%3A%22https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10%22%2C%22rawCRB%22%3Anull%2C%22rawCRBLocalStorage%22%3Anull%7D
Requested by: Host: micro.rubiconproject.com
URL: https://micro.rubiconproject.com/prebid/dynamic/10696.js?ver=1.0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.121.8.16 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-121-8-16.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 09 Aug 2022 19:23:29 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: https://www.rd.com
Cache-Control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Krk-No-Bid-Reason: consent
Content-Length: 26
X-Accel-Expires: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 144 B
1 KB 142ms
142ms XHR
application/json 37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: micro.rubiconproject.com
URL: https://micro.rubiconproject.com/prebid/dynamic/10696.js?ver=1.0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

ce20a8cfb975010340fb75df709f5e56c7cc372b41f7e5c4260ceeda01ba9b0a

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 09 Aug 2022 19:23:30 GMT
X-Proxy-Origin: 178.162.209.129; 178.162.209.129; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: d13359fc-f476-4e83-a009-e44e86f2d757
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.rd.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 144
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 351 B
802 B 108ms
42ms XHR
application/json 2602:803:c003:200::41
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=10696&site_id=377204&zone_id=2077662&size_id=15&rf=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&tg_i.aupname=6178%2Frdg_desktop%2Fvideoarticle%2Frail_1&tg_i.pbadslot=%2F6178%2Frdg_desktop%2Fvideoarticle%2Frail_1&tk_flint=dmpbjs_v6.24.2&x_source.tid=b96d007c-1417-4d23-bc2e-70255043a29e&l_pb_bid_id=29c5642c39c46b9&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.8587361050971312
Requested by: Host: micro.rubiconproject.com
URL: https://micro.rubiconproject.com/prebid/dynamic/10696.js?ver=1.0
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 2602:803:c003:200::41 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: d4580aeae0f60a9b08cb20f9ac4591550718dfb989a75109bd76a84de4513991

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 09 Aug 2022 19:23:29 GMT
Server: nginx/1.21.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://www.rd.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 351
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H3 200 cygnus Show response
htlb.casalemedia.com/ 37 B
605 B 121ms
120ms XHR
application/json 104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=681270&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%2230dd0fca83f0502%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A0%2C%22msi%22%3A0%2C%22mfu%22%3A0%2C%22bu%22%3A1%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A1%2C%22ren%22%3Afalse%2C%22version%22%3A%226.24.2%22%2C%22userIds%22%3A%5B%5D%2C%22err%22%3A%7B%222%22%3A1%7D%2C%22fpd%22%3Atrue%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%2231133be016a0155%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A300%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22681270%22%2C%22sid%22%3A%22300x250%22%7D%7D%5D%7D%2C%22ext%22%3A%7B%22dfp_ad_unit_code%22%3A%22%2F6178%2Frdg_desktop%2Fvideoarticle%2Frail_1%22%7D%7D%5D%2C%22at%22%3A1%2C%22user%22%3A%7B%22data%22%3A%5B%7B%22name%22%3A%22permutive.com%22%2C%22segment%22%3A%5B%5D%7D%5D%7D%7D
Requested by: Host: micro.rubiconproject.com
URL: https://micro.rubiconproject.com/prebid/dynamic/10696.js?ver=1.0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e2d3a61ed75752b249f1d03fdfede37dda068c8a2fc0a58f738d1c14438b17c4

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 09 Aug 2022 19:23:30 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 37
pragma: no-cache
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L9HBnU1FEs03o%2Fa4AKMiFHNTwZYyGyZ8w2tvB7nTXgCHgoNHnIjau85xTEFlFO05lgalGMg5Vr%2BpNKXgCnm3OXUkLVV6zJ%2Bn3%2FIPfqow6j3B5%2FgAEmbnENVX1t01E99jxe8cS5no"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://www.rd.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 7382ddd7eaf068ef-FRA
expires: 0

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
503 B 143ms
143ms XHR
application/json 3.122.72.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: micro.rubiconproject.com
URL: https://micro.rubiconproject.com/prebid/dynamic/10696.js?ver=1.0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.122.72.35 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-122-72-35.eu-central-1.compute.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 09 Aug 2022 19:23:30 GMT
accept-ch: sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-arch,sec-ch-rtt,sec-ch-viewport-height,sec-ch-ua-platform,sec-ch-viewport-width,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-dpr,sec-ch-device-memory,sec-ch-save-data,sec-ch-ua-mobile,sec-ch-downlink,user-agent,sec-ch-ect,sec-ch-width,sec-ch-prefers-color-scheme
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.rd.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
57 B 39ms
39ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: micro.rubiconproject.com
URL: https://micro.rubiconproject.com/prebid/dynamic/10696.js?ver=1.0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.rd.com
date: Tue, 09 Aug 2022 19:23:28 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 144 B
1 KB 133ms
120ms XHR
application/json 37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: micro.rubiconproject.com
URL: https://micro.rubiconproject.com/prebid/dynamic/10696.js?ver=1.0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

e2c487c59c8c431220ea6e16cc0e26f41010fdd878000b34201a7ff7e2ee3515

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 09 Aug 2022 19:23:30 GMT
X-Proxy-Origin: 178.162.209.129; 178.162.209.129; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 2e784696-43c3-428a-b67c-00e51caab446
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.rd.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 144
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK bid Show response
krk.kargo.com/api/v2/ 2 B
673 B 40ms
13ms XHR
application/json 3.121.8.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://krk.kargo.com/api/v2/bid?json=%7B%22sessionId%22%3A%22bf17bc4a-ada9-4f43-8f86-17bb85ca731a%22%2C%22requestCount%22%3A1%2C%22timeout%22%3A2000%2C%22currency%22%3A%22USD%22%2C%22cpmGranularity%22%3A1%2C%22timestamp%22%3A1660073009894%2C%22cpmRange%22%3A%7B%22floor%22%3A0%2C%22ceil%22%3A20%7D%2C%22bidIDs%22%3A%7B%2239ad5aea4b8e735%22%3A%22_awDqAZGHYZ%22%7D%2C%22bidSizes%22%3A%7B%2239ad5aea4b8e735%22%3A%5B%5B300%2C250%5D%5D%7D%2C%22prebidRawBidRequests%22%3A%5B%7B%22bidder%22%3A%22kargo%22%2C%22params%22%3A%7B%22placementId%22%3A%22_awDqAZGHYZ%22%7D%2C%22ortb2Imp%22%3A%7B%22ext%22%3A%7B%22data%22%3A%7B%22aupname%22%3A%226178%2Frdg_desktop%2Fvideoarticle%2Frail_1%22%2C%22adserver%22%3A%7B%22name%22%3A%22gam%22%2C%22adslot%22%3A%22%2F6178%2Frdg_desktop%2Fvideoarticle%2Frail_1%22%7D%2C%22pbadslot%22%3A%22%2F6178%2Frdg_desktop%2Fvideoarticle%2Frail_1%22%7D%7D%7D%2C%22mediaTypes%22%3A%7B%22banner%22%3A%7B%22sizes%22%3A%5B%5B300%2C250%5D%5D%7D%7D%2C%22adUnitCode%22%3A%22ad62f2b3468fbbb%22%2C%22transactionId%22%3A%22b96d007c-1417-4d23-bc2e-70255043a29e%22%2C%22sizes%22%3A%5B%5B300%2C250%5D%5D%2C%22bidId%22%3A%2239ad5aea4b8e735%22%2C%22bidderRequestId%22%3A%2238f9284e7e9a043%22%2C%22auctionId%22%3A%22d6d2d65b-88a7-44d6-b27d-37e4468efdb3%22%2C%22src%22%3A%22client%22%2C%22bidRequestsCount%22%3A1%2C%22bidderRequestsCount%22%3A1%2C%22bidderWinsCount%22%3A0%7D%5D%2C%22userIDs%22%3A%7B%22crbIDs%22%3A%7B%7D%7D%2C%22pageURL%22%3A%22https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10%22%2C%22rawCRB%22%3Anull%2C%22rawCRBLocalStorage%22%3Anull%7D
Requested by: Host: micro.rubiconproject.com
URL: https://micro.rubiconproject.com/prebid/dynamic/10696.js?ver=1.0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.121.8.16 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-121-8-16.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 09 Aug 2022 19:23:29 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: https://www.rd.com
Cache-Control: no-cache, no-store, no-transform, must-revalidate, private, max-age=0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Krk-No-Bid-Reason: consent
Content-Length: 26
X-Accel-Expires: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 59ms
23ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 09 Aug 2022 19:23:29 GMT

GET
H2 204 ping.gif
prd.jwpltx.com/v1/jwplayer6/ 0
82 B 106ms
106ms Image
text/plain 2a04:4e42:200::626
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prd.jwpltx.com/v1/jwplayer6/ping.gif?h=291986700&e=bs&n=7042910767497377&abc=0&abt=162_ad-iab-viewability_v4%2C128_sendDomainToFeedsOn&aid=UV3t3od4EeeD_gY3v_uBow&amp=0&ask=DPCwJXPi&at=1&c=1&ccp=0&cp=0&d=2&eb=0&ed=6&emi=1h7axzz1tf45&i=0&id=RO5TLTlb&lid=u4r8ty1qd50g&lsa=read&mt=1&pbd=1&pbr=1&pgi=iqaez5mo3opm&ph=1&pid=wjcpcdaI&pii=0&pl=383&plc=1&pli=1ald1dj1xy3x&pp=hlsjs&ppm=VOD&prc=1&ps=4&pss=1&pt=How%20to%20Identify%20a%20Fake%20QR%20Code%E2%80%94and%20Avoid%20Being%20Scammed&pu=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&pv=8.25.8&pyc=0&s=1&sdk=0&stc=1&stpe=0&t=Online%20Scams%20You%20Need%20to%20Be%20Aware%20of%20--%20and%20How%20to%20Avoid%20Them&tv=3.40.0&vb=0&vi=0&vl=90&wd=681&fed=hFIGA5RR&fid=58b42cd8-093f-4083-af50-55dd923d2d5b&ft=FEED&mu=https%3A%2F%2Fcdn.jwplayer.com%2Fmanifests%2FRO5TLTlb.m3u8&os=1&sa=1660073009980
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::626 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:30 GMT
via: 1.1 varnish
server: nginx
accept-ranges: bytes
x-served-by: cache-fra19164-FRA
x-cache: MISS
x-cache-hits: 0

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame BA80 13 KB
5 KB 43ms
13ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1169
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 09 Aug 2022 19:04:01 GMT
expires: Wed, 09 Aug 2023 19:04:01 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 675F 783 B
536 B 54ms
24ms Document
text/html 2a00:1450:4001:80b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

7340df43419118c6b64c973c496ecd6b95b0450eee32dc58b2ca4758bd3c2e80

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-nspWWl5pyONOG_VAF93MWQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 514
content-security-policy: script-src 'report-sample' 'nonce-nspWWl5pyONOG_VAF93MWQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 09 Aug 2022 19:23:30 GMT
expires: Tue, 09 Aug 2022 19:23:30 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 24ms
23ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.rd.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 09 Aug 2022 19:23:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 22ms
22ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.rd.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 09 Aug 2022 19:23:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 44 KB
11 KB 438ms
438ms XHR
text/plain 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2681189642686725&correlator=3508949709187126&eid=31068848%2C42531606&output=ldjh&gdfp_req=1&vrg=2022080401&ptt=17&impl=fifs&iu_parts=6178%2Crdg_desktop%2Cvideoarticle%2Crail_1&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=300x250&ifi=3&adks=1343688179&sfv=1-0-38&fsapi=false&prev_scp=location%3Dtop%26tf%3Datf%26pos%3Drail_1%26amznbid%3D2%26amznp%3D2%26m_mv%3DslotNoSlotData%26m_gv%3DslotNoSlotData&eri=1&cust_params=m_data%3D1%26m_safety%3Dunsafe%26m_categories%3Dgv_crime%252Cmoat_unsafe%26m_mv%3DdataAvailable%26m_gv%3DdataAvailable%26permutive%3D%26refresh%3Don%26rtime%3D30%26rnum%3D10%26property%3D6178%26siteId%3Drdg%26pageType%3Darticle%26url%3D%252Farticle%252Ffake-qr-code%252F%253F_PermHash%253D51cf1b81525390c4bf0b4f5edb1d5a7cbfcc42c12dc4c1801b8355cce898ef8b%2526_cmp%253Dreaduprdus%2526_ebid%253Dreaduprdus892022%2526_mid%253D521040%2526ehid%253DDB356BBBE6FE17684FD8C92DA1FA9B3732BD102B%26keywords%3Dpersonal-tech%252Ctech%26category%3Dpersonal-tech%252Ctech%26topic%3Dpersonal-tech%252Ctech%26pt%3Dvideo-article%26platform%3Ddesktop%26theme%3Dnew%26contentID%3D1720480%26sponsors%3Dno_value%26source%3Doriginal_to_tmbi%26categories-v2%3Dpersonal_tech%252Ctech%26ep_custom_result%3Dno_value%26author%3Dsw-107199%26content_group%3Dno_value%26afc%3Dno%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26ebid%3D%26campaign%3D%26mid%3D%26TMCM%3D47e0408c-fb17-40cc-a076-3e78b4eceb13%26gdpr_cookie_accepted%3Dtrue%26refer%3D%26random%3D26%26page_depth%3D1%26nwltr%3Dreaduprdus892022&sc=1&cookie_enabled=1&abxe=1&dt=1660073010045&lmt=1660072774&dlt=1660073007367&idt=612&adxs=991&adys=467&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&url=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&frm=20&vis=1&psz=367x275&msz=367x275&fws=512&ohw=0&ga_vid=1301817763.1660073008&ga_sid=1660073010&ga_hid=275016625&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

cafe /

Resource Hash

5413479dd05424eecd22d956df8c2b591087eb385f94c003f4ef62a8c28137ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:30 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11333
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.rd.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 45 KB
11 KB 721ms
720ms XHR
text/plain 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2681189642686725&correlator=3508949709187126&eid=31068848%2C42531606&output=ldjh&gdfp_req=1&vrg=2022080401&ptt=17&impl=fifs&iu_parts=6178%2Crdg_desktop%2Cvideoarticle%2Cprearticle&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=970x250%7C970x90%7C728x90%7C3x3&ifi=4&adks=2282643038&sfv=1-0-38&fsapi=false&prev_scp=pos%3Dprearticle%26location%3Dtop%26tf%3Datf%26amznbid%3D2%26amznp%3D2%26m_mv%3DslotNoSlotData%26m_gv%3DslotNoSlotData&eri=1&cust_params=m_data%3D1%26m_safety%3Dunsafe%26m_categories%3Dgv_crime%252Cmoat_unsafe%26m_mv%3DdataAvailable%26m_gv%3DdataAvailable%26permutive%3D%26refresh%3Don%26rtime%3D30%26rnum%3D10%26property%3D6178%26siteId%3Drdg%26pageType%3Darticle%26url%3D%252Farticle%252Ffake-qr-code%252F%253F_PermHash%253D51cf1b81525390c4bf0b4f5edb1d5a7cbfcc42c12dc4c1801b8355cce898ef8b%2526_cmp%253Dreaduprdus%2526_ebid%253Dreaduprdus892022%2526_mid%253D521040%2526ehid%253DDB356BBBE6FE17684FD8C92DA1FA9B3732BD102B%26keywords%3Dpersonal-tech%252Ctech%26category%3Dpersonal-tech%252Ctech%26topic%3Dpersonal-tech%252Ctech%26pt%3Dvideo-article%26platform%3Ddesktop%26theme%3Dnew%26contentID%3D1720480%26sponsors%3Dno_value%26source%3Doriginal_to_tmbi%26categories-v2%3Dpersonal_tech%252Ctech%26ep_custom_result%3Dno_value%26author%3Dsw-107199%26content_group%3Dno_value%26afc%3Dno%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26ebid%3D%26campaign%3D%26mid%3D%26TMCM%3D47e0408c-fb17-40cc-a076-3e78b4eceb13%26gdpr_cookie_accepted%3Dtrue%26refer%3D%26random%3D26%26page_depth%3D1%26nwltr%3Dreaduprdus892022&sc=1&cookie_enabled=1&abxe=1&dt=1660073010061&lmt=1660072774&dlt=1660073007367&idt=612&adxs=315&adys=177&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&url=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&frm=20&vis=1&psz=1260x275&msz=1260x270&fws=0&ohw=0&ga_vid=1301817763.1660073008&ga_sid=1660073010&ga_hid=275016625&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

cafe /

Resource Hash

de70dfb4d84a8ec90477e9e76a9ff7fefd352f9e806a74313b6f6d6232261473

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:30 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11224
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.rd.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 jjp8A9boDrBmSAr_yfbeEM1ThbAhpFVxRN30ZpHEy3Q.js Show response
pagead2.googlesyndication.com/bg/ Frame BA80 36 KB
14 KB 41ms
13ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/jjp8A9boDrBmSAr_yfbeEM1ThbAhpFVxRN30ZpHEy3Q.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8e3a7c03d6e80eb066480affc9f6de10cd5385b021a4557144ddf46691c4cb74

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 13:17:04 GMT
content-encoding: br
x-content-type-options: nosniff
age: 21986
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14162
x-xss-protection: 0
last-modified: Fri, 29 Jul 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 09 Aug 2023 13:17:04 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 675F 0
0 75ms
47ms Image
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022080401&jk=2681189642686725&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame BA80 0
10 B 13ms
13ms Image
text/plain 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?k0cQbA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:30 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H/1.1 200
OK user-sync Show response
sync.adkernel.com/ Frame 4E82 0
109 B 38ms
12ms Document
text/plain 77.245.57.72
WEBAIR-INTERNET-MTL

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adkernel.com/user-sync?zone=147357&r=https%3A%2F%2Fdemand.catapultx.com%2Fsync%3Fakuid%3Dhttps%3A%2F%2Fwww.rd.com%7C%7BUID%7D
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 77.245.57.72 , United States, ASN36057 (WEBAIR-INTERNET-MTL, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: close
Content-Length: 0
Date: Tue, 09 Aug 2022 19:23:30 GMT
Server: nginx

GET
H2

200

yz9d1p83-120.jpg
assets-jpcust.jwpsrv.com/thumbnails/
Redirect Chain

https://cdn.jwplayer.com/v2/media/cfnX7XUU/poster.jpg?width=120
https://assets-jpcust.jwpsrv.com/thumbnails/yz9d1p83-120.jpg

3 KB
4 KB

126ms
125ms

Image
image/jpeg

2a04:4e42:200::626
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-jpcust.jwpsrv.com/thumbnails/yz9d1p83-120.jpg
Protocol: H2
Server: 2a04:4e42:200::626 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: f1a21e904e61bafb952bbb2f64a3a28f456d963db7126cadd80b2116a5455da0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:30 GMT
content-encoding: gzip
age: 413
x-amz-server-side-encryption: AES256
x-cache: HIT, HIT
content-length: 3341
x-served-by: cache-iad-kiad7000132-IAD, cache-fra19164-FRA
access-control-allow-origin: *
last-modified: Fri, 12 Nov 2021 00:40:33 GMT
server: nginx
x-timer: S1660073011.647469,VS0,VE93
etag: "842d3bd34cc160f2fc4cad9647500eac"
vary: Accept-Encoding
content-type: image/jpeg
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=900
accept-ranges: bytes
access-control-allow-headers: accept-encoding, cache-control, origin, dnt, accept-language
x-cache-hits: 1, 1

Redirect headers

date: Tue, 09 Aug 2022 19:23:30 GMT
via: 1.1 b48fca327a980187d93a198e7530195c.cloudfront.net (CloudFront)
server: openresty
x-amz-cf-pop: VIE50-C1
location: https://assets-jpcust.jwpsrv.com/thumbnails/yz9d1p83-120.jpg
access-control-allow-methods: GET
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=180, max-stale=180
x-cache: Miss from cloudfront
access-control-allow-headers: accept-encoding, cache-control, origin, dnt, accept-language
content-length: 0
x-amz-cf-id: Rul_1001YWggvzuLyyfwykHsct6fdoJDhH9sMc5de_yTXJmDuPaaQg==

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012207221643000/ Frame 054A 220 KB
61 KB 74ms
23ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012207221643000/amp4ads-v0.mjs

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202207121816/wrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e78609c13e44bafd8f619e97e02631aea063465da09c9f1022a24a30f2ecd192

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 97525
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 61462
x-xss-protection: 0
server: sffe
date: Mon, 08 Aug 2022 16:18:05 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "006401e583f0e23c"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 08 Aug 2023 16:18:05 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012207221643000/v0/ Frame 054A 14 KB
5 KB 90ms
40ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012207221643000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202207121816/wrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

09bdd678609812f4311a2a3ae3b63b08b35029f886975555f704a3f79fbbe2d5

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 97525
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5196
x-xss-protection: 0
server: sffe
date: Mon, 08 Aug 2022 16:18:05 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "bc8caad49b08d8fb"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 08 Aug 2023 16:18:05 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012207221643000/v0/ Frame 054A 94 KB
28 KB 91ms
40ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012207221643000/v0/amp-analytics-0.1.mjs

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202207121816/wrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

866c3e7e9c3ac0d8e0df50f622518445b0465dc4a34bbb6082b6c27391d77dbc

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 97525
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28864
x-xss-protection: 0
server: sffe
date: Mon, 08 Aug 2022 16:18:05 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "14e9be8f3cf5efda"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 08 Aug 2023 16:18:05 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012207221643000/v0/ Frame 054A 5 KB
2 KB 101ms
51ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012207221643000/v0/amp-fit-text-0.1.mjs

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202207121816/wrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b396ad1f1cac053ea579e5989462b206af7fb863907bf319fe02d2a5ce29aebc

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 97525
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1913
x-xss-protection: 0
server: sffe
date: Mon, 08 Aug 2022 16:18:05 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "fcd376918b45715d"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 08 Aug 2023 16:18:05 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012207221643000/v0/ Frame 054A 40 KB
13 KB 98ms
48ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012207221643000/v0/amp-form-0.1.mjs

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202207121816/wrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1c9464895887e89bf485eb9a07e7ebe22ff70133a8bcb1e19a0774ecf67703a8

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 97525
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12959
x-xss-protection: 0
server: sffe
date: Mon, 08 Aug 2022 16:18:05 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "fd6c62727a90c1dd"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 08 Aug 2023 16:18:05 GMT

GET
DATA 200
OK truncated
/ Frame 054A 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c96b700589fc0e7649b9794319674963d8c09a2c2f352ffaf93fd46bc2d8aa79

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK pixel
protected-by.clarium.io/ 68 B
345 B 50ms
11ms Image
image/png 52.57.125.17
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://protected-by.clarium.io/pixel?tag=wt_VUhVbWFyT0VNVmNWWHRjazVtMm1kbERqWlFvLzIzNDk1MzgyODk6MzAweDI1MA==&v=5&s=v31ga20vpap&sb=-1&h=www.rd.com&cb=5979538&d=eyJ3aCI6IlZVaFZiV0Z5VDBWTlZtTldXSFJqYXpWdE1tMWtiRVJxV2xGdkx6SXpORGsxTXpneU9EazZNekF3ZURJMU1BPT0iLCJ3ZCI6eyJvIjoyMzQ5NTM4Mjg5LCJ3IjoiMzAwIiwiaCI6IjI1MCJ9LCJ3ciI6Mn0=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.57.125.17 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-125-17.eu-central-1.compute.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 09 Aug 2022 19:23:30 GMT
Server: nginx/1.14.0 (Ubuntu)
Content-Type: image/png
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 68
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H3 200 16594411703232708560
tpc.googlesyndication.com/simgad/ Frame 054A 12 KB
12 KB 15ms
14ms Image
image/png 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/16594411703232708560?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qmfsXSJm2PmOrgZssABlEUF0Sgikw

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

41bfc94dec842bcbdd396a0e78a1568638f50b5067fa94c66a767af05c77da59

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 04 Aug 2022 05:31:51 GMT
x-content-type-options: nosniff
age: 481899
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11897
x-xss-protection: 0
last-modified: Wed, 03 Aug 2022 14:40:20 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 04 Aug 2023 05:31:51 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 054A 2 KB
2 KB 16ms
15ms Image
image/png 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:03:14 GMT
x-content-type-options: nosniff
server: cafe
age: 1216
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 14819457070020093239
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Wed, 10 Aug 2022 19:03:14 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 054A 295 B
319 B 14ms
13ms Image
image/png 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 05:50:56 GMT
x-content-type-options: nosniff
server: cafe
age: 48754
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 426692510519060060
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Wed, 10 Aug 2022 05:50:56 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 054A 0
0 22ms
21ms Image
text/html 2a00:1450:4001:80b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRUL7jr10XAVvtl8PaSJf83WZvB-BVxX1-JR8VWkzxBYxlFw4LWMNV8CvUkCFPjfXEDEzJ4
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 054A 0
0 60ms
59ms Image
text/html 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C_afaMrTyYo2gB8Gh1gaFupKoC8bQrs1r9ImD4oMQsKGy74MCEAEg_Y3LGGCV0qOCsAegAYKY_eADyAECqQI2bYEoryaxPuACAKgDAcgDCKoEpgNP0ONhcxEQwyS6UT7LKBlQ0TqAvJH7goBv-8tHJ2-LMfghu1xvlxPIeyMOFa5WOaWtxGTNT8ZJeZNXcap-PxxNcrg2j8gRKNjyVygwddQfbANt-lkoTVoWT-MHMDN84wcqscbhm5HRSvymw6j66bE5rrpgq8rLvBSkWbmHgdOTKzATLGwP6POqF3b_iRfNDQGZ__GgBQvMrEdYYVjtAXhnl08Er5fApeoRaLDoig7JeUqK3rLRu9bCs9zrZLNcYifq7r8C_IJzS8RXpEzfBNR_wKN0g2amJgYteWbTUplP6u4Yu_eTA5jBBadf6BlXpOqI7pWfZPclx6Tb0AC9SM0w1tsMPHPGJVSjpA_cDZt9c0cqpWlDoerWAevw7M55cXYE-i37EvNhP7gvNH3K6POLx8-pZ1MwGtB5viTL86g_whIdVqK4E4k23viyMHZk5v4JSyhPKGtxoeWTw8TBCvmaDH1QpGeEMBtUIDnjiL1mU7Fo0_G_YppDfxfPWPUVmKyiRMLKx3Lt3s9IrYM4FrL8GBDE5OJIk-qy3cspSyeILMvpnBM4x8AEysHU45ME4AQBkgUECAQYAZIFBAgFGASgBgKAB8TkxDaoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAfIHBBCQjBTSCBEIgOGAcBABGB0yAusCOgKAQIAKA8gLAdgTDdAVAZgWAYAXAbIXHgocCAASFHB1Yi0xNjI5NjEyNzU5NjQxNTIwGNmhFQ&sigh=G2GrhM1NRqE&uach_m=[UACH]
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s08-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

GET
H2 200 segments_to_partner.js Show response
cdn.krxd.net/partnerjs/ 7 KB
4 KB 37ms
7ms Script
application/javascript 151.101.194.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.krxd.net/partnerjs/segments_to_partner.js?partner=a272cefb-df39-4fcd-beff-79cd6cdf22ec&client=trust
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/tmbiyieldheader910374028064/moatheader.js?ver=1.0.3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.194.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 0ed9f4489f29950f54053b4620800f6f1e061f3a467dfda552104034a71c3da9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-cdn-backend: 4FrRTvEr9h480D4BywjehZ--F_Partner_JS_S3
date: Tue, 09 Aug 2022 19:23:30 GMT
content-encoding: gzip
age: 935
x-amz-server-side-encryption: AES256
x-cache: HIT
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
content-length: 3459
x-served-by: cache-fra19154-FRA
last-modified: Wed, 03 Jun 2020 21:02:49 GMT
x-timer: S1660073011.561270,VS0,VE0
etag: "db6884bae01ad7499be92887e1875ecc"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 varnish
accept-ranges: bytes
x-cache-hits: 12

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
274 B 83ms
7ms Image
image/gif 23.35.237.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=TMBI_PREBID_HEADER1&hp=1&zMoatAdUnit1=rdg_desktop&zMoatAdUnit2=videoarticle&zMoatAdUnit3=rail_1&wf=1&ra=3&pxm=7&sgs=3&vb=4&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=11&f=0&j=&t=1660073007525&de=368357316332&rx=51276775722&m=0&ar=1da355aa18f-clean&iw=601e6e1&q=1&cb=0&cu=1660073007525&ll=2&lm=0&ln=0&em=0&en=0&d=81188057%3A2349538289%3A5052870237%3A138269341240&cm=1&zGSRC=1&gu=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&id=1&ii=4&bo=rdg_desktop&bd=rail_1&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&gw=tmbiyieldheader910374028064&fd=1&it=500&pe=1%3A857%3A857%3A3019%3A986&fs=199703&na=1569934084&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-151.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

unused62: 8096267
date: Tue, 09 Aug 2022 19:23:30 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
pragma: no-cache
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 09 Aug 2022 19:23:30 GMT

POST
H2 202 event Show response
prebid-a.rubiconproject.com/ 61 B
225 B 8ms
8ms XHR
application/json 3.65.165.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-a.rubiconproject.com/event
Requested by: Host: micro.rubiconproject.com
URL: https://micro.rubiconproject.com/prebid/dynamic/10696.js?ver=1.0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.65.165.22 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-65-165-22.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: edda75d7dc3a6104c5af0f926c5ae645ae25eb8c4f8a601c6d5293378e858a5c

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: *
date: Tue, 09 Aug 2022 19:23:30 GMT
content-length: 61
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type: application/json

OPTIONS
H2 200 event
prebid-a.rubiconproject.com/ Frame 0
0 9ms
9ms Preflight 3.65.165.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-a.rubiconproject.com/event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.65.165.22 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-65-165-22.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.rd.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-max-age: 1800
allow: GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH
content-length: 0
date: Tue, 09 Aug 2022 19:23:30 GMT
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers

GET
H2 200 get Show response
cdn.krxd.net/userdata/ 195 B
377 B 119ms
118ms Script
text/javascript 151.101.194.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.krxd.net/userdata/get?pub=700bca2a-e4ec-4f23-be94-47317652bac0&callback=kx_partner_segments
Requested by: Host: cdn.krxd.net
URL: https://cdn.krxd.net/partnerjs/segments_to_partner.js?partner=a272cefb-df39-4fcd-beff-79cd6cdf22ec&client=trust
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.194.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 73c96c74b22e305ac760cbf63d54a9f08e0e3cb3c7384112f55ad36b1286de35

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-cdn-backend: 4FrRTvEr9h480D4BywjehZ--F_userdata_ash_prod_krxd_net___UserData_Service_V2
date: Tue, 09 Aug 2022 19:23:30 GMT
content-encoding: gzip
age: 0
x-served-by: userdata-a017-ash-prod.krxd.net, cache-fra19154-FRA
vary: Accept-Encoding
x-cache: MISS, MISS
content-type: text/javascript
via: 1.1 varnish
cache-control: private, max-age=3600
x-age: 0
accept-ranges: bytes
x-timer: S1660073011.571027,VS0,VE98
content-length: 164
x-cache-hits: 0, 0

GET
H2

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 054A
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
0

80ms
43ms

Image
text/html

2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: H2
Server: 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Redirect headers

date: Tue, 09 Aug 2022 19:23:30 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 50ms
50ms Image
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2022080401&jk=2681189642686725&bg=!ZWalZiLNAAZGjrx1Zo47ACkAdvg8Wof_fec9gaXk_0dUS5LWgbRSGMB896FzxDiadzHP1yQS8dGx4QIAAABiUgAAAAFoAQeZAsnDbMeGujwCWlEYXTrWxBsqEt1Ns0VyUN9ylOvRZ6Ywn9lQxIoviYKBTIRnEJO4x71QcU4eKo2JAcbZMcovfIz_edr4WmAumDxZm2XH2dzZDxH6xKjKfelKo0DugTa8SbvOf4w2L9b3FZMeiYX_lvAzLraSqho1OTgCPvgsI982ShlwgtdNLiHHJqkSiINM2HjIuw5QD4Bl_1c1QFYQQMMWNm-b61o9xWQQxXlKl3AwuFG2CGnlnKjhsrYLhi1fSvw07wRvAvjUV2iNIxUCzLqqU0JkEwhrKXCFh-6zSeL3nVkCyzg8i0TqtE2-zHJ5W72eRWoaq9PwWqkqhzgvaScyT_T0q9F2QF3KQufUz61MxhAmFZz7qQ8WOsvRM4gzXdhwrVSO1TJdgHunJQBvZu8rlXUgCLgU45T96b6FafkGBrzBpDfxY_FpCdmIemlcveBtzI1q_lQc0XPMzyI45vP12IjgPP0S_TgujgBF3fRn3cQJ_nZ1NsPhRC-QF_0lOHE4GN8hZc9GI4QyXMm5fY7mxq2Q2YyviOfG5IjRzj10M1ckUY3mK-vv_v8RS27ic0ifA7DRvChKaHrTORqsifNV0rxHAvXIfwt0v0PFHbCZ80xPTi7D5otsQWNPi2rhc2AebRBP2KJK6tfMrwp2Rb5Wl4JdGzZe0sDCiKXbfM5kaWNh5g9lzdP_84-Xi6Um4h1i1262UXYaRUGB-bUwNN0AN31U_M5x3AdH62IOpm7taurDYNc8hDyVZHeUBsj3R5p7ZF383w-B2-8Q-eEbo6J0p91RPRCy0qZRjmAcksF0nsShprO3N2hd5j3VHp0BWG-ybd4bsr15AEiawQvwepcMS2Ff2E_qrtebadLII6Cll0yk1i89TI0mLffFy7jg_mqmANaAds-4Z69Tet4ZdhEJ0P27yGfzmN9bWSgQ0xdhRBE1URQDkc2hbw
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

GET
H3 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012207221643000/ Frame 4014 220 KB
60 KB 52ms
20ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012207221643000/amp4ads-v0.mjs

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202207121816/wrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e78609c13e44bafd8f619e97e02631aea063465da09c9f1022a24a30f2ecd192

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 97525
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 61462
x-xss-protection: 0
server: sffe
date: Mon, 08 Aug 2022 16:18:05 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "006401e583f0e23c"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 08 Aug 2023 16:18:05 GMT

GET
H3 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012207221643000/v0/ Frame 4014 14 KB
5 KB 78ms
47ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012207221643000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202207121816/wrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

09bdd678609812f4311a2a3ae3b63b08b35029f886975555f704a3f79fbbe2d5

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 97525
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5196
x-xss-protection: 0
server: sffe
date: Mon, 08 Aug 2022 16:18:05 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "bc8caad49b08d8fb"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 08 Aug 2023 16:18:05 GMT

GET
H3 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012207221643000/v0/ Frame 4014 94 KB
28 KB 70ms
39ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012207221643000/v0/amp-analytics-0.1.mjs

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202207121816/wrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

866c3e7e9c3ac0d8e0df50f622518445b0465dc4a34bbb6082b6c27391d77dbc

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 97525
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28864
x-xss-protection: 0
server: sffe
date: Mon, 08 Aug 2022 16:18:05 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "14e9be8f3cf5efda"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 08 Aug 2023 16:18:05 GMT

GET
H3 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012207221643000/v0/ Frame 4014 5 KB
2 KB 78ms
47ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012207221643000/v0/amp-fit-text-0.1.mjs

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202207121816/wrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b396ad1f1cac053ea579e5989462b206af7fb863907bf319fe02d2a5ce29aebc

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 97525
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1913
x-xss-protection: 0
server: sffe
date: Mon, 08 Aug 2022 16:18:05 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "fcd376918b45715d"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 08 Aug 2023 16:18:05 GMT

GET
H3 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012207221643000/v0/ Frame 4014 40 KB
13 KB 75ms
44ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012207221643000/v0/amp-form-0.1.mjs

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202207121816/wrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1c9464895887e89bf485eb9a07e7ebe22ff70133a8bcb1e19a0774ecf67703a8

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 97525
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12959
x-xss-protection: 0
server: sffe
date: Mon, 08 Aug 2022 16:18:05 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "fd6c62727a90c1dd"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 08 Aug 2023 16:18:05 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 4014 2 KB
2 KB 14ms
13ms Image
image/png 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202207121816/wrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:03:14 GMT
x-content-type-options: nosniff
server: cafe
age: 1216
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 14819457070020093239
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Wed, 10 Aug 2022 19:03:14 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 4014 295 B
319 B 14ms
14ms Image
image/png 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202207121816/wrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 05:50:56 GMT
x-content-type-options: nosniff
server: cafe
age: 48754
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 426692510519060060
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Wed, 10 Aug 2022 05:50:56 GMT

GET
DATA 200
OK truncated
/ Frame 4014 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5cd935496108c34f1f3e37e1b1eb791ed14b8683770a991a13edbc0660a3df3d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK pixel
protected-by.clarium.io/ 68 B
345 B 13ms
12ms Image
image/png 52.57.125.17
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://protected-by.clarium.io/pixel?tag=wt_VUhVbWFyT0VNVmNWWHRjazVtMm1kbERqWlFvLzIzNDk1MzgyODk6OTcweDI1MA==&v=5&s=v31ga20vpjp&sb=-1&h=www.rd.com&cb=9662879&d=eyJ3aCI6IlZVaFZiV0Z5VDBWTlZtTldXSFJqYXpWdE1tMWtiRVJxV2xGdkx6SXpORGsxTXpneU9EazZPVGN3ZURJMU1BPT0iLCJ3ZCI6eyJvIjoyMzQ5NTM4Mjg5LCJ3IjoiOTcwIiwiaCI6IjI1MCJ9LCJ3ciI6Mn0=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.57.125.17 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-57-125-17.eu-central-1.compute.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 09 Aug 2022 19:23:30 GMT
Server: nginx/1.14.0 (Ubuntu)
Content-Type: image/png
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 68
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H3 200 15154731701972942286
tpc.googlesyndication.com/daca_images/simgad/ Frame 4014 78 KB
78 KB 15ms
14ms Image
image/png 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/daca_images/simgad/15154731701972942286

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

37d796d47c326a0268a4fb42bd19b3537bac2b0faea4c28005023c3dda2ce739

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 04 Aug 2022 04:59:08 GMT
x-content-type-options: nosniff
age: 483862
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 79708
x-xss-protection: 0
last-modified: Wed, 03 Aug 2022 14:41:38 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 04 Aug 2023 04:59:08 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 4014 0
0 22ms
21ms Image
text/html 2a00:1450:4001:80b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSguYV_6ONR5XLGJaiSW2E7XyMWmFoqfxuIkfAMt7THuuKlrnQvheI-iwg7UdkkOkMthzNH
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 4014 0
0 62ms
61ms Image
text/html 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CuaquMrTyYq6lHP2emLAPju-ckA_G0K7Na5SLg-KDELChsu-DAhABIP2NyxhgldKjgrAHoAGCmP3gA8gBAqkCNm2BKK8msT7gAgCoAwHIAwiqBKMDT9DIT6EkplhOnPdBNRuX0BRG61_Iqbh_eYvCh-38LHdJqbfGxYJvT3BtxQU2P162pcrMDpI3xyHo4GqpSJ4ww1SEK-APlYeKGjDWg9fKerRKpQecfjlBA7aBdSImGbiDwcQUt0031p9sFwQx6Qb9v1VBv4SYlPhQ4Il3mK3J0mCP-o4zbGKaoRnDeuVm-uB5pybQvdv4gXbIdH-dkyAOxc1jmXPA5HcUBq11-KPKF16IEbgCvv9Lexz345hq1iBCUCCTkHlCZhyLr-oUBlJ07eoGrGpsehRZhdsicFN4sYB6hAbg-PBfABmbD1TbZpXb8fuEF5tUUhDkv-OLEV3Wl9Yliiivtwra3IF-2nYiIeDYatI5P8INej_0YKy9owU3ALs_ptX7iI4xxibglTEiKSmjqFLusAdBLlfGXuMcuce3xMbyqg7Zt8aQc3XvTrhjrN8_b0SDdiwbiuvi-PnTrOse8d1vdWztsOEx403bSWJxID2V3y06rGqSHB_Sta9OCUSToI7uX2gF57tCnd4wpMQtHvDIKPKfHhO239vIk50pjRbABMrB1OOTBOAEAZIFBAgEGAGSBQQIBRgEoAYCgAfE5MQ2qAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwHyBwQQ96gP0ggRCIDhgHAQARgdMgLrAjoCgECACgPICwHYEw3QFQGYFgGAFwGyFx4KHAgAEhRwdWItMTYyOTYxMjc1OTY0MTUyMBjZoRU&sigh=sxC7IoxWgZQ&uach_m=[UACH]
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s08-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

GET
H2 200 segments_to_partner.js Show response
cdn.krxd.net/partnerjs/ 7 KB
3 KB 7ms
7ms Script
application/javascript 151.101.194.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.krxd.net/partnerjs/segments_to_partner.js?partner=a272cefb-df39-4fcd-beff-79cd6cdf22ec&client=trust
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/tmbiyieldheader910374028064/moatheader.js?ver=1.0.3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.194.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 0ed9f4489f29950f54053b4620800f6f1e061f3a467dfda552104034a71c3da9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-cdn-backend: 4FrRTvEr9h480D4BywjehZ--F_Partner_JS_S3
date: Tue, 09 Aug 2022 19:23:30 GMT
content-encoding: gzip
age: 935
x-amz-server-side-encryption: AES256
x-cache: HIT
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
content-length: 3459
x-served-by: cache-fra19154-FRA
last-modified: Wed, 03 Jun 2020 21:02:49 GMT
x-timer: S1660073011.818869,VS0,VE0
etag: "db6884bae01ad7499be92887e1875ecc"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 varnish
accept-ranges: bytes
x-cache-hits: 13

OPTIONS
H2 200 event
prebid-a.rubiconproject.com/ Frame 0
0 8ms
8ms Preflight 3.65.165.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-a.rubiconproject.com/event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.65.165.22 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-65-165-22.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.rd.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-max-age: 1800
allow: GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH
content-length: 0
date: Tue, 09 Aug 2022 19:23:30 GMT
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
274 B 7ms
7ms Image
image/gif 23.35.237.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=TMBI_PREBID_HEADER1&hp=1&zMoatAdUnit1=rdg_desktop&zMoatAdUnit2=videoarticle&zMoatAdUnit3=prearticle&wf=1&ra=3&pxm=7&sgs=3&vb=4&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=11&f=0&j=&t=1660073007525&de=276271068292&rx=51276775722&m=0&ar=1da355aa18f-clean&iw=601e6e1&q=2&cb=0&cu=1660073007525&ll=2&lm=0&ln=0&em=0&en=0&d=81188057%3A2349538289%3A4735949670%3A138302961529&cm=1&zGSRC=1&gu=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&id=1&ii=4&bo=rdg_desktop&bd=prearticle&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&gw=tmbiyieldheader910374028064&fd=1&it=500&pe=1%3A857%3A857%3A3019%3A986&fs=199703&na=416218620&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-151.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

unused62: 8096267
date: Tue, 09 Aug 2022 19:23:30 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
pragma: no-cache
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 09 Aug 2022 19:23:30 GMT

POST
H2 202 event Show response
prebid-a.rubiconproject.com/ 61 B
225 B 8ms
7ms XHR
application/json 3.65.165.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-a.rubiconproject.com/event
Requested by: Host: micro.rubiconproject.com
URL: https://micro.rubiconproject.com/prebid/dynamic/10696.js?ver=1.0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.65.165.22 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-65-165-22.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: edda75d7dc3a6104c5af0f926c5ae645ae25eb8c4f8a601c6d5293378e858a5c

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: *
date: Tue, 09 Aug 2022 19:23:30 GMT
content-length: 61
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type: application/json

GET
H2 200 get Show response
cdn.krxd.net/userdata/ 195 B
240 B 7ms
7ms Script
text/javascript 151.101.194.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.krxd.net/userdata/get?pub=700bca2a-e4ec-4f23-be94-47317652bac0&callback=kx_partner_segments
Requested by: Host: cdn.krxd.net
URL: https://cdn.krxd.net/partnerjs/segments_to_partner.js?partner=a272cefb-df39-4fcd-beff-79cd6cdf22ec&client=trust
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.194.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 73c96c74b22e305ac760cbf63d54a9f08e0e3cb3c7384112f55ad36b1286de35

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-cdn-backend: 4FrRTvEr9h480D4BywjehZ--F_userdata_ash_prod_krxd_net___UserData_Service_V2
date: Tue, 09 Aug 2022 19:23:30 GMT
content-encoding: gzip
age: 0
x-served-by: userdata-a017-ash-prod.krxd.net, cache-fra19154-FRA
vary: Accept-Encoding
x-cache: MISS, HIT
content-type: text/javascript
via: 1.1 varnish
cache-control: private, max-age=3600
x-age: 0
accept-ranges: bytes
x-timer: S1660073011.828695,VS0,VE0
content-length: 164
x-cache-hits: 0, 1

GET
H3

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 4014
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
0

70ms
43ms

Image
text/html

2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: H3
Server: 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Redirect headers

date: Tue, 09 Aug 2022 19:23:30 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
274 B 8ms
7ms Image
image/gif 23.35.237.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&zMoatAdUnit1=rdg_desktop&zMoatAdUnit2=videoarticle&zMoatAdUnit3=rail_1&wf=1&ra=3&pxm=7&sgs=3&vb=4&kq=1&lo=1&uk=null&pk=0&wk=0&rk=1&tk=0&ak=https%3A%2F%2Ftpc.googlesyndication.com%2Fsimgad%2F16594411703232708560%3Fsqp%3D4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4%26rs%3DAOga4qmfsXSJm2PmOrgZssABlEUF0Sgikw&i=TMBI_PREBID_HEADER1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2Fz(lKm3GFlNUU%2Cu%5Bh_GcS%25%5BHvLU%5B4(K%2B%7BgeFWl_%3DNqUXR%3A%3D%2BAxMn%3Ch%2CyenA8p%2FHm%24%60%233P(ry5*ZRocMp1tq%5BN%7Bq%60RP%3CG.ceFW%7CoG%22mxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CC%24%3D!!tmxgk~GDgxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7B%2CNr1U*%26ujMUU9%3C%24kBjqI&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C2%2C2%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-v3N3MykstXpuUX885ljPGlx1P1tMeAYh8VIp1Vf7AbESGfrl5%2FmliBNlAlwWxmRnpyWz&rs=1-GKKOVythgEwLgg%3D%3D&sc=1&os=1-6g%3D%3D&qp=10000&is=&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=11&g=0&h=94&w=300&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&rm=1&fy=0&gp=76&zGSRC=1&gu=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&id=1&ii=4&f=0&j=&t=1660073007525&de=368357316332&rx=51276775722&cu=1660073007525&m=3519&ar=1da355aa18f-clean&iw=601e6e1&cb=0&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=76&lb=13716&le=1&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A857%3A857%3A3019%3A986&as=0&ag=7&an=0&gf=7&gg=0&ix=7&ic=7&ez=1&aj=1&pg=100&pf=0&ib=0&cc=0&bw=7&bx=0&dj=1&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=14&cd=0&ah=14&am=0&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=81188057%3A2349538289%3A5052870237%3A138269341240&cm=1&bo=rdg_desktop&bd=rail_1&gw=tmbiyieldheader910374028064&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&hv=Standard%20Image%20Ad%20finding%20&ab=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&tc=0&fs=199703&na=365961905&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-151.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

unused62: 8096267
date: Tue, 09 Aug 2022 19:23:31 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
pragma: no-cache
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 09 Aug 2022 19:23:31 GMT

GET
H/1.1 200
OK user-sync Show response
sync.adkernel.com/ Frame 48B6 0
109 B 38ms
13ms Document
text/plain 77.245.57.72
WEBAIR-INTERNET-MTL

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adkernel.com/user-sync?zone=147357&r=https%3A%2F%2Fdemand.catapultx.com%2Fsync%3Fakuid%3Dhttps%3A%2F%2Fwww.rd.com%7C%7BUID%7D
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 77.245.57.72 , United States, ASN36057 (WEBAIR-INTERNET-MTL, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: close
Content-Length: 0
Date: Tue, 09 Aug 2022 19:23:31 GMT
Server: nginx

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
274 B 7ms
7ms Image
image/gif 23.35.237.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&zMoatAdUnit1=rdg_desktop&zMoatAdUnit2=videoarticle&zMoatAdUnit3=prearticle&wf=1&ra=3&pxm=7&sgs=3&vb=4&kq=1&lo=1&uk=null&pk=0&wk=0&rk=1&tk=0&ak=https%3A%2F%2Ftpc.googlesyndication.com%2Fdaca_images%2Fsimgad%2F15154731701972942286&i=TMBI_PREBID_HEADER1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2Fz(lKm3GFlNUU%2Cu%5Bh_GcS%25%5BHvLU%5B4(K%2B%7BgeFWl_%3DNqUXR%3A%3D%2BAxMn%3Ch%2CyenA8p%2FHm%24%60%233P(ry5*ZRocMp1tq%5BN%7Bq%60RP%3CG.ceFW%7CoG%22mxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CC%24%3D!!tmxgk~GDgxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7B%2CNr1U*%26ujMUU9%3C%24kBjqI&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C2%2C2%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-v3N3MykstXpuUX885ljPGlx1P1tMeAYh8VIp1Vf7AbESGfrl5%2FmliBNlAlwWxmRnpyWz&rs=1-GKKOVythgEwLgg%3D%3D&sc=1&os=1-6g%3D%3D&qp=10000&is=&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=11&g=0&h=250&w=970&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&rm=1&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&id=1&ii=4&f=0&j=&t=1660073007525&de=276271068292&rx=51276775722&cu=1660073007525&m=3798&ar=1da355aa18f-clean&iw=601e6e1&cb=0&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=13716&le=1&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A857%3A857%3A3019%3A986&as=0&ag=49&an=0&gf=49&gg=0&ix=49&ic=49&ez=1&aj=1&pg=100&pf=0&ib=0&cc=0&bw=49&bx=0&dj=1&im=0&in=0&pd=0&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=98&cd=0&ah=98&am=0&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=81188057%3A2349538289%3A4735949670%3A138302961529&cm=1&bo=rdg_desktop&bd=prearticle&gw=tmbiyieldheader910374028064&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&hv=Standard%20Image%20Ad%20finding%20&ab=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&tc=0&fs=199703&na=1889803163&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-151.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

unused62: 8096267
date: Tue, 09 Aug 2022 19:23:31 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
pragma: no-cache
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 09 Aug 2022 19:23:31 GMT

GET
H2 200 13688 Show response
check.analytics.rlcdn.com/check/ 25 B
385 B 67ms
36ms XHR
application/json 143.204.89.57
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://check.analytics.rlcdn.com/check/13688
Requested by: Host: micro.rubiconproject.com
URL: https://micro.rubiconproject.com/prebid/dynamic/10696.js?ver=1.0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.89.57 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-89-57.fra50.r.cloudfront.net
Software: /
Resource Hash: 8a9ba7bbc88ec23d81a2d63845638a3b6603de473261872f301803cef84ef335

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 09 Aug 2022 19:23:31 GMT
via: 1.1 32c8da10203574baccb74b8f771a7ffa.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
x-amzn-requestid: 8996b5b1-f6c7-40b4-b4d6-83c05f14d698
x-cache: Miss from cloudfront
content-type: application/json
access-control-allow-origin: *
x-amzn-trace-id: Root=1-62f2b433-78bde49838e2f1f8618f7cf5
x-amz-apigw-id: WnEYFHRuDoEFq2g=
content-length: 25
x-amz-cf-id: 7SSPAsQHGRqBspJciDXKqBObNN9xD9-m-B0RDN1KfoyfN4Yz5okUgg==

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 054A 42 B
64 B 51ms
51ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvoCHh-fjJgeX9JipQKO9zRhuAkQyH8wLO0VuDZi94CJeSCXGmJCui_T0QLIOS09ywrEyMvqLEpQ36von4zUb3H304y3vU2zy-8567iQlWzQbWjBylt0tbZ17OwfzuJL7_W0GrWQng_CXjA&sai=AMfl-YSLpUnTNazPzcBwgM6uqWtwmVhD8pQExWICLwZkOa17WNTr0sZyfPnvWJO2IW0ak3IYR4p-rtXDXpYcS-6FoWiiR9enlHoSQvKB3hABtbNepoeid-Zm2ZJ1tNI&sig=Cg0ArKJSzFAKi13NtyXMEAE&cid=CAAST-Roe6KwRqpPryOib4eo9o8oDQRAnX6Wpf817gompNGiU9lbWCzfF8-UOkzeJizjH9XdVI8_nkhB6o_P3ePmgBs4ILpymRCGhvi9CVFRHT0&id=ampim&o=991,467&d=300,250&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,1000,1000,1000&tos=0,0,1000,0,0&tfs=178&tls=1178&g=100&h=100&tt=1178&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&uafvl=%5B%5D&uaw=false&adk=1343688179

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 09 Aug 2022 19:23:31 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 4014 42 B
64 B 52ms
52ms Image
image/gif 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv9I5657QzxLWOETgXUFm663wlUeqKyN558363o0_Klw9RDxPLpE_p7e71spv1IAbOEQWx4XGG8Az6Pr0F0W-6j9s8nhtayQJpDOwPjmCDldRXCJ-09kjiFWLIZW0ybpCS9UGFNkgwJux5B&sai=AMfl-YTgdyzRSJtzQrLSO2c0JOuQE_trDTXpTk496WTDmVFT9mtj_d_LldGC_8nTyrpxKMcjUW1UGMa4BchZUAbhu9nnbPP5DXcXwpEKPRQOTzoS1iZV2yP94RTvCWdg&sig=Cg0ArKJSzLurmkItHTCpEAE&cid=CAASUORokO0Foo7dQEWy7CdA3ekO7WnApZKlz36Oks3CzSIBX_AchpCymZdig3mfzVHx_CDF3zCG9TBXzn3yixHXcjJnclrkJcba13Bajj3WAb0w&id=ampim&o=315,177&d=970,250&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,0,1000,1000&tos=0,0,0,1000,0&tfs=130&tls=1130&g=100&h=100&tt=1130&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&uafvl=%5B%5D&uaw=false&adk=2282643038

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 09 Aug 2022 19:23:31 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
274 B 8ms
7ms Image
image/gif 23.35.237.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=37&q=0&hp=1&zMoatAdUnit1=rdg_desktop&zMoatAdUnit2=videoarticle&zMoatAdUnit3=rail_1&wf=1&ra=3&pxm=7&sgs=3&vb=4&kq=1&lo=1&uk=null&pk=0&wk=0&rk=1&tk=0&ak=-&i=TMBI_PREBID_HEADER1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2Fz(lKm3GFlNUU%2Cu%5Bh_GcS%25%5BHvLU%5B4(K%2B%7BgeFWl_%3DNqUXR%3A%3D%2BAxMn%3Ch%2CyenA8p%2FHm%24%60%233P(ry5*ZRocMp1tq%5BN%7Bq%60RP%3CG.ceFW%7CoG%22mxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CC%24%3D!!tmxgk~GDgxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7B%2CNr1U*%26ujMUU9%3C%24kBjqI&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C2%2C2%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-v3N3MykstXpuUX885ljPGlx1P1tMeAYh8VIp1Vf7AbESGfrl5%2FmliBNlAlwWxmRnpyWz&rs=1-GKKOVythgEwLgg%3D%3D&sc=1&os=1-6g%3D%3D&qp=10000&is=&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=11&g=1&h=94&w=300&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&rm=1&fy=0&gp=76&zGSRC=1&gu=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&id=1&ii=4&f=0&j=&t=1660073007525&de=368357316332&rx=51276775722&cu=1660073007525&m=4705&ar=1da355aa18f-clean&iw=601e6e1&cb=0&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=76&lb=13716&le=1&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A857%3A857%3A3019%3A986&as=1&ag=1199&an=7&gi=1&gf=1199&gg=7&ix=1199&ic=1199&ez=1&ck=1199&kw=1005&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1199&bx=7&ci=1199&jz=1005&dj=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1005&cd=14&ah=1005&am=14&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=81188057%3A2349538289%3A5052870237%3A138269341240&cm=1&bo=rdg_desktop&bd=rail_1&gw=tmbiyieldheader910374028064&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&hv=Standard%20Image%20Ad%20finding%20&ab=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&tc=0&fs=199703&na=424492995&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-151.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

unused62: 8096267
date: Tue, 09 Aug 2022 19:23:32 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
pragma: no-cache
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 09 Aug 2022 19:23:32 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
274 B 8ms
7ms Image
image/gif 23.35.237.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=5&q=0&hp=1&zMoatAdUnit1=rdg_desktop&zMoatAdUnit2=videoarticle&zMoatAdUnit3=rail_1&wf=1&ra=3&pxm=7&sgs=3&vb=4&kq=1&lo=1&uk=null&pk=0&wk=0&rk=1&tk=0&ak=-&i=TMBI_PREBID_HEADER1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2Fz(lKm3GFlNUU%2Cu%5Bh_GcS%25%5BHvLU%5B4(K%2B%7BgeFWl_%3DNqUXR%3A%3D%2BAxMn%3Ch%2CyenA8p%2FHm%24%60%233P(ry5*ZRocMp1tq%5BN%7Bq%60RP%3CG.ceFW%7CoG%22mxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CC%24%3D!!tmxgk~GDgxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7B%2CNr1U*%26ujMUU9%3C%24kBjqI&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C2%2C2%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-v3N3MykstXpuUX885ljPGlx1P1tMeAYh8VIp1Vf7AbESGfrl5%2FmliBNlAlwWxmRnpyWz&rs=1-GKKOVythgEwLgg%3D%3D&sc=1&os=1-6g%3D%3D&qp=10000&is=&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=11&g=2&h=94&w=300&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&rm=1&fy=0&gp=76&zGSRC=1&gu=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&id=1&ii=4&f=0&j=&t=1660073007525&de=368357316332&rx=51276775722&cu=1660073007525&m=4706&ar=1da355aa18f-clean&iw=601e6e1&cb=0&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=76&lb=13716&le=1&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A857%3A857%3A3019%3A986&as=1&ag=1199&an=1199&gi=1&gf=1199&gg=1199&ix=1199&ic=1199&ez=1&ck=1199&kw=1005&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1199&bx=1199&ci=1199&jz=1005&dj=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1005&cd=1005&ah=1005&am=1005&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=81188057%3A2349538289%3A5052870237%3A138269341240&cm=1&bo=rdg_desktop&bd=rail_1&gw=tmbiyieldheader910374028064&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&hv=Standard%20Image%20Ad%20finding%20&ab=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&tc=0&fs=199703&na=931206585&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-151.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

unused62: 8096267
date: Tue, 09 Aug 2022 19:23:32 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
pragma: no-cache
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 09 Aug 2022 19:23:32 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
274 B 7ms
7ms Image
image/gif 23.35.237.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=37&q=1&hp=1&zMoatAdUnit1=rdg_desktop&zMoatAdUnit2=videoarticle&zMoatAdUnit3=rail_1&wf=1&ra=3&pxm=7&sgs=3&vb=4&kq=1&lo=1&uk=null&pk=0&wk=0&rk=1&tk=0&ak=-&i=TMBI_PREBID_HEADER1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2Fz(lKm3GFlNUU%2Cu%5Bh_GcS%25%5BHvLU%5B4(K%2B%7BgeFWl_%3DNqUXR%3A%3D%2BAxMn%3Ch%2CyenA8p%2FHm%24%60%233P(ry5*ZRocMp1tq%5BN%7Bq%60RP%3CG.ceFW%7CoG%22mxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CC%24%3D!!tmxgk~GDgxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7B%2CNr1U*%26ujMUU9%3C%24kBjqI&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C2%2C2%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-v3N3MykstXpuUX885ljPGlx1P1tMeAYh8VIp1Vf7AbESGfrl5%2FmliBNlAlwWxmRnpyWz&rs=1-GKKOVythgEwLgg%3D%3D&sc=1&os=1-6g%3D%3D&qp=10000&is=&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=11&g=3&h=94&w=300&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&rm=1&fy=0&gp=76&zGSRC=1&gu=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&id=1&ii=4&f=0&j=&t=1660073007525&de=368357316332&rx=51276775722&cu=1660073007525&m=4707&ar=1da355aa18f-clean&iw=601e6e1&cb=0&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=76&lb=13716&le=1&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A857%3A857%3A3019%3A986&as=1&ag=1199&an=1199&gi=1&gf=1199&gg=1199&ix=1199&ic=1199&ez=1&ck=1199&kw=1005&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1199&bx=1199&ci=1199&jz=1005&dj=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1005&cd=1005&ah=1005&am=1005&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=81188057%3A2349538289%3A5052870237%3A138269341240&cm=1&bo=rdg_desktop&bd=rail_1&gw=tmbiyieldheader910374028064&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&hv=Standard%20Image%20Ad%20finding%20&ab=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&tc=0&fs=199703&na=1650093783&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-151.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

unused62: 8096267
date: Tue, 09 Aug 2022 19:23:32 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
pragma: no-cache
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 09 Aug 2022 19:23:32 GMT

GET
H/1.1 200
OK user-sync Show response
sync.adkernel.com/ Frame 7FAA 0
109 B 42ms
13ms Document
text/plain 77.245.57.72
WEBAIR-INTERNET-MTL

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adkernel.com/user-sync?zone=147357&r=https%3A%2F%2Fdemand.catapultx.com%2Fsync%3Fakuid%3Dhttps%3A%2F%2Fwww.rd.com%7C%7BUID%7D
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 77.245.57.72 , United States, ASN36057 (WEBAIR-INTERNET-MTL, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: close
Content-Length: 0
Date: Tue, 09 Aug 2022 19:23:32 GMT
Server: nginx

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
274 B 7ms
7ms Image
image/gif 23.35.237.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=37&q=0&hp=1&zMoatAdUnit1=rdg_desktop&zMoatAdUnit2=videoarticle&zMoatAdUnit3=prearticle&wf=1&ra=3&pxm=7&sgs=3&vb=4&kq=1&lo=1&uk=null&pk=0&wk=0&rk=1&tk=0&ak=-&i=TMBI_PREBID_HEADER1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2Fz(lKm3GFlNUU%2Cu%5Bh_GcS%25%5BHvLU%5B4(K%2B%7BgeFWl_%3DNqUXR%3A%3D%2BAxMn%3Ch%2CyenA8p%2FHm%24%60%233P(ry5*ZRocMp1tq%5BN%7Bq%60RP%3CG.ceFW%7CoG%22mxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CC%24%3D!!tmxgk~GDgxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7B%2CNr1U*%26ujMUU9%3C%24kBjqI&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C2%2C2%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-v3N3MykstXpuUX885ljPGlx1P1tMeAYh8VIp1Vf7AbESGfrl5%2FmliBNlAlwWxmRnpyWz&rs=1-GKKOVythgEwLgg%3D%3D&sc=1&os=1-6g%3D%3D&qp=10000&is=&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=11&g=1&h=250&w=970&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&rm=1&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&id=1&ii=4&f=0&j=&t=1660073007525&de=276271068292&rx=51276775722&cu=1660073007525&m=4909&ar=1da355aa18f-clean&iw=601e6e1&cb=0&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=13716&le=1&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A857%3A857%3A3019%3A986&as=1&ag=1161&an=49&gi=1&gf=1161&gg=49&ix=1161&ic=1161&ez=1&ck=1161&kw=1006&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1161&bx=49&ci=1161&jz=1006&dj=1&im=1&in=1&pd=1&nb=1&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1006&cd=98&ah=1006&am=98&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=81188057%3A2349538289%3A4735949670%3A138302961529&cm=1&bo=rdg_desktop&bd=prearticle&gw=tmbiyieldheader910374028064&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&hv=Standard%20Image%20Ad%20finding%20&ab=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&tc=0&fs=199703&na=1339016339&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-151.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

unused62: 8096267
date: Tue, 09 Aug 2022 19:23:32 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
pragma: no-cache
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 09 Aug 2022 19:23:32 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
274 B 7ms
7ms Image
image/gif 23.35.237.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=5&q=0&hp=1&zMoatAdUnit1=rdg_desktop&zMoatAdUnit2=videoarticle&zMoatAdUnit3=prearticle&wf=1&ra=3&pxm=7&sgs=3&vb=4&kq=1&lo=1&uk=null&pk=0&wk=0&rk=1&tk=0&ak=-&i=TMBI_PREBID_HEADER1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2Fz(lKm3GFlNUU%2Cu%5Bh_GcS%25%5BHvLU%5B4(K%2B%7BgeFWl_%3DNqUXR%3A%3D%2BAxMn%3Ch%2CyenA8p%2FHm%24%60%233P(ry5*ZRocMp1tq%5BN%7Bq%60RP%3CG.ceFW%7CoG%22mxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CC%24%3D!!tmxgk~GDgxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7B%2CNr1U*%26ujMUU9%3C%24kBjqI&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C2%2C2%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-v3N3MykstXpuUX885ljPGlx1P1tMeAYh8VIp1Vf7AbESGfrl5%2FmliBNlAlwWxmRnpyWz&rs=1-GKKOVythgEwLgg%3D%3D&sc=1&os=1-6g%3D%3D&qp=10000&is=&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=11&g=2&h=250&w=970&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&rm=1&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&id=1&ii=4&f=0&j=&t=1660073007525&de=276271068292&rx=51276775722&cu=1660073007525&m=4910&ar=1da355aa18f-clean&iw=601e6e1&cb=0&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=13716&le=1&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A857%3A857%3A3019%3A986&as=1&ag=1161&an=1161&gi=1&gf=1161&gg=1161&ix=1161&ic=1161&ez=1&ck=1161&kw=1006&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1161&bx=1161&ci=1161&jz=1006&dj=1&im=1&in=1&pd=1&nb=1&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1006&cd=1006&ah=1006&am=1006&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=81188057%3A2349538289%3A4735949670%3A138302961529&cm=1&bo=rdg_desktop&bd=prearticle&gw=tmbiyieldheader910374028064&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&hv=Standard%20Image%20Ad%20finding%20&ab=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&tc=0&fs=199703&na=1471269679&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-151.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

unused62: 8096267
date: Tue, 09 Aug 2022 19:23:32 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
pragma: no-cache
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 09 Aug 2022 19:23:32 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
274 B 7ms
7ms Image
image/gif 23.35.237.151
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=37&q=1&hp=1&zMoatAdUnit1=rdg_desktop&zMoatAdUnit2=videoarticle&zMoatAdUnit3=prearticle&wf=1&ra=3&pxm=7&sgs=3&vb=4&kq=1&lo=1&uk=null&pk=0&wk=0&rk=1&tk=0&ak=-&i=TMBI_PREBID_HEADER1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2Fz(lKm3GFlNUU%2Cu%5Bh_GcS%25%5BHvLU%5B4(K%2B%7BgeFWl_%3DNqUXR%3A%3D%2BAxMn%3Ch%2CyenA8p%2FHm%24%60%233P(ry5*ZRocMp1tq%5BN%7Bq%60RP%3CG.ceFW%7CoG%22mxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CC%24%3D!!tmxgk~GDgxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7B%2CNr1U*%26ujMUU9%3C%24kBjqI&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C2%2C2%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-v3N3MykstXpuUX885ljPGlx1P1tMeAYh8VIp1Vf7AbESGfrl5%2FmliBNlAlwWxmRnpyWz&rs=1-GKKOVythgEwLgg%3D%3D&sc=1&os=1-6g%3D%3D&qp=10000&is=&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=11&g=3&h=250&w=970&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&rm=1&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&id=1&ii=4&f=0&j=&t=1660073007525&de=276271068292&rx=51276775722&cu=1660073007525&m=4911&ar=1da355aa18f-clean&iw=601e6e1&cb=0&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=13716&le=1&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A857%3A857%3A3019%3A986&as=1&ag=1161&an=1161&gi=1&gf=1161&gg=1161&ix=1161&ic=1161&ez=1&ck=1161&kw=1006&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1161&bx=1161&ci=1161&jz=1006&dj=1&im=1&in=1&pd=1&nb=1&el=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1006&cd=1006&ah=1006&am=1006&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=81188057%3A2349538289%3A4735949670%3A138302961529&cm=1&bo=rdg_desktop&bd=prearticle&gw=tmbiyieldheader910374028064&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&hv=Standard%20Image%20Ad%20finding%20&ab=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&tc=0&fs=199703&na=1921507823&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.237.151 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-151.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

unused62: 8096267
date: Tue, 09 Aug 2022 19:23:32 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
pragma: no-cache
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 09 Aug 2022 19:23:32 GMT

GET
H/1.1 200
OK user-sync Show response
sync.adkernel.com/ Frame 8531 0
109 B 42ms
14ms Document
text/plain 77.245.57.72
WEBAIR-INTERNET-MTL

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adkernel.com/user-sync?zone=147357&r=https%3A%2F%2Fdemand.catapultx.com%2Fsync%3Fakuid%3Dhttps%3A%2F%2Fwww.rd.com%7C%7BUID%7D
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 77.245.57.72 , United States, ASN36057 (WEBAIR-INTERNET-MTL, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: close
Content-Length: 0
Date: Tue, 09 Aug 2022 19:23:33 GMT
Server: nginx

GET
H/1.1 200
OK user-sync Show response
sync.adkernel.com/ Frame 3068 0
109 B 45ms
15ms Document
text/plain 77.245.57.72
WEBAIR-INTERNET-MTL

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adkernel.com/user-sync?zone=147357&r=https%3A%2F%2Fdemand.catapultx.com%2Fsync%3Fakuid%3Dhttps%3A%2F%2Fwww.rd.com%7C%7BUID%7D
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 77.245.57.72 , United States, ASN36057 (WEBAIR-INTERNET-MTL, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: close
Content-Length: 0
Date: Tue, 09 Aug 2022 19:23:34 GMT
Server: nginx

GET
H2 451 envelope Show response
api.rlcdn.com/api/identity/ 0
250 B 281ms
18ms XHR
text/plain 34.120.133.55

General

Check archive.org

Show headers Download Go to

Full URL: https://api.rlcdn.com/api/identity/envelope?pid=13688
Requested by: Host: micro.rubiconproject.com
URL: https://micro.rubiconproject.com/prebid/dynamic/10696.js?ver=1.0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.133.55 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 09 Aug 2022 19:23:34 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: https://www.rd.com
access-control-allow-credentials: true
access-control-allow-headers: Accept, Authorization, Content-Type, Cookie, Origin, X-Requested-With
content-length: 0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame AC7E 15 KB
6 KB 381ms
20ms Document
text/html 184.51.9.34

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=160830
Requested by: Host: micro.rubiconproject.com
URL: https://micro.rubiconproject.com/prebid/dynamic/10696.js?ver=1.0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.51.9.34 -, , ASN (),
Reverse DNS
Software: Apache /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=128046
content-encoding: gzip
content-length: 5549
content-type: text/html; charset=UTF-8
date: Tue, 09 Aug 2022 19:23:34 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Thu, 11 Aug 2022 06:57:40 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 4200 15 KB
6 KB 381ms
21ms Document
text/html 184.51.9.34

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=160830
Requested by: Host: micro.rubiconproject.com
URL: https://micro.rubiconproject.com/prebid/dynamic/10696.js?ver=1.0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.51.9.34 -, , ASN (),
Reverse DNS
Software: Apache /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=128046
content-encoding: gzip
content-length: 5549
content-type: text/html; charset=UTF-8
date: Tue, 09 Aug 2022 19:23:34 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Thu, 11 Aug 2022 06:57:40 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame C31A 52 KB
17 KB 265ms
7ms Document
text/html 23.35.236.188

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: micro.rubiconproject.com
URL: https://micro.rubiconproject.com/prebid/dynamic/10696.js?ver=1.0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.188 -, , ASN (),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Allow-Origin: *
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Tue, 09 Aug 2022 19:23:34 GMT
ETag: "623de86a-cf34"
Expires: Wed, 10 Aug 2022 19:23:36 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Unused62: 8096267
Vary: Accept-Encoding

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame 6AF2 281 B
554 B 262ms
6ms Document
text/html 23.205.235.133

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: micro.rubiconproject.com
URL: https://micro.rubiconproject.com/prebid/dynamic/10696.js?ver=1.0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.205.235.133 -, , ASN (),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Tue, 09 Aug 2022 19:23:34 GMT
ETag: "40014-119-5d32342a551c0"
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 8761 15 KB
6 KB 380ms
23ms Document
text/html 184.51.9.34

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=160830
Requested by: Host: micro.rubiconproject.com
URL: https://micro.rubiconproject.com/prebid/dynamic/10696.js?ver=1.0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.51.9.34 -, , ASN (),
Reverse DNS
Software: Apache /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=128046
content-encoding: gzip
content-length: 5549
content-type: text/html; charset=UTF-8
date: Tue, 09 Aug 2022 19:23:34 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Thu, 11 Aug 2022 06:57:40 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 sync Show response
eb2.3lift.com/ Frame 8B29 37 B
140 B 261ms
8ms Document
image/gif 76.223.111.18

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?
Requested by: Host: micro.rubiconproject.com
URL: https://micro.rubiconproject.com/prebid/dynamic/10696.js?ver=1.0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.111.18 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif
date: Tue, 09 Aug 2022 19:23:34 GMT

GET
H2 200 sync Show response
eb2.3lift.com/ Frame 5EC2 37 B
139 B 261ms
9ms Document
image/gif 76.223.111.18

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?
Requested by: Host: micro.rubiconproject.com
URL: https://micro.rubiconproject.com/prebid/dynamic/10696.js?ver=1.0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.111.18 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif
date: Tue, 09 Aug 2022 19:23:34 GMT

GET
H2 200 sync Show response
eb2.3lift.com/ Frame 37AF 37 B
139 B 259ms
9ms Document
image/gif 76.223.111.18

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?
Requested by: Host: micro.rubiconproject.com
URL: https://micro.rubiconproject.com/prebid/dynamic/10696.js?ver=1.0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.111.18 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif
date: Tue, 09 Aug 2022 19:23:34 GMT

GET
H/1.1 200
OK ixmatch.html Show response
js-sec.indexww.com/um/ Frame B493 3 KB
2 KB 53ms
6ms Document
text/html 23.35.236.247

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: micro.rubiconproject.com
URL: https://micro.rubiconproject.com/prebid/dynamic/10696.js?ver=1.0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.247 -, , ASN (),
Reverse DNS
Software: Apache /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 1387
Content-Type: text/html; charset=UTF-8
Date: Tue, 09 Aug 2022 19:23:34 GMT
ETag: "e20015-b68-5e4a60c97afb7"
Last-Modified: Mon, 25 Jul 2022 19:18:30 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Server: Apache
Vary: Accept-Encoding

GET
H/1.1 200
OK ixmatch.html Show response
js-sec.indexww.com/um/ Frame 91B2 3 KB
2 KB 53ms
7ms Document
text/html 23.35.236.247

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: micro.rubiconproject.com
URL: https://micro.rubiconproject.com/prebid/dynamic/10696.js?ver=1.0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.247 -, , ASN (),
Reverse DNS
Software: Apache /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 1387
Content-Type: text/html; charset=UTF-8
Date: Tue, 09 Aug 2022 19:23:34 GMT
ETag: "e20015-b68-5e4a60c97afb7"
Last-Modified: Mon, 25 Jul 2022 19:18:30 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Server: Apache
Vary: Accept-Encoding

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 6F46 52 KB
17 KB 22ms
8ms Document
text/html 23.35.236.188

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: micro.rubiconproject.com
URL: https://micro.rubiconproject.com/prebid/dynamic/10696.js?ver=1.0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.188 -, , ASN (),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Allow-Origin: *
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Tue, 09 Aug 2022 19:23:34 GMT
ETag: "623de86a-cf34"
Expires: Wed, 10 Aug 2022 19:23:36 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Unused62: 8096267
Vary: Accept-Encoding

GET
H/1.1 200
OK ixmatch.html Show response
js-sec.indexww.com/um/ Frame ED28 3 KB
2 KB 52ms
7ms Document
text/html 23.35.236.247

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: micro.rubiconproject.com
URL: https://micro.rubiconproject.com/prebid/dynamic/10696.js?ver=1.0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.247 -, , ASN (),
Reverse DNS
Software: Apache /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 1387
Content-Type: text/html; charset=UTF-8
Date: Tue, 09 Aug 2022 19:23:34 GMT
ETag: "e20015-b68-5e4a60c97afb7"
Last-Modified: Mon, 25 Jul 2022 19:18:30 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Server: Apache
Vary: Accept-Encoding

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame B69F 52 KB
17 KB 27ms
7ms Document
text/html 23.35.236.188

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: micro.rubiconproject.com
URL: https://micro.rubiconproject.com/prebid/dynamic/10696.js?ver=1.0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.188 -, , ASN (),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Allow-Origin: *
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Tue, 09 Aug 2022 19:23:34 GMT
ETag: "623de86a-cf34"
Expires: Wed, 10 Aug 2022 19:23:36 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Unused62: 8096267
Vary: Accept-Encoding

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 6AF2 31 KB
10 KB 7ms
7ms Script
text/html 23.205.235.133

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.205.235.133 -, , ASN (),
Reverse DNS
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: c3d3e53145b2e47ef3c4a2a08c8a644b8acf51380859a40d48a39447646e9a02

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Tue, 09 Aug 2022 19:23:34 GMT
Content-Encoding: gzip
Last-Modified: Tue, 12 Jul 2022 20:44:25 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=39347
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9450
Expires: Wed, 10 Aug 2022 06:19:21 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame C31A 0
747 B 7ms
7ms Script
text/html 37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 09 Aug 2022 19:23:34 GMT
X-Proxy-Origin: 178.162.209.129; 178.162.209.129; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: eb1354a1-2140-417d-a345-1ffb7797edb3
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK khaos.jpg
token.rubiconproject.com/ Frame 6AF2 284 B
536 B 99ms
12ms Image
image/jpg 69.173.144.165

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/khaos.jpg?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.165 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 284
X-RPHost: 704c1e4d3fcc922a3031d436b584678b
Content-Type: image/jpg

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 6F46 0
747 B 7ms
7ms Script
text/html 37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 09 Aug 2022 19:23:34 GMT
X-Proxy-Origin: 178.162.209.129; 178.162.209.129; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: a1cce71c-fdb0-42d4-b41e-7a4aac37f014
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame B69F 0
747 B 17ms
17ms Script
text/html 37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 09 Aug 2022 19:23:34 GMT
X-Proxy-Origin: 178.162.209.129; 178.162.209.129; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 43c963ff-eb87-486f-be59-76f6423c8781
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

usermatch Show response
r.casalemedia.com/ Frame B421
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE...
https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA...

2 KB
2 KB

74ms
37ms

Document
text/html

104.18.19.126

General

Check archive.org

Show headers Download Go to

Full URL: https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/um/ixmatch.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.19.126 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: 309961d8bb2d8dcff9b6df28581e0f52e99df15c3468580bb321b3a8b5e75b4e

Request headers

Referer: https://js-sec.indexww.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 7382ddf83bc89b69-FRA
content-encoding: br
content-type: text/html
date: Tue, 09 Aug 2022 19:23:35 GMT
dropped-udsids: 241|230|39|45|105|24|88|111
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6Ku3Na73y8rvzTqEOg7t65ePAwQKInDhEcsxJr%2Bmt7Vx0qJVA0shL4PU9440qx0qH7fUq5VJXl4nOEXPRjZGR%2FXlnIcR5emhKWsdOAFBNnAKlK3fD5%2BYs3LJJlHmea8QojNI"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Is-Traffic-Usersync, Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 7382ddf7da4f5c32-FRA
content-type: text/html; charset=iso-8859-1
date: Tue, 09 Aug 2022 19:23:35 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires: 0
location: https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tgvEeKAkUWZA59nKe4cKknixwWaJg26VoVAjJV0KtpWUS%2FCLpZI5%2FZ32oQbO96WBF%2BrALMBmZtKeNKrTgYab%2BNDAX4Gu6C93948es%2F85KLUOXuuQlplEh9drM67atiLKABnSQj9XiII0Gw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2

200

usermatch Show response
r.casalemedia.com/ Frame 9973
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE...
https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA...

2 KB
1 KB

77ms
40ms

Document
text/html

104.18.19.126

General

Check archive.org

Show headers Download Go to

Full URL: https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/um/ixmatch.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.19.126 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: 92b87abad0f720fb63de85b2c4f6bdea38090b1ec6223d2046e81f397c25a6a6

Request headers

Referer: https://js-sec.indexww.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 7382ddf83bc79b69-FRA
content-encoding: br
content-type: text/html
date: Tue, 09 Aug 2022 19:23:35 GMT
dropped-udsids: 39|45|230|241|81|73|105|31
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8oltY4DC%2BjEbRku7A4a09u%2FBkz8pi%2FXznvyulcR6tmXkFf5t6fO8RTdYClEYDpDqHouCfo5jFOfHIrMuSSFiJMiPAt%2B%2BvipI5MZsl5C6HqynpGtWFQ9BbFKuccODoQINbycZ"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Is-Traffic-Usersync, Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 7382ddf7da505c32-FRA
content-type: text/html; charset=iso-8859-1
date: Tue, 09 Aug 2022 19:23:35 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires: 0
location: https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=prHcbD31oaXgP%2BAPRbVGKKmpt0AOL5lS%2FgGf%2FfwzBfeknZSyxBncWolXEWdqKxU%2BDnn3opORrZJSJoIiVlk%2BGCxsL8JCyMLj9fj2sYpWb2UIzZ6aqO3RtAlO9LFtPfCN%2Fp%2FBdU1kJZHt8g%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2

200

usermatch Show response
r.casalemedia.com/ Frame AE06
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE...
https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA...

2 KB
1 KB

73ms
41ms

Document
text/html

104.18.19.126

General

Check archive.org

Show headers Download Go to

Full URL: https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/um/ixmatch.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.19.126 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: 2322e1e0a2973f2918adf31582c5ad5668af0aee5299645411374e59a9eaff2c

Request headers

Referer: https://js-sec.indexww.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 7382ddf83bcb9b69-FRA
content-encoding: br
content-type: text/html
date: Tue, 09 Aug 2022 19:23:35 GMT
dropped-udsids: 230|241|39|45|13|51|88|188
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XxKne%2BUcrutXOWfi5lMVVXzAgKnzIuk5o78jZNRUSM1o3QgodtCN%2BWLdjnGl9Zh3mPrHMypQ7WVvFtkHuec43fZUHNYBDTe2LkPLmOmi8MFE1D%2BWpKNhAN2%2B3JLauBLvgGO5"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Is-Traffic-Usersync, Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 7382ddf7da515c32-FRA
content-type: text/html; charset=iso-8859-1
date: Tue, 09 Aug 2022 19:23:35 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires: 0
location: https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iBdA7lfPF9jjzPJAIsxa9m5TksSgb413szBjMHTuW55vP9yN8sNbGj9zgcFvp58ge9TP8v1t0WGssgjTmvn%2Ff4sQ8QAHdKVh9B1N8Z9F2YCyiszj4GNrj41qoObr%2F4RFJ%2BNUF6htzTOmnw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame AC7E 0
42 B 387ms
20ms Script
text/plain 185.64.190.78

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=68883131&p=160830&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=160830
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.78 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:34 GMT
content-length: 0

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame B421
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YvK0NzrGOeGmU0LD8cr2ngAABKAAAAIB
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YvK0NzrGOeGmU0LD8cr2ngAABKAAAAIB&dcc=t

43 B
645 B

104ms
104ms

Image
image/gif

209.54.182.161

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YvK0NzrGOeGmU0LD8cr2ngAABKAAAAIB&dcc=t

Requested by

Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1

Protocol

HTTP/1.1

Server

209.54.182.161 -, , ASN (),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 09 Aug 2022 19:23:35 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: 7X4RYW5E8SJZWSS569BZ
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 09 Aug 2022 19:23:35 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: WZ7KJ1EZJ111DMPNSPR8
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YvK0NzrGOeGmU0LD8cr2ngAABKAAAAIB&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame B421 170 B
502 B 80ms
26ms Image
image/png 142.250.185.66

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=YvK0NzrGOeGmU0LD8cr2ngAABKAAAAIB&gdpr_consent=&us_privacy=&gdpr=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 -, , ASN (),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 09 Aug 2022 19:23:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 casale
match.adsrvr.org/track/cmf/ Frame B421 70 B
264 B 111ms
37ms Image
image/gif 3.33.220.150

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/casale?gdpr=1
Requested by: Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 09 Aug 2022 19:23:35 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame B421
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D&gdpr=1
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=YvK0N-r3DcYxD-QdVdyGMAAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEILv9csDXJ4f2nkE39MqTfY&google_cver=1&gdpr=1

43 B
907 B

44ms
43ms

Image
image/gif

104.18.19.126

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEILv9csDXJ4f2nkE39MqTfY&google_cver=1&gdpr=1
Requested by: Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H3
Server: 104.18.19.126 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

cf-ray: 7382ddf999815b86-FRA
pragma: no-cache
date: Tue, 09 Aug 2022 19:23:35 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=i7ChB6Rz8TTZ1eMbt1H0g8IbLPNZ4JzPkW2K3LBm9Ee0jE7LfuPRbSQXOtIfg8rApYn8wE3tYYuBGGkR%2BaSeRfqoLVN6BRbUsQ8YGl805SR7VL1ilueHMywBc25FJ0xekE0SerFNISzCTw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 09 Aug 2022 19:23:35 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEILv9csDXJ4f2nkE39MqTfY&google_cver=1&gdpr=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 325
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame B421
Redirect Chain

https://d.adroll.com/cm/index/ssp?gdpr=1
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=105&external_user_id=0

43 B
906 B

31ms
31ms

Image
image/gif

104.18.19.126

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=105&external_user_id=0
Requested by: Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H3
Server: 104.18.19.126 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

cf-ray: 7382ddf969445b86-FRA
pragma: no-cache
date: Tue, 09 Aug 2022 19:23:35 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zR8m2xoXKVi4PVzZDFFae7TqJccY1Wnrlh81WrDytw99cfznQ3daeuWN951C4oted20C5qcVUo%2FIf2%2FKWQUabwjiWqzjB8b1vZVkfaV8W27YnX1QWGuhNjaJD6hgMJARu52Uu4SGAvtsoA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=105&external_user_id=0
date: Tue, 09 Aug 2022 19:23:35 GMT
server: nginx/1.20.0
content-length: 76

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame B421
Redirect Chain

https://csync.loopme.me/?redirect=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D24%26external_user_id%3D%7Bviewer_token%7D&us_privacy=&gdpr=1&gdpr_consent=
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=24&external_user_id=8721f6f4-d062-4b3a-b332-ab0eccc76274&us_privacy=null&gdpr_consent=null&gdpr=1

43 B
329 B

42ms
29ms

Image
image/gif

104.18.19.126

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=24&external_user_id=8721f6f4-d062-4b3a-b332-ab0eccc76274&us_privacy=null&gdpr_consent=null&gdpr=1
Requested by: Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H2
Server: 104.18.19.126 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 09 Aug 2022 19:23:35 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=U0hUV6xLiScW%2B8ug7ZTf1icLxj1iC3aATI6UYJyo0NCu%2BBK6Jh25G9J%2Bc%2FyPKhed5cZhzJeoghqw7yunQ4Uu%2BckGiK7lh0vmMKIkoXUWIWfDxdw1ZgCGap5%2FZYR8gTfROU%2Bym4QjMx6ZjA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: no-cache
cf-ray: 7382ddf90c4a5b50-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

date: Tue, 09 Aug 2022 19:23:35 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=24&external_user_id=8721f6f4-d062-4b3a-b332-ab0eccc76274&us_privacy=null&gdpr_consent=null&gdpr=1
cf-ray: 7382ddf8dd2a92a1-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame B421
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D&gdpr=1
https://sync-tm.everesttech.net/ct/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D&gdpr=1&_test=YvK0NwAFOBu1mwBC
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YvK0NwAFOBu1mwBC&gdpr=1&_test=YvK0NwAFOBu1mwBC

43 B
911 B

49ms
48ms

Image
image/gif

104.18.19.126

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YvK0NwAFOBu1mwBC&gdpr=1&_test=YvK0NwAFOBu1mwBC
Requested by: Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H3
Server: 104.18.19.126 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

cf-ray: 7382ddf9998f5b86-FRA
pragma: no-cache
date: Tue, 09 Aug 2022 19:23:35 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=r%2FG8kIGeRCm6FDTElPekqlxJLl0U4YAwU7o5fzW0tx5YwwzoOM%2B9k8b4b72NggM9g51zgQbLK3KK1mMl%2BJxtNX1pCtjVe20TL05W5Wq4095fgbLQC%2BWTv5m8VZ0mwzqnERUjuWnoydF33g%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 09 Aug 2022 19:23:35 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1660073015.287411,VS0,VE0
x-served-by: cache-fra19142-FRA
x-cache: HIT
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YvK0NwAFOBu1mwBC&gdpr=1&_test=YvK0NwAFOBu1mwBC
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2 403 match
c1.adform.net/serving/cookie/ Frame B421 0
331 B 101ms
22ms Image
text/plain 37.157.6.252

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1.adform.net/serving/cookie/match?party=29&gdpr=1

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.252 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 09 Aug 2022 19:23:35 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 200 htw-pixel.gif
cdn.indexww.com/ht/ Frame B421 43 B
103 B 64ms
15ms Image
image/gif 2606:4700::6812:d4c

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.indexww.com/ht/htw-pixel.gif?YvK0NzrGOeGmU0LD8cr2ngAA%261184
Requested by: Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d4c -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:35 GMT
cf-cache-status: HIT
age: 83
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
edge-control: cache-maxage=1h
content-length: 43
last-modified: Tue, 24 Jan 2017 19:36:04 GMT
server: cloudflare
etag: "da1f1d-2b-546dc3a097100"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 7382ddf8e9a79b2b-FRA
expires: Tue, 09 Aug 2022 23:23:35 GMT

GET
H2 200 casale
match.adsrvr.org/track/cmf/ Frame 9973 70 B
264 B 104ms
31ms Image
image/gif 3.33.220.150

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/casale?gdpr=1
Requested by: Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 09 Aug 2022 19:23:35 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 9973
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D&gdpr=1
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=YvK0N-r3DcYxD-QdVdyGMAAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEILv9csDXJ4f2nkE39MqTfY&google_cver=1&gdpr=1

43 B
911 B

28ms
28ms

Image
image/gif

104.18.19.126

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEILv9csDXJ4f2nkE39MqTfY&google_cver=1&gdpr=1
Requested by: Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H3
Server: 104.18.19.126 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

cf-ray: 7382ddf999785b86-FRA
pragma: no-cache
date: Tue, 09 Aug 2022 19:23:35 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=e5GIXyi4jpWwdRjGIeWCk2Nle1FpxlUGWKZy7XJ1cscauvhWbFxSUmibbhFW%2BWwp2BMqKefuJfUiGa6%2BjLEEIQtVz%2FCU5d83A5fxvgLLymzsCaruAWLG22KUqxC%2BS43WSK0LUkuNP3mY9A%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 09 Aug 2022 19:23:35 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEILv9csDXJ4f2nkE39MqTfY&google_cver=1&gdpr=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 325
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 9973 170 B
232 B 66ms
27ms Image
image/png 142.250.185.66

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=YvK0NzrGOeGmU0LD8cr2ngAABKAAAAIB&gdpr_consent=&us_privacy=&gdpr=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 -, , ASN (),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 09 Aug 2022 19:23:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame 9973
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YvK0NzrGOeGmU0LD8cr2ngAABKAAAAIB
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YvK0NzrGOeGmU0LD8cr2ngAABKAAAAIB&dcc=t

43 B
645 B

107ms
107ms

Image
image/gif

209.54.182.161

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YvK0NzrGOeGmU0LD8cr2ngAABKAAAAIB&dcc=t

Requested by

Protocol

HTTP/1.1

Server

209.54.182.161 -, , ASN (),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 09 Aug 2022 19:23:35 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: 79A0EA1F99WFREV5F6DN
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 09 Aug 2022 19:23:35 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: QNMVF3K019ZERE4E2WDX
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YvK0NzrGOeGmU0LD8cr2ngAABKAAAAIB&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame 9973
Redirect Chain

https://pixel.quantserve.com/pixel/p-Z8PuJEk6U7Hyq.gif?idmatch=0&gdpr=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&&external_user_id=ugdj9u4BNvOhB2H26VMo8rRWMfehBTL2tAPi11IF

43 B
954 B

37ms
23ms

Image
image/gif

104.18.19.126

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&&external_user_id=ugdj9u4BNvOhB2H26VMo8rRWMfehBTL2tAPi11IF
Requested by: Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H2
Server: 104.18.19.126 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

cf-ray: 7382ddf90c495b50-FRA
pragma: no-cache
date: Tue, 09 Aug 2022 19:23:35 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xDLO32EcmKive8foRCJwWWqD5TEgsdmkZV8kwpDCoY%2FHH%2Fb%2FpsBJN3pTA1NMS0ake%2Bjybwff5F9qMRaHqa3YdsUQc4WYsRiDgtY3f2d70tlm0E%2FX4mK7GtagYx1NfgADVeU2A058p4Kchw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 09 Aug 2022 19:23:35 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&&external_user_id=ugdj9u4BNvOhB2H26VMo8rRWMfehBTL2tAPi11IF
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 YvK0NzrGOeGmU0LD8cr2ngAABKAAAAIB
pr-bh.ybp.yahoo.com/sync/casale/ Frame 9973 43 B
988 B 137ms
34ms Image
image/gif 2a05:d018:d29:3605:c111:9aee:7bd3:6707

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/YvK0NzrGOeGmU0LD8cr2ngAABKAAAAIB?gdpr_consent=&us_privacy=&gdpr=1

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a05:d018:d29:3605:c111:9aee:7bd3:6707 -, , ASN (),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:35 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 9973
Redirect Chain

https://d.adroll.com/cm/index/ssp?gdpr=1
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=105&external_user_id=0

43 B
908 B

34ms
34ms

Image
image/gif

104.18.19.126

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=105&external_user_id=0
Requested by: Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H3
Server: 104.18.19.126 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

cf-ray: 7382ddf969455b86-FRA
pragma: no-cache
date: Tue, 09 Aug 2022 19:23:35 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yXNSgc%2BdK0ACcZLJapBAOYAd2V6pBR33D7D4vBZieVL7kGnrUO2XhlRrdjuwJsL30L8ChnHlSVeZf7EFTAFfo5cHgoghK3M85bv0yYkv7Zfs6Y0id2o52Onu%2BSY40HQCd%2FF1GXcP92tSHA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=105&external_user_id=0
date: Tue, 09 Aug 2022 19:23:35 GMT
server: nginx/1.20.0
content-length: 76

GET
H/1.1

200
OK

noop
px.owneriq.net/ Frame 9973
Redirect Chain

https://px.owneriq.net/eucm/p/cc?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D31%26external_user_id%3D(OIQ_UUID)
https://px.owneriq.net/ecc?redir=https%3a%2f%2fdsum-sec.casalemedia.com%2fcrum%3fcm_dsp_id%3d31%26external_user_id%3dQ7133594152001168672&uid=Q7133594152001168672&ref=%2Feucm%2Fp%2Fcc
https://px.owneriq.net/noop?ct=image%2Fgif

0
287 B

18ms
18ms

Image
image/gif

104.96.159.65

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.owneriq.net/noop?ct=image%2Fgif
Requested by: Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: HTTP/1.1
Server: 104.96.159.65 -, , ASN (),
Reverse DNS
Software: Apache/2.4.6 (CentOS) / PHP/7.3.33
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Tue, 09 Aug 2022 19:23:35 GMT
Server: Apache/2.4.6 (CentOS)
Connection: keep-alive
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
X-Powered-By: PHP/7.3.33
Content-Length: 0
Content-Type: image/gif

Redirect headers

Location: https://px.owneriq.net/noop?ct=image%2Fgif
Date: Tue, 09 Aug 2022 19:23:35 GMT
Server: AkamaiGHost
Connection: keep-alive
Content-Length: 0

GET
H2 200 htw-pixel.gif
cdn.indexww.com/ht/ Frame 9973 43 B
424 B 61ms
15ms Image
image/gif 2606:4700::6812:d4c

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.indexww.com/ht/htw-pixel.gif?YvK0NzrGOeGmU0LD8cr2ngAA%261184
Requested by: Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d4c -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:35 GMT
cf-cache-status: HIT
age: 83
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
edge-control: cache-maxage=1h
content-length: 43
last-modified: Tue, 24 Jan 2017 19:36:04 GMT
server: cloudflare
etag: "da1f1d-2b-546dc3a097100"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 7382ddf8e9a99b2b-FRA
expires: Tue, 09 Aug 2022 23:23:35 GMT

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame AE06 170 B
232 B 67ms
27ms Image
image/png 142.250.185.66

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=YvK0N_r3DcYxD_QdVdyGMAAABKEAAAAB&gdpr_consent=&us_privacy=&gdpr=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 -, , ASN (),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 09 Aug 2022 19:23:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame AE06
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YvK0N_r3DcYxD_QdVdyGMAAABKEAAAAB
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YvK0N_r3DcYxD_QdVdyGMAAABKEAAAAB&dcc=t

43 B
645 B

106ms
106ms

Image
image/gif

209.54.182.161

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YvK0N_r3DcYxD_QdVdyGMAAABKEAAAAB&dcc=t

Requested by

Protocol

HTTP/1.1

Server

209.54.182.161 -, , ASN (),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 09 Aug 2022 19:23:35 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: 6KJ6WXAE2YYVSFZTRGSB
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 09 Aug 2022 19:23:35 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: W4QA9W47NE2TV8GBWH16
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YvK0N_r3DcYxD_QdVdyGMAAABKEAAAAB&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 casale
match.adsrvr.org/track/cmf/ Frame AE06 70 B
265 B 101ms
31ms Image
image/gif 3.33.220.150

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/casale?gdpr=1
Requested by: Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 09 Aug 2022 19:23:35 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame AE06
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D&gdpr=1
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=YvK0N-r3DcYxD-QdVdyGMAAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEILv9csDXJ4f2nkE39MqTfY&google_cver=1&gdpr=1

43 B
911 B

52ms
52ms

Image
image/gif

104.18.19.126

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEILv9csDXJ4f2nkE39MqTfY&google_cver=1&gdpr=1
Requested by: Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H3
Server: 104.18.19.126 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

cf-ray: 7382ddf999765b86-FRA
pragma: no-cache
date: Tue, 09 Aug 2022 19:23:35 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mBxMxTJiSkMJwcE3qXPbx9rKH%2B67drUg3yL%2FuoiPzktRMK6SFgKifk8X23mkp6Ap1vGD9wE9P2xaoElrnhiwCOLafMGoqSDMP2wKSNzW8lS6pbo%2BHKT3lRpBqRajuhu3mAwjiuXccyjLkA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 09 Aug 2022 19:23:35 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEILv9csDXJ4f2nkE39MqTfY&google_cver=1&gdpr=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 325
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame AE06
Redirect Chain

https://sync.adotmob.com/cookie/indexexchange?r=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D13%26external_user_id%3D%7bamob_user_id%7d%26expiration%3D%5bEXPIRATION%5d&gdpr=1
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=13&external_user_id=%7Bamob_user_id%7D&expiration=[EXPIRATION]&gdpr=1

43 B
949 B

43ms
30ms

Image
image/gif

104.18.19.126

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=13&external_user_id=%7Bamob_user_id%7D&expiration=[EXPIRATION]&gdpr=1
Requested by: Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H3
Server: 104.18.19.126 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

cf-ray: 7382ddf959385b86-FRA
pragma: no-cache
date: Tue, 09 Aug 2022 19:23:35 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jZA%2Bj5AYdyEAGYaMvRTklj2lJZ5vBWzaqZkNXgXZAqGgl7MFMh9ddIEaHF%2Bxw85729j9seIvufgmGMUaRxvbQUH4x%2F70MaUHgMbHP1KpXVMpEUAach3hSRoNG7nqJAqNDOtHXkLcDSjJxw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=13&external_user_id=%7Bamob_user_id%7D&expiration=[EXPIRATION]&gdpr=1
date: Tue, 09 Aug 2022 19:23:35 GMT
access-control-allow-credentials: true
x-powered-by: Express
content-length: 0
vary: Origin
keep-alive: timeout=5

GET
H/1.1 200
OK sync
x.bidswitch.net/ Frame AE06 43 B
220 B 264ms
9ms Image
image/gif 18.194.56.109

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=index&gdpr=1
Requested by: Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.194.56.109 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Tue, 09 Aug 2022 19:23:35 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2

200

ZMAwryCI
sync-tm.everesttech.net/ct/upi/pid/ Frame AE06
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D&gdpr=1
https://sync-tm.everesttech.net/ct/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D&gdpr=1&_test=YvK0NwAFOYzRJgA0

85 B
166 B

10ms
9ms

Image
image/png

151.101.194.49

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D&gdpr=1&_test=YvK0NwAFOYzRJgA0
Requested by: Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H2
Server: 151.101.194.49 -, , ASN (),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 09 Aug 2022 19:23:35 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
age: 1640
x-served-by: cache-fra19142-FRA
x-cache: HIT
content-type: image/png
cache-control: no-cache
accept-ranges: bytes
x-timer: S1660073015.286393,VS0,VE0
content-length: 85
x-cache-hits: 10671

Redirect headers

pragma: no-cache
date: Tue, 09 Aug 2022 19:23:35 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1660073015.180411,VS0,VE94
x-served-by: cache-fra19142-FRA
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
location: https://sync-tm.everesttech.net/ct/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D&gdpr=1&_test=YvK0NwAFOYzRJgA0
cache-control: no-cache
accept-ranges: bytes
access-control-allow-origin: *
content-length: 0
x-cache-hits: 0

GET
H2 204 CookieIndex
rtb.adentifi.com/ Frame AE06 0
35 B 323ms
99ms Image
text/plain 54.243.198.75

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieIndex
Requested by: Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.243.198.75 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:35 GMT

GET
H2 200 htw-pixel.gif
cdn.indexww.com/ht/ Frame AE06 43 B
104 B 61ms
16ms Image
image/gif 2606:4700::6812:d4c

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.indexww.com/ht/htw-pixel.gif?YvK0N-r3DcYxD-QdVdyGMAAA%261185
Requested by: Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.rd.com%2Farticle%2Ffake-qr-code%2F%3F_cmp%3Dreaduprdus%26_ebid%3Dreaduprdus892022%26_mid%3D521040%26ehid%3D15AA7630F947CD95729C6EDD8EE52AF2CA558DA4%26_PermHash%3D6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F&C=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:d4c -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 19:23:35 GMT
cf-cache-status: HIT
age: 83
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
edge-control: cache-maxage=1h
content-length: 43
last-modified: Tue, 24 Jan 2017 19:36:04 GMT
server: cloudflare
etag: "da1f1d-2b-546dc3a097100"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 7382ddf8e9aa9b2b-FRA
expires: Tue, 09 Aug 2022 23:23:35 GMT

GET
H/1.1 200
OK user-sync Show response
sync.adkernel.com/ Frame 599F 0
109 B 53ms
21ms Document
text/plain 77.245.57.72
WEBAIR-INTERNET-MTL

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adkernel.com/user-sync?zone=147357&r=https%3A%2F%2Fdemand.catapultx.com%2Fsync%3Fakuid%3Dhttps%3A%2F%2Fwww.rd.com%7C%7BUID%7D
Requested by: Host: www.rd.com
URL: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 77.245.57.72 , United States, ASN36057 (WEBAIR-INTERNET-MTL, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.rd.com/article/fake-qr-code/?_cmp=readuprdus&_ebid=readuprdus892022&_mid=521040&ehid=15AA7630F947CD95729C6EDD8EE52AF2CA558DA4&_PermHash=6fc3e1e800d08559ed14734011cf36c2b7b4941d6468e9e838631df884d96e10
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: close
Content-Length: 0
Date: Tue, 09 Aug 2022 19:23:35 GMT
Server: nginx

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame C31A 0
747 B 22ms
21ms Script
text/html 37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 09 Aug 2022 19:23:35 GMT
X-Proxy-Origin: 178.162.209.129; 178.162.209.129; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 1d3f1689-cb17-4dbe-a869-77c8e9e0981a
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET async_usersync
ib.adnxs.com/ Frame 6F46 0
0

GET async_usersync
ib.adnxs.com/ Frame B69F 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: ib.adnxs.com
URL: https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Domain: ib.adnxs.com
URL: https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Verdicts & Comments Add Verdict or Comment

285 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

28 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.rd.com/article/fake-qr-code	1969-12-31 23:59:59	Name: ntvSession Value: {}
www.rd.com/article/fake-qr-code	1970-01-20 05:07:53	Name: _liChk Value: 0.7336011864820284
www.rd.com/	1970-01-20 05:51:05	Name: _pbjs_userid_consent_data Value: 3524755945110770
.rd.com/	1970-01-20 14:43:53	Name: _pnvl Value: false
.rd.com/	1970-01-20 14:43:53	Name: pushly.user_puuid Value: tZFRLnYt8P6xyp2ywJg0Sv8CdQDTj5TI
.rd.com/	1970-01-20 14:43:53	Name: _pndnt Value:
.rd.com/	1970-01-20 14:43:53	Name: _pnss Value: none
.www.rd.com/	1970-01-20 13:53:29	Name: beopid Value: 5d713d4d-69e8-4a0d-b851-27b7cd0e8c62
.rd.com/	1969-12-31 23:59:59	Name: _li_dcdm_c Value: .rd.com
.rd.com/	1970-01-20 14:43:53	Name: _lc2_fpi Value: 0ee7014c2aeb--01ga20zpschj125jhf3w3yrftz
.rd.com/	1970-01-20 07:17:29	Name: _fbp Value: fb.1.1660073007925.1334434933
.rd.com/	1970-01-20 14:43:53	Name: _ga Value: GA1.2.1301817763.1660073008
.rd.com/	1970-01-20 05:09:19	Name: _gid Value: GA1.2.92080498.1660073008
.rd.com/	1970-01-20 05:07:53	Name: _gat_gtag_UA_17041328_1 Value: 1
.rd.com/	1970-01-20 14:43:53	Name: _dor Value: www.rd.com
www.rd.com/	1970-01-20 05:09:19	Name: _lr_geo_location Value: DE
.skyword.com/	1970-01-20 14:43:53	Name: vis Value: FE6469D9-D3E6-802C-84C8-362D1E482F96
.adnxs.com/	1970-01-20 07:17:29	Name: uuid2 Value: 5985716758312207114
.rd.com/	1970-01-20 13:53:29	Name: _pin_unauth Value: dWlkPU1UWmxORGc0TkdVdE5qTmpNaTAwTnpFNExXSTFOV1F0WVRnMU1EY3pOV015TVdNeA
.liadm.com/	1970-01-20 14:43:53	Name: lidid Value: beb1466c-e998-4f60-9c8a-ff995fc96113
www.rd.com/	1969-12-31 23:59:59	Name: aasd Value: 1%7C1660073009253
www.rd.com/	1969-12-31 23:59:59	Name: __aaxsc Value: 2
.kargo.com/	1970-01-20 13:53:29	Name: ktcid Value: 96701b5e-a7bb-0bc3-12e4-acbb788b72a1
.adnxs.com/	1970-01-20 07:17:29	Name: icu Value: ChgIg55REAoYAiACKAIwsujKlwY4AkACSAIQsujKlwYYAQ..
.doubleclick.net/	1970-01-20 05:07:56	Name: DSID Value: NO_DATA
.doubleclick.net/	1970-01-20 14:29:29	Name: IDE Value: AHWqTUnAwWz8BkcQbNSRSeMKxIVOghO2HZUp6e_LRCAmCxkglrnnc5NuoN4Tgc-UVcg
.rd.com/	1970-01-20 14:29:29	Name: __gads Value: ID=a10f86731e5295d6:T=1660073010:S=ALNI_MbAYGIYEcSUN84uikg5CovlhINnww
www.rd.com/	1970-01-20 05:09:19	Name: _lr_sampling_rate Value: 100

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://d82f7a30-751a-4689-b7e9-19336a89ab46.edge.permutive.app/d82f7a30-751a-4689-b7e9-19336a89ab46-web.js Message: Failed to load resource: the server responded with a status of 403 ()
other	warning	URL: https://cdn.ampproject.org/rtv/012207221643000/v0/amp-ad-exit-0.1.mjs(Line 1) Message: Unrecognized feature: 'attribution-reporting'.
other	warning	URL: https://cdn.ampproject.org/rtv/012207221643000/v0/amp-ad-exit-0.1.mjs(Line 1) Message: Unrecognized feature: 'attribution-reporting'.
network	error	URL: https://api.rlcdn.com/api/identity/envelope?pid=13688 Message: Failed to load resource: the server responded with a status of 451 ()
network	error	URL: https://c1.adform.net/serving/cookie/match?party=29&gdpr=1 Message: Failed to load resource: the server responded with a status of 403 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

23b1a0822ba1831bce09eec41594b818.safeframe.googlesyndication.com
aamapi.com
acdn.adnxs.com
ads.pubmatic.com
adservice.google.com
adservice.google.de
api.bounceexchange.com
api.rlcdn.com
assets-jpcust.jwpsrv.com
assets.bounceexchange.com
ats.rlcdn.com
b-code.liadm.com
c.aaxads.com
c.amazon-adsystem.com
c1.adform.net
c2shb.pubgw.yahoo.com
cdn.ampproject.org
cdn.brandmetrics.com
cdn.flipboard.com
cdn.indexww.com
cdn.jsdelivr.net
cdn.jwplayer.com
cdn.krxd.net
cdn.p-n.io
check.analytics.rlcdn.com
click.email.rd.com
cm.g.doubleclick.net
collector.brandmetrics.com
confiant-integrations.global.ssl.fastly.net
connect.facebook.net
content.jwplatform.com
contents-tracking.beop.io
context.iris.tv
csync.loopme.me
ct.pinterest.com
d.adroll.com
d82f7a30-751a-4689-b7e9-19336a89ab46.edge.permutive.app
data.beop.io
dsum-sec.casalemedia.com
eb2.3lift.com
entitlements.jwplayer.com
eus.rubiconproject.com
fastlane.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
geo.privacymanager.io
googleads.g.doubleclick.net
hbopenbid.pubmatic.com
htlb.casalemedia.com
i.liadm.com
ib.adnxs.com
image6.pubmatic.com
imasdk.googleapis.com
js-sec.indexww.com
krk.kargo.com
l3.aaxads.com
ls.skimresources.com
match.adsrvr.org
mb.moatads.com
micro.rubiconproject.com
p.skimresources.com
pagead2.googlesyndication.com
pixel.quantserve.com
pr-bh.ybp.yahoo.com
prd.jwpltx.com
prebid-a.rubiconproject.com
prebid-server.rubiconproject.com
protected-by.clarium.io
pubads.g.doubleclick.net
px.moatads.com
px.owneriq.net
r.casalemedia.com
r.skimresources.com
rp.liadm.com
rp4.liadm.com
rtb.adentifi.com
s.amazon-adsystem.com
s.beop.io
s.ntv.io
s.pinimg.com
s.skimresources.com
s0.2mdn.net
sb.scorecardresearch.com
securepubads.g.doubleclick.net
sli.rd.com
ssl.p.jwpcdn.com
ssum-sec.casalemedia.com
static.cloudflareinsights.com
stats.g.doubleclick.net
sync-tm.everesttech.net
sync.adkernel.com
sync.adotmob.com
t.beop.io
t.skimresources.com
tag.bounceexchange.com
tags.catapultx.com
tlx.3lift.com
token.rubiconproject.com
tpc.googlesyndication.com
tracking.skyword.com
videodam.tmbi.com
widget.beop.io
www.aaxdetect.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.rd.com
x.bidswitch.net
z.moatads.com
ib.adnxs.com
104.18.18.126
104.18.19.126
104.96.145.101
104.96.148.107
104.96.159.65
108.138.4.10
13.111.148.19
13.32.121.60
13.32.99.122
13.32.99.21
142.250.185.66
142.250.186.162
143.204.89.32
143.204.89.57
151.101.129.194
151.101.194.133
151.101.194.49
151.139.128.11
152.199.22.243
152.199.23.151
18.132.175.146
18.156.195.47
18.194.56.109
18.203.105.247
184.51.9.197
184.51.9.34
185.183.112.148
185.64.189.112
185.64.190.78
20.50.2.28
209.54.182.161
23.205.235.133
23.35.236.188
23.35.236.247
23.35.237.151
23.36.162.26
23.47.212.208
23.75.240.210
2600:1f14:600:6e02:985c:c802:57ac:7531
2600:1f18:730:b150:64a4:fa7e:99c4:8411
2600:9000:206e:8600:1:a3fa:7cc0:93a1
2600:9000:225e:6c00:1:a3fa:7cc0:93a1
2600:9000:2304:3000:e:5a70:ca4f:f701
2600:9000:2304:e400:8:8845:1500:93a1
2602:803:c003:200::41
2606:4700:20::681a:79b
2606:4700:3035::6815:29f3
2606:4700:4400::6812:268d
2606:4700:4400::ac40:99f1
2606:4700:440e::6812:2fe6
2606:4700::6812:451
2606:4700::6812:d4c
2606:4700::6813:ad6c
2620:116:800d:21:ef75:8280:f209:5ba1
2a00:1450:4001:800::2006
2a00:1450:4001:806::2001
2a00:1450:4001:809::2003
2a00:1450:4001:80b::2004
2a00:1450:4001:80e::2003
2a00:1450:4001:80e::200e
2a00:1450:4001:80f::2001
2a00:1450:4001:812::2002
2a00:1450:4001:813::2002
2a00:1450:4001:82b::2008
2a00:1450:4001:82f::2003
2a00:1450:4001:830::2002
2a00:1450:4001:831::2002
2a00:1450:400c:c09::9b
2a00:1450:400e:80e::200a
2a00:1450:400e:80f::200a
2a02:26f0:dc:181::1931
2a03:2880:f007:8:face:b00c:0:1
2a03:2880:f12d:83:face:b00c:0:25de
2a04:4e42:200::626
2a04:4e42:400::485
2a05:d018:d29:3605:c111:9aee:7bd3:6707
3.121.8.16
3.122.72.35
3.33.220.150
3.65.16.214
3.65.165.22
34.111.8.32
34.120.117.212
34.120.133.55
34.120.253.250
34.230.119.25
34.254.16.176
34.98.72.95
35.190.59.101
35.190.91.160
35.201.67.47
37.157.6.252
37.252.173.215
52.213.82.126
52.57.125.17
54.146.208.95
54.226.61.34
54.243.198.75
69.173.144.165
76.223.111.18
77.245.57.72
99.86.240.124
0156d148a5d904d8a4b276d8cae5b77667e05ae546fa3b441e3116aca02ee6c8
01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
0660862c3bbbb31cd2e4a79c5b9ba036356e35e5c80ce5b7b66cc06c93865162
06b975b2cad4370629c5bb9f5b74f395b9dec39b45fe771396f1b47733b0f56d
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
0728797b523d2cd0d7cc032ec5db82405b7200fd35268aea06401ab5e10424da
08bc22c85c4246a31747bd1dc24007bf53be94f4e527e387ab0a1d81c637c3a6
08d20a2ee48b6892026d9a264b4c45206ccb1018dfb5f1d643d6a10bbd2f974a
09bdd678609812f4311a2a3ae3b63b08b35029f886975555f704a3f79fbbe2d5
0a0a852aa9b86a8b696dce2dd05d4d00a915b196b30aae0948af29fbcd3f54e6
0ad93024412465f56e8b0aa134d2a4dda848d68e23b5c20d12125f38f6a488c4
0af5349cb9f7625dc177ce8b0aec00e388266c2e6761c69f181ec6c2a5d6d130
0b7fba521251654385f089e43a68263f57f89321da25dbd457e2595e8727e9d1
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0d910cc1aa24413aaeef9f2cb52c3ed8bc4a06e823fc1d2d26f75667a0233764
0ed9f4489f29950f54053b4620800f6f1e061f3a467dfda552104034a71c3da9
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
11e5934d20c6bd213399fe63dc8de240747a0b49a7f782aec6981d6a66e08282
12f8e16de96fcaba1aaf32802ef8583cee0ebbd534d4c9216cdd09964381b5f8
13709eb92cc8d30ddca86cac6a763b4e40a4a5d6a338ce79e4220d91fe24c36a
156653c0c2c026afc382bbbe02e0ac95ae4734401670cdb06e44665de0e46000
1574db55dfbb34c01542fd1ef72942c1f9cd0aaf7a3ce135e0deb2e55dfdd486
17dbb476b9e2ac4cd30bc27ff21cd2d44a4d2d188dcc9dfcc7b151e20d9c89bc
1b06e1c6d409d4a667970959397d39f5ddbf9803cbf7f9acb70fe00b8127cf4f
1b371fe7914ea1f48622b928d3677af13d177e4e9595fc1d3395d8024f682762
1c4777fe3a673a05492e27d08032cc91c23ac5389897c9235b09b8b0f5a74db3
1c9464895887e89bf485eb9a07e7ebe22ff70133a8bcb1e19a0774ecf67703a8
1d982282f0397d47ade6971a4fcc4510e48818e69b8d0a1f841ef7c2719d13de
1fc1943ad73b34c7ecc7fc573e931cef2eeca1c68ebc90ae8c3a8f4162319965
207794d67b4c418fb8c527238697f628074d9c9fcf5476ac96e8572781b50097
22af5d3bf749542c2d95975186991b7b8c1e0766449c3fdeab55d57eb0d1ffdc
2322e1e0a2973f2918adf31582c5ad5668af0aee5299645411374e59a9eaff2c
25debee90474604a5599e170d42a4c9bf6133d9aa6384ea3f1748a1106dafff6
26f15316e56b49f0b180996e246eb7b435ad0fc4aad547ed39bc5253764d89ee
2b59b7362e2f136f8eb50ee9ed29dbb5ca434c1067cb56de2cf9808679028929
2bef08bfc4f5df889affb046f13acf8a5aba7d656918647bedc7c98eade9ffe4
2c34e56c8477ca237b6ca14153f7187aa724b0ba5f764e28b91b3f7bbeb2a762
2d199b9d8dc7886837cbfd12c9e8ddae7e28f5c375d564b31bf732a320921435
2df376a121504eb2a43ab52f31097cf60bf2127502f5ee165084c075642ccfd6
309961d8bb2d8dcff9b6df28581e0f52e99df15c3468580bb321b3a8b5e75b4e
33befdbbb24930584f5ac94ea3117adcd56518f20ab1619d05de83ffd1821d38
345a8b8d3c375a4c3e1926696bf53c3912d32cf268b228572fd234ff7fcbaf4d
351846a513b381063c0b9916ede4a812391bd06c3465763c65fc166123b7e4fa
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
37b17c5135a176a9474521af147d96dfa1fb4ca0f43f00d1400bd1885be3ab9b
37c9dcde8c4a0a5a7dcf5210b9f7cc93a1cbedfe367593480bcd0e383dbb60c4
37d796d47c326a0268a4fb42bd19b3537bac2b0faea4c28005023c3dda2ce739
388e31e7568caaf46c0e4ad833c001f35b03dfd85f820515132305b7eefd21c4
38ecfd35f3df13ac05900016fbb5975080b2856f6029ad5455203c0f5550c8ae
3a48ba6d11055a2a6f840befa14e603650d8ca3d752e16daccd828d3869fb791
3c9237f8569d7a3cbf7ab25bf871ad84aadc0098e254f3af2790c05c6a98fea3
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd
3f186210f22d15c9e99282bbc6f351ba7aa14966802f184537dfe273d695e826
3fb75dcca26d384c618e910e2328c32dabfd7a7b0bd3f4ee50bb8bf5065f0cb4
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390
41bfc94dec842bcbdd396a0e78a1568638f50b5067fa94c66a767af05c77da59
435b827b100268bdb32cc3ffabf94331103010fd2d1ba26890fc639d53a1b525
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
483784ecdf80ccaffd50869e23e2efdbeed9343b1b4c7dae837667e4984a68a7
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032
493bd9e02b4ac1dad8c1bb0d1448512d4ce80ac0d66b27d47cb46638cbbad8ba
49d65831c7e98a7d885d223699a41198204329efff9d1904c8af71323f613d68
4a3dbe01c6d50d8264cc5c9b01a48a659ca032ba9c1260903e4242975e518cff
4b05d7f4339a505c65d2fcb1b21addd2a13a0c155ddf7ca766d1e7203b2b6cae
4d0aba5a5138c32ec4646ede6045102a63b38e602e846a5823561c8e4299ddb2
4dd22a866cf7fa613e4a25f4e152e8d2f89e3e677c440e52c14e660927610e1d
4e421a0440b56149be838fad25420517bb36fc7135f18783835ddf6e73c29899
4f6366518c3d992d6a9a3aee342675532822d6b1d66217df7b284bb450dbb99a
4f6848f45929db24af962e27c4c96a44bd7e3bb4cdc8274e613315bb6e6eb435
502749d5b80e993b10e32816970a8f09da06d46d3abc4b897e333d34c6561a2a
50c1032bb1dd33cb368ac2f7c4ec1ded198f264f359381130d55e68a80567f1a
51ac5b2d4d716f7fe76fb278275cda1184b8fcb2c18f64ee55842076bcdfdb93
52b31d95b3be7d837502b15107ad1edf7f9c3ce42773ce65361336dde7597ab6
5315b3b69ad428d90ce6485dc31a8f0a06bfd2579b1c34120992aacd3bda5556
532cf7167d55ffff4ca4ee0d3913030f03ff89a34cda42c42b0b659ba446f932
5413479dd05424eecd22d956df8c2b591087eb385f94c003f4ef62a8c28137ff
5427e10c23520fbca480e8750c7e03dc2858eee594081879ea72a559bbd9fa81
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5577de66fefd6de448a833fd84d9a752e707cd52c7ff42ffdbbf8431d0551fa2
557e4d49c7f5f312a54c7eba0ee716186ca4087c0f69a3ddfc926cc43fd9a0a4
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
56e914584f77a21cf28171f6545abb9ec3246de4b923724d855d84cb1243a156
5726835a9449b924da62bf34cbe26cd64307f3c9159914f82fee7cab41aaf306
577c74b1ebd9b7a1c477f96620ef0c32ce5658e11dec9a564033c3ee57d3b76d
5893c1ccc8413220bf8a158af5a06e45ec294fe853348dd19b68f221ba4833f5
58a07739b05fec4d319e4d5c6b1fa4ac79e2a625e08ab3f303929b77fde5bdf4
58a96d162fc1324ff836fbc13751ab5a605802e98eace4e927e647bccf50cd63
58bc438e7e52302881247a70666f53af112ad1a706b4eb8935999132290f4c39
599c1a5d181f670117666d33f77c609474d56d0edbe95d60584dfd9ccceeeb21
59b92dc54ec59de5e855231a626d0dce05e8a050b0f33ad1ddeda966a930ad43
59d4737a7d9349d2129c8df151acbb986ca2c3f77706af37a40545ab1f9c93fd
5b0602eeeb1484cc85d98733fb9441e16d91eb68beb26c19519ea7e61c1d48d0
5bbc49b8e4b608dd8d1539e5f394825fa16220f5ba9d25d502c4493e690e75ea
5cd935496108c34f1f3e37e1b1eb791ed14b8683770a991a13edbc0660a3df3d
5d7c7d25a0da74c0dd466120c3c09bd94cb982fc66ebc4a78675339f37323bf5
5de2f269f121423a6e49c66c14466a779cd693fd6faeff3e04152024be81139c
5efc6bad9022a5f98b4043a2e85a3233d84270d4f9cfb1cd65080a31b7640491
6139dddd3b6b6b847bccd476918dc8fb4f4f5a10908e5707c704f155e0918e84
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
636d6f07b3e1c54521a32a4e40f9c889ef8fb235f024bcabd94cdb73f0b04901
63e55165cb26efa3df20628f8c2dfc0b13e7d7e7629761fe9f43b34d5498ea46
652d82ad34da02c9602d66332cfc52fb39b65da77c70a9faa518d859faf360b9
667a3a80b42e66f81cf68082a3e194c3179667eedd361f5ac04296b45a23b1f8
66f6e17d40054e4a5d8e5f90e8e93ca8b1b31e9964cb9b790eaad980ecd6b875
67753bf8ff944e4b146d4d08aa0bf0ebcb1618994bc9384aeda849996d09c17c
68284555b7929bc8140442a4a4ed0b4180d085bbfb5d2171554def907421f8f3
6838420e13959ecffe73d3576ee2125a66c9315237394a23e3dd4a5181e80cda
69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7
6980c1b5df92b2b97f679ff77a41a041d04ab563c1ff81b9acea0e8785fb8fb5
6c1bfdb14d27bda31dfee5f766c56a12bf8a618d7fb24cb9c0c539a35b2090b5
6d0b5a63ca5e36540e2628599ba666ef0ac2bd34f8ea5f25c9a51b0e4c72fed2
6dd1548d9bc310301ca3828e82a2f684d5ed2a799b37f53a79cc0a023da80d01
6e86a52a9858206302e32036d89907e3ac87762055e7f9c6364aec33221b3e41
7070c9402db323126f9422de0f47be9a29cda05bfe1dafe1af07306ca666b8f0
712ee4eb9657dcd072d7bbefefc6235ccf81828807c093390810a3d2af85586c
715bc6bf84352aa0f104c41c531e14948fd1d4fe2eafbd85d3c59862ce8b3d86
71795f168f858d2b071378a3a6b78556eea59f816aaafaeffe8eb55ffdcf97bb
71e5b6eb041cb505cab8acbb09548b57aa00ad344594519d2e3f8857a9687020
73048b6bc2bedb279c486de3365377836e5b75bf7e2a4919ff7576a936c9ccd5
7340df43419118c6b64c973c496ecd6b95b0450eee32dc58b2ca4758bd3c2e80
73c96c74b22e305ac760cbf63d54a9f08e0e3cb3c7384112f55ad36b1286de35
7658233cbe36b832efda5b9a27f917453114586626666ed6142b0c50a2e8fcef
76d773cd2f21f406e1cbb6d8b1ca5251b82c35488f2f431c17571012b052009c
783929bb93fcbbea66a9c287a1ec14fda946e3062133e0339a743cd28ad09191
796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90
7b6fef0a63424245b31b293b1a3bfd074c9da482e28fb9e920e1cf306e54e8a2
7cc0fa02d75d6ee0ba9502901af69fcd18d64aca7c88bd272a8e2b6dfe40f5c3
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
819f3136b7fa1d732f05ec1d9c773bed9bdcdb09e936fe964ae8fb70f29912f2
82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
866c3e7e9c3ac0d8e0df50f622518445b0465dc4a34bbb6082b6c27391d77dbc
8704f607741a4e0a4d82cf024d026c9e7c1d65241250c2223f31dca29a07dc15
889f28c7e0ff9ec3b2fb1f2cbdbe7c0d4a5a09a34406d76e89f8416b5cbd8457
89b4aa9e9bf8516c2ab7b5134f65d47b02071637259a14c9f60dccc207e05ce4
8a26f948122b1fe863bae3e65f7a64893e6e29e8e760ac075654174f96171cdd
8a9ba7bbc88ec23d81a2d63845638a3b6603de473261872f301803cef84ef335
8ac1703c1c34b2be426deda409d39258f82fae17f13e645f377f337a954aedde
8afbf08f34f262446fdb891795c984924d56e106d8ae491bd6644aefcaa39375
8b79630ec15683d0ed35aa5f175a2809a776c2f8075ec8b363ffec4b6c7b5b3b
8cd629187427fdb93787d7156be7a32c391bb2a8da471bbaa274e806e48b36e7
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8d8de3829d2383650a9308f175c7017fe6f3a60c3888d6d61e089f9b19141323
8e3a7c03d6e80eb066480affc9f6de10cd5385b021a4557144ddf46691c4cb74
90ac9971a59a7ac433772a4b628bad74e71017647687c7b9e55a0ed2bf90736d
917a63a19dac1348bb634d55b57bf5ae9217f1b6c740df56b9525aa5557e18ae
91c00cb18c492812180645a760c3e76b611b3dfb8576de93a0fa453aee1b078d
92b87abad0f720fb63de85b2c4f6bdea38090b1ec6223d2046e81f397c25a6a6
9399dab3e383fdc22b2d578596ba65980795310122106ce73252718dea66ef7e
9545822056572ccf35b6c6781374ef73bdee236004959748700ea7d644e0199d
96281150fc4b153640ffd15f9ce9a133ee631aecb0f955cd67974e72af74ae64
9629c59fb5d325a2fdf7324f731f6e8a4ee507af7d1bd260a4d290ee69c4d17c
9698d26296a1c7cc9eab2513fff3029368cfe795fc9ce1e198465a26b2bfcd76
970c55fcc93e289ca0d0328c445d35475008515b6800407ab73dcf689089f6f9
9aff82bb6bf217571cd2bfc3d1cee2b915056bfad051044e914352826c33d320
9b268fa9e727fb03331446edd6222f2f4e7c2bdb242b14939e4b5cacf4e7be9a
9cc5de9fdb0201569f2566a0cf00f15a0fae5a4260c3982c1fcf679d5811dbde
9d3b9fae5871a5e5fffef79fb26b16e5e0789ac2dfa94c96f08cf2461e1360e5
9e17addb1f066c3734f03eb49f081c7439b817d4ce21cdafcf6ef5cd81c05e51
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a10b9570a1c7858442b42f1cd48b69a191638269f37e4046607bf5fe188e38bf
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a1f86938ee81bd0bbd42f427141e814075ba7d660a4cc66f85ff9254a1278cb2
a221b8ec55e0d82883699663672c218c4de02207132f344a6440d69df7094b7d
a2acf545701465b3ff3d92f1d80eae2743004fff551e072738e00372b14b903b
a2e0a910385671a83ecc18e58bc12839a21260839514e18ab1862a6012008890
a32b280803f80b434b6b9b12f856f921d71e98275415fdb71a8f59b742cd7eb5
a35a51e32439cce8b4dd6734f65c18debec94ca81a30640b2ccaba988ce1639e
a3e64300797e8078baa41dbc49e2affc1d2bedd04a470f0c929ed7fac698fbcd
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a57258a3f51dc6ee13ca490ab8e780ed443e5725a650e7f085f1c67325784461
a64e083bdb3ff06c71a5ac92ecadf7a268e26dacf715baae6e84a6a3f3711366
a67117312ce631cdfc251dfbb90058bc01e3849deb0cd7fed130745b5813d1b2
a6735e9f72eac896e917b31e6d7bdca60528f28ac6cab6b88251849347ba3f80
a6a06429105f522575f9dc82a176e6d7c505a29284c0529cfd141daa9d816e7c
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
a7b36a3eb9f17d8c9358746188338240677f6d27016bae8571902a078d12097e
acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a
ae919a7c9f25f0fd97fc18e398ae8e453fcaae487e4a4cb4f896e7fecde4a780
ae97441771e91747997d983ff28bdb321a821846d2d6da01587f01d0fe33c5b7
af783b2650aaeb43013aa489f72edfaf2c1b348ad47681537265264414a1a7ee
afbeecfcb775ea87363f8eb7105a6ab60cb64eadb7a71a455cd52cc3cc8d5740
b0b68a2820314b9d471468ca2fcb17de112c4c864f048e50d593f054962f2c9d
b0e385c1e349d9f04e3f2d4df39f992f5d0115630e27c67e672296b947e4ebb3
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b202f2a7fae6fd09ff47455af24fa930f65cec69067211835d0d2c223fd95066
b2bad1e576aa96df171e492e3119d2da02486866a4fcb62a0ba57a8f5ff1d394
b396ad1f1cac053ea579e5989462b206af7fb863907bf319fe02d2a5ce29aebc
b423a0606a3921c194a4b9a7fae62b3c3767877fde6602c42428f10023f26d21
b5c3760ebad493fbb95c0ac2cbcdeca727826c3f9c78719d2964c62abca3c7a1
b6c2fd209cd3b56d6fc439c1191bf3aaff5cafc1ccc47d3f367e32f8180a37d1
b8197cfb30b45b71af2f3bc2a64401b589ceb23b3d0b18b4e6dfffae7befcedf
b88fca268e1352a0922f301c6b88f0499606c01faa8d0718de11a8153a5edc3a
b8d99817a8b892853ac7152f6db0c094fc8e1a06a841da6c7e2a095ce1349cc3
b9544dbbc4559751f0ceafc848716911393670f4e5bd8ae18e952d7d08bd346b
b95939599754deb2250672a0ecba1494e7af2352a3598695df9684d77f953d73
b991004bf766883ecf36d27ff836b327b64abbca550239430fe9641b2fcc61d1
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bd25bde9fc4427cd6f3babcb8f888fe6174ca48881c103e243d4c6f83f30aab6
bdaeb78e6d2060e6cb329c9d4f359ef32521bffb3699826aeb6f53a54ef2c2bc
bfcc2143b6f0635117b7354d9c0965778cd10168c10ca661d0ce42af30820951
c0b195905fdb73566a39eff0a966a34751098e677648810fae752c3a936584cc
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e
c3d3e53145b2e47ef3c4a2a08c8a644b8acf51380859a40d48a39447646e9a02
c5e24ad5cb560937b7ff087c5e6b7e5b5ee15e866d0725e1385fe98ad6268df6
c7f7fbc513e55c62a48a2d2349d1d5a48ffc8698c3688f38737965632e6a463c
c96b700589fc0e7649b9794319674963d8c09a2c2f352ffaf93fd46bc2d8aa79
c978f89ecbf531f2b8bb903cab82fb0b0f1b44603dc1be644e028eebc655e89d
cb3f12f81184edd76efed5fe35a5c4ed281ff579e30ff9b13936a184afbc8cde
cc094ffe53f9cc289462d2bd847678bb257c47a9fd48389c837d09d90f1176d3
cd3f35aac14379985ade61d3d71e2af7bc7dbf2a403caa4934c822e85f4ade43
ce20a8cfb975010340fb75df709f5e56c7cc372b41f7e5c4260ceeda01ba9b0a
cf016295997068c6cd58f52c4fca8fdec2806b76e09b12521fcf734e0fcbf5f5
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d02ab98a558ccea032a6a1bc2bfefd2b4a2a3a1aa9f3dad40c70d4486f87704a
d0bffc7261df1454c5e05475cda7d9e6647318dc6c3936767e1252bfe8849c54
d1f6b58a8b32dea13acb29a386dab49f87293729abd1835672433d087bf29d6f
d278491b1de51ad826d16be5ab27b1746999c02d45200f107218427e34eed798
d2dd397f2f81170f2fd0bd5cee8f455e200894e9e2a81a114c29aa7b6856d744
d4580aeae0f60a9b08cb20f9ac4591550718dfb989a75109bd76a84de4513991
d669534a76a01823b9c2c53e150cb5cbdf338e7e2e80e4c429b12935137d793a
d6bc239a6993be3a5ed13249ff2d27e4e3bc80a30bbd6df2ff92b4db0ad1d996
d7471e3df1ba49ecc8acc2dc6d8c4c3619f1a8e094050bdb2432c1cb2548468d
d838708f9080299078c167af8e85a8cba9b28e00c13491d28f332dda28881fca
da3db457741823b2b3579b647a3d800eee052062f99208c8ca15c490bc4e142a
da9507cb1a3616e1442336158dcd9d6cfca240745ebe2a04e538e0e04cf11224
db0b2a9340137033881412a37a10f61ac49ca9017206bf08511d9d8fc0688dae
db9f62325642bd8ba149e128efe54e4f5072a700daaa9b586fc7a55c35dffc5f
dbc32f33967798a78d4d23797bcac666b28f0c1c6ccafb52ab501b8f1f7f746c
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
ddfea4688644106797f10d32994fd83c3508ba7090bf893c430c8cd2e573d8c6
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de70dfb4d84a8ec90477e9e76a9ff7fefd352f9e806a74313b6f6d6232261473
de7826b311a111b9a3ca8f37f1455eb43a548fa7189c46d39118543bd87173af
e0edfbf1d314a2d9637bf18245e19edb5c94d82367dbf711173ce58b7ae4e11a
e20ddb9ed1fa044cb624f0253bb06b13c92ed9915063bd63a5806440c6b1ce7c
e2c487c59c8c431220ea6e16cc0e26f41010fdd878000b34201a7ff7e2ee3515
e2d3a61ed75752b249f1d03fdfede37dda068c8a2fc0a58f738d1c14438b17c4
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5935466216a250bb06338805b32ffb19eeda9042ead790ebc6e5dda27820adb
e75555ca161f289d4830a84a1856b37a9cb0077f78af600fb47c67c135baa8fd
e78609c13e44bafd8f619e97e02631aea063465da09c9f1022a24a30f2ecd192
e9c45dea6d149ac4de08c8a5af38836a97d0c08144d2f1858247748b29615da3
ea6a175eb6226f00c8b2c59c12fb502205c532256dda71b9c903a36124c736a1
eae3e60047cc587e0cbdd516d13add26d0e42b1d276fc09225053066fbfae8df
ec10b5df5cd1a0f9cbbe8a1743f6d768a9b4523513d356985ce8b3c9fd96d252
ec15f98604211de09a04020860148a98124296e8ce00c461f5fded4eb0ff9d47
ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152
ed03606264f99e9e2b49861b119a5378d9c52f9bec0d56e9bf8f4a2afd0f05b5
edda75d7dc3a6104c5af0f926c5ae645ae25eb8c4f8a601c6d5293378e858a5c
ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0005c4930117c882abab233a3dc18ff04b76f8cb9ea86bed294c1a7a4464ec4
f039e32c9e62cd2acc5bf02dec7282686e6f41be6b01bfa249f9590cda747cba
f05e7cffaf25f8189d7f982960a21a7d99610b50102854ee49ff597f95cfc466
f1a21e904e61bafb952bbb2f64a3a28f456d963db7126cadd80b2116a5455da0
f29595049d8fe1e75b1c0d062c5436594a18730673c161bc96e7200ba3026083
f2b86ff090038df34b053747723c34ff9a00de105a79dbc9011697aaabf58a4f
f2f11e4d45030f1f21ec7d3ae67a65b83c4c67016fe861fbebdff04ca0c8cd60
f838b3467a329431f0fe6a00705cf5ae17609fc27843141faa62e6d0d21159fd
f9cfcddf5665fbffe11d395ef61e9073a4c182dc9255c9f1154e4ec573b66815
fc0c4893ccbfbb1c266374313522a0ff2383a73b9de5280299af809169650cf2
fcc83a5b6aef86420c1ad553167106df96bd0ff4192ffe52b1647599948edbcf
fd0a1ac929c11b08e819fe4b0a18c5574012c44f09de8987c6be99a0f055a505
fe3fcb884394be745dbd11141b6d780028a4d86106b6292d7502db096f582218

www.rd.com Open in urlscan Pro 2606:4700:4400::6812:268d Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

365 Requests

93 %HTTPS

37 %IPv6

66 Domains

113 Subdomains

97 IPs

8 Countries

3413 kBTransfer

10949 kBSize

28 Cookies

48 Outgoing links

Page URL History

Redirected requests

365 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 25 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.rd.com Open in urlscan Pro
2606:4700:4400::6812:268d Public Scan

Screenshot
Live screenshot

Full Image

365
Requests

93 %
HTTPS

37 %
IPv6

66
Domains

113
Subdomains

97
IPs

8
Countries

3413 kB
Transfer

10949 kB
Size

28
Cookies

365 HTTP transactions
25 data transactions