secure.everyaction.com
45.60.31.183 Public Scan Open in urlscan Pro

URL: http://secure.ucsusa.org/onlineactions/dR5QqmX2uUCLCFD1KkVEzg2?MS=topnav
Title: Donate

URL: https://fastaction.ngpvan.com/##whats-this
Title: ?

URL: https://www.ucs.org/privacy-policy#toc-text-messaging
Title: Terms & Conditions

URL: https://www.ucs.org/privacy-policy
Title: Privacy Policy

URL: https://secure.ucs.org.org/onlineactions/6TtUU7KYKkKm07SkWzm_Yw2
Title: Gifts in Honor

URL: https://secure.ucs.org.org/onlineactions/LA5-XXhFGUKJjpKyRFvQcw2
Title: Gift Memberships

URL: https://fastaction.ngpvan.com/sign_up
Title: Sign up with your email address

URL: https://fastaction.ngpvan.com/terms
Title: terms of service

URL: https://fastaction.ngpvan.com/privacy
Title: privacy policy.

URL: https://fastaction.ngpvan.com/log_in
Title: Log in with your email address

URL: https://fastaction.ngpvan.com/auth/actionid_signup
Title: Sign up with your email address

URL: https://fastaction.ngpvan.com/auth/actionid
Title: Log in with your email address

URL: https://www.charitynavigator.org/index.cfm?bay=search.summary&orgid=5970

URL: https://www.charitywatch.org/ratings-and-metrics/union-of-concerned-scientists/281

URL: https://www.guidestar.org/profile/04-2535767

URL: https://www.ucsusa.org/privacy-policy
Title: Privacy Policy

URL: https://www.ucsusa.org/state-disclosures
Title: State Disclosures

URL: https://www.ucsusa.org/about/news
Title: News

URL: https://www.ucsusa.org/about/jobs
Title: Jobs

URL: https://www.ucsusa.org/contact
Title: Contact

URL: https://www.facebook.com/unionofconcernedscientists
Title: Facebook

URL: https://bsky.app/profile/ucsusa.bsky.social
Title: BlueSky

URL: https://www.youtube.com/user/ConcernedScientists
Title: YouTube

URL: https://www.instagram.com/unionofconcernedscientists
Title: Instagram

xx-fbcdn-shv-02-iad3.fbcdn.net

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://mbl.ms/nXACmzK_lfO HTTP 301
https://secure.everyaction.com/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2fuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3d&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 92

https://ad.doubleclick.net/activity;src=8188095;type=site;cat=ucs-g0;ord=367765031085;npa=0;auiddc=1541318537.1748261129;u1=%2F5LsOqOrd906PKtLlv8yw8A2;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KlA;gtm=45fe55l1v9189007292z86541836za200zb6541836;gcd=13l3l3l3l1l1;dma=0;dc_fmt=3;tag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~104481633~104481635;ptag_exp=101509157~103116026~103130498~103130500~103200004~103211513~103233427~103252644~103252646~104481633~104481635;epver=2;dc_random=1748261130298;~oref=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057 HTTP 302
https://ad.doubleclick.net/activity;dc_pre=CMyIq52MwY0DFYQQaAgdo6wiTA;src=8188095;type=site;cat=ucs-g0;ord=367765031085;npa=0;auiddc=1541318537.1748261129;u1=%2F5LsOqOrd906PKtLlv8yw8A2;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KlA;gtm=45fe55l1v9189007292z86541836za200zb6541836;gcd=13l3l3l3l1l1;dma=0;dc_fmt=3;tag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~104481633~104481635;ptag_exp=101509157~103116026~103130498~103130500~103200004~103211513~103233427~103252644~103252646~104481633~104481635;epver=2;dc_random=1748261130298;~oref=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057

Request Chain 93

https://8188095.fls.doubleclick.net/activityi;src=8188095;type=site;cat=ucs-g0;ord=367765031085;npa=0;auiddc=1541318537.1748261129;u1=%2F5LsOqOrd906PKtLlv8yw8A2;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KlA;gtm=45fe55l1v9189007292z86541836za200zb6541836;gcd=13l3l3l3l1l1;dma=0;dc_fmt=2;tag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~104481633~104481635;ptag_exp=101509157~103116026~103130498~103130500~103200004~103211513~103233427~103252644~103252646~104481633~104481635;epver=2;dc_random=1748261130298;_dc_test=1;~oref=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057 HTTP 302
https://8188095.fls.doubleclick.net/activityi;dc_pre=CLmHr52MwY0DFUQLiAkdFegL1w;src=8188095;type=site;cat=ucs-g0;ord=367765031085;npa=0;auiddc=1541318537.1748261129;u1=%2F5LsOqOrd906PKtLlv8yw8A2;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KlA;gtm=45fe55l1v9189007292z86541836za200zb6541836;gcd=13l3l3l3l1l1;dma=0;dc_fmt=2;tag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~104481633~104481635;ptag_exp=101509157~103116026~103130498~103130500~103200004~103211513~103233427~103252644~103252646~104481633~104481635;epver=2;dc_random=1748261130298;_dc_test=1;~oref=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057

Request Chain 95

https://ad.doubleclick.net/activity;src=8188095;type=site;cat=ucs-d0;ord=6724603406122;npa=0;auiddc=1541318537.1748261129;u1=%2F5LsOqOrd906PKtLlv8yw8A2;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KlA;gtm=45fe55l1v9189007292z86541836za200zb6541836;gcd=13l3l3l3l1l1;dma=0;dc_fmt=3;tag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~104481633~104481635;ptag_exp=101509157~103116026~103130498~103130500~103200004~103211513~103233427~103252644~103252646~104481633~104481635;epver=2;dc_random=1748261130361;~oref=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057 HTTP 302
https://ad.doubleclick.net/activity;dc_pre=CNyVq52MwY0DFTkDaAgdL6USQw;src=8188095;type=site;cat=ucs-d0;ord=6724603406122;npa=0;auiddc=1541318537.1748261129;u1=%2F5LsOqOrd906PKtLlv8yw8A2;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KlA;gtm=45fe55l1v9189007292z86541836za200zb6541836;gcd=13l3l3l3l1l1;dma=0;dc_fmt=3;tag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~104481633~104481635;ptag_exp=101509157~103116026~103130498~103130500~103200004~103211513~103233427~103252644~103252646~104481633~104481635;epver=2;dc_random=1748261130361;~oref=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057

Request Chain 96

https://8188095.fls.doubleclick.net/activityi;src=8188095;type=site;cat=ucs-d0;ord=6724603406122;npa=0;auiddc=1541318537.1748261129;u1=%2F5LsOqOrd906PKtLlv8yw8A2;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KlA;gtm=45fe55l1v9189007292z86541836za200zb6541836;gcd=13l3l3l3l1l1;dma=0;dc_fmt=2;tag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~104481633~104481635;ptag_exp=101509157~103116026~103130498~103130500~103200004~103211513~103233427~103252644~103252646~104481633~104481635;epver=2;dc_random=1748261130361;_dc_test=1;~oref=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057 HTTP 302
https://8188095.fls.doubleclick.net/activityi;dc_pre=COaBr52MwY0DFUgtiAkdpMoFbw;src=8188095;type=site;cat=ucs-d0;ord=6724603406122;npa=0;auiddc=1541318537.1748261129;u1=%2F5LsOqOrd906PKtLlv8yw8A2;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KlA;gtm=45fe55l1v9189007292z86541836za200zb6541836;gcd=13l3l3l3l1l1;dma=0;dc_fmt=2;tag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~104481633~104481635;ptag_exp=101509157~103116026~103130498~103130500~103200004~103211513~103233427~103252644~103252646~104481633~104481635;epver=2;dc_random=1748261130361;_dc_test=1;~oref=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057

Request Chain 101

https://pixel.quantserve.com/pixel;r=271619514;labels=_fp.event.Default;rf=0;a=p-8w7tSVuzV_3NU;url=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057;ns=0;ce=1;qjs=1;qv=69fd865d-20250501105756;ref=;dst=0;et=1748261130523;tzo=600;ogl=site_name.Union%20of%20Concerned%20Scientists%2Cimage.https%3A%2F%2Fnvlupin%252Eblob%252Ecore%252Ewindows%252Enet%2Fimages%2Fvan%2FUCS%2FUCS%2F1%2F58097%2Fimages%2FUCS%2520lo%2Curl.https%3A%2F%2Fsecure%252Eucs%252Eorg%2Fa%2F05-2025-may-current%2Ctitle.Help%20defend%20science!%2Ctype.article%2Cdescription.The%20Union%20of%20Concerned%20Scientists%20puts%20rigorous%252C%20independent%20science%20to%20work%20to%20;d=everyaction.com;uht=2;fpan=1;fpa=P1-a13d9bac-54d8-47f2-9d97-3be734bb3b0a;pbc=;_ses=c74017c7-3635-4300-9072-31be443ab990;_seg=0;_ss=1;gdpr=0;mdl= HTTP 302
https://pixel-ssn.quantserve.com/pixel;r=271619514;labels=_fp.event.Default;rf=0;a=p-8w7tSVuzV_3NU;url=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057;ns=0;ce=1;qjs=1;qv=69fd865d-20250501105756;ref=;dst=0;et=1748261130523;tzo=600;ogl=site_name.Union%20of%20Concerned%20Scientists%2Cimage.https%3A%2F%2Fnvlupin%252Eblob%252Ecore%252Ewindows%252Enet%2Fimages%2Fvan%2FUCS%2FUCS%2F1%2F58097%2Fimages%2FUCS%2520lo%2Curl.https%3A%2F%2Fsecure%252Eucs%252Eorg%2Fa%2F05-2025-may-current%2Ctitle.Help%20defend%20science!%2Ctype.article%2Cdescription.The%20Union%20of%20Concerned%20Scientists%20puts%20rigorous%252C%20independent%20science%20to%20work%20to%20;d=everyaction.com;uht=2;fpan=1;fpa=P1-a13d9bac-54d8-47f2-9d97-3be734bb3b0a;pbc=;_ses=c74017c7-3635-4300-9072-31be443ab990;_seg=0;_ss=1;gdpr=0;mdl=;dip=aad40893-260a-4b77-9645-b9390d744a09

Request Chain 107

https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=2809753636385369760&referrer=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057&forward= HTTP 302
https://p.rfihub.com/cm?pub=39342&in=0&userid=5d1c07c8-c611-429e-8faa-b55eb5bcbf83%3A1748261130.991296&forward=https%3A//i.liadm.com/s/56409%3Fbidder_id%3D200442%26bidder_uuid%3D5d1c07c8-c611-429e-8faa-b55eb5bcbf83%253A1748261130.991296%26pid%3D500040%26it%3D1%26iv%3D5d1c07c8-c611-429e-8faa-b55eb5bcbf83%253A1748261130.991296%26_%3D1748261130.9921808&cb=1748261130.992205 HTTP 302
https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=969470238291792301&referrer={encSite}&forward=https%3A%2F%2Fi.liadm.com%2Fs%2F56409%3Fbidder_id%3D200442%26bidder_uuid%3D5d1c07c8-c611-429e-8faa-b55eb5bcbf83%253A1748261130.991296%26pid%3D500040%26it%3D1%26iv%3D5d1c07c8-c611-429e-8faa-b55eb5bcbf83%253A1748261130.991296%26_%3D1748261130.9921808 HTTP 302
https://i.liadm.com/s/56409?bidder_id=200442&bidder_uuid=5d1c07c8-c611-429e-8faa-b55eb5bcbf83%3A1748261130.991296&pid=500040&it=1&iv=5d1c07c8-c611-429e-8faa-b55eb5bcbf83%3A1748261130.991296&_=1748261130.9921808 HTTP 303
https://pippio.com/api/sync?it=1&pid=500040&_=1748261130.9921808&iv=5d1c07c8-c611-429e-8faa-b55eb5bcbf83:1748261130.991296

Request Chain 108

https://cm.g.doubleclick.net/pixel?&in=0&google_nid=zeta_interactive&google_cm=&google_sc=&google_hm=MjgwOTc1MzYzNjM4NTM2OTc2MA==&forward= HTTP 302
https://cm.g.doubleclick.net/pixel?in=0&google_nid=zeta_interactive&google_cm=&google_sc=&google_hm=MjgwOTc1MzYzNjM4NTM2OTc2MA==&forward=&google_tc= HTTP 302
https://a.rfihub.com/cm?pub=445&in=0&forward=&google_error=15 HTTP 302
https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=969470238291792301&referrer={encSite}&forward= HTTP 302
https://p.rfihub.com/cm?pub=39342&in=0&userid=5d1c07c8-c611-429e-8faa-b55eb5bcbf83%3A1748261130.991296&forward=https%3A//i.liadm.com/s/56409%3Fbidder_id%3D200442%26bidder_uuid%3D5d1c07c8-c611-429e-8faa-b55eb5bcbf83%253A1748261130.991296%26pid%3D500040%26it%3D1%26iv%3D5d1c07c8-c611-429e-8faa-b55eb5bcbf83%253A1748261130.991296%26_%3D1748261131.719812&cb=1748261131.7198331 HTTP 302
https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=969470238291792301&referrer={encSite}&forward=https%3A%2F%2Fi.liadm.com%2Fs%2F56409%3Fbidder_id%3D200442%26bidder_uuid%3D5d1c07c8-c611-429e-8faa-b55eb5bcbf83%253A1748261130.991296%26pid%3D500040%26it%3D1%26iv%3D5d1c07c8-c611-429e-8faa-b55eb5bcbf83%253A1748261130.991296%26_%3D1748261131.719812 HTTP 302
https://i.liadm.com/s/56409?bidder_id=200442&bidder_uuid=5d1c07c8-c611-429e-8faa-b55eb5bcbf83%3A1748261130.991296&pid=500040&it=1&iv=5d1c07c8-c611-429e-8faa-b55eb5bcbf83%3A1748261130.991296&_=1748261131.719812 HTTP 303
https://pippio.com/api/sync?it=1&pid=500040&_=1748261131.719812&iv=5d1c07c8-c611-429e-8faa-b55eb5bcbf83:1748261130.991296

Request Chain 109

https://ib.adnxs.com/setuid?entity=18&code=2809753636385369760 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D18%26code%3D2809753636385369760

Request Chain 110

https://dpm.demdex.net/ibs:dpid=1121&dpuuid=2809753636385369760&redir= HTTP 302
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=2809753636385369760&redir=

Request Chain 112

https://us-u.openx.net/w/1.0/sd?id=537073062&val=2809753636385369760&r= HTTP 302
https://us-u.openx.net/w/1.0/sd?cc=1&id=537073062&val=2809753636385369760&r=

Request Chain 113

https://p.rfihub.com/cm?pub=24472&in=1 HTTP 302
https://ps.eyeota.net/match?uid=2809753636385369760&bid=omt9pi0 HTTP 302
https://ps.eyeota.net/match/bounce/?uid=2809753636385369760&bid=omt9pi0

Request Chain 116

https://i.liadm.com/s/90096?bidder_id=246506&bidder_uuid=2809753636385369760 HTTP 303
https://i.liadm.com/s/90096?bidder_id=246506&bidder_uuid=2809753636385369760&_li_chk=true&previous_uuid=13b4e4d51d9d414dbf926f321c98059e HTTP 303
https://thrtle.com/sync?vxii_pid=7006&vxii_pdid=13b4e4d5-1d9d-414d-bf92-6f321c98059e&us_privacy=1YN- HTTP 302
https://thrtle.com/sync?_reach=1&vxii_pdid=13b4e4d5-1d9d-414d-bf92-6f321c98059e&vxii_pid=12&vxii_pid1=7006&vxii_rcid=458f4125-2974-473f-987a-76d7a954cb00&vxii_rmax=3 HTTP 302
https://ib.adnxs.com/getuid?https%3A%2F%2Fthrtle.com%2Fsync%3Fvxii_pid%3D5006%26vxii_pdid%3D%24UID%26vxii_ts%3D1%26_t%3D1748261131%26_reach%3D1 HTTP 302
https://thrtle.com/sync?vxii_pid=5006&vxii_pdid=1027157301885763985&vxii_ts=1&_t=1748261131&_reach=1

Request Chain 117

https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=2809753636385369760&forward= HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=2809753636385369760&forward=&C=1

Request Chain 122

https://sync-tm.everesttech.net/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D&_test=aDRZCwASlngfmwBh

Request Chain 123

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/994113961/?random=1669570956&cv=11&fst=1748261130132&bg=ffffff&guid=ON&async=1&gcl_ctr=1&gtm=45be55l1z86541836za200zb6541836&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~103116026~103130495~103130497~103200004~103233427~103252644~103252646~104481633~104481635&ptag_exp=101509157~103116026~103130498~103130500~103200004~103211513~103233427~103252644~103252646~104481633~104481635&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057&label=80uVCNHT54MBEKnzg9oD&hn=www.googleadservices.com&frm=0&tiba=Defend%20Science%20from%20Trump%E2%80%99s%20Attacks.%20Donate%20Now.&value=0&npa=0&pscdl=noapi&auid=1541318537.1748261129&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_m=%23validators%3E%3Anth-child(2)%3E%3Anth-child(1)*A%3Atrue%3A17%3Afalse*1&ec_sel=%23validators%3E%3Anth-child(2)%3E%3Anth-child(1)&ec_meta=A%3Atrue%3A17%3Afalse&ec_lat=8&ec_s=1&fledge=1&capi=1&_tu=Kg&fmt=3&ct_cookie_present=false&crd=CPLOsQIIobixAgixwbECCLDBsQIIscOxAgiKxbECCMLJsQIItMaxAgiQybECCMLPsQIIw8-xAgjTxbECCOvMsQIIz86xAgikz7ECCP7OsQII1c-xAgiX1LECSid0cmlnZ2VyLCBldmVudC1zb3VyY2U7bmF2aWdhdGlvbi1zb3VyY2VaAwoBAWIECgICAw&eitems=ChAI8KLQwQYQ_qa9wr6Iqag-Eh0AOJh_GHkE_DBLJAADGtCajB6VM8GG0-RnZOJp5A&pscrd=IhMI9N6cnYzBjQMVT3NHAR1CXg3dMgwIA2IICAAQABgAIAAyDAgEYggIABAAGAAgADIMCAdiCAgAEAAYACAAMgwICGIICAAQABgAIAAyDAgJYggIABAAGAAgADIMCApiCAgAEAAYACAAMgwIAmIICAAQABgAIAAyDAgLYggIABAAGAAgADIMCBViCAgAEAAYACAAMgwIH2IICAAQABgAIAAyDAgTYggIABAAGAAgADIMCBJiCAgAEAAYACAAOh9odHRwczovL3NlY3VyZS5ldmVyeWFjdGlvbi5jb20vQldDaEVJOEtMUXdRWVE4TzZsOTY2SnQ1bmZBUklzQUJJQXpkT095alFieXVvSDNHVWJzOGRtbG5NRVhnUVFrQWtER1ZfUmh3dUtwNmVFdUJBZmZ5eENOVEl6DAgJYggIABAAGAAgAA HTTP 302
https://www.google.com/pagead/1p-conversion/994113961/?random=1669570956&cv=11&fst=1748261130132&bg=ffffff&guid=ON&async=1&gcl_ctr=1&gtm=45be55l1z86541836za200zb6541836&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~103116026~103130495~103130497~103200004~103233427~103252644~103252646~104481633~104481635&ptag_exp=101509157~103116026~103130498~103130500~103200004~103211513~103233427~103252644~103252646~104481633~104481635&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057&label=80uVCNHT54MBEKnzg9oD&hn=www.googleadservices.com&frm=0&tiba=Defend%20Science%20from%20Trump%E2%80%99s%20Attacks.%20Donate%20Now.&value=0&npa=0&pscdl=noapi&auid=1541318537.1748261129&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_m=%23validators%3E%3Anth-child(2)%3E%3Anth-child(1)*A%3Atrue%3A17%3Afalse*1&ec_sel=%23validators%3E%3Anth-child(2)%3E%3Anth-child(1)&ec_meta=A%3Atrue%3A17%3Afalse&ec_lat=8&ec_s=1&fledge=1&capi=1&_tu=Kg&fmt=3&ct_cookie_present=false&crd=CPLOsQIIobixAgixwbECCLDBsQIIscOxAgiKxbECCMLJsQIItMaxAgiQybECCMLPsQIIw8-xAgjTxbECCOvMsQIIz86xAgikz7ECCP7OsQII1c-xAgiX1LECSid0cmlnZ2VyLCBldmVudC1zb3VyY2U7bmF2aWdhdGlvbi1zb3VyY2VaAwoBAWIECgICAw&pscrd=IhMI9N6cnYzBjQMVT3NHAR1CXg3dMgwIA2IICAAQABgAIAAyDAgEYggIABAAGAAgADIMCAdiCAgAEAAYACAAMgwICGIICAAQABgAIAAyDAgJYggIABAAGAAgADIMCApiCAgAEAAYACAAMgwIAmIICAAQABgAIAAyDAgLYggIABAAGAAgADIMCBViCAgAEAAYACAAMgwIH2IICAAQABgAIAAyDAgTYggIABAAGAAgADIMCBJiCAgAEAAYACAAOh9odHRwczovL3NlY3VyZS5ldmVyeWFjdGlvbi5jb20vQldDaEVJOEtMUXdRWVE4TzZsOTY2SnQ1bmZBUklzQUJJQXpkT095alFieXVvSDNHVWJzOGRtbG5NRVhnUVFrQWtER1ZfUmh3dUtwNmVFdUJBZmZ5eENOVEl6DAgJYggIABAAGAAgAA&is_vtc=1&cid=CAQSGwDZpuyzeM5syB72pHUfJU4X5E_dZMu3vzLtuw&eitems=ChAI8KLQwQYQ_qa9wr6Iqag-Eh0AOJh_GKpphHX5pRWbhYMB1Ld0w4uyInYN4Xe6ug&random=1237720010

Request Chain 124

https://p.rfihub.com/cm?pub=24472&in=1 HTTP 302
https://ps.eyeota.net/match?uid=969470238291792301&bid=omt9pi0 HTTP 302
https://ps.eyeota.net/match/bounce/?uid=969470238291792301&bid=omt9pi0

Request Chain 125

https://sync-tm.everesttech.net/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D&_test=aDRZCwALIXM1JgA_

Request Chain 126

https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=969470238291792301&referrer=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057&forward= HTTP 302
https://p.rfihub.com/cm?pub=39342&in=0&userid=7ef7be00-5114-4a85-a49a-21ff6678690a%3A1748261130.993146&forward=https%3A//i.liadm.com/s/56409%3Fbidder_id%3D200442%26bidder_uuid%3D7ef7be00-5114-4a85-a49a-21ff6678690a%253A1748261130.993146%26pid%3D500040%26it%3D1%26iv%3D7ef7be00-5114-4a85-a49a-21ff6678690a%253A1748261130.993146%26_%3D1748261130.994197&cb=1748261130.9942176 HTTP 302
https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=969470238291792301&referrer={encSite}&forward=https%3A%2F%2Fi.liadm.com%2Fs%2F56409%3Fbidder_id%3D200442%26bidder_uuid%3D7ef7be00-5114-4a85-a49a-21ff6678690a%253A1748261130.993146%26pid%3D500040%26it%3D1%26iv%3D7ef7be00-5114-4a85-a49a-21ff6678690a%253A1748261130.993146%26_%3D1748261130.994197 HTTP 302
https://i.liadm.com/s/56409?bidder_id=200442&bidder_uuid=7ef7be00-5114-4a85-a49a-21ff6678690a%3A1748261130.993146&pid=500040&it=1&iv=7ef7be00-5114-4a85-a49a-21ff6678690a%3A1748261130.993146&_=1748261130.994197 HTTP 303
https://pippio.com/api/sync?it=1&pid=500040&_=1748261130.994197&iv=7ef7be00-5114-4a85-a49a-21ff6678690a:1748261130.993146

Request Chain 127

https://cm.g.doubleclick.net/pixel?&in=0&google_nid=zeta_interactive&google_cm=&google_sc=&google_hm=OTY5NDcwMjM4MjkxNzkyMzAx&forward= HTTP 302
https://cm.g.doubleclick.net/pixel?in=0&google_nid=zeta_interactive&google_cm=&google_sc=&google_hm=OTY5NDcwMjM4MjkxNzkyMzAx&forward=&google_tc= HTTP 302
https://a.rfihub.com/cm?pub=445&in=0&forward=&google_error=15 HTTP 302
https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=969470238291792301&referrer={encSite}&forward= HTTP 302
https://p.rfihub.com/cm?pub=39342&in=0&userid=5d1c07c8-c611-429e-8faa-b55eb5bcbf83%3A1748261130.991296&forward=https%3A//i.liadm.com/s/56409%3Fbidder_id%3D200442%26bidder_uuid%3D5d1c07c8-c611-429e-8faa-b55eb5bcbf83%253A1748261130.991296%26pid%3D500040%26it%3D1%26iv%3D5d1c07c8-c611-429e-8faa-b55eb5bcbf83%253A1748261130.991296%26_%3D1748261131.914878&cb=1748261131.914897 HTTP 302
https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=969470238291792301&referrer={encSite}&forward=https%3A%2F%2Fi.liadm.com%2Fs%2F56409%3Fbidder_id%3D200442%26bidder_uuid%3D5d1c07c8-c611-429e-8faa-b55eb5bcbf83%253A1748261130.991296%26pid%3D500040%26it%3D1%26iv%3D5d1c07c8-c611-429e-8faa-b55eb5bcbf83%253A1748261130.991296%26_%3D1748261131.914878 HTTP 302
https://i.liadm.com/s/56409?bidder_id=200442&bidder_uuid=5d1c07c8-c611-429e-8faa-b55eb5bcbf83%3A1748261130.991296&pid=500040&it=1&iv=5d1c07c8-c611-429e-8faa-b55eb5bcbf83%3A1748261130.991296&_=1748261131.914878 HTTP 303
https://pippio.com/api/sync?it=1&pid=500040&_=1748261131.914878&iv=5d1c07c8-c611-429e-8faa-b55eb5bcbf83:1748261130.991296

Request Chain 128

https://ib.adnxs.com/setuid?entity=18&code=969470238291792301 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D18%26code%3D969470238291792301

Request Chain 129

https://dpm.demdex.net/ibs:dpid=1121&dpuuid=969470238291792301&redir= HTTP 302
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=969470238291792301&redir=

Request Chain 131

https://us-u.openx.net/w/1.0/sd?id=537073062&val=969470238291792301&r= HTTP 302
https://us-u.openx.net/w/1.0/sd?cc=1&id=537073062&val=969470238291792301&r=

Request Chain 134

https://i.liadm.com/s/90096?bidder_id=246506&bidder_uuid=969470238291792301 HTTP 303
https://i.liadm.com/s/90096?bidder_id=246506&bidder_uuid=969470238291792301&_li_chk=true&previous_uuid=990fcfa2212e41be8de99cbf9f3199ef HTTP 303
https://thrtle.com/sync?vxii_pid=7006&vxii_pdid=990fcfa2-212e-41be-8de9-9cbf9f3199ef&us_privacy=1YN- HTTP 302
https://thrtle.com/sync?_reach=1&vxii_pdid=990fcfa2-212e-41be-8de9-9cbf9f3199ef&vxii_pid=12&vxii_pid1=7006&vxii_rcid=13c7baf2-c3e9-4383-a0ab-37a491af168f&vxii_rmax=3 HTTP 302
https://ib.adnxs.com/getuid?https%3A%2F%2Fthrtle.com%2Fsync%3Fvxii_pid%3D5006%26vxii_pdid%3D%24UID%26vxii_ts%3D1%26_t%3D1748261131%26_reach%3D1 HTTP 302
https://thrtle.com/sync?vxii_pid=5006&vxii_pdid=1027157301885763985&vxii_ts=1&_t=1748261131&_reach=1 HTTP 302
https://cms.analytics.yahoo.com/cms?partner_id=THROTLE HTTP 302
https://ups.analytics.yahoo.com/ups/58691/cms?partner_id=THROTLE HTTP 302
https://thrtle.com/sync?vxii_pid=5038&vxii_pdid=y-r2ZqVh1E2oTw.JZJpTFEP1HgTI_GyJOHj0wTnQ--~A HTTP 302
https://pixel-sync.sitescout.com/connectors/throtle/usersync?redir=https%3A%2F%2Fthrtle.com%2Fsync%3Fvxii_pid%3D5026%26vxii_pdid%3D%7BuserId%7D%26vxii_ts%3D4%26_t%3D1748261132 HTTP 302
https://pixel-sync.sitescout.com/connectors/throtle/usersync?cookieQ=1&redir=https%3A%2F%2Fthrtle.com%2Fsync%3Fvxii_pid%3D5026%26vxii_pdid%3D%7BuserId%7D%26vxii_ts%3D4%26_t%3D1748261132 HTTP 302
https://thrtle.com/sync?vxii_pid=5026&vxii_pdid=5a602d4b-df63-4d0f-86e8-7d21fdababb3-6834590d-5553&vxii_ts=4&_t=1748261132 HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=brgeu23&ttd_tpi=1&TTD_PUID=13c7baf2-c3e9-4383-a0ab-37a491af168f HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=brgeu23&ttd_tpi=1&TTD_PUID=13c7baf2-c3e9-4383-a0ab-37a491af168f HTTP 302
https://thrtle.com/sync?vxii_pid=5015&vxii_pdid=477cf374-773c-4ebf-8d21-922b158a37fe

Request Chain 135

https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=969470238291792301&forward= HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=969470238291792301&forward=&C=1

Request Chain 148

https://secure.everyaction.com/favicon.ico HTTP 301
https://secure.everyaction.com/Content/images/favicon.ico

147 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request 5LsOqOrd906PKtLlv8yw8A2 Show response
secure.everyaction.com/
Redirect Chain

https://mbl.ms/nXACmzK_lfO
https://secure.everyaction.com/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2fuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2fn++xLi...

60 KB
28 KB

693ms
399ms

Document
text/html

45.60.31.183
INCAPSULA

General

Check archive.org

Download Go to

Full URL

https://secure.everyaction.com/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2fuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3d&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.31.183 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

d3156f3c9c3a6cd7358d4a097e91704ccede6f0f16877941841f00faddfbde37

Security Headers

Name	Value
Content-Security-Policy	default-src * 'unsafe-eval' 'unsafe-inline' data: blob:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-expose-headers: Request-Context
cache-control: private
content-encoding: gzip
content-security-policy: default-src * 'unsafe-eval' 'unsafe-inline' data: blob:
content-type: text/html; charset=utf-8
date: Mon, 26 May 2025 12:05:25 GMT
request-context: appId=cid-v1:ccd92c0b-19c7-485c-b607-cbfe2344efa3
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-cdn: Imperva
x-content-type-options: nosniff
x-iinfo: 61-290774940-290774991 NNNN CT(80 133 0) RT(1748261125817 221) q(0 0 2 2) r(3 3) U2
x-xss-protection: 1; mode=block

Redirect headers

Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Date: Mon, 26 May 2025 12:05:25 GMT
Expires: -1
Location: https://secure.everyaction.com/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2fuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3d&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057
Pragma: no-cache
Strict-Transport-Security: max-age=31536000
X-CDN: Imperva
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Iinfo: 59-258915138-258915179 NNNN CT(59 129 0) RT(1748261125206 135) q(0 0 2 0) r(3 3) U11
X-XSS-Protection: 1; mode=block

GET
H2 200 at.js Show response
static.everyaction.com/ea-actiontag/ 866 KB
247 KB 831ms
283ms Script
application/javascript 2600:9000:27cb:b200:3:1d53:4780:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://static.everyaction.com/ea-actiontag/at.js
Requested by: Host: secure.everyaction.com
URL: https://secure.everyaction.com/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2fuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3d&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:27cb:b200:3:1d53:4780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: fd964eb371c9fc3a5309421784964f182411170c30430fc6102b63dfb9a2febb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://secure.everyaction.com
Referer: https://secure.everyaction.com/

Response headers

access-control-max-age: 3000
content-encoding: gzip
etag: "14f15d340d0f22c18c5854816af0e12b"
age: 77382
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: fIBDT5xJcpq4CUW43X3LiNrYz0AQPPlNsrmVcsLrm7sR-JFsWee7kw==
date: Sun, 25 May 2025 14:35:46 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 20 May 2025 14:35:37 GMT
cache-control: max-age=900, s-maxage=86400, public
via: 1.1 762d730dc67e76a23b806d2aba1a1cae.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 252417
x-amz-cf-pop: IAD55-P6
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 at.min.css
static.everyaction.com/ea-actiontag/ 60 KB
12 KB 830ms
283ms Stylesheet
text/css 2600:9000:27cb:b200:3:1d53:4780:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://static.everyaction.com/ea-actiontag/at.min.css
Requested by: Host: secure.everyaction.com
URL: https://secure.everyaction.com/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2fuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3d&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:27cb:b200:3:1d53:4780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 86c3acb9942a818a09b4044ac460cf6dc8103312b137ae99f72ed1765e9fe0d9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

access-control-max-age: 3000
content-encoding: gzip
etag: "46ba4b8202ce8396fbcf00e20d5ddd1c"
age: 77382
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: BSpn4cJFmYnB3_iQpgIfidbakMl9m668MnmEzqBriURBpvn-h7tJgA==
date: Sun, 25 May 2025 14:35:46 GMT
content-type: text/css; charset=utf-8
last-modified: Tue, 20 May 2025 14:35:37 GMT
cache-control: max-age=900, s-maxage=86400, public
via: 1.1 717a0e7af2a3da4138a71f64ce4675d0.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 11832
x-amz-cf-pop: IAD55-P6
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 style.css
ucsusa.gitlab.io/everyaction-templates/ 44 KB
44 KB 533ms
252ms Stylesheet
text/css 2600:1901:0:7b8a::
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://ucsusa.gitlab.io/everyaction-templates/style.css
Requested by: Host: secure.everyaction.com
URL: https://secure.everyaction.com/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2fuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3d&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1901:0:7b8a:: Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
Software: /
Resource Hash: b1fbdd6c59281f452373fc0801e9a9cbfbdc35ea5ed8647d2e25c4571da3c079

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

x-request-id: 01JW67QGR76N4HJCTZCJKBRYQC
cache-control: max-age=600
etag: "bdf08a11f8911f97cbda5799bf3bc845bdcf6fd787b50361429c682ed52e3de0"
expires: Mon, 26 May 2025 12:15:27 UTC
permissions-policy: interest-cohort=()
content-length: 45389
date: Mon, 26 May 2025 12:05:27 GMT
content-type: text/css; charset=utf-8
last-modified: Wed, 03 Mar 2021 20:43:53 GMT
vary: Origin

GET
H2 200 script.js Show response
ucsusa.gitlab.io/everyaction-templates/ 2 KB
2 KB 506ms
230ms Script
application/javascript 2600:1901:0:7b8a::
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://ucsusa.gitlab.io/everyaction-templates/script.js
Requested by: Host: secure.everyaction.com
URL: https://secure.everyaction.com/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2fuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3d&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1901:0:7b8a:: Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
Software: /
Resource Hash: 26732aac610952027aa9b1a48be805396a81081ae04c9501ea41ee7c5d695e2f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

x-request-id: 01JW67QGR76N4HJCTZCNRMCTCB
cache-control: max-age=600
etag: "bdf08a11f8911f97cbda5799bf3bc845bdcf6fd787b50361429c682ed52e3de0"
expires: Mon, 26 May 2025 12:15:27 UTC
permissions-policy: interest-cohort=()
content-length: 2179
date: Mon, 26 May 2025 12:05:27 GMT
content-type: application/javascript
last-modified: Wed, 03 Mar 2021 20:43:53 GMT
vary: Origin

GET fonts.css
cloud.typography.com/6045052/6787212/css/ 0
0

GET
H2 200 jquery-2.2.4.min.js Show response
code.jquery.com/ 84 KB
29 KB 809ms
217ms Script
application/javascript 2a04:4e42:200::649
FASTLY

General

Check archive.org

Download Go to

Full URL: https://code.jquery.com/jquery-2.2.4.min.js
Requested by: Host: secure.everyaction.com
URL: https://secure.everyaction.com/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2fuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3d&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

content-encoding: gzip
etag: W/"28feccc0-14e4a"
age: 4746463
x-cache: HIT, HIT
date: Mon, 26 May 2025 12:05:27 GMT
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
x-cache-hits: 64127, 73566
x-served-by: cache-lga21935-LGA, cache-toj-leto2350025-TOJ
vary: Accept-Encoding
cache-control: public, max-age=31536000, stale-while-revalidate=604800
x-timer: S1748261127.284584,VS0,VE0
cross-origin-resource-policy: cross-origin
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 29811
server: nginx

GET
H2 200 css2
fonts.googleapis.com/ 1 KB
958 B 442ms
146ms Stylesheet
text/css 2607:f8b0:4004:c19::5f
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Caveat:wght@500&display=swap

Requested by

Host: secure.everyaction.com
URL: https://secure.everyaction.com/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2fuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3d&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c19::5f Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

0aa70f870376072bc0b05043674a18e3506825b132c46403a36a4a4e92d8c548

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 26 May 2025 12:05:26 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 26 May 2025 12:05:26 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Mon, 26 May 2025 12:05:26 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 3747760300.js Show response
cdn.optimizely.com/js/ 304 KB
94 KB 322ms
78ms Script
text/javascript 2606:4700::6812:4239
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.optimizely.com/js/3747760300.js
Requested by: Host: secure.everyaction.com
URL: https://secure.everyaction.com/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2fuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3d&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:4239 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0ee73d9905cd27f22a883ffd35a59060631b5426b24955a14e969f8f0f357cc6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

access-control-max-age: 86400
access-control-expose-headers: x-amz-meta-revision
content-encoding: gzip
cf-cache-status: HIT
etag: "78a35fd21c31f35b2b9185cf486789f9"
x-amz-version-id: QmKEVkRFT8W3puMW7fLKIUw_aLlMsNRy
age: 137
access-control-allow-methods: GET, HEAD
date: Mon, 26 May 2025 12:05:26 GMT
x-amz-meta-revision: 1380
content-type: text/javascript; charset=utf-8
last-modified: Tue, 20 May 2025 19:57:15 GMT
vary: Accept-Encoding
x-amz-id-2: airSYvwMW/wsj8zsHE9hHOUOPQ3sC1Uv7z6NDoQPiy5+U2TJgsnWo2j9FniCfcHPLK4g2eUZ8tobzj/F1aOArWSRf7Xh02QG
access-control-allow-headers: *
x-amz-replication-status: PENDING
cache-control: max-age=120
timing-allow-origin: *
x-amz-meta-pci_enabled: False
access-control-allow-credentials: false
x-amz-request-id: GKN1J0EDB40HHKRD
cf-ray: 945d240ae846f7c5-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 95060
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H/1.1 200
OK 2024CharityNavigator_150px.png
nvlupin.blob.core.windows.net/images/van/UCS/UCS/1/58097/images/ 17 KB
17 KB 721ms
142ms Image
image/png 20.209.68.129
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://nvlupin.blob.core.windows.net/images/van/UCS/UCS/1/58097/images/2024CharityNavigator_150px.png
Requested by: Host: secure.everyaction.com
URL: https://secure.everyaction.com/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2fuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3d&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 20.209.68.129 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: a0821ec5a3e9f0f6aeda804ee38b5eab4e3df2f5a434d82687a9f45221ad72a1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
ETag: 0x8DCB17473CDBE68
x-ms-request-id: 38e7c5e3-901e-0012-0536-ce1e40000000
Access-Control-Allow-Origin: *
Content-Length: 17281
Date: Mon, 26 May 2025 12:05:26 GMT
Content-Type: image/png
Last-Modified: Wed, 31 Jul 2024 15:21:29 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-blob-type: BlockBlob

GET
H/1.1 200
OK charity-watch-top-rated.svg
nvlupin.blob.core.windows.net/images/van/UCS/UCS/1/58097/images/ 7 KB
7 KB 727ms
148ms Image
image/svg+xml 20.209.68.129
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://nvlupin.blob.core.windows.net/images/van/UCS/UCS/1/58097/images/charity-watch-top-rated.svg
Requested by: Host: secure.everyaction.com
URL: https://secure.everyaction.com/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2fuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3d&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 20.209.68.129 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: ad416536782ba3d56f7b674cdfe6a4c3487056a49030d94a027e8b1c28c9b6c1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
ETag: 0x8D891037EB225D2
x-ms-request-id: c066dba4-901e-003d-1d36-ce138b000000
Access-Control-Allow-Origin: *
Content-Length: 6894
Date: Mon, 26 May 2025 12:05:26 GMT
Content-Type: image/svg+xml
Last-Modified: Wed, 25 Nov 2020 05:32:26 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-blob-type: BlockBlob

GET
H/1.1 200
OK candid-seal-2023.svg
nvlupin.blob.core.windows.net/images/van/UCS/UCS/1/58097/images/ 13 KB
13 KB 131ms
130ms Image
image/svg+xml 20.209.68.129
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://nvlupin.blob.core.windows.net/images/van/UCS/UCS/1/58097/images/candid-seal-2023.svg
Requested by: Host: secure.everyaction.com
URL: https://secure.everyaction.com/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2fuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3d&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 20.209.68.129 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 5ee4dbeb415263a1bd1ff3f3903cac7f086f10d596e250c6fb68194e284f11fb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
ETag: 0x8DBEB6E39988D1D
x-ms-request-id: 38e7c676-901e-0012-1036-ce1e40000000
Access-Control-Allow-Origin: *
Content-Length: 13137
Date: Mon, 26 May 2025 12:05:26 GMT
Content-Type: image/svg+xml
Last-Modified: Wed, 22 Nov 2023 15:18:04 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-blob-type: BlockBlob

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ 84 KB
30 KB 449ms
124ms Script
text/javascript 2607:f8b0:4004:c1b::5f
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1b::5f Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

content-encoding: gzip
age: 431367
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options: nosniff
expires: Thu, 21 May 2026 12:16:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 21 May 2025 12:16:00 GMT
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges: bytes
access-control-allow-origin: *
content-length: 30028
x-xss-protection: 0
server: sffe

GET
H/1.1 200
OK vgs-collect.js Show response
js.verygoodvault.com/vgs-collect/2.18.4/ 134 KB
44 KB 624ms
299ms Script
application/javascript 108.138.64.53
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://js.verygoodvault.com/vgs-collect/2.18.4/vgs-collect.js
Requested by: Host: secure.everyaction.com
URL: https://secure.everyaction.com/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2fuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3d&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.64.53 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-64-53.iad12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 575b2165304d899b7001ab593aeee31b371a46aee8b899c22a87ab9313389eda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://secure.everyaction.com
Referer: https://secure.everyaction.com/

Response headers

Access-Control-Max-Age: 3000
Content-Encoding: gzip
x-amz-version-id: jfBMjoXBTwBLxrf4sD.h_N_F9QJn5gdY
ETag: W/"156be461dd96d02fce3792c020f7748a"
Age: 12
Access-Control-Allow-Methods: GET
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 5FOiQgF9PV5Z2O7HwdIynlE7D1yTUiFnxIjhqQDw1SrrIbuPTo8bhQ==
Date: Mon, 26 May 2025 12:05:20 GMT
Content-Type: application/javascript
Vary: Accept-Encoding
Last-Modified: Thu, 16 Mar 2023 10:29:55 GMT
Transfer-Encoding: chunked
Cache-Control: max-age=60
Connection: keep-alive
Via: 1.1 f588325f7617672d954c4267c8bee1ea.cloudfront.net (CloudFront)
Access-Control-Allow-Origin: *
X-Amz-Cf-Pop: IAD12-P1
Server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 _Incapsula_Resource Show response
secure.everyaction.com/ 91 KB
22 KB 83ms
79ms Script
application/javascript 45.60.31.183
INCAPSULA

General

Check archive.org

Download Go to

Full URL: https://secure.everyaction.com/_Incapsula_Resource?SWJIYLWA=719d34d31c8e3a6e6fffd425f7e032f3&ns=1&cb=601746324
Requested by: Host: secure.everyaction.com
URL: https://secure.everyaction.com/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2fuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3d&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.60.31.183 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: /
Resource Hash: c824827dd14d1c9c9268723c866ef2476b1625f15267d182773aa4ac1c4bbdde

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2fuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3d&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057

Response headers

x-robots-tag: noindex
cache-control: no-cache, no-store
content-encoding: gzip
content-length: 22167
content-type: application/javascript

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 473 KB
149 KB 845ms
150ms Script
application/javascript 2607:f8b0:4004:c17::61
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-NB5C4Q

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

68ab93f00aeea67ba675e669a1e0f74a2b40e808e7191d7d160a598379d0b638

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1317:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1317:0"}],}
expires: Mon, 26 May 2025 12:05:28 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 26 May 2025 12:05:28 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1317:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1317:0
content-length: 151351
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 ai.2.min.js Show response
az416426.vo.msecnd.net/scripts/b/ 120 KB
57 KB 469ms
177ms Script
text/javascript 2620:1ec:bdf::40
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to

Full URL: https://az416426.vo.msecnd.net/scripts/b/ai.2.min.js
Requested by: Host: secure.everyaction.com
URL: https://secure.everyaction.com/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2fuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3d&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:bdf::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: bde9be4cbe799089a419225f87c2a9986043f6c7cb55853aaadab7200713f136

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

access-control-expose-headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-aijssdksrc,x-ms-meta-aijssdkver,x-ms-meta-lastmodified,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
content-encoding: br
x-fd-int-roxy-purgeid: 0
x-cache: TCP_HIT
date: Mon, 26 May 2025 12:05:27 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Wed, 05 Feb 2025 20:28:13 GMT
cache-control: public, max-age=1800, immutable, no-transform
x-ms-meta-lastmodified: 2020-10-07 00:07:47
x-ms-request-id: 3186d61d-601e-0040-2cfb-c22a79000000
x-ms-meta-aijssdksrc: [cdn]/scripts/b/ai.2.8.18.min.js
access-control-allow-origin: *
x-ms-meta-aijssdkver: 2.8.18
x-ms-blob-type: BlockBlob
x-azure-ref: 20250526T120527Z-15cb9cd4b88tlpkghC1LAXr1tw0000000a8g0000000026c2

GET
H2 200 a3747760300.html Show response
a3747760300.cdn.optimizely.com/client_storage/ Frame 4AED 2 KB
1 KB 663ms
98ms Document
text/html 2606:4700::6812:4239
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://a3747760300.cdn.optimizely.com/client_storage/a3747760300.html
Requested by: Host: cdn.optimizely.com
URL: https://cdn.optimizely.com/js/3747760300.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:4239 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2e02b85d7dfec4a7d2f3b1b25a160873099bc5c1d654f8b764170b1da0d71c37

Request headers

Referer: https://secure.everyaction.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=120
cf-cache-status: HIT
cf-ray: 945d24140e3e2b51-LAX
content-encoding: gzip
content-length: 788
content-type: text/html; charset=utf-8
date: Mon, 26 May 2025 12:05:28 GMT
etag: "dcceb611ae433c1a8f963fe6f6f89658"
last-modified: Tue, 20 May 2025 19:57:10 GMT
server: cloudflare
server-timing: cfCacheStatus;desc="HIT"
vary: Accept-Encoding
x-amz-id-2: 9yuhoTLqf2aZXmnbXcVgMHoH0TaHPYJOfAVAk7f9cjOy8ygbM2SbaI6W1QBl/1klCmlMjNZOsLI=
x-amz-meta-pci_enabled: False
x-amz-replication-status: COMPLETED
x-amz-request-id: DN4ZRAKZKG3VTG60
x-amz-server-side-encryption: AES256
x-amz-version-id: _2AAUmeu4l7.sGudq0CvDpCdNsA5fkHt

GET
H2 200 extra.min.css
static.everyaction.com/ea-actiontag/ 78 KB
14 KB 149ms
148ms Stylesheet
text/css 2600:9000:27cb:b200:3:1d53:4780:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://static.everyaction.com/ea-actiontag/extra.min.css
Requested by: Host: static.everyaction.com
URL: https://static.everyaction.com/ea-actiontag/at.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:27cb:b200:3:1d53:4780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e4325adb876dc62beeba60e7db634146523b775adc94c7e0803ebcfd56eacba9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

access-control-max-age: 3000
content-encoding: gzip
etag: "72adedff4b37fdccbef3ad4a1b47eeac"
age: 77384
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: lP-71BPpVE5xSbUtYjl3EzzELyWytleCIkCofCw0H-kOfICz35AgPQ==
date: Sun, 25 May 2025 14:35:45 GMT
content-type: text/css; charset=utf-8
last-modified: Tue, 20 May 2025 14:35:37 GMT
cache-control: max-age=900, s-maxage=86400, public
via: 1.1 717a0e7af2a3da4138a71f64ce4675d0.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 14169
x-amz-cf-pop: IAD55-P6
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 5LsOqOrd906PKtLlv8yw8A2 Show response
secure.everyaction.com/v1/Forms/ 31 KB
11 KB 164ms
157ms XHR
application/json 45.60.31.183
INCAPSULA

General

Check archive.org

Download Go to

Full URL

https://secure.everyaction.com/v1/Forms/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2FuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2Fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2Fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3D&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/b/ai.2.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.31.183 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

cba3e60c4ea5c74f36ec11e2dc6e2984c97e155db88dfdffe7c3bd976ddc4028

Security Headers

Name	Value
Content-Security-Policy	default-src * 'unsafe-eval' 'unsafe-inline' data: blob:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Request-Id: |8eca29eff6184ba79f50d8866f75dcf4.f0fdda8808724c82
traceparent: 00-8eca29eff6184ba79f50d8866f75dcf4-f0fdda8808724c82-01
Referer: https://secure.everyaction.com/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2fuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3d&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Accept: application/json, text/javascript, */*; q=0.01

Response headers

access-control-expose-headers: Request-Context
content-encoding: gzip
x-content-type-options: nosniff
expires: -1
date: Mon, 26 May 2025 12:05:28 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
x-iinfo: 61-290774940-290774991 PNNN RT(1748261125817 2706) q(0 1 1 -1) r(1 1) U2
content-security-policy: default-src * 'unsafe-eval' 'unsafe-inline' data: blob:
cache-control: no-cache
pragma: no-cache
x-cdn: Imperva
request-context: appId=cid-v1:ccd92c0b-19c7-485c-b607-cbfe2344efa3
content-length: 10759
x-xss-protection: 1; mode=block

GET
H2 200 _Incapsula_Resource
secure.everyaction.com/ 1 B
35 B 67ms
66ms Image
text/plain 45.60.31.183
INCAPSULA

General

Check archive.org

Download Go to Show image

Full URL: https://secure.everyaction.com/_Incapsula_Resource?SWKMTFSR=1&e=0.4741451007001757
Requested by: Host: secure.everyaction.com
URL: https://secure.everyaction.com/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2fuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3d&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.60.31.183 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2fuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3d&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057

Response headers

x-robots-tag: noindex
cache-control: no-cache, no-store
content-length: 1
content-type: text/plain

POST
H2 204 events Show response
logx.optimizely.com/v1/ 0
390 B 262ms
90ms XHR
text/plain 34.49.241.189
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://logx.optimizely.com/v1/events
Requested by: Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/b/ai.2.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.49.241.189 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 189.241.49.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://secure.everyaction.com/

Response headers

x-request-id: 098f7873-d8f9-4f34-be63-1df22b20a8dc
access-control-expose-headers: X-Requested-With,Content-Type,Accept,Origin,X-App-Trace-Id
timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: POST,OPTIONS
via: 1.1 google
access-control-allow-origin: https://secure.everyaction.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 26 May 2025 12:05:28 GMT
content-type: text/plain
access-control-allow-headers: X-Requested-With,Content-Type,Accept,Origin,X-App-Trace-Id,X-Optimizely-Strict

GET
H/1.1 200
OK profile Show response
fastaction.ngpvan.com/api/v3/ 149 B
1 KB 543ms
376ms XHR
application/json 45.60.31.183
INCAPSULA

General

Check archive.org

Download Go to

Full URL

https://fastaction.ngpvan.com/api/v3/profile?_=1748261128371

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/b/ai.2.min.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

45.60.31.183 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Microsoft-IIS/10.0 / Express, ASP.NET

Resource Hash

7a6bc6255779448263cb390c67e3ad8f200955f242a49e944047e0c2bd632285

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Accept: application/json, text/javascript, */*; q=0.01
Referer: https://secure.everyaction.com/

Response headers

Strict-Transport-Security: max-age=31536000; includeSubdomains
X-Iinfo: 62-302957986-302958016 NNNN CT(63 140 0) RT(1748261128794 100) q(0 0 2 19) r(3 3) U4
Content-Encoding: gzip
ETag: W/"95-orVZT49lcMha/9U7qGOd2Xm/P5U"
X-CDN: Imperva
Access-Control-Allow-Credentials: true
request-context: appId=cid-v1:ccd92c0b-19c7-485c-b607-cbfe2344efa3
Access-Control-Allow-Origin: https://secure.everyaction.com
Content-Length: 266
P3P: CP="NOI ADM DEV COM NAV OUR STP"
Date: Mon, 26 May 2025 12:05:29 GMT
Content-Type: application/json; charset=utf-8
Vary: Accept-Encoding,Accept-Encoding
Server: Microsoft-IIS/10.0
X-Powered-By: Express, ASP.NET

GET
H/1.1 200
OK index.html Show response
js.verygoodvault.com/vgs-collect/2.18.4/lib/ Frame 36CE 158 KB
50 KB 393ms
133ms Document
text/html 108.138.64.12
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://js.verygoodvault.com/vgs-collect/2.18.4/lib/index.html
Requested by: Host: js.verygoodvault.com
URL: https://js.verygoodvault.com/vgs-collect/2.18.4/vgs-collect.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.64.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-64-12.iad12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 50ee636f13b74948c3b143ad598ebc57ff83c19f57faa6365ab01de0641cd632

Request headers

Referer: https://secure.everyaction.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

Age: 50
Cache-Control: max-age=60
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html
Date: Mon, 26 May 2025 12:04:39 GMT
ETag: W/"891d22e58a2927b43f5ab135e7bdaa88"
Last-Modified: Thu, 16 Mar 2023 10:29:57 GMT
Server: AmazonS3
Transfer-Encoding: chunked
Vary: Accept-Encoding
Via: 1.1 65566883560611dde36b4dfe13fd3272.cloudfront.net (CloudFront), 1.1 c1bfc7dbcf7f9782aa3be590b7ce3d6a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: FCqEVZ1LjX6RPTv6PcQb6Lfq8e-16nrsbjaHwI3FLLjvInAEZyNG-A==
X-Amz-Cf-Pop: IAD55-P3 IAD12-P1
X-Cache: Hit from cloudfront
x-amz-server-side-encryption: AES256
x-amz-version-id: D5Am0ac.4Bfz1LEHZRvgk67rZFGuM9PD

GET
DATA 200
OK truncated
/ 8 KB
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b525ba674f775719291102cb54f5d702e4c61f177c5146a5194f063e47cf4930

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3 200 WnznHAc5bAfYB2QRah7pcpNvOx-pjcB9eIWpYQ.woff2
fonts.gstatic.com/s/caveat/v18/ 50 KB
50 KB 252ms
121ms Font
font/woff2 172.253.115.94
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fonts.gstatic.com/s/caveat/v18/WnznHAc5bAfYB2QRah7pcpNvOx-pjcB9eIWpYQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Caveat:wght@500&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f94.1e100.net

Software

sffe /

Resource Hash

3d9d8c193a5a8bdbac8868ffceab7094a73d8611a84028f10f938b23e95c1d1c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://secure.everyaction.com
Referer: https://fonts.googleapis.com/

Response headers

age: 343588
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Fri, 22 May 2026 12:39:01 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 12:39:01 GMT
last-modified: Thu, 14 Sep 2023 00:55:44 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 50984
x-xss-protection: 0
server: sffe

GET
H2 200 paypal-logo.png
static.everyaction.com/ea-actiontag/assets/images/ 3 KB
3 KB 125ms
124ms Image
image/png 2600:9000:27cb:b200:3:1d53:4780:93a1
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://static.everyaction.com/ea-actiontag/assets/images/paypal-logo.png
Requested by: Host: static.everyaction.com
URL: https://static.everyaction.com/ea-actiontag/at.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:27cb:b200:3:1d53:4780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 02d1bfc3fb8b4eff4d80613794e94142267895398d35dbca72e8ca7ddb62ab54

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://static.everyaction.com/ea-actiontag/at.min.css

Response headers

access-control-max-age: 3000
etag: "459c51e4e024db4720b62513d12edb6a"
age: 6384484
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: DJrdBIZqlkGseEax_Z47FG7ykQgEZDRptvUr9lMb4-WNo0hUQnNH5w==
date: Thu, 13 Mar 2025 14:37:25 GMT
content-type: image/png
last-modified: Tue, 07 Dec 2021 15:33:44 GMT
cache-control: public,max-age=31536000
via: 1.1 717a0e7af2a3da4138a71f64ce4675d0.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 2778
x-amz-cf-pop: IAD55-P6
server: AmazonS3

GET
H2 200 5LsOqOrd906PKtLlv8yw8A2 Show response
secure.everyaction.com/PayPalClientToken/ 2 KB
2 KB 497ms
496ms XHR
text/plain 45.60.31.183
INCAPSULA

General

Check archive.org

Download Go to

Full URL

https://secure.everyaction.com/PayPalClientToken/5LsOqOrd906PKtLlv8yw8A2

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/b/ai.2.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.31.183 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

eb241fa45f5fb3f7833f8256eabfd1353e006bfb69b2564fd6388ae75f502529

Security Headers

Name	Value
Content-Security-Policy	default-src * 'unsafe-eval' 'unsafe-inline' data: blob:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Request-Id: |8eca29eff6184ba79f50d8866f75dcf4.93bdeae8b46449a5
traceparent: 00-8eca29eff6184ba79f50d8866f75dcf4-93bdeae8b46449a5-01
Referer: https://secure.everyaction.com/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2fuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3d&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Accept: */*

Response headers

strict-transport-security: max-age=31536000
x-iinfo: 61-290774940-290775503 2NNN RT(1748261125817 3057) q(0 0 0 -1) r(4 4)
content-security-policy: default-src * 'unsafe-eval' 'unsafe-inline' data: blob:
access-control-expose-headers: Request-Context
cache-control: public, max-age=10
content-encoding: gzip
x-cdn: Imperva
x-content-type-options: nosniff
request-context: appId=cid-v1:ccd92c0b-19c7-485c-b607-cbfe2344efa3
date: Mon, 26 May 2025 12:05:29 GMT
x-xss-protection: 1; mode=block
content-type: text/plain; charset=utf-8
vary: Origin,Accept-Encoding
x-frame-options: SAMEORIGIN

GET
H2 200 intlTelInput.min.css
static.everyaction.com/ea-actiontag/assets/styles/ 19 KB
20 KB 146ms
146ms Stylesheet
text/css 2600:9000:27cb:b200:3:1d53:4780:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://static.everyaction.com/ea-actiontag/assets/styles/intlTelInput.min.css
Requested by: Host: static.everyaction.com
URL: https://static.everyaction.com/ea-actiontag/at.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:27cb:b200:3:1d53:4780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 80174969764673851b6aa49f7f2db4e556666c28a1a23466ab984b1743eb0aa7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

access-control-max-age: 3000
etag: "7e7462900c78bbf73c9dfde6c0b617fc"
age: 47926
access-control-allow-methods: GET
via: 1.1 717a0e7af2a3da4138a71f64ce4675d0.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
x-cache: Hit from cloudfront
content-length: 19755
x-amz-cf-id: VyhYGsoAgQJrR5jHC6vojdutb5Y2dlF_QYugumV0PZTY5lutQ0IDOw==
date: Sun, 25 May 2025 22:46:43 GMT
content-type: text/css; charset=utf-8
last-modified: Wed, 06 Jul 2022 18:06:16 GMT
server: AmazonS3
x-amz-cf-pop: IAD55-P6

GET
H2 200 intlTelInput.js Show response
static.everyaction.com/ea-actiontag/assets/js/ 87 KB
21 KB 182ms
181ms Script
application/javascript 2600:9000:27cb:b200:3:1d53:4780:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://static.everyaction.com/ea-actiontag/assets/js/intlTelInput.js
Requested by: Host: static.everyaction.com
URL: https://static.everyaction.com/ea-actiontag/at.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:27cb:b200:3:1d53:4780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8591bd5866850d9ce6364055d34f31055fef11f1705518cae23d87a57ef99933

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

access-control-max-age: 3000
content-encoding: gzip
etag: "0d84f90a2a517cacd498722e0fe0500e"
age: 2869499
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: zWidng1rYTsZY3eiGC3rrHiSisLR9l2-MGDpgSLGoR1jqOlGzKVIhg==
date: Wed, 23 Apr 2025 07:00:30 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 11 Apr 2023 14:36:16 GMT
cache-control: max-age=31536000
via: 1.1 717a0e7af2a3da4138a71f64ce4675d0.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 20855
x-amz-cf-pop: IAD55-P6
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 intl-tel.input.utils.js Show response
static.everyaction.com/ea-actiontag/assets/js/ 245 KB
55 KB 271ms
271ms Script
application/javascript 2600:9000:27cb:b200:3:1d53:4780:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://static.everyaction.com/ea-actiontag/assets/js/intl-tel.input.utils.js
Requested by: Host: static.everyaction.com
URL: https://static.everyaction.com/ea-actiontag/at.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:27cb:b200:3:1d53:4780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8496a94dcfd779693def6ae3e607a923fece02f38491ef1462e7cb51cab12e7d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

access-control-max-age: 3000
content-encoding: gzip
etag: "4b9bf850ee4aa76202eb0e6f5948bfa8"
age: 10735483
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: DL_x5ki43D-wIbguBpYr0Mf1EOQGQzN8OBcbjL4n_3-414P5e_gGaQ==
date: Wed, 22 Jan 2025 06:00:46 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 12 Apr 2022 14:33:00 GMT
cache-control: max-age=31536000
via: 1.1 717a0e7af2a3da4138a71f64ce4675d0.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 56004
x-amz-cf-pop: IAD55-P6
server: AmazonS3

GET
DATA 200
OK truncated
/ 784 B
0 Image
image/svg+xml

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fe62bab84590322ae4bfcde20dfb50a72c1b68b330c2a7f1b0aefb65999f16bc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
H2 200 5LsOqOrd906PKtLlv8yw8A2
secure.everyaction.com/v1/Track/ 0
159 B 149ms
145ms Image
text/plain 45.60.31.183
INCAPSULA

General

Check archive.org

Download Go to Show image

Full URL

https://secure.everyaction.com/v1/Track/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2FuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2Fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2Fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3D&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057&formSessionId=8f4fcb94-5f51-4a9b-9729-66641267f3f4&bName=chrome&dType=desktop&formVersion=4/17/2025%206:15:58%20PM|2/26/2025%205:15:10%20PM&fUrl=aHR0cHM6Ly9zZWN1cmUuZXZlcnlhY3Rpb24uY29tLzVMc09xT3JkOTA2UEt0TGx2OHl3OEEyP2NvbnRhY3RkYXRhPTkrQTBmdWVadmJqM29ZSTlBbVZVNlVrUmZkT2hDb0VwQXhiWTFpaFQ1WjNyU3NZeTVhdDltQzdBNmtqMzhPQ3JXRFM0ZlE0ZWV1JTJmdXFxZlRibVZPMEVLYjhCQVFYSVl4N0orTyttYmI3SHJLYmJ2WE8xbmNBUVAlMmZuKyt4TGkyVVlCTjFGWUdWdGtpK25ydW1xNjNSa0lyUmZncisrOGRjUW1vVWd4YmlPTENka2ZCMEFJU2JFRSs3VTVlaiUyZnA4NEFZaCtEUTlCREk5a0o5MXNkZWdSNm5YYnkrMkRMMmt5OWNXbU9CUmVkSGMlM2QmYW09MTAwJm1zPXNtcyZtbWRyPTM1MGE1Nzc0LWEwNjctNGNlZC04Zjg0LTAxY2E4ZGFiZDA1Nw%3D%3D&fRef=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.60.31.183 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src * 'unsafe-eval' 'unsafe-inline' data: blob:
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2fuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3d&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057

Response headers

strict-transport-security: max-age=31536000
x-iinfo: 61-290774940-290774991 PNNN RT(1748261125817 3180) q(0 0 0 -1) r(1 1) U2
content-security-policy: default-src * 'unsafe-eval' 'unsafe-inline' data: blob:
access-control-expose-headers: Request-Context
cache-control: no-cache
pragma: no-cache
x-cdn: Imperva
x-content-type-options: nosniff
request-context: appId=cid-v1:ccd92c0b-19c7-485c-b607-cbfe2344efa3
expires: -1
content-length: 0
date: Mon, 26 May 2025 12:05:28 GMT
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN

GET
H2 200 fast-action.svg
static.everyaction.com/ea-actiontag/assets/images/ 9 KB
9 KB 249ms
244ms Image
image/svg+xml 2600:9000:27cb:b200:3:1d53:4780:93a1
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://static.everyaction.com/ea-actiontag/assets/images/fast-action.svg
Requested by: Host: secure.everyaction.com
URL: https://secure.everyaction.com/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2fuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3d&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:27cb:b200:3:1d53:4780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b60497a77afdcb315e270ec5f6fe3d53797c486032fc6752523aa8c65be7b985

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

access-control-max-age: 3000
etag: "babd47dc25531a9faeadc04f1afa1910"
age: 77731
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: GqDCW_e0R-yuS4ej-t1t78-8u6fGri2OcYNb8FzmI1YAFW_Z71YpZg==
date: Sun, 25 May 2025 14:29:59 GMT
content-type: image/svg+xml
last-modified: Tue, 07 Dec 2021 15:33:44 GMT
cache-control: max-age=86400
via: 1.1 717a0e7af2a3da4138a71f64ce4675d0.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 9203
x-amz-cf-pop: IAD55-P6
server: AmazonS3

GET
H/1.1 200
OK index.html Show response
js.verygoodvault.com/vgs-collect/2.18.4/lib/ Frame CF1A 158 KB
0 70ms
69ms Document
text/html 108.138.64.12
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://js.verygoodvault.com/vgs-collect/2.18.4/lib/index.html
Requested by: Host: js.verygoodvault.com
URL: https://js.verygoodvault.com/vgs-collect/2.18.4/vgs-collect.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.64.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-64-12.iad12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 50ee636f13b74948c3b143ad598ebc57ff83c19f57faa6365ab01de0641cd632

Request headers

Referer: https://secure.everyaction.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

Age: 50
Cache-Control: max-age=60
Content-Encoding: gzip
Content-Type: text/html
Date: Mon, 26 May 2025 12:04:39 GMT
ETag: W/"891d22e58a2927b43f5ab135e7bdaa88"
Last-Modified: Thu, 16 Mar 2023 10:29:57 GMT
Server: AmazonS3
Vary: Accept-Encoding
Via: 1.1 65566883560611dde36b4dfe13fd3272.cloudfront.net (CloudFront), 1.1 c1bfc7dbcf7f9782aa3be590b7ce3d6a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: FCqEVZ1LjX6RPTv6PcQb6Lfq8e-16nrsbjaHwI3FLLjvInAEZyNG-A==
X-Amz-Cf-Pop: IAD55-P3 IAD12-P1
X-Cache: Hit from cloudfront
x-amz-server-side-encryption: AES256
x-amz-version-id: D5Am0ac.4Bfz1LEHZRvgk67rZFGuM9PD

GET
H/1.1 200
OK index.html Show response
js.verygoodvault.com/vgs-collect/2.18.4/lib/ Frame 4595 158 KB
0 68ms
68ms Document
text/html 108.138.64.12
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://js.verygoodvault.com/vgs-collect/2.18.4/lib/index.html
Requested by: Host: js.verygoodvault.com
URL: https://js.verygoodvault.com/vgs-collect/2.18.4/vgs-collect.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.64.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-64-12.iad12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 50ee636f13b74948c3b143ad598ebc57ff83c19f57faa6365ab01de0641cd632

Request headers

Referer: https://secure.everyaction.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

Age: 50
Cache-Control: max-age=60
Content-Encoding: gzip
Content-Type: text/html
Date: Mon, 26 May 2025 12:04:39 GMT
ETag: W/"891d22e58a2927b43f5ab135e7bdaa88"
Last-Modified: Thu, 16 Mar 2023 10:29:57 GMT
Server: AmazonS3
Vary: Accept-Encoding
Via: 1.1 65566883560611dde36b4dfe13fd3272.cloudfront.net (CloudFront), 1.1 c1bfc7dbcf7f9782aa3be590b7ce3d6a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: FCqEVZ1LjX6RPTv6PcQb6Lfq8e-16nrsbjaHwI3FLLjvInAEZyNG-A==
X-Amz-Cf-Pop: IAD55-P3 IAD12-P1
X-Cache: Hit from cloudfront
x-amz-server-side-encryption: AES256
x-amz-version-id: D5Am0ac.4Bfz1LEHZRvgk67rZFGuM9PD

POST
H3 200 collect
www.google.com/ccm/ 0
0 677ms
345ms Fetch
text/plain 172.253.63.105
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google.com/ccm/collect?en=page_view&dl=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2&scrsrc=www.googletagmanager.com&frm=0&rnd=505004944.1748261129&dt=Defend%20Science%20from%20Trump%E2%80%99s%20Attacks.%20Donate%20Now.&auid=1541318537.1748261129&navt=n&npa=0&gtm=45He55l1v6541836za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~103116026~103130498~103130500~103200004~103211513~103233427~103252644~103252646~104481633~104481635&tft=1748261129070&tfd=3970&apve=1&apvf=f
Requested by: Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/b/ai.2.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.253.63.105 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bi-in-f105.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 446 KB
148 KB 148ms
145ms Script
application/javascript 2607:f8b0:4004:c17::61
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-VB9DKE4V36&cx=c&gtm=45He55l1v6541836za200&tag_exp=101509157~103116026~103130498~103130500~103200004~103211513~103233427~103252644~103252646~104481633~104481635

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NB5C4Q

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

6135ce76bc10d6b94a14c011492ffd150d9a86bec58f1480872c5723ccf24f0d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

content-encoding: zstd
report-to: {"group":"ascgcycc:1075:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1075:0"}],}
expires: Mon, 26 May 2025 12:05:29 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 26 May 2025 12:05:29 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1075:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1075:0
content-length: 151370
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 601ms
271ms Script
text/javascript 2607:f8b0:4004:c07::65
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NB5C4Q

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::65 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

content-encoding: gzip
age: 6572
report-to: {"group":"ascnsrsgac:225:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],}
x-content-type-options: nosniff
expires: Mon, 26 May 2025 12:15:57 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 26 May 2025 10:15:57 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
content-type: text/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgac:225:0
content-length: 20994
server: Golfe2

GET
H2 200 bat.js Show response
bat.bing.com/ 52 KB
15 KB 429ms
101ms Script
application/javascript 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NB5C4Q

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

c4e400da2b9e9a111a08457d1de07c9280c7233e4a305b967da320564a83eb0f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: gzip
etag: "8077e3804cc0db1:0"
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 18D6CC0286E442A7AD758872B7DFE2F2 Ref B: LAX311000110021 Ref C: 2025-05-26T12:05:29Z
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 14978
date: Mon, 26 May 2025 12:05:29 GMT
content-type: application/javascript
last-modified: Thu, 08 May 2025 19:07:55 GMT
vary: Accept-Encoding

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 275 KB
69 KB 439ms
141ms Script
application/x-javascript 157.240.229.1
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.229.1 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

467389e1c54ff093185c031255951ed7d0b319391f0ab2783dcf81f5671b1d94

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' blob: ;script-src data: 'nonce-qtaGxSqq' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: 'self' https://.google-analytics.com .google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: .cdninstagram.com https://.google-analytics.com;font-src 'self' data: blob: ;img-src 'self' data: blob: https://.google-analytics.com;media-src 'self' data: blob: ;child-src 'self' data: blob: ;frame-src 'self' data: blob: ;manifest-src 'self' data: blob: ;object-src 'self' data: blob: ;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 26 May 2025 12:05:29 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' blob: *;script-src data: 'nonce-qtaGxSqq' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self' https://*.google-analytics.com *.google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com https://*.google-analytics.com;font-src 'self' data: blob: *;img-src 'self' data: blob: * https://*.google-analytics.com;media-src 'self' data: blob: *;child-src 'self' data: blob: *;frame-src 'self' data: blob: *;manifest-src 'self' data: blob: *;object-src 'self' data: blob: *;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=120, rtx=0, c=26, mss=1232, tbw=8710, tp=13, tpl=0, uplat=0, ullat=-1
pragma: public
x-fb-debug: RW1NTdDjgaM3dMwMyyLi1/UYOaCSifqOtNMXaLkKP39+d0I04IkuNjHinFCRSi2wMIJAjINzSbpcqxvzHfydnA==
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: default-src 'self' blob: *;script-src 'nonce-qtaGxSqq' 'report-sample' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self' https://*.google-analytics.com *.google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com https://*.google-analytics.com;font-src 'self' data: blob: *;img-src 'self' data: blob: * https://*.google-analytics.com;media-src 'self' data: blob: *;child-src 'self' data: blob: *;frame-src 'self' data: blob: *;manifest-src 'self' data: blob: *;object-src 'self' data: blob: *;worker-src 'self' data: blob: *;report-uri https://www.facebook.com/csp/reporting/?minimize=0;require-trusted-types-for 'script';
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 70852
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 tc.min.js Show response
c1.rfihub.net/js/ 19 KB
6 KB 588ms
266ms Script
application/x-javascript 2600:9000:24f1:e800:1:76cf:fe80:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c1.rfihub.net/js/tc.min.js
Requested by: Host: secure.everyaction.com
URL: https://secure.everyaction.com/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2fuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3d&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:24f1:e800:1:76cf:fe80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Jetty(9.4.51.v20230217) /
Resource Hash: 7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

x-amz-cf-id: gc4gfo6nWtMpwZjVxsPprfMcnL9h9RskPeLpE-9QnZzuAQ4uTiZUYQ==
cache-control: public, max-age=3600
content-encoding: gzip
age: 2482
via: 1.1 e5f49cd65618fc548cd417b060a75e76.cloudfront.net (CloudFront)
expires: Mon, 26 May 2025 12:24:07 GMT
x-cache: Hit from cloudfront
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 6162
date: Mon, 26 May 2025 11:24:07 GMT
content-type: application/x-javascript
last-modified: Mon, 26 May 2025 11:23:57 GMT
server: Jetty(9.4.51.v20230217)
x-amz-cf-pop: JFK50-P4

GET
H2 200 quant.js Show response
secure.quantserve.com/ 25 KB
10 KB 611ms
290ms Script
application/javascript 2620:116:800b:21:b08a:1dc5:659b:4055
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: secure.everyaction.com
URL: https://secure.everyaction.com/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2fuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3d&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800b:21:b08a:1dc5:659b:4055 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: fe524af3eefa0c849a3c0380ee2720a31b9f3be1f17d4f0743f66f48d19ea48c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

cache-control: private, max-age=86400
content-encoding: gzip
etag: "e/rzK4q7afrr8Qp3nTLJmQ=="
expires: Tue, 27 May 2025 12:05:29 GMT
accept-ranges: bytes
date: Mon, 26 May 2025 12:05:29 GMT
content-type: application/javascript
vary: Accept-Encoding

GET
H2 200 ytc.js Show response
s.yimg.com/wi/ 19 KB
7 KB 576ms
255ms Script
application/javascript 2001:4998:14:800::1001
YAHOO

General

Check archive.org

Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4998:14:800::1001 , United States, ASN14777 (YAHOO, US),

Reverse DNS

Software

ATS /

Resource Hash

de25ff38288676dc79292a95d410944c2045e6e09c5e4563c40d08c615a20c54

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

content-encoding: gzip
etag: "cca96295b6201a4ce80988bdae868775-df"
x-amz-version-id: S368G.On_HD5kCG8tTyFviJgJpLggMJN
age: 2774
date: Mon, 26 May 2025 11:19:16 GMT
last-modified: Mon, 10 Feb 2025 13:55:37 GMT
vary: Origin, Accept-Encoding
x-amz-expiration: expiry-date="Wed, 18 Mar 2026 00:00:00 GMT", rule-id="standard-lifecycle"
content-type: application/javascript
x-amz-id-2: 75e07MEDESkuI6EeqNYC4nveqS4bs9P2OaO7KhoUbeIYNeaUcFp7zhNGx1bHkRdwjTQQgNLyhno=
strict-transport-security: max-age=31536000
cache-control: public,max-age=3600
ats-carp-promotion: 1, 1
referrer-policy: no-referrer-when-downgrade
x-amz-request-id: 0GNW48Z60H17Q6YK
accept-ranges: bytes
content-length: 6810
server: ATS
x-amz-server-side-encryption: AES256

GET
H2 200 adelphic_universal_pixel.js Show response
js.ipredictive.com/ 3 KB
3 KB 464ms
151ms Script
application/javascript 18.238.4.101
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://js.ipredictive.com/adelphic_universal_pixel.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NB5C4Q
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.238.4.101 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-238-4-101.phl51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9f2926504d61d971160c1b7a5891313062cd0cab673e787d51c3ecd58b6cfba8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

vary: Origin
etag: "05cb9d98e5afdb7af23fad7b8e2eceb1"
age: 1856
via: 1.1 b88fda0ef7fc0be68ec5692fdd8f97ec.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 2815
x-amz-cf-id: xiFt_Xfhe8Lhkj6ZxfIUkcL543lAnMwJInNrb1hJUyWr_92AZi1kbQ==
date: Mon, 26 May 2025 11:34:34 GMT
content-type: application/javascript
last-modified: Thu, 08 Aug 2024 19:15:17 GMT
server: AmazonS3
x-amz-cf-pop: PHL51-P1
x-amz-server-side-encryption: AES256

GET
H2 200 sw_iframe.html Show response
www.googletagmanager.com/static/service_worker/55j0/ Frame D0E2 3 KB
2 KB 572ms
313ms Document
text/html 2607:f8b0:4004:c17::61
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/static/service_worker/55j0/sw_iframe.html?origin=https%3A%2F%2Fsecure.everyaction.com

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NB5C4Q

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d36b373b44b77f016e4b7df913ba2da2a8025456f016bc794861f210c0e3ada3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 8006
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 1482
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="analytics-container-tag-serving"
cross-origin-resource-policy: cross-origin
date: Mon, 26 May 2025 09:52:03 GMT
expires: Tue, 26 May 2026 09:52:03 GMT
last-modified: Mon, 19 May 2025 09:28:00 GMT
report-to: {"group":"analytics-container-tag-serving","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/analytics-container-tag-serving"}]}
server: sffe
service-worker-allowed: /static/service_worker
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK application.909e2f5f9100accd006e.modern.js Show response
js.verygoodvault.com/vgs-collect/2.18.4/lib/ Frame 36CE 331 KB
107 KB 138ms
137ms Script
application/javascript 108.138.64.12
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://js.verygoodvault.com/vgs-collect/2.18.4/lib/application.909e2f5f9100accd006e.modern.js
Requested by: Host: js.verygoodvault.com
URL: https://js.verygoodvault.com/vgs-collect/2.18.4/lib/index.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.64.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-64-12.iad12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6b5b8d9d9ffa6c2cc34b2bc6188cb900a6f1490983d0f16276ae7073978f1a5f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://js.verygoodvault.com
Referer: https://js.verygoodvault.com/vgs-collect/2.18.4/lib/index.html

Response headers

Access-Control-Max-Age: 3000
Content-Encoding: gzip
x-amz-version-id: bFbwHKJMSq_P8gXZB7NkRn9e60aeznRH
ETag: W/"55ba8f4f8f5789d1d6f863f100a30e86"
Age: 23
Access-Control-Allow-Methods: GET
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: B0yMm-14rirQr5yKgF_rNArZY6tF2bvnumrkdt2VoXNhSUflMb8Jzg==
Date: Mon, 26 May 2025 12:05:06 GMT
Content-Type: application/javascript
Vary: Accept-Encoding
Last-Modified: Thu, 16 Mar 2023 10:29:57 GMT
Transfer-Encoding: chunked
Cache-Control: max-age=60
Connection: keep-alive
Via: 1.1 c1bfc7dbcf7f9782aa3be590b7ce3d6a.cloudfront.net (CloudFront)
Access-Control-Allow-Origin: *
X-Amz-Cf-Pop: IAD12-P1
Server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H/1.1 200
OK application.909e2f5f9100accd006e.modern.js Show response
js.verygoodvault.com/vgs-collect/2.18.4/lib/ Frame 4595 331 KB
0 136ms
135ms Script
application/javascript 108.138.64.12
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://js.verygoodvault.com/vgs-collect/2.18.4/lib/application.909e2f5f9100accd006e.modern.js
Requested by: Host: js.verygoodvault.com
URL: https://js.verygoodvault.com/vgs-collect/2.18.4/lib/index.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.64.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-64-12.iad12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6b5b8d9d9ffa6c2cc34b2bc6188cb900a6f1490983d0f16276ae7073978f1a5f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://js.verygoodvault.com
Referer: https://js.verygoodvault.com/vgs-collect/2.18.4/lib/index.html

Response headers

Access-Control-Max-Age: 3000
Content-Encoding: gzip
x-amz-version-id: bFbwHKJMSq_P8gXZB7NkRn9e60aeznRH
ETag: W/"55ba8f4f8f5789d1d6f863f100a30e86"
Age: 23
Access-Control-Allow-Methods: GET
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: B0yMm-14rirQr5yKgF_rNArZY6tF2bvnumrkdt2VoXNhSUflMb8Jzg==
Date: Mon, 26 May 2025 12:05:06 GMT
Content-Type: application/javascript
Vary: Accept-Encoding
Last-Modified: Thu, 16 Mar 2023 10:29:57 GMT
Cache-Control: max-age=60
Via: 1.1 c1bfc7dbcf7f9782aa3be590b7ce3d6a.cloudfront.net (CloudFront)
Access-Control-Allow-Origin: *
X-Amz-Cf-Pop: IAD12-P1
Server: AmazonS3
x-amz-server-side-encryption: AES256

POST
H2 200 graphql Show response
payments.braintree-api.com/ 1 KB
1 KB 155ms
153ms XHR
application/json 3.218.50.40
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://payments.braintree-api.com/graphql

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/b/ai.2.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.218.50.40 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-218-50-40.compute-1.amazonaws.com

Software

nginx /

Resource Hash

5a9e54da7f6b030de2e5dd4b6e84caff2505352a77e1872a7eee4ed2ada6ec7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NiIsImtpZCI6IjIwMTgwNDI2MTYtcHJvZHVjdGlvbiIsImlzcyI6Imh0dHBzOi8vYXBpLmJyYWludHJlZWdhdGV3YXkuY29tIn0.eyJleHAiOjE3NDgzNDc1MjksImp0aSI6ImQ5NDU3MzRjLWRiZjUtNDJmZS1iNmUzLTdlOGM2NWExYjUwNCIsInN1YiI6InMzYjJjOGt3dDlxdzc3N3QiLCJpc3MiOiJodHRwczovL2FwaS5icmFpbnRyZWVnYXRld2F5LmNvbSIsIm1lcmNoYW50Ijp7InB1YmxpY19pZCI6InMzYjJjOGt3dDlxdzc3N3QiLCJ2ZXJpZnlfY2FyZF9ieV9kZWZhdWx0IjpmYWxzZX0sInJpZ2h0cyI6WyJtYW5hZ2VfdmF1bHQiXSwic2NvcGUiOlsiQnJhaW50cmVlOlZhdWx0Il0sIm9wdGlvbnMiOnt9fQ.m4g4rDbFDsxOBk5878Z8JXQ18YuDLVvK4peVGoLDEGoiUCEJgELag_fB6JIGRK3NmA2BnjpQ_UP9KpgMQoDTkg
Referer: https://secure.everyaction.com/
Braintree-Version: 2018-05-10
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache, no-store
paypal-debug-id: 54fbf80f5e084
braintree-version: 2016-10-07
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
access-control-allow-origin: https://secure.everyaction.com
content-length: 675
date: Mon, 26 May 2025 12:05:30 GMT
content-type: application/json
vary: Braintree-Version, Accept-Encoding
server: nginx
x-frame-options: DENY

GET
H/1.1 200
OK application.909e2f5f9100accd006e.modern.js Show response
js.verygoodvault.com/vgs-collect/2.18.4/lib/ Frame CF1A 331 KB
0 124ms
124ms Script
application/javascript 108.138.64.12
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://js.verygoodvault.com/vgs-collect/2.18.4/lib/application.909e2f5f9100accd006e.modern.js
Requested by: Host: js.verygoodvault.com
URL: https://js.verygoodvault.com/vgs-collect/2.18.4/lib/index.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.64.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-64-12.iad12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6b5b8d9d9ffa6c2cc34b2bc6188cb900a6f1490983d0f16276ae7073978f1a5f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://js.verygoodvault.com
Referer: https://js.verygoodvault.com/vgs-collect/2.18.4/lib/index.html

Response headers

Access-Control-Max-Age: 3000
Content-Encoding: gzip
x-amz-version-id: bFbwHKJMSq_P8gXZB7NkRn9e60aeznRH
ETag: W/"55ba8f4f8f5789d1d6f863f100a30e86"
Age: 23
Access-Control-Allow-Methods: GET
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: B0yMm-14rirQr5yKgF_rNArZY6tF2bvnumrkdt2VoXNhSUflMb8Jzg==
Date: Mon, 26 May 2025 12:05:06 GMT
Content-Type: application/javascript
Vary: Accept-Encoding
Last-Modified: Thu, 16 Mar 2023 10:29:57 GMT
Cache-Control: max-age=60
Via: 1.1 c1bfc7dbcf7f9782aa3be590b7ce3d6a.cloudfront.net (CloudFront)
Access-Control-Allow-Origin: *
X-Amz-Cf-Pop: IAD12-P1
Server: AmazonS3
x-amz-server-side-encryption: AES256

OPTIONS
H2 200 graphql
payments.braintree-api.com/ Frame 0
0 568ms
129ms Preflight 3.218.50.40
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://payments.braintree-api.com/graphql

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.218.50.40 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-218-50-40.compute-1.amazonaws.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,braintree-version,content-type
Access-Control-Request-Method: POST
Origin: https://secure.everyaction.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: authorization,braintree-version,content-type
access-control-allow-methods: GET,DELETE,OPTIONS,PATCH,POST,PUT
access-control-allow-origin: https://secure.everyaction.com
access-control-max-age: 1800
date: Mon, 26 May 2025 12:05:29 GMT
paypal-debug-id: cc86a303e6aa4
server: nginx
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
x-frame-options: DENY

GET
H3 200 destination Show response
www.googletagmanager.com/gtag/ 335 KB
115 KB 142ms
141ms Script
application/javascript 142.251.111.97
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=AW-1071979118&cx=c&gtm=45je55l1v879307084za200zb6541836&tag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~103289853~104481633~104481635

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VB9DKE4V36&cx=c&gtm=45He55l1v6541836za200&tag_exp=101509157~103116026~103130498~103130500~103200004~103211513~103233427~103252644~103252646~104481633~104481635

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.97 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

796a821467f9b7b351995f1c48ad6687507a6df67360634b05629349f5b5e6d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

content-encoding: br
report-to: {"group":"ascgcysghrgc:42:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcysghrgc:42:0"}],}
expires: Mon, 26 May 2025 12:05:29 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 26 May 2025 12:05:29 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcysghrgc:42:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcysghrgc:42:0
content-length: 118042
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 destination Show response
www.googletagmanager.com/gtag/ 287 KB
101 KB 155ms
154ms Script
application/javascript 142.251.111.97
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=DC-8188095&cx=c&gtm=45je55l1v879307084za200zb6541836&tag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~103289853~104481633~104481635

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.97 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

ff8b86f8cc9406e2614762529e74b842f7223a16f98c49f253317bc88bf47002

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

content-encoding: br
report-to: {"group":"ascgcysghrgc:42:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcysghrgc:42:0"}],}
expires: Mon, 26 May 2025 12:05:29 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 26 May 2025 12:05:29 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcysghrgc:42:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcysghrgc:42:0
content-length: 103651
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 destination Show response
www.googletagmanager.com/gtag/ 309 KB
109 KB 258ms
257ms Script
application/javascript 142.251.111.97
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=AW-994113961&cx=c&gtm=45je55l1v879307084za200zb6541836&tag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~103289853~104481633~104481635

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.97 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

91e7afb447a3504e20f7fdd1d2b8d902b4a4768c9375850fe2a6a3813840ff33

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

content-encoding: br
report-to: {"group":"ascgcysghrgc:42:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcysghrgc:42:0"}],}
expires: Mon, 26 May 2025 12:05:29 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 26 May 2025 12:05:29 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcysghrgc:42:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcysghrgc:42:0
content-length: 111512
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect
analytics.google.com/g/ 0
0 731ms
96ms Fetch
text/plain 2001:4860:4802:38::181
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-VB9DKE4V36&gtm=45je55l1v879307084z86541836za200zb6541836&_p=1748261127486&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~103289853~104481633~104481635&ptag_exp=101509157~103116026~103130498~103130500~103200004~103211513~103233427~103252644~103252646~104481633~104481635&cid=2113998087.1748261130&ecid=1110614464&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_eu=AAAAAAQ&_s=1&sid=1748261129&sct=1&seg=0&dl=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057&dt=Defend%20Science%20from%20Trump%E2%80%99s%20Attacks.%20Donate%20Now.&_tu=Kg&en=view_item&pr1=nmDev%20AX%20Current%20FY25%20May%20Campaign%20(Control)&_et=5&tfd=4474
Requested by: Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/b/ai.2.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:38::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:155:0
report-to: {"group":"ascnsrsggc:155:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:155:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://secure.everyaction.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:155:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 26 May 2025 12:05:30 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
analytics.google.com/g/ 0
0 729ms
95ms Fetch
text/plain 2001:4860:4802:38::181
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-VB9DKE4V36&gtm=45je55l1v879307084z86541836za200zb6541836&_p=1748261127486&em=tv.1~em.JOuYQE8Z2hsAKfKBAmtYiETjnccIhoKKF3gBUizH4Fo&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~103289853~104481633~104481635&ptag_exp=101509157~103116026~103130498~103130500~103200004~103211513~103233427~103252644~103252646~104481633~104481635&cid=2113998087.1748261130&ecid=1110614464&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&ec_mode=a&_s=2&sid=1748261129&sct=1&seg=0&dl=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057&dt=Defend%20Science%20from%20Trump%E2%80%99s%20Attacks.%20Donate%20Now.&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=4475
Requested by: Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/b/ai.2.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:38::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:155:0
report-to: {"group":"ascnsrsggc:155:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:155:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://secure.everyaction.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:155:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 26 May 2025 12:05:30 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
561 B 414ms
130ms Ping
text/plain 2607:f8b0:4004:c21::9c
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-VB9DKE4V36&cid=2113998087.1748261130&gtm=45je55l1v879307084z86541836za200zb6541836&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~103289853~104481633~104481635&ptag_exp=101509157~103116026~103130498~103130500~103200004~103211513~103233427~103252644~103252646~104481633~104481635
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VB9DKE4V36&cx=c&gtm=45He55l1v6541836za200&tag_exp=101509157~103116026~103130498~103130500~103200004~103211513~103233427~103252644~103252646~104481633~104481635
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c21::9c Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:124:0
report-to: {"group":"ascnsrsggc:124:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:124:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://secure.everyaction.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:124:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 26 May 2025 12:05:29 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 5625923.js Show response
bat.bing.com/p/action/ 3 KB
1 KB 93ms
93ms Script
application/javascript 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to

Full URL

https://bat.bing.com/p/action/5625923.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

19be2ec5ff7bc5207e0beb799112f86e27902fff0e18423a1940d3581c3d8e9b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: br
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 9E285A1663D64EDB9783F29A1764E696 Ref B: LAX311000110021 Ref C: 2025-05-26T12:05:29Z
x-cache: CONFIG_NOCACHE
date: Mon, 26 May 2025 12:05:29 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding

GET
H/1.1 200
OK event Show response
ad.ipredictive.com/d/track/ Frame FAFC 0
327 B 805ms
124ms Document
text/plain 18.235.101.177
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://ad.ipredictive.com/d/track/event?upid=108146&cache_buster=1748261129&url=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2FuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%2Fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%2Fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%3D%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057&val=undefined&tn=undefined&itms=undefined&p1=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057&p2=Defend+Science+from+Trump%E2%80%99s+Attacks.+Donate+Now.+
Requested by: Host: js.ipredictive.com
URL: https://js.ipredictive.com/adelphic_universal_pixel.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.235.101.177 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-235-101-177.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://secure.everyaction.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 0
Date: Mon, 26 May 2025 12:05:30 GMT
X-CI-RTID: a54e95c3-886f-494d-85f1-204dd5e19e78

GET
H2 204 0
bat.bing.com/action/ 0
362 B 93ms
93ms Image
text/plain 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=5625923&tm=gtm002&Ver=2&mid=1ad15e85-e4d9-4041-ae53-dc360807cec3&bo=1&sid=b79990403a2911f09dfaf77626ce2efa&vid=b799f0f03a2911f0b271e9a0b83b0595&vids=1&msclkid=N&pi=918639831&lg=en-US&sw=1600&sh=1200&sc=24&tl=Defend%20Science%20from%20Trump%E2%80%99s%20Attacks.%20Donate%20Now.&p=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057&r=&lt=3492&evt=pageLoad&sv=1&cdb=AQAQ&rn=862897

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, must-revalidate
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: D1FB8F38C3E4468D831AB9DFD08C5027 Ref B: LAX311000110021 Ref C: 2025-05-26T12:05:29Z
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Mon, 26 May 2025 12:05:29 GMT

GET
H/1.1 200
OK ca.html Show response
20802620p.rfihub.com/ Frame EF81 5 KB
6 KB 879ms
135ms Document
text/html 199.38.167.131
ROCKETFUEL

General

Check archive.org

Download Go to

Full URL: https://20802620p.rfihub.com/ca.html?ver=9&rb=35937&ca=20802620&_o=35937&_t=20802620&pe=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057&pf=&ra=6928295840006712
Requested by: Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 199.38.167.131 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.4.51.v20230217) /
Resource Hash: e2594cf390979a868cf58f70809568870f5c13e4af80b452d78278cacfe9069d

Request headers

Referer: https://secure.everyaction.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

Cache-Control: no-cache
Content-Length: 5180
Content-Type: text/html;charset=utf-8
Date: Mon, 26 May 2025 12:05:30 GMT
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.4.51.v20230217)

GET
H/1.1 200
OK ca.html Show response
20802623p.rfihub.com/ Frame A107 5 KB
6 KB 470ms
139ms Document
text/html 199.38.167.131
ROCKETFUEL

General

Check archive.org

Download Go to

Full URL: https://20802623p.rfihub.com/ca.html?ver=9&rb=35937&ca=20802623&_o=35937&_t=20802623&pe=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057&pf=&ra=12008147827519444
Requested by: Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 199.38.167.131 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.4.51.v20230217) /
Resource Hash: c853db5c1f45591b9b5d4e23d7f3941620e4c94f7c76736536b4df215d1ef785

Request headers

Referer: https://secure.everyaction.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

Cache-Control: no-cache
Content-Length: 5197
Content-Type: text/html;charset=utf-8
Date: Mon, 26 May 2025 12:05:30 GMT
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.4.51.v20230217)

GET
H2 200 rules-p-8w7tSVuzV_3NU.js Show response
rules.quantcount.com/ 5 KB
2 KB 566ms
147ms Script
application/javascript 2600:9000:26a0:9e00:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://rules.quantcount.com/rules-p-8w7tSVuzV_3NU.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:26a0:9e00:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ba28457aec8e96bda721a20af6fd36d57940c7607597f0caadd72e6c08615f88

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

content-encoding: gzip
etag: W/"610bb3b00c066431338a8002bf88acfa"
age: 454
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: G6L3CxNBvZDxt_ql24WULPwajw0V_z8O8AceU2WqGWV2AliUwzWTEQ==
date: Mon, 26 May 2025 11:57:57 GMT
content-type: application/javascript
vary: Accept-Encoding
last-modified: Fri, 01 Nov 2019 20:00:46 GMT
cache-control: max-age=3600
cross-origin-resource-policy: cross-origin
via: 1.1 212f3832d7f59d71fd3926166fcc89ae.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: YUL62-P2
server: AmazonS3
x-amz-server-side-encryption: AES256

POST
H2 200 collect Show response
www.google-analytics.com/j/ 3 B
456 B 131ms
128ms XHR
text/plain 2607:f8b0:4004:c07::65
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=602258257&t=pageview&_s=1&dl=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057&ul=en-us&de=UTF-8&dt=Defend%20Science%20from%20Trump%E2%80%99s%20Attacks.%20Donate%20Now.&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAEABAAAAACAAI~&jid=69129568&gjid=1265738968&cid=2113998087.1748261130&tid=UA-6648639-1&_gid=116906419.1748261130&_r=1&_slc=1&gtm=45He55l1n71NB5C4Qv6541836za200&cd2=&cd3=&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~103116026~103130498~103130500~103200004~103211513~103233427~103252644~103252646~104481633~104481635&z=618232687

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/b/ai.2.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::65 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://secure.everyaction.com/

Response headers

report-to: {"group":"ascnsrsgac:175:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 26 May 2025 12:05:29 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0
access-control-allow-origin: https://secure.everyaction.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgac:175:0
content-length: 3
server: Golfe2

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
71 B 131ms
130ms XHR
text/plain 2607:f8b0:4004:c07::65
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=602258257&t=timing&_s=1&dl=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057&ul=en-us&de=UTF-8&dt=Defend%20Science%20from%20Trump%E2%80%99s%20Attacks.%20Donate%20Now.&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&utc=ContributionForm&utv=Form%20Load&utl=Page%3A%20%2F5LsOqOrd906PKtLlv8yw8A2&utt=4017&_u=YADAAEABAAAAACAAI~&jid=887335901&gjid=231376211&cid=2113998087.1748261130&tid=UA-6648639-1&_gid=116906419.1748261130&_r=1&gtm=45He55l1n71NB5C4Qv6541836za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~103116026~103130498~103130500~103200004~103211513~103233427~103252644~103252646~104481633~104481635&z=1978028269

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/b/ai.2.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::65 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://secure.everyaction.com/

Response headers

report-to: {"group":"ascnsrsgac:175:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 26 May 2025 12:05:29 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0
access-control-allow-origin: https://secure.everyaction.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgac:175:0
content-length: 1
server: Golfe2

GET
H2 200 collect
www.google-analytics.com/ 35 B
376 B 121ms
120ms Image
image/gif 2607:f8b0:4004:c07::65
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=602258257&t=event&ni=1&_s=1&dl=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057&ul=en-us&de=UTF-8&dt=Defend%20Science%20from%20Trump%E2%80%99s%20Attacks.%20Donate%20Now.&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Form%20Loaded&ea=ContributionForm&el=Defend%20Science%20from%20Trump%E2%80%99s%20Attacks.%20Donate%20Now.&_u=YAHAAEABAAAAACAAI~&jid=&gjid=&cid=2113998087.1748261130&tid=UA-6648639-1&_gid=116906419.1748261130&gtm=45He55l1n71NB5C4Qv6541836za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~103116026~103130498~103130500~103200004~103211513~103233427~103252644~103252646~104481633~104481635&z=161380452

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::65 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

age: 41606
report-to: {"group":"ascnsrsgac:163:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:163:0"}],}
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 26 May 2025 00:32:03 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:163:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgac:163:0
content-length: 35
server: Golfe2

POST
H2 200 vgs Show response
vgs-collect-keeper.apps.verygood.systems/ Frame 36CE 0
111 B 451ms
133ms XHR
text/plain 23.23.51.244
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://vgs-collect-keeper.apps.verygood.systems/vgs
Requested by: Host: js.verygoodvault.com
URL: https://js.verygoodvault.com/vgs-collect/2.18.4/lib/application.909e2f5f9100accd006e.modern.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.23.51.244 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-23-23-51-244.compute-1.amazonaws.com
Software: / Express
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://js.verygoodvault.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Accept: application/json, text/plain, */*
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://js.verygoodvault.com
content-length: 0
date: Mon, 26 May 2025 12:05:30 GMT
x-powered-by: Express
vary: Origin

GET
H2 200 10095888.json Show response
s.yimg.com/wi/config/ 2 B
399 B 410ms
141ms XHR
application/json 2001:4998:14:800::1001
YAHOO

General

Check archive.org

Download Go to

Full URL

https://s.yimg.com/wi/config/10095888.json

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/b/ai.2.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4998:14:800::1001 , United States, ASN14777 (YAHOO, US),

Reverse DNS

Software

ATS /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

access-control-max-age: 0
access-control-expose-headers
content-encoding: gzip
age: 0
access-control-allow-methods: GET
date: Mon, 26 May 2025 12:05:30 GMT
content-type: application/json
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
x-amz-id-2: 8cv9g56HpBk5Id+L0x34wamoE+j/yYDwn3S7ZeN6mEYkhcnACMWuEmaM4PRaLcgKHDxS1aWPxeI=
strict-transport-security: max-age=31536000
cache-control: public,max-age=3600
referrer-policy: no-referrer-when-downgrade
x-amz-request-id: G0WTNSCENNG53G5C
access-control-allow-origin: *
content-length: 22
server: ATS

GET
H3 200 625465517575530 Show response
connect.facebook.net/signals/config/ 68 KB
14 KB 283ms
277ms Script
application/x-javascript 157.240.229.1
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/signals/config/625465517575530?v=2.9.203&r=stable&domain=secure.everyaction.com&hme=36c7454c4b078660353e5d4c89e3eaca439a56e5c3ceaadddff6c79ae427835a&ex_m=74%2C128%2C113%2C117%2C65%2C6%2C106%2C73%2C19%2C101%2C93%2C55%2C58%2C183%2C204%2C211%2C207%2C208%2C210%2C32%2C107%2C57%2C81%2C209%2C178%2C181%2C205%2C206%2C191%2C140%2C45%2C196%2C193%2C194%2C37%2C152%2C18%2C54%2C200%2C199%2C142%2C21%2C44%2C2%2C47%2C69%2C70%2C71%2C75%2C97%2C20%2C17%2C100%2C96%2C95%2C114%2C56%2C116%2C42%2C115%2C33%2C98%2C43%2C90%2C29%2C179%2C182%2C149%2C14%2C15%2C16%2C8%2C9%2C28%2C25%2C26%2C61%2C66%2C68%2C79%2C105%2C108%2C30%2C80%2C12%2C10%2C84%2C52%2C24%2C110%2C109%2C111%2C102%2C13%2C23%2C4%2C41%2C78%2C22%2C161%2C136%2C77%2C1%2C99%2C60%2C88%2C36%2C31%2C86%2C87%2C92%2C40%2C7%2C94%2C85%2C48%2C35%2C38%2C0%2C72%2C118%2C91%2C5%2C51%2C50%2C89%2C248%2C176%2C126%2C164%2C157%2C3%2C39%2C67%2C46%2C112%2C49%2C83%2C64%2C63%2C34%2C103%2C62%2C59%2C53%2C82%2C76%2C27%2C104%2C11%2C119

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.229.1 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-02-iad3.fbcdn.net

Software

Resource Hash

40e57e6f6417d86b7d542a7b50bd42da6bf26ae5118bb95f298c2f28f07913eb

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' blob: ;script-src data: 'nonce-AIqtwZEZ' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: 'self' https://.google-analytics.com .google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: .cdninstagram.com https://.google-analytics.com;font-src 'self' data: blob: ;img-src 'self' data: blob: https://.google-analytics.com;media-src 'self' data: blob: ;child-src 'self' data: blob: ;frame-src 'self' data: blob: ;manifest-src 'self' data: blob: ;object-src 'self' data: blob: ;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 26 May 2025 12:05:30 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' blob: *;script-src data: 'nonce-AIqtwZEZ' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self' https://*.google-analytics.com *.google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com https://*.google-analytics.com;font-src 'self' data: blob: *;img-src 'self' data: blob: * https://*.google-analytics.com;media-src 'self' data: blob: *;child-src 'self' data: blob: *;frame-src 'self' data: blob: *;manifest-src 'self' data: blob: *;object-src 'self' data: blob: *;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
x-fb-connection-quality: GOOD; q=0.7, rtt=125, rtx=8, c=50, mss=1232, tbw=94214, tp=85, tpl=8, uplat=149, ullat=0
pragma: public
x-fb-debug: DjEVP1o/g4ZxcC0WiHtXqi9sjLe1ABBDaPx4aCByPf5R2moZEwnfTfuNKaNyGphtSexg5n2kRhY1TP9P8tNyPw==
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: default-src 'self' blob: *;script-src 'nonce-AIqtwZEZ' 'report-sample' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self' https://*.google-analytics.com *.google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com https://*.google-analytics.com;font-src 'self' data: blob: *;img-src 'self' data: blob: * https://*.google-analytics.com;media-src 'self' data: blob: *;child-src 'self' data: blob: *;frame-src 'self' data: blob: *;manifest-src 'self' data: blob: *;object-src 'self' data: blob: *;worker-src 'self' data: blob: *;report-uri https://www.facebook.com/csp/reporting/?minimize=0;require-trusted-types-for 'script';
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?1

GET
DATA 200
OK truncated
/ Frame CF1A 557 B
0 Image
image/svg+xml

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7cf4641497720eff15f2b923bdae3ffafe95044234ab5bf0028cb1f1e9e04186

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
H/1.1 200
OK visa.svg
js.verygoodvault.com/vgs-collect/icons/ Frame CF1A 0
1 KB 121ms
121ms Other
image/svg+xml 108.138.64.12
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://js.verygoodvault.com/vgs-collect/icons/visa.svg
Requested by: Host: js.verygoodvault.com
URL: https://js.verygoodvault.com/vgs-collect/2.18.4/lib/application.909e2f5f9100accd006e.modern.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.64.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-64-12.iad12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://js.verygoodvault.com/vgs-collect/2.18.4/lib/index.html

Response headers

Content-Encoding: gzip
x-amz-version-id: H.lNoG4vwL1ej33_03.Q4hw1WNRfkp4C
ETag: W/"bf0e3c7ebdd4f91c9ef36fefa89822e9"
Age: 18408
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: YldDXLkdaGBRiasc52xbG_IiqAtypPKLh-9U1tBt9olOm3w-_j9FDw==
Date: Mon, 26 May 2025 06:58:43 GMT
Content-Type: image/svg+xml
Last-Modified: Tue, 16 Feb 2021 23:07:16 GMT
Vary: Accept-Encoding
Transfer-Encoding: chunked
Connection: keep-alive
Via: 1.1 c1bfc7dbcf7f9782aa3be590b7ce3d6a.cloudfront.net (CloudFront)
Access-Control-Allow-Origin: *
X-Amz-Cf-Pop: IAD12-P1
Server: AmazonS3

GET
H/1.1 200
OK visa-electron.svg
js.verygoodvault.com/vgs-collect/icons/ Frame CF1A 0
2 KB 213ms
121ms Other
image/svg+xml 108.138.64.12
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://js.verygoodvault.com/vgs-collect/icons/visa-electron.svg
Requested by: Host: js.verygoodvault.com
URL: https://js.verygoodvault.com/vgs-collect/2.18.4/lib/application.909e2f5f9100accd006e.modern.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.64.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-64-12.iad12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://js.verygoodvault.com/vgs-collect/2.18.4/lib/index.html

Response headers

Content-Encoding: gzip
x-amz-version-id: MgNF_FMVP1IvFHrPIq8AALFoZu_j7TtV
ETag: W/"c962f159de73e843c20331630bc3cd07"
Age: 13575
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: Q9XN0ABK_o1bgVY80BMeGlKLSXWV3ZJoAyOovCyrnUkU0dTsq4tF4Q==
Date: Mon, 26 May 2025 08:19:32 GMT
Content-Type: image/svg+xml
Last-Modified: Tue, 16 Feb 2021 23:07:16 GMT
Vary: Accept-Encoding
Transfer-Encoding: chunked
Connection: keep-alive
Via: 1.1 c1bfc7dbcf7f9782aa3be590b7ce3d6a.cloudfront.net (CloudFront)
Access-Control-Allow-Origin: *
X-Amz-Cf-Pop: IAD12-P1
Server: AmazonS3

GET
H/1.1 200
OK amex.svg
js.verygoodvault.com/vgs-collect/icons/ Frame CF1A 0
1 KB 339ms
123ms Other
image/svg+xml 108.138.64.12
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://js.verygoodvault.com/vgs-collect/icons/amex.svg
Requested by: Host: js.verygoodvault.com
URL: https://js.verygoodvault.com/vgs-collect/2.18.4/lib/application.909e2f5f9100accd006e.modern.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.64.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-64-12.iad12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://js.verygoodvault.com/vgs-collect/2.18.4/lib/index.html

Response headers

Content-Encoding: gzip
x-amz-version-id: ItVZhXC517ZMCtDQ0ErslqkZpDw4TP_K
ETag: W/"d76aac2504772a3c74494f11fd18d87f"
Age: 22013
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 2i5CFgu8ajD99hf2lcfy08Lshv0VjZL72ph_Jg3b1av5B7p764gE9g==
Date: Mon, 26 May 2025 05:58:44 GMT
Content-Type: image/svg+xml
Last-Modified: Tue, 16 Feb 2021 23:07:16 GMT
Vary: Accept-Encoding
Transfer-Encoding: chunked
Connection: keep-alive
Via: 1.1 c1bfc7dbcf7f9782aa3be590b7ce3d6a.cloudfront.net (CloudFront)
Access-Control-Allow-Origin: *
X-Amz-Cf-Pop: IAD12-P1
Server: AmazonS3

GET
H/1.1 200
OK maestro.svg
js.verygoodvault.com/vgs-collect/icons/ Frame CF1A 0
4 KB 359ms
123ms Other
image/svg+xml 108.138.64.12
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://js.verygoodvault.com/vgs-collect/icons/maestro.svg
Requested by: Host: js.verygoodvault.com
URL: https://js.verygoodvault.com/vgs-collect/2.18.4/lib/application.909e2f5f9100accd006e.modern.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.64.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-64-12.iad12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://js.verygoodvault.com/vgs-collect/2.18.4/lib/index.html

Response headers

Content-Encoding: gzip
x-amz-version-id: 1_p31LpzRSjwSiLiTYV71TUVe9IpUn9e
ETag: W/"3625c25fe4e71c0daa524694d3b3d2e2"
Age: 43397
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: h1u0N8Cs8Dx_Ogv_x5sr9vUieATkhfzKvaJYEbOOqL_K3uTEt07TJA==
Date: Mon, 26 May 2025 00:02:14 GMT
Content-Type: image/svg+xml
Last-Modified: Tue, 16 Feb 2021 23:07:16 GMT
Vary: Accept-Encoding
Transfer-Encoding: chunked
Connection: keep-alive
Via: 1.1 6f067a3fd6e721a7db2a2901701a65d8.cloudfront.net (CloudFront)
Access-Control-Allow-Origin: *
X-Amz-Cf-Pop: IAD12-P1
Server: AmazonS3

GET
H/1.1 200
OK mastercard.svg
js.verygoodvault.com/vgs-collect/icons/ Frame CF1A 0
1 KB 362ms
119ms Other
image/svg+xml 108.138.64.12
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://js.verygoodvault.com/vgs-collect/icons/mastercard.svg
Requested by: Host: js.verygoodvault.com
URL: https://js.verygoodvault.com/vgs-collect/2.18.4/lib/application.909e2f5f9100accd006e.modern.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.64.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-64-12.iad12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://js.verygoodvault.com/vgs-collect/2.18.4/lib/index.html

Response headers

Content-Encoding: gzip
x-amz-version-id: PU9xtdz3b.d2kDLc5M1BB7mi5YpUwVDj
ETag: W/"8baef8cd0813bb42fe4bd99adf195035"
Age: 19263
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: l6PvJmzPOCEdAL-7ESDIVU8blc2v24W0G7obd2-XivEVi_UzPzrFAA==
Date: Mon, 26 May 2025 06:44:42 GMT
Content-Type: image/svg+xml
Last-Modified: Tue, 16 Feb 2021 23:07:16 GMT
Vary: Accept-Encoding
Transfer-Encoding: chunked
Connection: keep-alive
Via: 1.1 7db19e3781edb64ef4f7023d2c25783e.cloudfront.net (CloudFront)
Access-Control-Allow-Origin: *
X-Amz-Cf-Pop: IAD12-P1
Server: AmazonS3

GET
H/1.1 200
OK unionpay.svg
js.verygoodvault.com/vgs-collect/icons/ Frame CF1A 0
5 KB 368ms
122ms Other
image/svg+xml 108.138.64.12
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://js.verygoodvault.com/vgs-collect/icons/unionpay.svg
Requested by: Host: js.verygoodvault.com
URL: https://js.verygoodvault.com/vgs-collect/2.18.4/lib/application.909e2f5f9100accd006e.modern.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.64.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-64-12.iad12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://js.verygoodvault.com/vgs-collect/2.18.4/lib/index.html

Response headers

Content-Encoding: gzip
x-amz-version-id: G6Y4bx8_pMrmOjFIicD1hgmIdROiurIv
ETag: W/"01249c1708efa3c5c18a35778f20207b"
Age: 15873
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: IIZUCIkaqu6UqN_Nk6tEZhYaeXviMJSUrbe75ID-IrptV4WTqv1m0A==
Date: Mon, 26 May 2025 07:41:09 GMT
Content-Type: image/svg+xml
Last-Modified: Tue, 16 Feb 2021 23:07:16 GMT
Vary: Accept-Encoding
Transfer-Encoding: chunked
Connection: keep-alive
Via: 1.1 c1bfc7dbcf7f9782aa3be590b7ce3d6a.cloudfront.net (CloudFront)
Access-Control-Allow-Origin: *
X-Amz-Cf-Pop: IAD12-P1
Server: AmazonS3

GET
H/1.1 200
OK meeza.svg
js.verygoodvault.com/vgs-collect/icons/ Frame CF1A 0
7 KB 288ms
128ms Other
image/svg+xml 108.138.64.12
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://js.verygoodvault.com/vgs-collect/icons/meeza.svg
Requested by: Host: js.verygoodvault.com
URL: https://js.verygoodvault.com/vgs-collect/2.18.4/lib/application.909e2f5f9100accd006e.modern.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.64.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-64-12.iad12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://js.verygoodvault.com/vgs-collect/2.18.4/lib/index.html

Response headers

Content-Encoding: gzip
x-amz-version-id: fIKvFE1HubfUWhiWGE6EdQYTnLAnJ9MH
ETag: W/"07e73ffeb1e07b87f158e34e9900bd96"
Age: 21672
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: uqfRUoyG8mgIbgcEUkHOrEpxybtLU6DAP86dDa4qa4buO3QBy88nCw==
Date: Mon, 26 May 2025 06:04:19 GMT
Content-Type: image/svg+xml
Last-Modified: Tue, 16 Feb 2021 23:07:16 GMT
Vary: Accept-Encoding
Transfer-Encoding: chunked
Connection: keep-alive
Via: 1.1 a01680a1fee7e35f1738191420d98822.cloudfront.net (CloudFront)
Access-Control-Allow-Origin: *
X-Amz-Cf-Pop: IAD12-P1
Server: AmazonS3

GET
H/1.1 200
OK jcb.svg
js.verygoodvault.com/vgs-collect/icons/ Frame CF1A 0
2 KB 163ms
127ms Other
image/svg+xml 108.138.64.12
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://js.verygoodvault.com/vgs-collect/icons/jcb.svg
Requested by: Host: js.verygoodvault.com
URL: https://js.verygoodvault.com/vgs-collect/2.18.4/lib/application.909e2f5f9100accd006e.modern.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.64.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-64-12.iad12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://js.verygoodvault.com/vgs-collect/2.18.4/lib/index.html

Response headers

Content-Encoding: gzip
x-amz-version-id: QmKwMQRUu5GGnar6U1.XDYKwXr9GTt4E
ETag: W/"afc9c9bd9dd25718d84aa1b295e3cd4f"
Age: 10375
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: EP4mKs8OnekkKoS22euSWklDygJEgSidy0__eFyx2XsxTxhb3TrLTw==
Date: Mon, 26 May 2025 09:12:43 GMT
Content-Type: image/svg+xml
Last-Modified: Tue, 16 Feb 2021 23:07:16 GMT
Vary: Accept-Encoding
Transfer-Encoding: chunked
Connection: keep-alive
Via: 1.1 5988b4ae4648c0fec3c60a3cca580092.cloudfront.net (CloudFront)
Access-Control-Allow-Origin: *
X-Amz-Cf-Pop: IAD12-P1
Server: AmazonS3

GET
H/1.1 200
OK hipercard.svg
js.verygoodvault.com/vgs-collect/icons/ Frame CF1A 0
3 KB 129ms
129ms Other
image/svg+xml 108.138.64.12
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://js.verygoodvault.com/vgs-collect/icons/hipercard.svg
Requested by: Host: js.verygoodvault.com
URL: https://js.verygoodvault.com/vgs-collect/2.18.4/lib/application.909e2f5f9100accd006e.modern.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.64.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-64-12.iad12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://js.verygoodvault.com/vgs-collect/2.18.4/lib/index.html

Response headers

Content-Encoding: gzip
x-amz-version-id: wESZZuki93YD2Y88rRKC5LDYBxi8XywO
ETag: W/"39424aebb87e84c688d70ebf51e5cec6"
Age: 19247
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: n9vo_ZBfK33H3qEq3x81CuXA56ZzIp7B14xVCv81kVomglx7dYzezg==
Date: Mon, 26 May 2025 06:44:43 GMT
Content-Type: image/svg+xml
Last-Modified: Tue, 16 Feb 2021 23:07:16 GMT
Vary: Accept-Encoding
Transfer-Encoding: chunked
Connection: keep-alive
Via: 1.1 c1bfc7dbcf7f9782aa3be590b7ce3d6a.cloudfront.net (CloudFront)
Access-Control-Allow-Origin: *
X-Amz-Cf-Pop: IAD12-P1
Server: AmazonS3

GET
H/1.1 200
OK forbrugsforeningen.svg
js.verygoodvault.com/vgs-collect/icons/ Frame CF1A 0
2 KB 124ms
123ms Other
image/svg+xml 108.138.64.12
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://js.verygoodvault.com/vgs-collect/icons/forbrugsforeningen.svg
Requested by: Host: js.verygoodvault.com
URL: https://js.verygoodvault.com/vgs-collect/2.18.4/lib/application.909e2f5f9100accd006e.modern.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.64.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-64-12.iad12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://js.verygoodvault.com/vgs-collect/2.18.4/lib/index.html

Response headers

Content-Encoding: gzip
x-amz-version-id: iffR3o1DDLBtfD6DUK07BGzKAQQ9SkB1
ETag: W/"0e30901c80583be81a54ad19e75340a7"
Age: 45806
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: _NlIqHSr7PHUotdkLSc3F_xsNoQpu4jsB21QTZdBVGKAR9oFnz5FQg==
Date: Sun, 25 May 2025 23:22:05 GMT
Content-Type: image/svg+xml
Last-Modified: Tue, 16 Feb 2021 23:07:16 GMT
Vary: Accept-Encoding
Transfer-Encoding: chunked
Connection: keep-alive
Via: 1.1 6f067a3fd6e721a7db2a2901701a65d8.cloudfront.net (CloudFront)
Access-Control-Allow-Origin: *
X-Amz-Cf-Pop: IAD12-P1
Server: AmazonS3

GET
H/1.1 200
OK elo.svg
js.verygoodvault.com/vgs-collect/icons/ Frame CF1A 0
2 KB 127ms
126ms Other
image/svg+xml 108.138.64.12
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://js.verygoodvault.com/vgs-collect/icons/elo.svg
Requested by: Host: js.verygoodvault.com
URL: https://js.verygoodvault.com/vgs-collect/2.18.4/lib/application.909e2f5f9100accd006e.modern.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.64.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-64-12.iad12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://js.verygoodvault.com/vgs-collect/2.18.4/lib/index.html

Response headers

Content-Encoding: gzip
x-amz-version-id: SZ2jJtdJs0WLGiaIwIjXub4ID5pKkMH_
ETag: W/"2819c6f92cfc42b73058a840aba885a7"
Age: 19676
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: MiHznae1Jo1jhGDuKoz7sqdSVIm8VGP8DP0W8ZMBAs0QtkVYcp-cng==
Date: Mon, 26 May 2025 06:37:35 GMT
Content-Type: image/svg+xml
Last-Modified: Tue, 16 Feb 2021 23:07:16 GMT
Vary: Accept-Encoding
Transfer-Encoding: chunked
Connection: keep-alive
Via: 1.1 7db19e3781edb64ef4f7023d2c25783e.cloudfront.net (CloudFront)
Access-Control-Allow-Origin: *
X-Amz-Cf-Pop: IAD12-P1
Server: AmazonS3

GET
H/1.1 200
OK discover.svg
js.verygoodvault.com/vgs-collect/icons/ Frame CF1A 0
2 KB 123ms
123ms Other
image/svg+xml 108.138.64.12
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://js.verygoodvault.com/vgs-collect/icons/discover.svg
Requested by: Host: js.verygoodvault.com
URL: https://js.verygoodvault.com/vgs-collect/2.18.4/lib/application.909e2f5f9100accd006e.modern.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.64.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-64-12.iad12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://js.verygoodvault.com/vgs-collect/2.18.4/lib/index.html

Response headers

Content-Encoding: gzip
x-amz-version-id: 47gYKG16RG7X_h0fKEEIboeS2mmCMeYz
ETag: W/"5bd5bab591da0ad8f328376e0f9ebe29"
Age: 18421
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: I-h15kcv8uc7kYoK7CIwwLmICJsPju9Yin0Fg7Eoot16uHhgVZFE6w==
Date: Mon, 26 May 2025 06:58:30 GMT
Content-Type: image/svg+xml
Last-Modified: Tue, 16 Feb 2021 23:07:16 GMT
Vary: Accept-Encoding
Transfer-Encoding: chunked
Connection: keep-alive
Via: 1.1 c1bfc7dbcf7f9782aa3be590b7ce3d6a.cloudfront.net (CloudFront)
Access-Control-Allow-Origin: *
X-Amz-Cf-Pop: IAD12-P1
Server: AmazonS3

GET
H/1.1 200
OK diners-club.svg
js.verygoodvault.com/vgs-collect/icons/ Frame CF1A 0
1 KB 123ms
123ms Other
image/svg+xml 108.138.64.12
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://js.verygoodvault.com/vgs-collect/icons/diners-club.svg
Requested by: Host: js.verygoodvault.com
URL: https://js.verygoodvault.com/vgs-collect/2.18.4/lib/application.909e2f5f9100accd006e.modern.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.64.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-64-12.iad12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://js.verygoodvault.com/vgs-collect/2.18.4/lib/index.html

Response headers

Content-Encoding: gzip
x-amz-version-id: GmZUrCmUOwT9x.EL1h3aTKcLFhZAn.Ls
ETag: W/"39a2c40eee9103f96fab5bc8d3dbbeb8"
Age: 19792
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: K2fgYxXup8q2DryNytm_KEBU1qRw78ofvCJHgrY2cFthMXcxNyMVXw==
Date: Mon, 26 May 2025 06:35:41 GMT
Content-Type: image/svg+xml
Last-Modified: Tue, 16 Feb 2021 23:07:16 GMT
Vary: Accept-Encoding
Transfer-Encoding: chunked
Connection: keep-alive
Via: 1.1 5988b4ae4648c0fec3c60a3cca580092.cloudfront.net (CloudFront)
Access-Control-Allow-Origin: *
X-Amz-Cf-Pop: IAD12-P1
Server: AmazonS3

GET
H/1.1 200
OK dankort.svg
js.verygoodvault.com/vgs-collect/icons/ Frame CF1A 0
1 KB 122ms
122ms Other
image/svg+xml 108.138.64.12
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://js.verygoodvault.com/vgs-collect/icons/dankort.svg
Requested by: Host: js.verygoodvault.com
URL: https://js.verygoodvault.com/vgs-collect/2.18.4/lib/application.909e2f5f9100accd006e.modern.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.64.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-64-12.iad12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://js.verygoodvault.com/vgs-collect/2.18.4/lib/index.html

Response headers

Content-Encoding: gzip
x-amz-version-id: L7PgpoDJdtbcwmCNdHkqIlTpNlkZVtdK
ETag: W/"5a58f174478046c4d7105db80bb660f0"
Age: 16461
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: P9jTfpUVztCBLvSWr2GBAyyrp2EhW_Ly54rCXnyqezKduMdDXGhEbA==
Date: Mon, 26 May 2025 07:31:10 GMT
Content-Type: image/svg+xml
Last-Modified: Tue, 16 Feb 2021 23:07:16 GMT
Vary: Accept-Encoding
Transfer-Encoding: chunked
Connection: keep-alive
Via: 1.1 a01680a1fee7e35f1738191420d98822.cloudfront.net (CloudFront)
Access-Control-Allow-Origin: *
X-Amz-Cf-Pop: IAD12-P1
Server: AmazonS3

GET
H3 200 / Show response
www.googleadservices.com/pagead/conversion/994113961/ 7 KB
3 KB 287ms
144ms Script
text/javascript 172.253.122.156
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/994113961/?random=1748261130132&cv=11&fst=1748261130132&bg=ffffff&guid=ON&async=1&gcl_ctr=1&gtm=45be55l1z86541836za200zb6541836&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~103116026~103130495~103130497~103200004~103233427~103252644~103252646~104481633~104481635&ptag_exp=101509157~103116026~103130498~103130500~103200004~103211513~103233427~103252644~103252646~104481633~104481635&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057&label=80uVCNHT54MBEKnzg9oD&hn=www.googleadservices.com&frm=0&tiba=Defend%20Science%20from%20Trump%E2%80%99s%20Attacks.%20Donate%20Now.&value=0&bttype=purchase&npa=0&pscdl=noapi&auid=1541318537.1748261129&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_m=%23validators%3E%3Anth-child(2)%3E%3Anth-child(1)*A%3Atrue%3A17%3Afalse*1&ec_sel=%23validators%3E%3Anth-child(2)%3E%3Anth-child(1)&ec_meta=A%3Atrue%3A17%3Afalse&ec_lat=8&ec_s=1&fledge=1&capi=1&_tu=Kg&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-994113961&cx=c&gtm=45je55l1v879307084za200zb6541836&tag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~103289853~104481633~104481635

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f156.1e100.net

Software

cafe /

Resource Hash

9d2fc4e9f4a60c38e24fed392dfa2a389a3087aacfb50f89911e4b36e2eb189b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 2779
date: Mon, 26 May 2025 12:05:30 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 994113961 Show response
td.doubleclick.net/td/rul/ Frame A17D 13 B
523 B 519ms
151ms Document
text/html 2607:f8b0:4004:c19::9c
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://td.doubleclick.net/td/rul/994113961?random=1748261130132&cv=11&fst=1748261130132&fmt=3&bg=ffffff&guid=ON&async=1&gcl_ctr=1&gtm=45be55l1z86541836za200zb6541836&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~103116026~103130495~103130497~103200004~103233427~103252644~103252646~104481633~104481635&ptag_exp=101509157~103116026~103130498~103130500~103200004~103211513~103233427~103252644~103252646~104481633~104481635&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057&label=80uVCNHT54MBEKnzg9oD&hn=www.googleadservices.com&frm=0&tiba=Defend%20Science%20from%20Trump%E2%80%99s%20Attacks.%20Donate%20Now.&value=0&bttype=purchase&npa=0&pscdl=noapi&auid=1541318537.1748261129&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_m=%23validators%3E%3Anth-child(2)%3E%3Anth-child(1)*A%3Atrue%3A17%3Afalse*1&ec_sel=%23validators%3E%3Anth-child(2)%3E%3Anth-child(1)&ec_meta=A%3Atrue%3A17%3Afalse&ec_lat=8&ec_s=1&fledge=1&capi=1&_tu=Kg&ct_cookie_present=0

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c19::9c Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b633a587c652d02386c4f16f8c6f6aab7352d97f16367c3c40576214372dd628

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://secure.everyaction.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 26 May 2025 12:05:30 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H/1.1 200
OK s3b2c8kwt9qw777t
client-analytics.braintreegateway.com/ Frame 0
0 599ms
120ms Preflight 13.59.58.110
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://client-analytics.braintreegateway.com/s3b2c8kwt9qw777t

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.59.58.110 Columbus, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://secure.everyaction.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Headers: content-type
Access-Control-Allow-Methods: GET, HEAD, POST, OPTIONS
Access-Control-Allow-Origin: https://secure.everyaction.com
Access-Control-Max-Age: 3000
Connection: keep-alive
Content-Length: 0
Date: Mon, 26 May 2025 12:05:30 GMT
Server: nginx
Strict-Transport-Security: max-age=31536000; includeSubDomains

OPTIONS
H/1.1 200
OK s3b2c8kwt9qw777t
client-analytics.braintreegateway.com/ Frame 0
0 600ms
120ms Preflight 13.59.58.110
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://client-analytics.braintreegateway.com/s3b2c8kwt9qw777t

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.59.58.110 Columbus, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://secure.everyaction.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Headers: content-type
Access-Control-Allow-Methods: GET, HEAD, POST, OPTIONS
Access-Control-Allow-Origin: https://secure.everyaction.com
Access-Control-Max-Age: 3000
Connection: keep-alive
Content-Length: 0
Date: Mon, 26 May 2025 12:05:30 GMT
Server: nginx
Strict-Transport-Security: max-age=31536000; includeSubDomains

POST
H/1.1 200
OK s3b2c8kwt9qw777t Show response
client-analytics.braintreegateway.com/ 0
357 B 130ms
127ms XHR
text/plain 13.59.58.110
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://client-analytics.braintreegateway.com/s3b2c8kwt9qw777t

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/b/ai.2.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.59.58.110 Columbus, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://secure.everyaction.com/

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Access-Control-Max-Age: 3000
Connection: keep-alive
Access-Control-Allow-Methods: GET, HEAD, POST, OPTIONS
Access-Control-Allow-Origin: https://secure.everyaction.com
Content-Length: 0
Date: Mon, 26 May 2025 12:05:30 GMT
Server: nginx
Access-Control-Allow-Headers

POST
H/1.1 200
OK s3b2c8kwt9qw777t Show response
client-analytics.braintreegateway.com/ 0
357 B 126ms
124ms XHR
text/plain 13.59.58.110
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://client-analytics.braintreegateway.com/s3b2c8kwt9qw777t

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/b/ai.2.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.59.58.110 Columbus, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://secure.everyaction.com/

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Access-Control-Max-Age: 3000
Connection: keep-alive
Access-Control-Allow-Methods: GET, HEAD, POST, OPTIONS
Access-Control-Allow-Origin: https://secure.everyaction.com
Content-Length: 0
Date: Mon, 26 May 2025 12:05:30 GMT
Server: nginx
Access-Control-Allow-Headers

GET
H2 200 dispatch-frame.min.html Show response
checkout.paypal.com/web/3.44.2/html/ Frame 030A 8 KB
3 KB 680ms
218ms Document
text/html 151.101.130.133
FASTLY

General

Check archive.org

Download Go to

Full URL

https://checkout.paypal.com/web/3.44.2/html/dispatch-frame.min.html

Requested by

Host: static.everyaction.com
URL: https://static.everyaction.com/ea-actiontag/at.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.130.133 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

6d55efade9ac73087908d12850743009e8cb0634976bcdf224bfe87b65174668

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.everyaction.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=86400, s-maxage=31536000, public,max-age=3600
content-encoding: br
content-length: 2866
content-type: text/html
date: Mon, 26 May 2025 12:05:30 GMT
dc: ccg11-origin-www-1.paypal.com
etag: W/"662bdc42-1ed4"
expires: Wed, 12 Feb 2025 17:39:19 GMT
last-modified: Fri, 26 Apr 2024 16:54:26 GMT
paypal-debug-id: 59d5f11bbbf68
strict-transport-security: max-age=31557600
timing-allow-origin: https://www.paypal.com,https://www.sandbox.paypal.com
traceparent: 00-000000000000000000059d5f11bbbf68-90b33433c11c3068-01
vary: Accept-Encoding, Accept-Encoding
via: 1.1 varnish, 1.1 varnish
x-cache: MISS, HIT, HIT
x-cache-hits: 0, 5626, 0
x-content-type-options: nosniff
x-served-by: cache-sjc10053-SJC, cache-sjc10056-SJC, cache-mad2200121-MAD
x-timer: S1748261131.799949,VS0,VE1

OPTIONS
H/1.1 200
OK s3b2c8kwt9qw777t
client-analytics.braintreegateway.com/ Frame 0
0 594ms
123ms Preflight 13.59.58.110
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://client-analytics.braintreegateway.com/s3b2c8kwt9qw777t

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.59.58.110 Columbus, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://secure.everyaction.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Headers: content-type
Access-Control-Allow-Methods: GET, HEAD, POST, OPTIONS
Access-Control-Allow-Origin: https://secure.everyaction.com
Access-Control-Max-Age: 3000
Connection: keep-alive
Content-Length: 0
Date: Mon, 26 May 2025 12:05:30 GMT
Server: nginx
Strict-Transport-Security: max-age=31536000; includeSubDomains

POST
H/1.1 200
OK s3b2c8kwt9qw777t Show response
client-analytics.braintreegateway.com/ 0
357 B 127ms
125ms XHR
text/plain 13.59.58.110
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://client-analytics.braintreegateway.com/s3b2c8kwt9qw777t

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/b/ai.2.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.59.58.110 Columbus, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-160-143-175.compute-1.amazonaws.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://secure.everyaction.com/

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Access-Control-Max-Age: 3000
Connection: keep-alive
Access-Control-Allow-Methods: GET, HEAD, POST, OPTIONS
Access-Control-Allow-Origin: https://secure.everyaction.com
Content-Length: 0
Date: Mon, 26 May 2025 12:05:30 GMT
Server: nginx
Access-Control-Allow-Headers

GET
H3

200

activity;dc_pre=CMyIq52MwY0DFYQQaAgdo6wiTA;src=8188095;type=site;cat=ucs-g0;ord=367765031085;npa=0;auiddc=1541318537.1748261129;u1=%2F5LsOqOrd906PKtLlv8yw8A2;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=... Show response
ad.doubleclick.net/
Redirect Chain

https://ad.doubleclick.net/activity;src=8188095;type=site;cat=ucs-g0;ord=367765031085;npa=0;auiddc=1541318537.1748261129;u1=%2F5LsOqOrd906PKtLlv8yw8A2;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;...
https://ad.doubleclick.net/activity;dc_pre=CMyIq52MwY0DFYQQaAgdo6wiTA;src=8188095;type=site;cat=ucs-g0;ord=367765031085;npa=0;auiddc=1541318537.1748261129;u1=%2F5LsOqOrd906PKtLlv8yw8A2;uaa=;uab=;ua...

42 B
68 B

152ms
149ms

Fetch
image/png

142.250.31.148
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/activity;dc_pre=CMyIq52MwY0DFYQQaAgdo6wiTA;src=8188095;type=site;cat=ucs-g0;ord=367765031085;npa=0;auiddc=1541318537.1748261129;u1=%2F5LsOqOrd906PKtLlv8yw8A2;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KlA;gtm=45fe55l1v9189007292z86541836za200zb6541836;gcd=13l3l3l3l1l1;dma=0;dc_fmt=3;tag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~104481633~104481635;ptag_exp=101509157~103116026~103130498~103130500~103200004~103211513~103233427~103252644~103252646~104481633~104481635;epver=2;dc_random=1748261130298;~oref=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057?

Requested by

Protocol

Server

142.250.31.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f148.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 42
date: Mon, 26 May 2025 12:05:30 GMT
attribution-reporting-register-trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"9708319099335062787"}],"aggregatable_trigger_data":[{"filters":[{"14":["6668743"]}],"key_piece":"0xb9451f70c546462a","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0x647db52dbae4e841","not_filters":{"14":["6668743"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"34782020":34,"34782021":34,"34782022":34,"34782023":3345,"647437288":32,"647437289":32,"647437290":32,"647437291":3177,"914032284":65,"914032285":65,"914032286":65,"914032287":6356},"aggregation_coordinator_origin":"https://publickeyservice.msmt.gcp.privacysandboxservices.com","debug_key":"7061399168418703743","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"9708319099335062787","filters":[{"14":["6668743"],"source_type":["event"]}],"priority":"10","trigger_data":"1"},{"deduplication_key":"9708319099335062787","filters":[{"14":["6668743"],"source_type":["navigation"]}],"priority":"10","trigger_data":"6"},{"deduplication_key":"9708319099335062787","filters":[{"source_type":["event"]}],"priority":"0","trigger_data":"0"},{"deduplication_key":"9708319099335062787","filters":[{"source_type":["navigation"]}],"priority":"0","trigger_data":"7"}],"filters":{"8":["8188095"]}}
content-type: image/png
x-xss-protection: 0
server: cafe

Redirect headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
location: https://ad.doubleclick.net/activity;dc_pre=CMyIq52MwY0DFYQQaAgdo6wiTA;src=8188095;type=site;cat=ucs-g0;ord=367765031085;npa=0;auiddc=1541318537.1748261129;u1=%2F5LsOqOrd906PKtLlv8yw8A2;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KlA;gtm=45fe55l1v9189007292z86541836za200zb6541836;gcd=13l3l3l3l1l1;dma=0;dc_fmt=3;tag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~104481633~104481635;ptag_exp=101509157~103116026~103130498~103130500~103200004~103211513~103233427~103252644~103252646~104481633~104481635;epver=2;dc_random=1748261130298;~oref=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057?
pragma: no-cache
cross-origin-resource-policy: cross-origin
follow-only-when-prerender-shown: 1
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Mon, 26 May 2025 12:05:30 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: cafe

GET
H2

200

activityi;dc_pre=CLmHr52MwY0DFUQLiAkdFegL1w;src=8188095;type=site;cat=ucs-g0;ord=367765031085;npa=0;auiddc=1541318537.1748261129;u1=%2F5LsOqOrd906PKtLlv8yw8A2;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv... Show response
8188095.fls.doubleclick.net/ Frame 48D1
Redirect Chain

https://8188095.fls.doubleclick.net/activityi;src=8188095;type=site;cat=ucs-g0;ord=367765031085;npa=0;auiddc=1541318537.1748261129;u1=%2F5LsOqOrd906PKtLlv8yw8A2;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;ua...
https://8188095.fls.doubleclick.net/activityi;dc_pre=CLmHr52MwY0DFUQLiAkdFegL1w;src=8188095;type=site;cat=ucs-g0;ord=367765031085;npa=0;auiddc=1541318537.1748261129;u1=%2F5LsOqOrd906PKtLlv8yw8A2;ua...

1 KB
1 KB

156ms
149ms

Document
text/html

142.251.163.149
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://8188095.fls.doubleclick.net/activityi;dc_pre=CLmHr52MwY0DFUQLiAkdFegL1w;src=8188095;type=site;cat=ucs-g0;ord=367765031085;npa=0;auiddc=1541318537.1748261129;u1=%2F5LsOqOrd906PKtLlv8yw8A2;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KlA;gtm=45fe55l1v9189007292z86541836za200zb6541836;gcd=13l3l3l3l1l1;dma=0;dc_fmt=2;tag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~104481633~104481635;ptag_exp=101509157~103116026~103130498~103130500~103200004~103211513~103233427~103252644~103252646~104481633~104481635;epver=2;dc_random=1748261130298;_dc_test=1;~oref=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=DC-8188095&cx=c&gtm=45je55l1v879307084za200zb6541836&tag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~103289853~104481633~104481635

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.149 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f149.1e100.net

Software

cafe /

Resource Hash

48a22202d1f4576e189ce965121c1d64f94bc093446d3cee898d45b0612e031d

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://secure.everyaction.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 26 May 2025 12:05:30 GMT
expires: Mon, 26 May 2025 12:05:30 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 26 May 2025 12:05:30 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://8188095.fls.doubleclick.net/activityi;dc_pre=CLmHr52MwY0DFUQLiAkdFegL1w;src=8188095;type=site;cat=ucs-g0;ord=367765031085;npa=0;auiddc=1541318537.1748261129;u1=%2F5LsOqOrd906PKtLlv8yw8A2;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KlA;gtm=45fe55l1v9189007292z86541836za200zb6541836;gcd=13l3l3l3l1l1;dma=0;dc_fmt=2;tag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~104481633~104481635;ptag_exp=101509157~103116026~103130498~103130500~103200004~103211513~103233427~103252644~103252646~104481633~104481635;epver=2;dc_random=1748261130298;_dc_test=1;~oref=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 activityi;fledge=1;src=8188095;type=site;cat=ucs-g0;ord=367765031085;npa=0;auiddc=1541318537.1748261129;u1=%2F5LsOqOrd906PKtLlv8yw8A2;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0... Show response
td.doubleclick.net/td/fls/rul/ Frame 45E4 13 B
184 B 380ms
159ms Document
text/html 2607:f8b0:4004:c19::9c
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=8188095;type=site;cat=ucs-g0;ord=367765031085;npa=0;auiddc=1541318537.1748261129;u1=%2F5LsOqOrd906PKtLlv8yw8A2;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KlA;gtm=45fe55l1v9189007292z86541836za200zb6541836;gcd=13l3l3l3l1l1;dma=0;dc_fmt=9;tag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~104481633~104481635;ptag_exp=101509157~103116026~103130498~103130500~103200004~103211513~103233427~103252644~103252646~104481633~104481635;epver=2;dc_random=1748261130298;_dc_test=1;~oref=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057?

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c19::9c Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b633a587c652d02386c4f16f8c6f6aab7352d97f16367c3c40576214372dd628

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://secure.everyaction.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 26 May 2025 12:05:30 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

activity;dc_pre=CNyVq52MwY0DFTkDaAgdL6USQw;src=8188095;type=site;cat=ucs-d0;ord=6724603406122;npa=0;auiddc=1541318537.1748261129;u1=%2F5LsOqOrd906PKtLlv8yw8A2;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv... Show response
ad.doubleclick.net/
Redirect Chain

https://ad.doubleclick.net/activity;src=8188095;type=site;cat=ucs-d0;ord=6724603406122;npa=0;auiddc=1541318537.1748261129;u1=%2F5LsOqOrd906PKtLlv8yw8A2;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0...
https://ad.doubleclick.net/activity;dc_pre=CNyVq52MwY0DFTkDaAgdL6USQw;src=8188095;type=site;cat=ucs-d0;ord=6724603406122;npa=0;auiddc=1541318537.1748261129;u1=%2F5LsOqOrd906PKtLlv8yw8A2;uaa=;uab=;u...

42 B
68 B

203ms
177ms

Fetch
image/png

142.250.31.148
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/activity;dc_pre=CNyVq52MwY0DFTkDaAgdL6USQw;src=8188095;type=site;cat=ucs-d0;ord=6724603406122;npa=0;auiddc=1541318537.1748261129;u1=%2F5LsOqOrd906PKtLlv8yw8A2;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KlA;gtm=45fe55l1v9189007292z86541836za200zb6541836;gcd=13l3l3l3l1l1;dma=0;dc_fmt=3;tag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~104481633~104481635;ptag_exp=101509157~103116026~103130498~103130500~103200004~103211513~103233427~103252644~103252646~104481633~104481635;epver=2;dc_random=1748261130361;~oref=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057?

Requested by

Protocol

Server

142.250.31.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f148.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 42
date: Mon, 26 May 2025 12:05:30 GMT
attribution-reporting-register-trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"14522969478498092417"}],"aggregatable_trigger_data":[{"filters":[{"14":["6669010"]}],"key_piece":"0x8b09c2dc81883b54","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0x31a012fe1afbd624","not_filters":{"14":["6669010"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"34782020":34,"34782021":34,"34782022":34,"34782023":3345,"647437288":32,"647437289":32,"647437290":32,"647437291":3177,"914032284":65,"914032285":65,"914032286":65,"914032287":6356},"aggregation_coordinator_origin":"https://publickeyservice.msmt.gcp.privacysandboxservices.com","debug_key":"7061399168418703743","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"14522969478498092417","filters":[{"14":["6669010"],"source_type":["event"]}],"priority":"10","trigger_data":"1"},{"deduplication_key":"14522969478498092417","filters":[{"14":["6669010"],"source_type":["navigation"]}],"priority":"10","trigger_data":"6"},{"deduplication_key":"14522969478498092417","filters":[{"source_type":["event"]}],"priority":"0","trigger_data":"0"},{"deduplication_key":"14522969478498092417","filters":[{"source_type":["navigation"]}],"priority":"0","trigger_data":"7"}],"filters":{"8":["8188095"]}}
content-type: image/png
x-xss-protection: 0
server: cafe

Redirect headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
location: https://ad.doubleclick.net/activity;dc_pre=CNyVq52MwY0DFTkDaAgdL6USQw;src=8188095;type=site;cat=ucs-d0;ord=6724603406122;npa=0;auiddc=1541318537.1748261129;u1=%2F5LsOqOrd906PKtLlv8yw8A2;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KlA;gtm=45fe55l1v9189007292z86541836za200zb6541836;gcd=13l3l3l3l1l1;dma=0;dc_fmt=3;tag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~104481633~104481635;ptag_exp=101509157~103116026~103130498~103130500~103200004~103211513~103233427~103252644~103252646~104481633~104481635;epver=2;dc_random=1748261130361;~oref=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057?
pragma: no-cache
cross-origin-resource-policy: cross-origin
follow-only-when-prerender-shown: 1
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Mon, 26 May 2025 12:05:30 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: cafe

GET
H2

200

activityi;dc_pre=COaBr52MwY0DFUgtiAkdpMoFbw;src=8188095;type=site;cat=ucs-d0;ord=6724603406122;npa=0;auiddc=1541318537.1748261129;u1=%2F5LsOqOrd906PKtLlv8yw8A2;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uap... Show response
8188095.fls.doubleclick.net/ Frame F77D
Redirect Chain

https://8188095.fls.doubleclick.net/activityi;src=8188095;type=site;cat=ucs-d0;ord=6724603406122;npa=0;auiddc=1541318537.1748261129;u1=%2F5LsOqOrd906PKtLlv8yw8A2;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;u...
https://8188095.fls.doubleclick.net/activityi;dc_pre=COaBr52MwY0DFUgtiAkdpMoFbw;src=8188095;type=site;cat=ucs-d0;ord=6724603406122;npa=0;auiddc=1541318537.1748261129;u1=%2F5LsOqOrd906PKtLlv8yw8A2;u...

1 KB
1 KB

146ms
141ms

Document
text/html

142.251.163.149
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://8188095.fls.doubleclick.net/activityi;dc_pre=COaBr52MwY0DFUgtiAkdpMoFbw;src=8188095;type=site;cat=ucs-d0;ord=6724603406122;npa=0;auiddc=1541318537.1748261129;u1=%2F5LsOqOrd906PKtLlv8yw8A2;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KlA;gtm=45fe55l1v9189007292z86541836za200zb6541836;gcd=13l3l3l3l1l1;dma=0;dc_fmt=2;tag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~104481633~104481635;ptag_exp=101509157~103116026~103130498~103130500~103200004~103211513~103233427~103252644~103252646~104481633~104481635;epver=2;dc_random=1748261130361;_dc_test=1;~oref=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057?

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.149 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f149.1e100.net

Software

cafe /

Resource Hash

abcd7646a98f6996af668219cd6b70f496dee4efc5f1e854b71acaf350dcca2c

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://secure.everyaction.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 727
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 26 May 2025 12:05:30 GMT
expires: Mon, 26 May 2025 12:05:30 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 26 May 2025 12:05:30 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://8188095.fls.doubleclick.net/activityi;dc_pre=COaBr52MwY0DFUgtiAkdpMoFbw;src=8188095;type=site;cat=ucs-d0;ord=6724603406122;npa=0;auiddc=1541318537.1748261129;u1=%2F5LsOqOrd906PKtLlv8yw8A2;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KlA;gtm=45fe55l1v9189007292z86541836za200zb6541836;gcd=13l3l3l3l1l1;dma=0;dc_fmt=2;tag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~104481633~104481635;ptag_exp=101509157~103116026~103130498~103130500~103200004~103211513~103233427~103252644~103252646~104481633~104481635;epver=2;dc_random=1748261130361;_dc_test=1;~oref=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 activityi;fledge=1;src=8188095;type=site;cat=ucs-d0;ord=6724603406122;npa=0;auiddc=1541318537.1748261129;u1=%2F5LsOqOrd906PKtLlv8yw8A2;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=... Show response
td.doubleclick.net/td/fls/rul/ Frame 5060 13 B
184 B 205ms
153ms Document
text/html 2607:f8b0:4004:c19::9c
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=8188095;type=site;cat=ucs-d0;ord=6724603406122;npa=0;auiddc=1541318537.1748261129;u1=%2F5LsOqOrd906PKtLlv8yw8A2;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KlA;gtm=45fe55l1v9189007292z86541836za200zb6541836;gcd=13l3l3l3l1l1;dma=0;dc_fmt=9;tag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~104481633~104481635;ptag_exp=101509157~103116026~103130498~103130500~103200004~103211513~103233427~103252644~103252646~104481633~104481635;epver=2;dc_random=1748261130361;_dc_test=1;~oref=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057?

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c19::9c Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b633a587c652d02386c4f16f8c6f6aab7352d97f16367c3c40576214372dd628

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://secure.everyaction.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 26 May 2025 12:05:30 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1071979118/ 4 KB
2 KB 410ms
153ms Script
text/javascript 142.251.111.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1071979118/?random=1748261130394&cv=11&fst=1748261130394&bg=ffffff&guid=ON&async=1&gtm=45be55l1v9210099727z86541836za200zb6541836&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~102938614~103116026~103130498~103130500~103200004~103233427~103252644~103252646~104481633~104481635&ptag_exp=101509157~103116026~103130498~103130500~103200004~103211513~103233427~103252644~103252646~104481633~104481635&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057&hn=www.googleadservices.com&frm=0&tiba=Defend%20Science%20from%20Trump%E2%80%99s%20Attacks.%20Donate%20Now.&npa=0&pscdl=noapi&auid=1541318537.1748261129&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&_tu=Cg&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-1071979118&cx=c&gtm=45je55l1v879307084za200zb6541836&tag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~103289853~104481633~104481635

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f155.1e100.net

Software

cafe /

Resource Hash

1bcce5e07b4265e2fb15efb5286373811ca7a7e936aa068005963fc9c34cd0e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2250
date: Mon, 26 May 2025 12:05:30 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 1071979118 Show response
td.doubleclick.net/td/rul/ Frame 76BC 13 B
176 B 202ms
157ms Document
text/html 2607:f8b0:4004:c19::9c
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://td.doubleclick.net/td/rul/1071979118?random=1748261130394&cv=11&fst=1748261130394&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be55l1v9210099727z86541836za200zb6541836&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~102938614~103116026~103130498~103130500~103200004~103233427~103252644~103252646~104481633~104481635&ptag_exp=101509157~103116026~103130498~103130500~103200004~103211513~103233427~103252644~103252646~104481633~104481635&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057&hn=www.googleadservices.com&frm=0&tiba=Defend%20Science%20from%20Trump%E2%80%99s%20Attacks.%20Donate%20Now.&npa=0&pscdl=noapi&auid=1541318537.1748261129&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&_tu=Cg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c19::9c Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b633a587c652d02386c4f16f8c6f6aab7352d97f16367c3c40576214372dd628

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://secure.everyaction.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 26 May 2025 12:05:30 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 sp.pl
sp.analytics.yahoo.com/ 43 B
677 B 454ms
149ms Image
image/gif 54.160.143.175
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Mon%2C%2026%20May%202025%2012%3A05%3A30%20GMT&n=10&b=Defend%20Science%20from%20Trump%E2%80%99s%20Attacks.%20Donate%20Now.&.yp=10095888&f=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057&enc=UTF-8&yv=1.16.6&tagmgr=gtm

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

54.160.143.175 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS/9.1.10.165 /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
cache-control: no-cache, no-store, private, must-revalidate
pragma: no-cache
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-content-type-options: nosniff
via: http/1.1 traffic_server (ApacheTrafficServer/9.1.10.165)
expires: Mon, 26 May 2025 12:05:30 GMT
accept-ranges: bytes
referrer-policy: strict-origin-when-cross-origin
content-length: 43
date: Mon, 26 May 2025 12:05:30 GMT
content-type: image/gif
server: ATS/9.1.10.165
x-frame-options: DENY

GET
H2

200

pixel;r=271619514;labels=_fp.event.Default;rf=0;a=p-8w7tSVuzV_3NU;url=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSs...
pixel-ssn.quantserve.com/
Redirect Chain

https://pixel.quantserve.com/pixel;r=271619514;labels=_fp.event.Default;rf=0;a=p-8w7tSVuzV_3NU;url=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9A...
https://pixel-ssn.quantserve.com/pixel;r=271619514;labels=_fp.event.Default;rf=0;a=p-8w7tSVuzV_3NU;url=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3o...

43 B
364 B

452ms
141ms

Image
image/gif

192.184.68.254
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://pixel-ssn.quantserve.com/pixel;r=271619514;labels=_fp.event.Default;rf=0;a=p-8w7tSVuzV_3NU;url=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057;ns=0;ce=1;qjs=1;qv=69fd865d-20250501105756;ref=;dst=0;et=1748261130523;tzo=600;ogl=site_name.Union%20of%20Concerned%20Scientists%2Cimage.https%3A%2F%2Fnvlupin%252Eblob%252Ecore%252Ewindows%252Enet%2Fimages%2Fvan%2FUCS%2FUCS%2F1%2F58097%2Fimages%2FUCS%2520lo%2Curl.https%3A%2F%2Fsecure%252Eucs%252Eorg%2Fa%2F05-2025-may-current%2Ctitle.Help%20defend%20science!%2Ctype.article%2Cdescription.The%20Union%20of%20Concerned%20Scientists%20puts%20rigorous%252C%20independent%20science%20to%20work%20to%20;d=everyaction.com;uht=2;fpan=1;fpa=P1-a13d9bac-54d8-47f2-9d97-3be734bb3b0a;pbc=;_ses=c74017c7-3635-4300-9072-31be443ab990;_seg=0;_ss=1;gdpr=0;mdl=;dip=aad40893-260a-4b77-9645-b9390d744a09

Requested by

Protocol

Server

192.184.68.254 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

013042932688da7c3b9af64ecfffb3c3e8ef3aaa0881d57c192df167f1b2a9b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

strict-transport-security: max-age=86400
cache-control: private, no-cache, no-store, proxy-revalidate
pragma: no-cache
expires: Fri, 04 Aug 1978 12:00:00 GMT
content-length: 43
date: Mon, 26 May 2025 12:05:31 GMT
attribution-reporting-register-trigger: {"event_trigger_data":[{"filters":[{"label":["XIs9cXuHhiR3L4rY6hRZdQ=="],"pcode":["p-8w7tSVuzV_3NU"]}],"trigger_data":"1"}]}
content-type: image/gif

Redirect headers

strict-transport-security: max-age=86400
cache-control: private, no-cache, no-store, proxy-revalidate
location: https://pixel-ssn.quantserve.com/pixel;r=271619514;labels=_fp.event.Default;rf=0;a=p-8w7tSVuzV_3NU;url=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057;ns=0;ce=1;qjs=1;qv=69fd865d-20250501105756;ref=;dst=0;et=1748261130523;tzo=600;ogl=site_name.Union%20of%20Concerned%20Scientists%2Cimage.https%3A%2F%2Fnvlupin%252Eblob%252Ecore%252Ewindows%252Enet%2Fimages%2Fvan%2FUCS%2FUCS%2F1%2F58097%2Fimages%2FUCS%2520lo%2Curl.https%3A%2F%2Fsecure%252Eucs%252Eorg%2Fa%2F05-2025-may-current%2Ctitle.Help%20defend%20science!%2Ctype.article%2Cdescription.The%20Union%20of%20Concerned%20Scientists%20puts%20rigorous%252C%20independent%20science%20to%20work%20to%20;d=everyaction.com;uht=2;fpan=1;fpa=P1-a13d9bac-54d8-47f2-9d97-3be734bb3b0a;pbc=;_ses=c74017c7-3635-4300-9072-31be443ab990;_seg=0;_ss=1;gdpr=0;mdl=;dip=aad40893-260a-4b77-9645-b9390d744a09
pragma: no-cache
expires: Fri, 04 Aug 1978 12:00:00 GMT
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
date: Mon, 26 May 2025 12:05:30 GMT
attribution-reporting-register-trigger: {"event_trigger_data":[{"filters":[{"label":["XIs9cXuHhiR3L4rY6hRZdQ=="],"pcode":["p-8w7tSVuzV_3NU"]}],"trigger_data":"1"}]}
content-type: image/gif

GET
H3 200 /
www.facebook.com/privacy_sandbox/topics/registration/ 67 B
0 336ms
178ms Fetch
image/png 31.13.66.35
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://www.facebook.com/privacy_sandbox/topics/registration/?id=625465517575530

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/b/ai.2.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.66.35 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'nonce-MzWhCCwt' blob: data: 'self' connect.facebook.net 'wasm-unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;child-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net accounts.meta.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;manifest-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;object-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

access-control-expose-headers: X-FB-Debug, X-Loader-Length, X-Stack, Error-MID
content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7508724379991826563&cpp=C3&cv=1023187099&st=1748261130801"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
observe-browsing-topics: ?1
expires: Sat, 01 Jan 2000 00:00:00 GMT
access-control-allow-methods: OPTIONS
alt-svc: h3=":443"; ma=86400
date: Mon, 26 May 2025 12:05:30 GMT
content-type: image/png
vary: Origin, Accept-Encoding
x-fb-debug: 4hLWcq3HvrdFixm0ogD8IODscypsP3+ucy6oYbQyv2938FHoYuzzIQNbjQMwt14EsEFDskqm9RVsCboeU+8hgw==
priority: u=1,i
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7508724379991826563&cpp=C3&cv=1023187099&st=1748261130801", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-MzWhCCwt' blob: data: 'self' connect.facebook.net 'wasm-unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: GOOD; q=0.7, rtt=123, rtx=0, c=24, mss=1232, tbw=8705, tp=13, tpl=0, uplat=32, ullat=0
cross-origin-opener-policy: same-origin-allow-popups
pragma: no-cache
cross-origin-resource-policy: same-origin
access-control-allow-credentials: true
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top
access-control-allow-origin: *
cross-origin-opener-policy-report-only: restrict-properties;report-to="coop_report"
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H3 200 /
www.facebook.com/tr/ 0
16 B 287ms
127ms Image
text/plain 31.13.66.35
FACEBOOK

General

Check archive.org

Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=625465517575530&ev=PageView&dl=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057&rl=&if=false&ts=1748261130558&sw=1600&sh=1200&v=2.9.203&r=stable&ec=0&o=12318&fbp=fb.1.1748261130545.966910404337282717&ler=empty&cdl=API_unavailable&it=1748261130000&coo=false&exp=k2&rqm=GET

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.66.35 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: GOOD; q=0.7, rtt=121, rtx=0, c=24, mss=1232, tbw=9169, tp=18, tpl=0, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Mon, 26 May 2025 12:05:30 GMT
content-type: text/plain
server: proxygen-bolt
priority: u=3,i

GET
H3 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
193 B 440ms
283ms Image
image/png 31.13.66.35
FACEBOOK

General

Check archive.org

Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=625465517575530&ev=PageView&dl=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057&rl=&if=false&ts=1748261130558&sw=1600&sh=1200&v=2.9.203&r=stable&ec=0&o=12318&fbp=fb.1.1748261130545.966910404337282717&ler=empty&cdl=API_unavailable&it=1748261130000&coo=false&exp=k2&rqm=FGET

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.66.35 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'nonce-pDWEoOou' blob: data: 'self' connect.facebook.net 'wasm-unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;child-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net accounts.meta.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;manifest-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;object-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7508724378870991387&cpp=C3&cv=1023187099&st=1748261130795"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 26 May 2025 12:05:30 GMT
content-type: image/png
vary: Accept-Encoding
x-fb-debug: REV1B+S5bpU+2ykUjxbpiiLZwfm4RKImrDI96pHo6r9XHVEmQhJY4T37OmLtOWuPuNfmpOGAA/MckVrPwZ31mA==
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7508724378870991387&cpp=C3&cv=1023187099&st=1748261130795", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-pDWEoOou' blob: data: 'self' connect.facebook.net 'wasm-unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: GOOD; q=0.7, rtt=122, rtx=0, c=27, mss=1232, tbw=13173, tp=27, tpl=0, uplat=162, ullat=0
cross-origin-opener-policy: same-origin-allow-popups
pragma: no-cache
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H3 200 /
www.facebook.com/tr/ 0
16 B 288ms
135ms Image
text/plain 31.13.66.35
FACEBOOK

General

Check archive.org

Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=625465517575530&ev=ViewContent&dl=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057&rl=&if=false&ts=1748261130563&cd[page_type]=DonationPage&sw=1600&sh=1200&v=2.9.203&r=stable&ec=1&o=12318&fbp=fb.1.1748261130545.966910404337282717&ler=empty&cdl=API_unavailable&it=1748261130000&coo=false&exp=k2&rqm=GET

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.66.35 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: GOOD; q=0.7, rtt=121, rtx=0, c=24, mss=1232, tbw=8753, tp=14, tpl=0, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Mon, 26 May 2025 12:05:30 GMT
content-type: text/plain
server: proxygen-bolt
priority: u=3,i

GET
H3 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
198 B 422ms
274ms Image
image/png 31.13.66.35
FACEBOOK

General

Check archive.org

Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=625465517575530&ev=ViewContent&dl=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057&rl=&if=false&ts=1748261130563&cd[page_type]=DonationPage&sw=1600&sh=1200&v=2.9.203&r=stable&ec=1&o=12318&fbp=fb.1.1748261130545.966910404337282717&ler=empty&cdl=API_unavailable&it=1748261130000&coo=false&exp=k2&rqm=FGET

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.66.35 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'nonce-2x7pVbRb' blob: data: 'self' connect.facebook.net 'wasm-unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;child-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net accounts.meta.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;manifest-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;object-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7508724379051601111&cpp=C3&cv=1023187099&st=1748261130789"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
attribution-reporting-register-trigger: {"event_trigger_data":[{"trigger_data":"0"}],"aggregatable_trigger_data":[],"aggregatable_values":{},"aggregatable_source_registration_time":"exclude","filters":{"3":["2406620272770370"]},"debug_reporting":true,"debug_key":"2433847535889089155"}
date: Mon, 26 May 2025 12:05:30 GMT
content-type: image/png
vary: Accept-Encoding
x-fb-debug: 2pNE0toG+enTFLO/bmP/TTgXzjpnmtRXOATf1vGhpQDpP8g9paGrOutUmFPkddiJIK3o+XStnal/kKGrz/R6gA==
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7508724379051601111&cpp=C3&cv=1023187099&st=1748261130789", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-2x7pVbRb' blob: data: 'self' connect.facebook.net 'wasm-unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: GOOD; q=0.7, rtt=122, rtx=0, c=27, mss=1232, tbw=9509, tp=24, tpl=0, uplat=143, ullat=0
cross-origin-opener-policy: same-origin-allow-popups
pragma: no-cache
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2

200

sync
pippio.com/api/ Frame A107
Redirect Chain

https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=2809753636385369760&referrer=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9Am...
https://p.rfihub.com/cm?pub=39342&in=0&userid=5d1c07c8-c611-429e-8faa-b55eb5bcbf83%3A1748261130.991296&forward=https%3A//i.liadm.com/s/56409%3Fbidder_id%3D200442%26bidder_uuid%3D5d1c07c8-c611-429e-...
https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=969470238291792301&referrer={encSite}&forward=https%3A%2F%2Fi.liadm.com%2Fs%2F56409%3Fbidder_id%3D200442%26bidder_uuid%3D5d1c07c...
https://i.liadm.com/s/56409?bidder_id=200442&bidder_uuid=5d1c07c8-c611-429e-8faa-b55eb5bcbf83%3A1748261130.991296&pid=500040&it=1&iv=5d1c07c8-c611-429e-8faa-b55eb5bcbf83%3A1748261130.991296&_=17482...
https://pippio.com/api/sync?it=1&pid=500040&_=1748261130.9921808&iv=5d1c07c8-c611-429e-8faa-b55eb5bcbf83:1748261130.991296

42 B
408 B

389ms
115ms

Image
image/gif

107.178.254.65
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://pippio.com/api/sync?it=1&pid=500040&_=1748261130.9921808&iv=5d1c07c8-c611-429e-8faa-b55eb5bcbf83:1748261130.991296
Protocol: H2
Server: 107.178.254.65 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 65.254.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://20802623p.rfihub.com/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Mon, 26 May 2025 12:05:32 GMT
content-type: image/gif

Redirect headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Location: https://pippio.com/api/sync?it=1&pid=500040&_=1748261130.9921808&iv=5d1c07c8-c611-429e-8faa-b55eb5bcbf83:1748261130.991296
Content-Length: 0
Date: Mon, 26 May 2025 12:05:31 GMT
trace-id: 3ca92feda38f5e34
Request-Time: 1
Connection: keep-alive

GET
H2

200

sync
pippio.com/api/ Frame A107
Redirect Chain

https://cm.g.doubleclick.net/pixel?&in=0&google_nid=zeta_interactive&google_cm=&google_sc=&google_hm=MjgwOTc1MzYzNjM4NTM2OTc2MA==&forward=
https://cm.g.doubleclick.net/pixel?in=0&google_nid=zeta_interactive&google_cm=&google_sc=&google_hm=MjgwOTc1MzYzNjM4NTM2OTc2MA==&forward=&google_tc=
https://a.rfihub.com/cm?pub=445&in=0&forward=&google_error=15
https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=969470238291792301&referrer={encSite}&forward=
https://p.rfihub.com/cm?pub=39342&in=0&userid=5d1c07c8-c611-429e-8faa-b55eb5bcbf83%3A1748261130.991296&forward=https%3A//i.liadm.com/s/56409%3Fbidder_id%3D200442%26bidder_uuid%3D5d1c07c8-c611-429e-...
https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=969470238291792301&referrer={encSite}&forward=https%3A%2F%2Fi.liadm.com%2Fs%2F56409%3Fbidder_id%3D200442%26bidder_uuid%3D5d1c07c...
https://i.liadm.com/s/56409?bidder_id=200442&bidder_uuid=5d1c07c8-c611-429e-8faa-b55eb5bcbf83%3A1748261130.991296&pid=500040&it=1&iv=5d1c07c8-c611-429e-8faa-b55eb5bcbf83%3A1748261130.991296&_=17482...
https://pippio.com/api/sync?it=1&pid=500040&_=1748261131.719812&iv=5d1c07c8-c611-429e-8faa-b55eb5bcbf83:1748261130.991296

42 B
169 B

116ms
115ms

Image
image/gif

107.178.254.65
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://pippio.com/api/sync?it=1&pid=500040&_=1748261131.719812&iv=5d1c07c8-c611-429e-8faa-b55eb5bcbf83:1748261130.991296
Protocol: H2
Server: 107.178.254.65 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 65.254.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://20802623p.rfihub.com/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Mon, 26 May 2025 12:05:32 GMT
content-type: image/gif

Redirect headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Location: https://pippio.com/api/sync?it=1&pid=500040&_=1748261131.719812&iv=5d1c07c8-c611-429e-8faa-b55eb5bcbf83:1748261130.991296
Content-Length: 0
Date: Mon, 26 May 2025 12:05:32 GMT
trace-id: a1736c985c2d91fa
Request-Time: 1
Connection: keep-alive

GET
H2

200

bounce
ib.adnxs.com/ Frame A107
Redirect Chain

https://ib.adnxs.com/setuid?entity=18&code=2809753636385369760
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D18%26code%3D2809753636385369760

43 B
1 KB

152ms
142ms

Image
image/gif

68.67.160.75
ASN-APPNEX

General

Check archive.org

Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D18%26code%3D2809753636385369760

Requested by

Protocol

Server

68.67.160.75 Colonia, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://20802623p.rfihub.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.246; 162.245.206.246; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 1fd6de60-c4d2-4a3e-9292-3defb265958c
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Mon, 26 May 2025 12:05:31 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.23.4

Redirect headers

cache-control: no-store, no-cache, private
location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D18%26code%3D2809753636385369760
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 162.245.206.246; 162.245.206.246; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: 54b39560-f8ac-4c45-9a77-b8f9c592561e
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Mon, 26 May 2025 12:05:30 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

demconf.jpg
dpm.demdex.net/ Frame A107
Redirect Chain

https://dpm.demdex.net/ibs:dpid=1121&dpuuid=2809753636385369760&redir=
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=2809753636385369760&redir=

42 B
716 B

125ms
124ms

Image
image/gif

35.172.91.125
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=2809753636385369760&redir=

Requested by

Protocol

Server

35.172.91.125 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-172-91-125.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://20802623p.rfihub.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-va6-2-v076-06d1d63cd.edge-va6.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: 5Wq6F9moTio=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Mon, 26 May 2025 12:05:31 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=2809753636385369760&redir=
dcs: dcs-prod-va6-1-v076-0525d506c.edge-va6.demdex.com 0 ms
pragma: no-cache
x-tid: 3RrTBG2hQx4=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Mon, 26 May 2025 12:05:30 GMT

GET
H2 200 Pug
image2.pubmatic.com/AdServer/ Frame A107 42 B
448 B 412ms
128ms Image
image/gif 8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw==&piggybackCookie=2809753636385369760&r=
Requested by: Host: secure.everyaction.com
URL: https://secure.everyaction.com/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2fuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3d&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://20802623p.rfihub.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Mon, 26 May 2025 12:05:30 GMT
content-type: image/gif; charset=utf-8
server: nginx

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame A107
Redirect Chain

https://us-u.openx.net/w/1.0/sd?id=537073062&val=2809753636385369760&r=
https://us-u.openx.net/w/1.0/sd?cc=1&id=537073062&val=2809753636385369760&r=

43 B
171 B

113ms
97ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?cc=1&id=537073062&val=2809753636385369760&r=
Requested by: Host: secure.everyaction.com
URL: https://secure.everyaction.com/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2fuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3d&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://20802623p.rfihub.com/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.246
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Mon, 26 May 2025 12:05:30 GMT
content-type: image/gif
vary: Accept

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?cc=1&id=537073062&val=2809753636385369760&r=
x-forwarded-for: 162.245.206.246
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Mon, 26 May 2025 12:05:30 GMT
content-type: text/plain; charset=utf-8
vary: Origin

GET
H/1.1

200
OK

/
ps.eyeota.net/match/bounce/ Frame A107
Redirect Chain

https://p.rfihub.com/cm?pub=24472&in=1
https://ps.eyeota.net/match?uid=2809753636385369760&bid=omt9pi0
https://ps.eyeota.net/match/bounce/?uid=2809753636385369760&bid=omt9pi0

70 B
440 B

128ms
127ms

Image
image/gif

54.156.26.12
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match/bounce/?uid=2809753636385369760&bid=omt9pi0
Protocol: HTTP/1.1
Server: 54.156.26.12 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-156-26-12.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://20802623p.rfihub.com/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Mon, 26 May 2025 12:05:32 GMT
Content-Type: image/gif

Redirect headers

Location: /match/bounce/?uid=2809753636385369760&bid=omt9pi0
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Mon, 26 May 2025 12:05:31 GMT

GET
H2 200 cksync.php
contextual.media.net/ Frame A107 103 B
567 B 549ms
178ms Image
image/gif 23.45.148.30
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=3&type=rkt&ovsid=2809753636385369760

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.45.148.30 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-45-148-30.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

ab463a9907ed230b168209510175be2f0842209d4839c44367217d7c43a69336

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://20802623p.rfihub.com/

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=0, no-cache, no-store
timing-allow-origin: *
pragma: no-cache
expires: Mon, 26 May 2025 12:05:31 GMT
x-mnet-hl2: E
alt-svc: h3=":443"; ma=93600
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
content-length: 103
date: Mon, 26 May 2025 12:05:31 GMT
content-type: image/gif
server: Apache

GET
H2 200 /
bpi.rtactivate.com/tag/ Frame A107 43 B
108 B 650ms
283ms Image
image/gif 54.146.62.102
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://bpi.rtactivate.com/tag/?id=11017&user_id=2809753636385369760
Requested by: Host: secure.everyaction.com
URL: https://secure.everyaction.com/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2fuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3d&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.146.62.102 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-146-62-102.compute-1.amazonaws.com
Software: awselb/2.0 /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://20802623p.rfihub.com/

Response headers

content-length: 43
date: Mon, 26 May 2025 12:05:31 GMT
content-type: image/gif
server: awselb/2.0

GET
H2

204

sync
thrtle.com/ Frame A107
Redirect Chain

https://i.liadm.com/s/90096?bidder_id=246506&bidder_uuid=2809753636385369760
https://i.liadm.com/s/90096?bidder_id=246506&bidder_uuid=2809753636385369760&_li_chk=true&previous_uuid=13b4e4d51d9d414dbf926f321c98059e
https://thrtle.com/sync?vxii_pid=7006&vxii_pdid=13b4e4d5-1d9d-414d-bf92-6f321c98059e&us_privacy=1YN-
https://thrtle.com/sync?_reach=1&vxii_pdid=13b4e4d5-1d9d-414d-bf92-6f321c98059e&vxii_pid=12&vxii_pid1=7006&vxii_rcid=458f4125-2974-473f-987a-76d7a954cb00&vxii_rmax=3
https://ib.adnxs.com/getuid?https%3A%2F%2Fthrtle.com%2Fsync%3Fvxii_pid%3D5006%26vxii_pdid%3D%24UID%26vxii_ts%3D1%26_t%3D1748261131%26_reach%3D1
https://thrtle.com/sync?vxii_pid=5006&vxii_pdid=1027157301885763985&vxii_ts=1&_t=1748261131&_reach=1

0
466 B

130ms
129ms

Image
text/plain

52.45.182.175
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://thrtle.com/sync?vxii_pid=5006&vxii_pdid=1027157301885763985&vxii_ts=1&_t=1748261131&_reach=1
Protocol: H2
Server: 52.45.182.175 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-45-182-175.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://20802623p.rfihub.com/

Response headers

date: Mon, 26 May 2025 12:05:32 GMT
p3p: CP="NOI OUR BUS UNI COM NAV"

Redirect headers

cache-control: no-store, no-cache, private
location: https://thrtle.com/sync?vxii_pid=5006&vxii_pdid=1027157301885763985&vxii_ts=1&_t=1748261131&_reach=1
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.246; 162.245.206.246; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: ccd89d82-94b5-4dc9-8961-c2a39edd73eb
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Mon, 26 May 2025 12:05:32 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame A107
Redirect Chain

https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=2809753636385369760&forward=
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=2809753636385369760&forward=&C=1

43 B
326 B

92ms
92ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=2809753636385369760&forward=&C=1
Requested by: Host: secure.everyaction.com
URL: https://secure.everyaction.com/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2fuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3d&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057
Protocol: H2
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://20802623p.rfihub.com/

Response headers

cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NGJtWYASr7n6fshsBjkNTBYWUhU1jh3p8tvDL89YGLzJQm67s0coNrM3L1WyS4pB8qfMUEQ%2B6MMX8YXXRordfwz9bXDHrc7j0VOj4Bh0yvelLjQ3i2gvsvpz9F2yE%2F%2FKSWCljQIAJjV9eg%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 945d2426b9807d65-LAX
expires: 0
alt-svc: h3=":443"; ma=86400
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Mon, 26 May 2025 12:05:31 GMT
content-type: image/gif
vary: Accept-Encoding
server: cloudflare

Redirect headers

cache-control: no-cache
location: /rum?cm_dsp_id=57&external_user_id=2809753636385369760&forward=&C=1
cf-cache-status: DYNAMIC
pragma: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gTOsBPvpSZwez%2FQBBwnjzJ%2BcJZF9zWRpj2ZDbp5h96gCxnGGzAeTNwF8xnhZWjrbZ2%2BRW0B%2B8jvgXrIPHXk7%2B1TrgGz3U7VgXGmCuEpEcTOjRuaanRTcCg%2BlRAybtOPmIHBEvBUmEaXHrA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 945d242638e87d65-LAX
expires: 0
alt-svc: h3=":443"; ma=86400
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Mon, 26 May 2025 12:05:31 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 360947.gif
idsync.rlcdn.com/ Frame A107 42 B
439 B 279ms
112ms Image
image/gif 35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://idsync.rlcdn.com/360947.gif?partner_uid=2809753636385369760
Requested by: Host: secure.everyaction.com
URL: https://secure.everyaction.com/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2fuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3d&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://20802623p.rfihub.com/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Mon, 26 May 2025 12:05:31 GMT
content-type: image/gif

GET
H2 200 sync
partners.tremorhub.com/ Frame A107 43 B
174 B 1166ms
902ms Image
image/gif 2600:1f10:4ce4:4a02:7461:ccaa:6922:447a
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://partners.tremorhub.com/sync?UIRF=2809753636385369760&r=w9YdmX6pbs9Z
Requested by: Host: secure.everyaction.com
URL: https://secure.everyaction.com/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2fuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3d&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f10:4ce4:4a02:7461:ccaa:6922:447a Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://20802623p.rfihub.com/

Response headers

p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date: Mon, 26 May 2025 12:05:31 GMT
content-type: image/gif
server: nginx

GET
H2 200 g.pixel
aa.agkn.com/adscores/ Frame A107 43 B
528 B 428ms
144ms Image
image/gif 3.161.213.57
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://aa.agkn.com/adscores/g.pixel?sid=9212192898&rf=2809753636385369760
Requested by: Host: secure.everyaction.com
URL: https://secure.everyaction.com/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2fuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3d&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.213.57 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-213-57.yul62.r.cloudfront.net
Software: AAWebServer /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://20802623p.rfihub.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-methods: GET, OPTIONS
via: 1.1 480d73d26133a5d3268f9cfc7c99d59c.cloudfront.net (CloudFront)
expires: 0
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 43
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Mon, 26 May 2025 12:05:31 GMT
content-type: image/gif
x-amz-cf-pop: YUL62-P1
server: AAWebServer
x-amz-cf-id: MYQznaNLN9f7cEhzCX7LKQYWaygZB-78LJeiugUbko-gD0hQrI2WSQ==
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 sync
x.bidswitch.net/ Frame A107 43 B
183 B 447ms
133ms Image
image/gif 35.211.202.130
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/sync?dsp_id=119&user_id=2809753636385369760&expires=30&gdpr={GDPR}&gdpr_consent={GDPR_CONSENT_469}&gdpr_pd={GDPR_PD}
Requested by: Host: secure.everyaction.com
URL: https://secure.everyaction.com/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2fuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3d&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.211.202.130 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 130.202.211.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://20802623p.rfihub.com/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Mon, 26 May 2025 12:05:31 GMT
content-type: image/gif

GET
H2

200

/
sync-tm.everesttech.net/ct/upi/pid/Mlpt2JaG/ Frame A107
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D&_test=aDRZCwASlngfmwBh

85 B
150 B

224ms
223ms

Image
image/png

151.101.194.49
FASTLY

General

Check archive.org

Download Go to Show image

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D&_test=aDRZCwASlngfmwBh
Protocol: H2
Server: 151.101.194.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://20802623p.rfihub.com/

Response headers

x-robots-tag: noindex
cache-control: no-cache
x-timer: S1748261132.940530,VS0,VE0
age: 3269
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
x-cache: HIT
content-length: 85
date: Mon, 26 May 2025 12:05:31 GMT
content-type: image/png
x-served-by: cache-toj-leto2350045-TOJ
server: Jetty(9.4.35.v20201120)
x-cache-hits: 32758

Redirect headers

x-robots-tag: noindex
cache-control: no-cache
location: https://sync-tm.everesttech.net/ct/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D&_test=aDRZCwASlngfmwBh
x-timer: S1748261132.614568,VS0,VE95
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
content-length: 0
date: Mon, 26 May 2025 12:05:31 GMT
x-served-by: cache-toj-leto2350045-TOJ
server: Jetty(9.4.35.v20201120)
x-cache-hits: 0

GET
H3

200

/
www.google.com/pagead/1p-conversion/994113961/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/994113961/?random=1669570956&cv=11&fst=1748261130132&bg=ffffff&guid=ON&async=1&gcl_ctr=1&gtm=45be55l1z86541836za200zb6541836&gcd=13l...
https://www.google.com/pagead/1p-conversion/994113961/?random=1669570956&cv=11&fst=1748261130132&bg=ffffff&guid=ON&async=1&gcl_ctr=1&gtm=45be55l1z86541836za200zb6541836&gcd=13l3l3l3l1l1&dma=0&tag_e...

42 B
64 B

151ms
150ms

Image
image/gif

172.253.63.105
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://www.google.com/pagead/1p-conversion/994113961/?random=1669570956&cv=11&fst=1748261130132&bg=ffffff&guid=ON&async=1&gcl_ctr=1&gtm=45be55l1z86541836za200zb6541836&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~103116026~103130495~103130497~103200004~103233427~103252644~103252646~104481633~104481635&ptag_exp=101509157~103116026~103130498~103130500~103200004~103211513~103233427~103252644~103252646~104481633~104481635&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057&label=80uVCNHT54MBEKnzg9oD&hn=www.googleadservices.com&frm=0&tiba=Defend%20Science%20from%20Trump%E2%80%99s%20Attacks.%20Donate%20Now.&value=0&npa=0&pscdl=noapi&auid=1541318537.1748261129&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_m=%23validators%3E%3Anth-child(2)%3E%3Anth-child(1)*A%3Atrue%3A17%3Afalse*1&ec_sel=%23validators%3E%3Anth-child(2)%3E%3Anth-child(1)&ec_meta=A%3Atrue%3A17%3Afalse&ec_lat=8&ec_s=1&fledge=1&capi=1&_tu=Kg&fmt=3&ct_cookie_present=false&crd=CPLOsQIIobixAgixwbECCLDBsQIIscOxAgiKxbECCMLJsQIItMaxAgiQybECCMLPsQIIw8-xAgjTxbECCOvMsQIIz86xAgikz7ECCP7OsQII1c-xAgiX1LECSid0cmlnZ2VyLCBldmVudC1zb3VyY2U7bmF2aWdhdGlvbi1zb3VyY2VaAwoBAWIECgICAw&pscrd=IhMI9N6cnYzBjQMVT3NHAR1CXg3dMgwIA2IICAAQABgAIAAyDAgEYggIABAAGAAgADIMCAdiCAgAEAAYACAAMgwICGIICAAQABgAIAAyDAgJYggIABAAGAAgADIMCApiCAgAEAAYACAAMgwIAmIICAAQABgAIAAyDAgLYggIABAAGAAgADIMCBViCAgAEAAYACAAMgwIH2IICAAQABgAIAAyDAgTYggIABAAGAAgADIMCBJiCAgAEAAYACAAOh9odHRwczovL3NlY3VyZS5ldmVyeWFjdGlvbi5jb20vQldDaEVJOEtMUXdRWVE4TzZsOTY2SnQ1bmZBUklzQUJJQXpkT095alFieXVvSDNHVWJzOGRtbG5NRVhnUVFrQWtER1ZfUmh3dUtwNmVFdUJBZmZ5eENOVEl6DAgJYggIABAAGAAgAA&is_vtc=1&cid=CAQSGwDZpuyzeM5syB72pHUfJU4X5E_dZMu3vzLtuw&eitems=ChAI8KLQwQYQ_qa9wr6Iqag-Eh0AOJh_GKpphHX5pRWbhYMB1Ld0w4uyInYN4Xe6ug&random=1237720010

Requested by

Protocol

Server

172.253.63.105 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f105.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Mon, 26 May 2025 12:05:30 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

Redirect headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
location: https://www.google.com/pagead/1p-conversion/994113961/?random=1669570956&cv=11&fst=1748261130132&bg=ffffff&guid=ON&async=1&gcl_ctr=1&gtm=45be55l1z86541836za200zb6541836&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~103116026~103130495~103130497~103200004~103233427~103252644~103252646~104481633~104481635&ptag_exp=101509157~103116026~103130498~103130500~103200004~103211513~103233427~103252644~103252646~104481633~104481635&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057&label=80uVCNHT54MBEKnzg9oD&hn=www.googleadservices.com&frm=0&tiba=Defend%20Science%20from%20Trump%E2%80%99s%20Attacks.%20Donate%20Now.&value=0&npa=0&pscdl=noapi&auid=1541318537.1748261129&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_m=%23validators%3E%3Anth-child(2)%3E%3Anth-child(1)*A%3Atrue%3A17%3Afalse*1&ec_sel=%23validators%3E%3Anth-child(2)%3E%3Anth-child(1)&ec_meta=A%3Atrue%3A17%3Afalse&ec_lat=8&ec_s=1&fledge=1&capi=1&_tu=Kg&fmt=3&ct_cookie_present=false&crd=CPLOsQIIobixAgixwbECCLDBsQIIscOxAgiKxbECCMLJsQIItMaxAgiQybECCMLPsQIIw8-xAgjTxbECCOvMsQIIz86xAgikz7ECCP7OsQII1c-xAgiX1LECSid0cmlnZ2VyLCBldmVudC1zb3VyY2U7bmF2aWdhdGlvbi1zb3VyY2VaAwoBAWIECgICAw&pscrd=IhMI9N6cnYzBjQMVT3NHAR1CXg3dMgwIA2IICAAQABgAIAAyDAgEYggIABAAGAAgADIMCAdiCAgAEAAYACAAMgwICGIICAAQABgAIAAyDAgJYggIABAAGAAgADIMCApiCAgAEAAYACAAMgwIAmIICAAQABgAIAAyDAgLYggIABAAGAAgADIMCBViCAgAEAAYACAAMgwIH2IICAAQABgAIAAyDAgTYggIABAAGAAgADIMCBJiCAgAEAAYACAAOh9odHRwczovL3NlY3VyZS5ldmVyeWFjdGlvbi5jb20vQldDaEVJOEtMUXdRWVE4TzZsOTY2SnQ1bmZBUklzQUJJQXpkT095alFieXVvSDNHVWJzOGRtbG5NRVhnUVFrQWtER1ZfUmh3dUtwNmVFdUJBZmZ5eENOVEl6DAgJYggIABAAGAAgAA&is_vtc=1&cid=CAQSGwDZpuyzeM5syB72pHUfJU4X5E_dZMu3vzLtuw&eitems=ChAI8KLQwQYQ_qa9wr6Iqag-Eh0AOJh_GKpphHX5pRWbhYMB1Ld0w4uyInYN4Xe6ug&random=1237720010
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 42
date: Mon, 26 May 2025 12:05:30 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H/1.1

200
OK

/
ps.eyeota.net/match/bounce/ Frame EF81
Redirect Chain

https://p.rfihub.com/cm?pub=24472&in=1
https://ps.eyeota.net/match?uid=969470238291792301&bid=omt9pi0
https://ps.eyeota.net/match/bounce/?uid=969470238291792301&bid=omt9pi0

70 B
440 B

127ms
127ms

Image
image/gif

54.156.26.12
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match/bounce/?uid=969470238291792301&bid=omt9pi0
Protocol: HTTP/1.1
Server: 54.156.26.12 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-156-26-12.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://20802620p.rfihub.com/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Mon, 26 May 2025 12:05:32 GMT
Content-Type: image/gif

Redirect headers

Location: /match/bounce/?uid=969470238291792301&bid=omt9pi0
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Mon, 26 May 2025 12:05:32 GMT

GET
H2

200

/
sync-tm.everesttech.net/ct/upi/pid/Mlpt2JaG/ Frame EF81
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D&_test=aDRZCwALIXM1JgA_

85 B
172 B

222ms
222ms

Image
image/png

151.101.194.49
FASTLY

General

Check archive.org

Download Go to Show image

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D&_test=aDRZCwALIXM1JgA_
Protocol: H2
Server: 151.101.194.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://20802620p.rfihub.com/

Response headers

x-robots-tag: noindex
cache-control: no-cache
x-timer: S1748261132.614549,VS0,VE0
age: 3269
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
x-cache: HIT
content-length: 85
date: Mon, 26 May 2025 12:05:31 GMT
content-type: image/png
x-served-by: cache-toj-leto2350045-TOJ
server: Jetty(9.4.35.v20201120)
x-cache-hits: 32755

Redirect headers

x-robots-tag: noindex
cache-control: no-cache
location: https://sync-tm.everesttech.net/ct/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D&_test=aDRZCwALIXM1JgA_
x-timer: S1748261131.301259,VS0,VE87
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
content-length: 0
date: Mon, 26 May 2025 12:05:31 GMT
x-served-by: cache-toj-leto2350045-TOJ
server: Jetty(9.4.35.v20201120)
x-cache-hits: 0

GET
H2

200

sync
pippio.com/api/ Frame EF81
Redirect Chain

https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=969470238291792301&referrer=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmV...
https://p.rfihub.com/cm?pub=39342&in=0&userid=7ef7be00-5114-4a85-a49a-21ff6678690a%3A1748261130.993146&forward=https%3A//i.liadm.com/s/56409%3Fbidder_id%3D200442%26bidder_uuid%3D7ef7be00-5114-4a85-...
https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=969470238291792301&referrer={encSite}&forward=https%3A%2F%2Fi.liadm.com%2Fs%2F56409%3Fbidder_id%3D200442%26bidder_uuid%3D7ef7be0...
https://i.liadm.com/s/56409?bidder_id=200442&bidder_uuid=7ef7be00-5114-4a85-a49a-21ff6678690a%3A1748261130.993146&pid=500040&it=1&iv=7ef7be00-5114-4a85-a49a-21ff6678690a%3A1748261130.993146&_=17482...
https://pippio.com/api/sync?it=1&pid=500040&_=1748261130.994197&iv=7ef7be00-5114-4a85-a49a-21ff6678690a:1748261130.993146

42 B
570 B

277ms
113ms

Image
image/gif

107.178.254.65
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://pippio.com/api/sync?it=1&pid=500040&_=1748261130.994197&iv=7ef7be00-5114-4a85-a49a-21ff6678690a:1748261130.993146
Protocol: H2
Server: 107.178.254.65 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 65.254.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://20802620p.rfihub.com/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Mon, 26 May 2025 12:05:32 GMT
content-type: image/gif

Redirect headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Location: https://pippio.com/api/sync?it=1&pid=500040&_=1748261130.994197&iv=7ef7be00-5114-4a85-a49a-21ff6678690a:1748261130.993146
Content-Length: 0
Date: Mon, 26 May 2025 12:05:31 GMT
trace-id: 2dc62c511690a93f
Request-Time: 1
Connection: keep-alive

GET
H3

200

sync
pippio.com/api/ Frame EF81
Redirect Chain

https://cm.g.doubleclick.net/pixel?&in=0&google_nid=zeta_interactive&google_cm=&google_sc=&google_hm=OTY5NDcwMjM4MjkxNzkyMzAx&forward=
https://cm.g.doubleclick.net/pixel?in=0&google_nid=zeta_interactive&google_cm=&google_sc=&google_hm=OTY5NDcwMjM4MjkxNzkyMzAx&forward=&google_tc=
https://a.rfihub.com/cm?pub=445&in=0&forward=&google_error=15
https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=969470238291792301&referrer={encSite}&forward=
https://p.rfihub.com/cm?pub=39342&in=0&userid=5d1c07c8-c611-429e-8faa-b55eb5bcbf83%3A1748261130.991296&forward=https%3A//i.liadm.com/s/56409%3Fbidder_id%3D200442%26bidder_uuid%3D5d1c07c8-c611-429e-...
https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=969470238291792301&referrer={encSite}&forward=https%3A%2F%2Fi.liadm.com%2Fs%2F56409%3Fbidder_id%3D200442%26bidder_uuid%3D5d1c07c...
https://i.liadm.com/s/56409?bidder_id=200442&bidder_uuid=5d1c07c8-c611-429e-8faa-b55eb5bcbf83%3A1748261130.991296&pid=500040&it=1&iv=5d1c07c8-c611-429e-8faa-b55eb5bcbf83%3A1748261130.991296&_=17482...
https://pippio.com/api/sync?it=1&pid=500040&_=1748261131.914878&iv=5d1c07c8-c611-429e-8faa-b55eb5bcbf83:1748261130.991296

42 B
59 B

113ms
113ms

Image
image/gif

107.178.254.65
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://pippio.com/api/sync?it=1&pid=500040&_=1748261131.914878&iv=5d1c07c8-c611-429e-8faa-b55eb5bcbf83:1748261130.991296
Protocol: H3
Server: 107.178.254.65 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 65.254.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://20802620p.rfihub.com/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Mon, 26 May 2025 12:05:32 GMT
content-type: image/gif

Redirect headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Location: https://pippio.com/api/sync?it=1&pid=500040&_=1748261131.914878&iv=5d1c07c8-c611-429e-8faa-b55eb5bcbf83:1748261130.991296
Content-Length: 0
Date: Mon, 26 May 2025 12:05:32 GMT
trace-id: 4663614c91af5b97
Request-Time: 1
Connection: keep-alive

GET
H2

200

bounce
ib.adnxs.com/ Frame EF81
Redirect Chain

https://ib.adnxs.com/setuid?entity=18&code=969470238291792301
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D18%26code%3D969470238291792301

43 B
1 KB

153ms
143ms

Image
image/gif

68.67.160.75
ASN-APPNEX

General

Check archive.org

Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D18%26code%3D969470238291792301

Requested by

Protocol

Server

68.67.160.75 Colonia, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://20802620p.rfihub.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.246; 162.245.206.246; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 48d3e9e9-b5d0-4cd0-9509-00ba2e90f5f4
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Mon, 26 May 2025 12:05:31 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.23.4

Redirect headers

cache-control: no-store, no-cache, private
location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D18%26code%3D969470238291792301
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 162.245.206.246; 162.245.206.246; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: 162a80dc-fa3c-4592-9854-55b0bdf56fa3
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Mon, 26 May 2025 12:05:30 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

demconf.jpg
dpm.demdex.net/ Frame EF81
Redirect Chain

https://dpm.demdex.net/ibs:dpid=1121&dpuuid=969470238291792301&redir=
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=969470238291792301&redir=

42 B
714 B

130ms
128ms

Image
image/gif

35.172.91.125
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=969470238291792301&redir=

Requested by

Protocol

Server

35.172.91.125 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-172-91-125.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://20802620p.rfihub.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-va6-1-v076-017a074d4.edge-va6.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: 7qOLefpyQM0=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Mon, 26 May 2025 12:05:31 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=969470238291792301&redir=
dcs: dcs-prod-va6-2-v076-0bf8ebcd8.edge-va6.demdex.com 0 ms
pragma: no-cache
x-tid: g9UwA3dnQRs=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Mon, 26 May 2025 12:05:30 GMT

GET
H2 200 Pug
image2.pubmatic.com/AdServer/ Frame EF81 42 B
216 B 265ms
127ms Image
image/gif 8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw==&piggybackCookie=969470238291792301&r=
Requested by: Host: secure.everyaction.com
URL: https://secure.everyaction.com/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2fuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3d&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://20802620p.rfihub.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Mon, 26 May 2025 12:05:30 GMT
content-type: image/gif; charset=utf-8
server: nginx

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame EF81
Redirect Chain

https://us-u.openx.net/w/1.0/sd?id=537073062&val=969470238291792301&r=
https://us-u.openx.net/w/1.0/sd?cc=1&id=537073062&val=969470238291792301&r=

43 B
97 B

111ms
96ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?cc=1&id=537073062&val=969470238291792301&r=
Requested by: Host: secure.everyaction.com
URL: https://secure.everyaction.com/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2fuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3d&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://20802620p.rfihub.com/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.246
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Mon, 26 May 2025 12:05:30 GMT
content-type: image/gif
vary: Accept

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?cc=1&id=537073062&val=969470238291792301&r=
x-forwarded-for: 162.245.206.246
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Mon, 26 May 2025 12:05:30 GMT
content-type: text/plain; charset=utf-8
vary: Origin

GET
H2 200 cksync.php
contextual.media.net/ Frame EF81 103 B
566 B 398ms
171ms Image
image/gif 23.45.148.30
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=3&type=rkt&ovsid=969470238291792301

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.45.148.30 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-45-148-30.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

ab463a9907ed230b168209510175be2f0842209d4839c44367217d7c43a69336

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://20802620p.rfihub.com/

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=0, no-cache, no-store
timing-allow-origin: *
pragma: no-cache
expires: Mon, 26 May 2025 12:05:31 GMT
x-mnet-hl2: E
alt-svc: h3=":443"; ma=93600
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
content-length: 103
date: Mon, 26 May 2025 12:05:31 GMT
content-type: image/gif
server: Apache

GET
H2 200 /
bpi.rtactivate.com/tag/ Frame EF81 43 B
109 B 509ms
282ms Image
image/gif 54.146.62.102
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://bpi.rtactivate.com/tag/?id=11017&user_id=969470238291792301
Requested by: Host: secure.everyaction.com
URL: https://secure.everyaction.com/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2fuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3d&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.146.62.102 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-146-62-102.compute-1.amazonaws.com
Software: awselb/2.0 /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://20802620p.rfihub.com/

Response headers

content-length: 43
date: Mon, 26 May 2025 12:05:31 GMT
content-type: image/gif
server: awselb/2.0

GET

sync
thrtle.com/ Frame EF81
Redirect Chain

https://i.liadm.com/s/90096?bidder_id=246506&bidder_uuid=969470238291792301
https://i.liadm.com/s/90096?bidder_id=246506&bidder_uuid=969470238291792301&_li_chk=true&previous_uuid=990fcfa2212e41be8de99cbf9f3199ef
https://thrtle.com/sync?vxii_pid=7006&vxii_pdid=990fcfa2-212e-41be-8de9-9cbf9f3199ef&us_privacy=1YN-
https://thrtle.com/sync?_reach=1&vxii_pdid=990fcfa2-212e-41be-8de9-9cbf9f3199ef&vxii_pid=12&vxii_pid1=7006&vxii_rcid=13c7baf2-c3e9-4383-a0ab-37a491af168f&vxii_rmax=3
https://ib.adnxs.com/getuid?https%3A%2F%2Fthrtle.com%2Fsync%3Fvxii_pid%3D5006%26vxii_pdid%3D%24UID%26vxii_ts%3D1%26_t%3D1748261131%26_reach%3D1
https://thrtle.com/sync?vxii_pid=5006&vxii_pdid=1027157301885763985&vxii_ts=1&_t=1748261131&_reach=1
https://cms.analytics.yahoo.com/cms?partner_id=THROTLE
https://ups.analytics.yahoo.com/ups/58691/cms?partner_id=THROTLE
https://thrtle.com/sync?vxii_pid=5038&vxii_pdid=y-r2ZqVh1E2oTw.JZJpTFEP1HgTI_GyJOHj0wTnQ--~A
https://pixel-sync.sitescout.com/connectors/throtle/usersync?redir=https%3A%2F%2Fthrtle.com%2Fsync%3Fvxii_pid%3D5026%26vxii_pdid%3D%7BuserId%7D%26vxii_ts%3D4%26_t%3D1748261132
https://pixel-sync.sitescout.com/connectors/throtle/usersync?cookieQ=1&redir=https%3A%2F%2Fthrtle.com%2Fsync%3Fvxii_pid%3D5026%26vxii_pdid%3D%7BuserId%7D%26vxii_ts%3D4%26_t%3D1748261132
https://thrtle.com/sync?vxii_pid=5026&vxii_pdid=5a602d4b-df63-4d0f-86e8-7d21fdababb3-6834590d-5553&vxii_ts=4&_t=1748261132
https://match.adsrvr.org/track/cmf/generic?ttd_pid=brgeu23&ttd_tpi=1&TTD_PUID=13c7baf2-c3e9-4383-a0ab-37a491af168f
https://match.adsrvr.org/track/cmb/generic?ttd_pid=brgeu23&ttd_tpi=1&TTD_PUID=13c7baf2-c3e9-4383-a0ab-37a491af168f
https://thrtle.com/sync?vxii_pid=5015&vxii_pdid=477cf374-773c-4ebf-8d21-922b158a37fe

0
0

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame EF81
Redirect Chain

https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=969470238291792301&forward=
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=969470238291792301&forward=&C=1

43 B
337 B

87ms
84ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=969470238291792301&forward=&C=1
Requested by: Host: secure.everyaction.com
URL: https://secure.everyaction.com/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2fuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3d&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057
Protocol: H2
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://20802620p.rfihub.com/

Response headers

cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Bk%2BLJNRlMdWEjolWX6q1VLZ5ZCpNxvbDOb9dILs8zIlA1KGB4zU1%2BYVH7sSUGddPXFIvFm4tSuTNukc620DEC4eZbD5oEQvR68ai3TLStpdLZ3v78cY0ISKbiRSf5girjoYHc45l2PJJ8w%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 945d2426b97d7d65-LAX
expires: 0
alt-svc: h3=":443"; ma=86400
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Mon, 26 May 2025 12:05:31 GMT
content-type: image/gif
vary: Accept-Encoding
server: cloudflare

Redirect headers

cache-control: no-cache
location: /rum?cm_dsp_id=57&external_user_id=969470238291792301&forward=&C=1
cf-cache-status: DYNAMIC
pragma: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P2TIWQBty5PrCUHc9aPebVU7j8jI222ZuxuyDlogRDADQh71OSikLQilyvgPqgIUnS7QAZMItQ42EmgY1VbKcA3fdy4Od3EhdDkHBMacchNycOWLPtEkFQN1DmDDGF1bpan7rdZeGAJH0w%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 945d242638e97d65-LAX
expires: 0
alt-svc: h3=":443"; ma=86400
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Mon, 26 May 2025 12:05:31 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 360947.gif
idsync.rlcdn.com/ Frame EF81 42 B
279 B 210ms
111ms Image
image/gif 35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://idsync.rlcdn.com/360947.gif?partner_uid=969470238291792301
Requested by: Host: secure.everyaction.com
URL: https://secure.everyaction.com/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2fuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3d&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://20802620p.rfihub.com/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Mon, 26 May 2025 12:05:31 GMT
content-type: image/gif

GET
H2 200 sync
partners.tremorhub.com/ Frame EF81 43 B
175 B 382ms
134ms Image
image/gif 2600:1f10:4ce4:4a02:7461:ccaa:6922:447a
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://partners.tremorhub.com/sync?UIRF=969470238291792301&r=fCoQmBBcJB1K
Requested by: Host: secure.everyaction.com
URL: https://secure.everyaction.com/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2fuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3d&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f10:4ce4:4a02:7461:ccaa:6922:447a Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://20802620p.rfihub.com/

Response headers

p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date: Mon, 26 May 2025 12:05:31 GMT
content-type: image/gif
server: nginx

GET
H2 200 g.pixel
aa.agkn.com/adscores/ Frame EF81 43 B
527 B 396ms
145ms Image
image/gif 3.161.213.57
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://aa.agkn.com/adscores/g.pixel?sid=9212192898&rf=969470238291792301
Requested by: Host: secure.everyaction.com
URL: https://secure.everyaction.com/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2fuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3d&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.213.57 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-213-57.yul62.r.cloudfront.net
Software: AAWebServer /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://20802620p.rfihub.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-methods: GET, OPTIONS
via: 1.1 480d73d26133a5d3268f9cfc7c99d59c.cloudfront.net (CloudFront)
expires: 0
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 43
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Mon, 26 May 2025 12:05:31 GMT
content-type: image/gif
x-amz-cf-pop: YUL62-P1
server: AAWebServer
x-amz-cf-id: Z4f-Eb4MPPgtFvMeYuOO4SwZRt938MkjfnEA7niUx7E-X3cIybHd9g==
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 sync
x.bidswitch.net/ Frame EF81 43 B
92 B 382ms
136ms Image
image/gif 35.211.202.130
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/sync?dsp_id=119&user_id=969470238291792301&expires=30&gdpr={GDPR}&gdpr_consent={GDPR_CONSENT_469}&gdpr_pd={GDPR_PD}
Requested by: Host: secure.everyaction.com
URL: https://secure.everyaction.com/5LsOqOrd906PKtLlv8yw8A2?contactdata=9+A0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%2fuqqfTbmVO0EKb8BAQXIYx7J+O+mbb7HrKbbvXO1ncAQP%2fn++xLi2UYBN1FYGVtki+nrumq63RkIrRfgr++8dcQmoUgxbiOLCdkfB0AISbEE+7U5ej%2fp84AYh+DQ9BDI9kJ91sdegR6nXby+2DL2ky9cWmOBRedHc%3d&am=100&ms=sms&mmdr=350a5774-a067-4ced-8f84-01ca8dabd057
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.211.202.130 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 130.202.211.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://20802620p.rfihub.com/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Mon, 26 May 2025 12:05:31 GMT
content-type: image/gif

GET
H3 200 /
www.google.com/pagead/1p-user-list/1071979118/ 42 B
64 B 137ms
137ms Image
image/gif 172.253.63.105
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1071979118/?random=1748261130394&cv=11&fst=1748260800000&bg=ffffff&guid=ON&async=1&gtm=45be55l1v9210099727z86541836za200zb6541836&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~102938614~103116026~103130498~103130500~103200004~103233427~103252644~103252646~104481633~104481635&ptag_exp=101509157~103116026~103130498~103130500~103200004~103211513~103233427~103252644~103252646~104481633~104481635&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.everyaction.com%2F5LsOqOrd906PKtLlv8yw8A2%3Fcontactdata%3D9%2BA0fueZvbj3oYI9AmVU6UkRfdOhCoEpAxbY1ihT5Z3rSsYy5at9mC7A6kj38OCrWDS4fQ4eeu%252fuqqfTbmVO0EKb8BAQXIYx7J%2BO%2Bmbb7HrKbbvXO1ncAQP%252fn%2B%2BxLi2UYBN1FYGVtki%2Bnrumq63RkIrRfgr%2B%2B8dcQmoUgxbiOLCdkfB0AISbEE%2B7U5ej%252fp84AYh%2BDQ9BDI9kJ91sdegR6nXby%2B2DL2ky9cWmOBRedHc%253d%26am%3D100%26ms%3Dsms%26mmdr%3D350a5774-a067-4ced-8f84-01ca8dabd057&hn=www.googleadservices.com&frm=0&tiba=Defend%20Science%20from%20Trump%E2%80%99s%20Attacks.%20Donate%20Now.&npa=0&pscdl=noapi&auid=1541318537.1748261129&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&_tu=Cg&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDZpuyzMkIOvQYlVjXevDNjcaamHV_1wJqKEw&random=3563888500&rmt_tld=0&ipr=y

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.105 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f105.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://secure.everyaction.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Mon, 26 May 2025 12:05:30 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H2 200 vgs Show response
vgs-collect-keeper.apps.verygood.systems/ Frame 36CE 0
110 B 589ms
533ms XHR
text/plain 23.23.51.244
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://vgs-collect-keeper.apps.verygood.systems/vgs
Requested by: Host: js.verygoodvault.com
URL: https://js.verygoodvault.com/vgs-collect/2.18.4/lib/application.909e2f5f9100accd006e.modern.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.23.51.244 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-23-23-51-244.compute-1.amazonaws.com
Software: / Express
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://js.verygoodvault.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Accept: application/json, text/plain, */*
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://js.verygoodvault.com
content-length: 0
date: Mon, 26 May 2025 12:05:30 GMT
x-powered-by: Express
vary: Origin

POST
H/1.1 200
OK s3b2c8kwt9qw777t Show response
client-analytics.braintreegateway.com/ 0
357 B 157ms
137ms XHR
text/plain 13.59.58.110
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://client-analytics.braintreegateway.com/s3b2c8kwt9qw777t

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/b/ai.2.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.59.58.110 Columbus, United States, ASN16509 (AMAZON-02, US),

Reverse DNS