www.markskousen.com
192.124.249.5 Public Scan Open in urlscan Pro

Software

Sucuri/Cloudproxy /

Resource Hash

a5170e658d3d495ff4ccc2e181920a7d474fb26857a00317f99bd2a93bec6c80

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000
content-security-policy: upgrade-insecure-requests;
content-type: text/html; charset=UTF-8
date: Fri, 01 Aug 2025 06:23:19 GMT
link: <https://www.markskousen.com/wp-json/>; rel="https://api.w.org/", <https://www.markskousen.com/?p=27793>; rel=shortlink
server: Sucuri/Cloudproxy
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-sucuri-cache: EXPIRED
x-sucuri-id: 11005
x-xss-protection: 1; mode=block

Redirect headers

alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000
content-length: 0
content-security-policy: upgrade-insecure-requests;
content-type: text/html; charset=UTF-8
date: Fri, 01 Aug 2025 06:23:19 GMT
link: <https://www.markskousen.com/wp-json/>; rel="https://api.w.org/", <https://www.markskousen.com/?p=27793>; rel=shortlink
location: /offer/tnt-default/?source=CAFE1&utm_source=&utm_medium=email&utm_campaign=&utm_content=&osl=&recip_id=&bcid=&step=2
server: Sucuri/Cloudproxy
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-sucuri-cache: EXPIRED
x-sucuri-id: 11005
x-xss-protection: 1; mode=block

GET
H3 200 jquery.min.js Show response
www.markskousen.com/wp-includes/js/jquery/ 86 KB
86 KB 83ms
81ms Script
application/javascript 192.124.249.5
SUCURI-SEC

General

Check archive.org

Download Go to

Full URL

https://www.markskousen.com/wp-includes/js/jquery/jquery.min.js?3.7.1

Requested by

Host: www.markskousen.com
URL: https://www.markskousen.com/offer/tnt-default/?source=CAFE1&utm_source=&utm_medium=email&utm_campaign=&utm_content=&osl=&recip_id=&bcid=&step=2

Protocol

Security

QUIC, , AES_256_GCM

Server

192.124.249.5 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

Sucuri/Cloudproxy /

Resource Hash

cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/offer/tnt-default/?source=CAFE1&utm_source=&utm_medium=email&utm_campaign=&utm_content=&osl=&recip_id=&bcid=&step=2

Response headers

x-sucuri-cache: HIT
etag: "15601-61c3290fc00e4"
x-content-type-options: nosniff
expires: Thu, 31 Dec 2037 23:55:55 GMT
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000
date: Fri, 01 Aug 2025 06:23:19 GMT
content-type: application/javascript
last-modified: Mon, 01 Jul 2024 17:02:46 GMT
x-frame-options: SAMEORIGIN
x-sucuri-id: 11005
content-security-policy: upgrade-insecure-requests;
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 87553
x-xss-protection: 1; mode=block
server: Sucuri/Cloudproxy

GET
H2 200 css
fonts.googleapis.com/ 11 KB
1 KB 441ms
156ms Stylesheet
text/css 2607:f8b0:4006:81f::200a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto+Mono:700,700italic|Roboto+Slab:400,700|Titillium+Web:400,900,700

Requested by

Host: www.markskousen.com
URL: https://www.markskousen.com/offer/tnt-default/?source=CAFE1&utm_source=&utm_medium=email&utm_campaign=&utm_content=&osl=&recip_id=&bcid=&step=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81f::200a Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

fe42ac4df414961386c857aa5c8aebd73c04916bf3051a16579741af33b310e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Fri, 01 Aug 2025 06:23:20 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 01 Aug 2025 06:23:20 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Fri, 01 Aug 2025 06:23:20 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 jquery-2.1.1.min.js Show response
code.jquery.com/ 82 KB
29 KB 683ms
222ms Script
application/javascript 2a04:4e42:600::649
FASTLY

General

Check archive.org

Download Go to

Full URL: https://code.jquery.com/jquery-2.1.1.min.js
Requested by: Host: www.markskousen.com
URL: https://www.markskousen.com/offer/tnt-default/?source=CAFE1&utm_source=&utm_medium=email&utm_campaign=&utm_content=&osl=&recip_id=&bcid=&step=2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:600::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

content-encoding: gzip
etag: W/"28feccc0-14915"
age: 3948339
x-cache: HIT, HIT
date: Fri, 01 Aug 2025 06:23:20 GMT
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
x-cache-hits: 8781, 41958
x-served-by: cache-lga21958-LGA, cache-mad2200137-MAD
vary: Accept-Encoding
cache-control: public, max-age=31536000, stale-while-revalidate=604800
x-timer: S1754029400.288680,VS0,VE0
cross-origin-resource-policy: cross-origin
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 29482
server: nginx

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 269 KB
99 KB 541ms
156ms Script
application/javascript 2607:f8b0:4006:80e::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-1592302-4

Requested by

Host: www.markskousen.com
URL: https://www.markskousen.com/offer/tnt-default/?source=CAFE1&utm_source=&utm_medium=email&utm_campaign=&utm_content=&osl=&recip_id=&bcid=&step=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2008 Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

94c182ed602606a5786094700f3838ed6b21e8c08e53ca6ba9d987be4302860d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

content-encoding: zstd
report-to: {"group":"ascgcycc:1099:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1099:0"}],}
expires: Fri, 01 Aug 2025 06:23:20 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 01 Aug 2025 06:23:20 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1099:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1099:0
content-length: 100294
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 346 KB
122 KB 535ms
342ms Script
application/javascript 2607:f8b0:4006:80e::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-664724290

Requested by

Host: www.markskousen.com
URL: https://www.markskousen.com/offer/tnt-default/?source=CAFE1&utm_source=&utm_medium=email&utm_campaign=&utm_content=&osl=&recip_id=&bcid=&step=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2008 Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1424d3b715f2bdbb359e6b3c430100d4431d69ebc76e191f93a3061e0583f227

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

content-encoding: zstd
report-to: {"group":"ascgcycc:1099:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1099:0"}],}
expires: Fri, 01 Aug 2025 06:23:20 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 01 Aug 2025 06:23:20 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 01 Aug 2025 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1099:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1099:0
content-length: 124437
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 TNT.png
www.markskousen.com/wp-content/uploads/ 30 KB
31 KB 82ms
81ms Image
image/png 192.124.249.5
SUCURI-SEC

General

Check archive.org

Download Go to Show image

Full URL

https://www.markskousen.com/wp-content/uploads/TNT.png

Requested by

Host: www.markskousen.com
URL: https://www.markskousen.com/offer/tnt-default/?source=CAFE1&utm_source=&utm_medium=email&utm_campaign=&utm_content=&osl=&recip_id=&bcid=&step=2

Protocol

Security

QUIC, , AES_256_GCM

Server

192.124.249.5 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

Sucuri/Cloudproxy /

Resource Hash

f84dd617d74123b7c925e8323ccc9c5af0eb0ff337e9b0cb3e327b9a8a6f11b3

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/offer/tnt-default/?source=CAFE1&utm_source=&utm_medium=email&utm_campaign=&utm_content=&osl=&recip_id=&bcid=&step=2

Response headers

x-sucuri-cache: HIT
etag: "78e5-619adb9d78808"
x-content-type-options: nosniff
expires: Thu, 31 Dec 2037 23:55:55 GMT
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000
date: Fri, 01 Aug 2025 06:23:19 GMT
content-type: image/png
last-modified: Thu, 30 May 2024 15:43:18 GMT
x-frame-options: SAMEORIGIN
x-sucuri-id: 11005
content-security-policy: upgrade-insecure-requests;
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 30949
x-xss-protection: 1; mode=block
server: Sucuri/Cloudproxy

GET
H3 200 30-day-money-back-guarantee.jpg
www.markskousen.com/wp-content/uploads/ 18 KB
18 KB 84ms
83ms Image
image/jpeg 192.124.249.5
SUCURI-SEC

General

Check archive.org

Download Go to Show image

Full URL

https://www.markskousen.com/wp-content/uploads/30-day-money-back-guarantee.jpg

Requested by

Host: www.markskousen.com
URL: https://www.markskousen.com/offer/tnt-default/?source=CAFE1&utm_source=&utm_medium=email&utm_campaign=&utm_content=&osl=&recip_id=&bcid=&step=2

Protocol

Security

QUIC, , AES_256_GCM

Server

192.124.249.5 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

Sucuri/Cloudproxy /

Resource Hash

97e8eb5401cb534a136270c23524eaa2ef6cddbd132491430a7831a4157f7981

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/offer/tnt-default/?source=CAFE1&utm_source=&utm_medium=email&utm_campaign=&utm_content=&osl=&recip_id=&bcid=&step=2

Response headers

x-sucuri-cache: HIT
etag: "480d-619adb33e2c9f"
x-content-type-options: nosniff
expires: Thu, 31 Dec 2037 23:55:55 GMT
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000
date: Fri, 01 Aug 2025 06:23:19 GMT
content-type: image/jpeg
last-modified: Thu, 30 May 2024 15:41:27 GMT
x-frame-options: SAMEORIGIN
x-sucuri-id: 11005
content-security-policy: upgrade-insecure-requests;
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 18445
x-xss-protection: 1; mode=block
server: Sucuri/Cloudproxy

GET
H3 200 roger-500.png
www.markskousen.com/wp-content/uploads/ 256 KB
257 KB 81ms
81ms Image
image/png 192.124.249.5
SUCURI-SEC

General

Check archive.org

Download Go to Show image

Full URL

https://www.markskousen.com/wp-content/uploads/roger-500.png

Requested by

Host: www.markskousen.com
URL: https://www.markskousen.com/offer/tnt-default/?source=CAFE1&utm_source=&utm_medium=email&utm_campaign=&utm_content=&osl=&recip_id=&bcid=&step=2

Protocol

Security

QUIC, , AES_256_GCM

Server

192.124.249.5 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

xx-fbcdn-shv-01-yyz1.fbcdn.net

Software

Sucuri/Cloudproxy /

Resource Hash

d01f76a9a40b7d53a1e43f1b5cab87a6639392f4b70d9d367b4af2d64f4d2151

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/offer/tnt-default/?source=CAFE1&utm_source=&utm_medium=email&utm_campaign=&utm_content=&osl=&recip_id=&bcid=&step=2

Response headers

x-sucuri-cache: HIT
etag: "401a8-619adbe887395"
x-content-type-options: nosniff
expires: Thu, 31 Dec 2037 23:55:55 GMT
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000
date: Fri, 01 Aug 2025 06:23:19 GMT
content-type: image/png
last-modified: Thu, 30 May 2024 15:44:36 GMT
x-frame-options: SAMEORIGIN
x-sucuri-id: 11005
content-security-policy: upgrade-insecure-requests;
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 262568
x-xss-protection: 1; mode=block
server: Sucuri/Cloudproxy

GET
H2 200 ld.js Show response
dynamic.criteo.com/js/ld/ 71 KB
24 KB 659ms
248ms Script
application/javascript 2620:100:a00b::6
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://dynamic.criteo.com/js/ld/ld.js?a=113755

Requested by

Host: www.markskousen.com
URL: https://www.markskousen.com/offer/tnt-default/?source=CAFE1&utm_source=&utm_medium=email&utm_campaign=&utm_content=&osl=&recip_id=&bcid=&step=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::6 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

f174c2da16f288ae9be720f9a5610934268a2c7a53b17c6594811f11a15a06ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: public,max-age=10800
timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
date: Fri, 01 Aug 2025 06:23:20 GMT
content-type: application/javascript; charset=utf-8
vary: Origin, Accept-Encoding
server: Kestrel

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 296 KB
76 KB 300ms
129ms Script
application/x-javascript 31.13.80.12
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.markskousen.com
URL: https://www.markskousen.com/offer/tnt-default/?source=CAFE1&utm_source=&utm_medium=email&utm_campaign=&utm_content=&osl=&recip_id=&bcid=&step=2

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.80.12 Toronto, Canada, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

b02de74697736ff2402407771c2f63e897f6b3b6e5af7df2c34505498eff8d71

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' blob: ;script-src 'nonce-k6Zh0kKB' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: 'self' https://.google-analytics.com .google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: .cdninstagram.com https://.google-analytics.com;font-src 'self' data: blob: ;img-src 'self' data: blob: https://.google-analytics.com;media-src 'self' data: blob: ;child-src 'self' data: blob: ;frame-src 'self' data: blob: ;manifest-src 'self' data: blob: ;object-src 'self' data: blob: ;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 01 Aug 2025 06:23:20 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' blob: *;script-src 'nonce-k6Zh0kKB' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self' https://*.google-analytics.com *.google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com https://*.google-analytics.com;font-src 'self' data: blob: *;img-src 'self' data: blob: * https://*.google-analytics.com;media-src 'self' data: blob: *;child-src 'self' data: blob: *;frame-src 'self' data: blob: *;manifest-src 'self' data: blob: *;object-src 'self' data: blob: *;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=127, rtx=0, c=24, mss=1232, tbw=8706, tp=13, tpl=0, uplat=1, ullat=-1
pragma: public
x-fb-debug: YE75qt+SYhs4fwb6WyR80QflPy7KKJC/6HwSzHySBjwqEXyrBqiWrCvrcsfAOeHEQ7VnyG6MCZid3kZUdUf6CA==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
content-length: 77647
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H/1.1 200
OK obtp.js Show response
amplify.outbrain.com/cp/ 27 KB
9 KB 367ms
121ms Script
application/x-javascript 23.11.209.82
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://amplify.outbrain.com/cp/obtp.js
Requested by: Host: www.markskousen.com
URL: https://www.markskousen.com/offer/tnt-default/?source=CAFE1&utm_source=&utm_medium=email&utm_campaign=&utm_content=&osl=&recip_id=&bcid=&step=2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.11.209.82 Mount Prospect, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-11-209-82.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 651eb4808009b795d875fe7186c4a8bc3304ba7897305266ad3d58f906824a80

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

Cache-Control: max-age=1200
Content-Encoding: gzip
ETag: "10da80e1b0e2b3d620ef145b567d83b5:1753278037.249278"
Connection: keep-alive
Expires: Fri, 01 Aug 2025 06:43:20 GMT
Accept-Ranges: bytes
X-CC: US
Content-Length: 9263
X-RG: NA
Date: Fri, 01 Aug 2025 06:23:20 GMT
Content-Type: application/x-javascript
Last-Modified: Wed, 23 Jul 2025 13:38:22 GMT
Server: AkamaiNetStorage
Vary: Accept-Encoding

GET
H2 200 tfa.js Show response
cdn.taboola.com/libtrc/unip/1255890/ 81 KB
25 KB 868ms
408ms Script
application/javascript 151.101.193.44
FASTLY

General

Check archive.org

Download Go to

Full URL: https://cdn.taboola.com/libtrc/unip/1255890/tfa.js
Requested by: Host: www.markskousen.com
URL: https://www.markskousen.com/offer/tnt-default/?source=CAFE1&utm_source=&utm_medium=email&utm_campaign=&utm_content=&osl=&recip_id=&bcid=&step=2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.44 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a70df7eac97630605fbba37326618ca3d442ddc1356a483e8df8ba9c9b809e7e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

x-fastly-object-storage: false
content-encoding: gzip
etag: "031a26c7d8a3425fb7313cea81ca564b"
x-amz-version-id: goNv4UpDoLT75OnCPECwZ0pzH7mSh2fd
age: 0
x-cache: HIT
date: Fri, 01 Aug 2025 06:23:21 GMT
last-modified: Sun, 27 Jul 2025 11:20:55 GMT
x-served-by: cache-mad22055-MAD
x-cache-hits: 0
content-type: application/javascript; charset=utf-8
x-amz-id-2: MOPBStiwnsCiBMJkpBFpbzH6Z3ZzaOG4Ol0u2vASFP/kvswQqXtNQNQh0eDaP7UGgxnsFRu674g=
x-amz-meta-x-tbl-source: kfc-purge-prod
vary: Accept-Encoding
x-amz-replication-status: FAILED
cache-control: private,max-age=14401
x-timer: S1754029401.072329,VS0,VE185
via: 1.1 varnish
x-amz-request-id: RTTT8FDA3RDACQFW
accept-ranges: bytes
access-control-allow-origin: *
abp: 82
content-length: 24711
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H/1.1 200
OK pixie.js Show response
acdn.adnxs.com/dmp/up/ 25 KB
9 KB 428ms
141ms Script
application/javascript 23.209.72.141
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL: https://acdn.adnxs.com/dmp/up/pixie.js
Requested by: Host: www.markskousen.com
URL: https://www.markskousen.com/offer/tnt-default/?source=CAFE1&utm_source=&utm_medium=email&utm_campaign=&utm_content=&osl=&recip_id=&bcid=&step=2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.209.72.141 Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a23-209-72-141.deploy.static.akamaitechnologies.com
Software: nginx/1.24.0 (Ubuntu) /
Resource Hash: 72eec63e5e08a7445b2edf1b063f2ed8024475656f6136d6e70e24e595ff3141

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

Cache-Control: max-age=86402
Content-Encoding: gzip
ETag: W/"675772a2-6412"
Connection: keep-alive
X-Check-Cacheable: YES
Expires: Sat, 02 Aug 2025 06:23:22 GMT
Access-Control-Allow-Origin: *
Content-Length: 8780
X-Serial: 5417
Date: Fri, 01 Aug 2025 06:23:20 GMT
Last-Modified: Mon, 09 Dec 2024 22:43:46 GMT
Content-Type: application/javascript
Server: nginx/1.24.0 (Ubuntu)
Vary: Accept-Encoding

GET
H2 200 events.js Show response
tags.srv.stackadapt.com/ 22 KB
7 KB 410ms
133ms Script
text/javascript 3.226.40.10
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://tags.srv.stackadapt.com/events.js
Requested by: Host: www.markskousen.com
URL: https://www.markskousen.com/offer/tnt-default/?source=CAFE1&utm_source=&utm_medium=email&utm_campaign=&utm_content=&osl=&recip_id=&bcid=&step=2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.226.40.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-226-40-10.compute-1.amazonaws.com
Software: /
Resource Hash: 2eef348f030a94f8b4380689e3743788d7a383bc7243612fadd78c1af8ee7220

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

access-control-allow-origin: *
cache-control: max-age=5
content-encoding: gzip
date: Fri, 01 Aug 2025 06:23:20 GMT
content-type: text/javascript

GET
H3 200 mgsensor.js Show response
a.mgid.com/ 17 KB
5 KB 325ms
156ms Script
application/javascript 104.17.199.65
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://a.mgid.com/mgsensor.js?d=1754029400497

Requested by

Host: www.markskousen.com
URL: https://www.markskousen.com/offer/tnt-default/?source=CAFE1&utm_source=&utm_medium=email&utm_campaign=&utm_content=&osl=&recip_id=&bcid=&step=2

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.199.65 , Ascension Island, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

50717873101f479c7173074a285d6d1037bb55493e044b26f079a723bcfb425f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: DYNAMIC
x-mg-request-uuid: b0ba407b-bdb4-42c2-90e1-e626aa10bd21
x-content-type-options: nosniff
cf-ray: 96833f0a7834ed39-SJC
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 01 Aug 2025 06:23:20 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare
priority: u=3,i=?0

GET
H/1.1 200
OK index.php Show response
portal.publishersserviceassociates.com/api_new_order/eaglestep/ Frame 71CD 29 KB
30 KB 538ms
137ms Document
text/html 98.83.182.201
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1
Requested by: Host: www.markskousen.com
URL: https://www.markskousen.com/offer/tnt-default/?source=CAFE1&utm_source=&utm_medium=email&utm_campaign=&utm_content=&osl=&recip_id=&bcid=&step=2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 98.83.182.201 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-98-83-182-201.compute-1.amazonaws.com
Software: Apache /
Resource Hash: ca143c23ad1813a39190d134691d2878d2add4814323eb32a7c432fa62e3101f

Request headers

Referer: https://www.markskousen.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Fri, 01 Aug 2025 06:23:21 GMT
Keep-Alive: timeout=5, max=100
Server: Apache
Transfer-Encoding: chunked

GET
H3 200 explode.png
www.markskousen.com/wp-content/uploads/ 2 KB
2 KB 83ms
82ms Image
image/png 192.124.249.5
SUCURI-SEC

General

Check archive.org

Download Go to Show image

Full URL

https://www.markskousen.com/wp-content/uploads/explode.png

Requested by

Host: www.markskousen.com
URL: https://www.markskousen.com/offer/tnt-default/?source=CAFE1&utm_source=&utm_medium=email&utm_campaign=&utm_content=&osl=&recip_id=&bcid=&step=2

Protocol

Security

QUIC, , AES_256_GCM

Server

192.124.249.5 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

Sucuri/Cloudproxy /

Resource Hash

10b78c1ea9e312b05f881bf8e07fd2d7171e36ce37a067291dad1a3b4b199a73

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/offer/tnt-default/?source=CAFE1&utm_source=&utm_medium=email&utm_campaign=&utm_content=&osl=&recip_id=&bcid=&step=2

Response headers

x-sucuri-cache: HIT
etag: "7e3-619adbb71eb4b"
x-content-type-options: nosniff
expires: Thu, 31 Dec 2037 23:55:55 GMT
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000
date: Fri, 01 Aug 2025 06:23:20 GMT
content-type: image/png
last-modified: Thu, 30 May 2024 15:43:45 GMT
x-frame-options: SAMEORIGIN
x-sucuri-id: 11005
content-security-policy: upgrade-insecure-requests;
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 2019
x-xss-protection: 1; mode=block
server: Sucuri/Cloudproxy

GET
H3 200 NaPecZTIAOhVxoMyOr9n_E7fdMPmDQ.woff2
fonts.gstatic.com/s/titilliumweb/v18/ 12 KB
12 KB 280ms
135ms Font
font/woff2 142.250.80.67
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fonts.gstatic.com/s/titilliumweb/v18/NaPecZTIAOhVxoMyOr9n_E7fdMPmDQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto+Mono:700,700italic|Roboto+Slab:400,700|Titillium+Web:400,900,700

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.67 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

861b80b49d2a634d8746e2e45c672309d9ba69a2fdd95da2af034d7a1d09b3f9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Origin: https://www.markskousen.com
Referer: https://fonts.googleapis.com/

Response headers

age: 127135
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 30 Jul 2026 19:04:25 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Jul 2025 19:04:25 GMT
last-modified: Mon, 02 Jun 2025 16:41:37 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 12344
x-xss-protection: 0
server: sffe

GET
H3 200 NaPDcZTIAOhVxoMyOr9n_E7ffHjDGItzYw.woff2
fonts.gstatic.com/s/titilliumweb/v18/ 11 KB
11 KB 337ms
191ms Font
font/woff2 142.250.80.67
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fonts.gstatic.com/s/titilliumweb/v18/NaPDcZTIAOhVxoMyOr9n_E7ffHjDGItzYw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto+Mono:700,700italic|Roboto+Slab:400,700|Titillium+Web:400,900,700

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.67 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9e3162d81ed6681322ab34791660f1b45c79945197e7a7dbb217005b2926caf4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Origin: https://www.markskousen.com
Referer: https://fonts.googleapis.com/

Response headers

age: 125971
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 30 Jul 2026 19:23:49 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Jul 2025 19:23:49 GMT
last-modified: Mon, 02 Jun 2025 16:41:40 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 11732
x-xss-protection: 0
server: sffe

GET
H3 200 BngMUXZYTXPIvIBgJJSb6ufN5qU.woff2
fonts.gstatic.com/s/robotoslab/v35/ 33 KB
33 KB 287ms
143ms Font
font/woff2 142.250.80.67
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fonts.gstatic.com/s/robotoslab/v35/BngMUXZYTXPIvIBgJJSb6ufN5qU.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto+Mono:700,700italic|Roboto+Slab:400,700|Titillium+Web:400,900,700

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.67 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a96-6-1-76.deploy.static.akamaitechnologies.com

Software

sffe /

Resource Hash

50cf7d32c18e1001749b51f1565ef745bc0687b0297b2b13465ed577cc20a8ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Origin: https://www.markskousen.com
Referer: https://fonts.googleapis.com/

Response headers

age: 126031
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 30 Jul 2026 19:22:49 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Jul 2025 19:22:49 GMT
last-modified: Thu, 29 May 2025 23:35:41 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 34236
x-xss-protection: 0
server: sffe

GET
H/1.1 200
OK 00048f41518fe36dfbeba4a95536b83263 Show response
wave.outbrain.com/mtWavesBundler/handler/ 2 B
539 B 354ms
117ms Script
text/html 96.6.1.76
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL

https://wave.outbrain.com/mtWavesBundler/handler/00048f41518fe36dfbeba4a95536b83263

Requested by

Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

96.6.1.76 Lithia Springs, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

/ Express

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

Content-Encoding: gzip
ETag: W/"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"
Expires: Fri, 01 Aug 2025 06:24:21 GMT
X-CC: US
Date: Fri, 01 Aug 2025 06:23:21 GMT
Content-Type: text/html; charset=utf-8
Vary: Accept-Encoding
x-traceid: fecd8f095d6c77b0317f747a6409f3fb
strict-transport-security: max-age=31536000; includeSubDomains; preload
Cache-Control: max-age=60
ob-sent-time: 1753967514186
Connection: keep-alive
Access-Control-Allow-Origin: *
Content-Length: 22
X-RG: NA
x-powered-by: Express

GET
H/1.1 200
OK topics Show response
amplify.outbrain.com/ 26 B
301 B 359ms
122ms Fetch
text/html 23.11.209.82
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://amplify.outbrain.com/topics
Requested by: Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.11.209.82 Mount Prospect, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-11-209-82.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6d0291f90718dc0537f65dc6a4f68d8e75f0a8a3a0b62836d9cf41350ecaf552

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

Cache-Control: max-age=1200
Connection: keep-alive
Observe-Browsing-Topics: ?1
Expires: Fri, 01 Aug 2025 06:43:21 GMT
Access-Control-Allow-Origin: *
X-CC: US
Content-Length: 26
X-RG: NA
Date: Fri, 01 Aug 2025 06:23:21 GMT
Content-Type: text/html

GET
H/1.1 200
OK unifiedPixel Show response
tr.outbrain.com/ 53 B
321 B 461ms
148ms Fetch
image/gif 70.42.32.159
AS-OUTBRAIN

General

Check archive.org

Download Go to

Full URL

https://tr.outbrain.com/unifiedPixel?au=false&bust=07902859221146602&referrer=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fsource%3DCAFE1%26utm_source%3D%26utm_medium%3Demail%26utm_campaign%3D%26utm_content%3D%26osl%3D%26recip_id%3D%26bcid%3D%26step%3D2&marketerId=00048f41518fe36dfbeba4a95536b83263&name=PAGE_VIEW&dl=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fsource%3DCAFE1%26utm_source%3D%26utm_medium%3Demail%26utm_campaign%3D%26utm_content%3D%26osl%3D%26recip_id%3D%26bcid%3D%26step%3D2&g=0&zone=all&obApiVersion=1.1&obtpVersion=2.18.179

Requested by

Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

70.42.32.159 , United States, ASN22075 (AS-OUTBRAIN, US),

Reverse DNS

ny.outbrain.com

Software

Resource Hash

b51f3497b0a65f1e1e87e75f5e7e823d871c23bcf76a5ee4101783c8f939e553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/offer/tnt-default/?source=CAFE1&utm_source=&utm_medium=email&utm_campaign=&utm_content=&osl=&recip_id=&bcid=&step=2

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache
content-length: 54
content-encoding: br
date: Fri, 01 Aug 2025 06:23:21 GMT
content-type: image/gif;
x-traceid: 0a03a3e791ee0ea451615544c92449d7

GET
H/1.1 200
OK cachedClickId Show response
tr.outbrain.com/ 35 B
293 B 463ms
151ms Script
application/javascript 70.42.32.159
AS-OUTBRAIN

General

Check archive.org

Download Go to

Full URL

https://tr.outbrain.com/cachedClickId?marketerId=00048f41518fe36dfbeba4a95536b83263

Requested by

Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

70.42.32.159 , United States, ASN22075 (AS-OUTBRAIN, US),

Reverse DNS

ny.outbrain.com

Software

Resource Hash

1d348f9f803c95305f63def9d75fd50e79e54a375e1a4a888edbbea366845580

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 39
content-encoding: br
date: Fri, 01 Aug 2025 06:23:21 GMT
content-type: application/javascript
x-traceid: 7b99b701b94e3846f17fc4b26ff3dff9

GET
H2 200 sa.css
tags.srv.stackadapt.com/ 65 B
203 B 132ms
131ms Stylesheet
text/css 3.226.40.10
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.css
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.226.40.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-226-40-10.compute-1.amazonaws.com
Software: /
Resource Hash: 38d958c36c748a5525dcce1f8dbf7cd4aeb13592fdd40be447a3be8e711b5d11

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

access-control-allow-origin: *
cache-control: only-if-cached, no-transform, private, max-age=7776000
content-length: 65
date: Fri, 01 Aug 2025 06:23:20 GMT
content-type: text/css

GET
H2 200 sa.jpeg Show response
tags.srv.stackadapt.com/ 0
2 KB 394ms
132ms Fetch
image/jpeg 3.226.40.10
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.jpeg
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.226.40.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-226-40-10.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

access-control-allow-origin: *
cache-control: only-if-cached, no-transform, private, max-age=7776000
content-length: 651
date: Fri, 01 Aug 2025 06:23:21 GMT
content-type: image/jpeg

GET
H2 200 up Show response
ib.adnxs.com/pixie/ 9 B
318 B 408ms
133ms Fetch
application/xml 68.67.181.103
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL: https://ib.adnxs.com/pixie/up?pi=4be06a77-58f6-4195-bd1f-04e0c4ad8369
Requested by: Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/up/pixie.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 68.67.181.103 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS: 1041.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software: nginx/1.25.5 /
Resource Hash: e4b9a4d34a563158069f54e72a34585d7a2a25f753b9b30220d429d2bc8624b8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

access-control-max-age: 0
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
x-proxy-origin: 162.245.206.248; 162.245.206.248; 1041.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
access-control-allow-origin: https://www.markskousen.com
content-length: 9
date: Fri, 01 Aug 2025 06:23:21 GMT
content-type: application/xml
server: nginx/1.25.5
access-control-allow-headers: Content-Type

GET
H3 200 404669578233644 Show response
connect.facebook.net/signals/config/ 67 KB
13 KB 227ms
226ms Script
application/x-javascript 31.13.80.12
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/signals/config/404669578233644?v=2.9.221&r=stable&domain=www.markskousen.com&hme=6531127cc5702b048f1a4e2975833edefec3a60f8f391fe8ffb9a77b3d2626d1&ex_m=83%2C143%2C124%2C18%2C117%2C58%2C40%2C118%2C64%2C57%2C131%2C72%2C13%2C82%2C26%2C112%2C103%2C62%2C65%2C111%2C128%2C91%2C133%2C7%2C3%2C4%2C6%2C5%2C2%2C73%2C81%2C134%2C206%2C155%2C52%2C211%2C208%2C209%2C45%2C170%2C25%2C61%2C215%2C214%2C158%2C28%2C51%2C8%2C54%2C77%2C78%2C79%2C84%2C107%2C27%2C24%2C110%2C106%2C105%2C125%2C63%2C127%2C126%2C41%2C108%2C50%2C100%2C12%2C130%2C37%2C197%2C199%2C165%2C21%2C22%2C23%2C15%2C16%2C36%2C33%2C34%2C68%2C74%2C76%2C89%2C116%2C119%2C38%2C90%2C19%2C17%2C94%2C59%2C31%2C121%2C120%2C122%2C113%2C20%2C30%2C49%2C88%2C129%2C29%2C180%2C151%2C86%2C109%2C67%2C98%2C44%2C39%2C96%2C97%2C102%2C48%2C14%2C104%2C95%2C55%2C43%2C46%2C0%2C80%2C132%2C1%2C101%2C11%2C99%2C255%2C195%2C141%2C183%2C176%2C9%2C47%2C75%2C53%2C123%2C56%2C93%2C71%2C70%2C42%2C114%2C69%2C66%2C60%2C92%2C85%2C35%2C115%2C32%2C87%2C10%2C135

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.80.12 Toronto, Canada, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-yyz1.fbcdn.net

Software

Resource Hash

11ccff7375ac9c254d905e791f00fd6cf8a3bdc2b32f37c3456a491b6c207575

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' blob: ;script-src 'nonce-u0eoOeV0' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: 'self' https://.google-analytics.com .google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: .cdninstagram.com https://.google-analytics.com;font-src 'self' data: blob: ;img-src 'self' data: blob: https://.google-analytics.com;media-src 'self' data: blob: ;child-src 'self' data: blob: ;frame-src 'self' data: blob: ;manifest-src 'self' data: blob: ;object-src 'self' data: blob: ;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 01 Aug 2025 06:23:21 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' blob: *;script-src 'nonce-u0eoOeV0' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self' https://*.google-analytics.com *.google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com https://*.google-analytics.com;font-src 'self' data: blob: *;img-src 'self' data: blob: * https://*.google-analytics.com;media-src 'self' data: blob: *;child-src 'self' data: blob: *;frame-src 'self' data: blob: *;manifest-src 'self' data: blob: *;object-src 'self' data: blob: *;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=127, rtx=0, c=91, mss=1232, tbw=90982, tp=86, tpl=0, uplat=98, ullat=0
pragma: public
x-fb-debug: PYIkGai0jgc9XaszXJgYyrWEiYJ/Vhe6P4lNSImRMFVv//+jqLWKwyyIONNXaqrsRx2iuj9CAoSZPDyl098x5w==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 91C3 16 KB
6 KB 391ms
129ms Document
text/html 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/syncframe?topUrl=www.markskousen.com&origin=onetag

Requested by

Host: dynamic.criteo.com
URL: https://dynamic.criteo.com/js/ld/ld.js?a=113755

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

bd0b829514385fac308264642fd3fd5af08be3335de88dd514e8de8377d431cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.markskousen.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Fri, 01 Aug 2025 06:23:21 GMT
server: Kestrel
server-processing-duration-in-ticks: 253548
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 459 KB
152 KB 161ms
160ms Script
application/javascript 2607:f8b0:4006:80e::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-KRLWBDB6PF&cx=c&gtm=457e57u1za200&tag_exp=101509157~103116026~103200004~103233427~104684208~104684211~105087538~105087540~105103161~105103163

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-1592302-4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2008 Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5a8dcd0ed4c9296213b1ba23c1a33c15537383dcc309f5cc9aa60e601f5dd379

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

content-encoding: zstd
report-to: {"group":"ascgcycc:1099:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1099:0"}],}
expires: Fri, 01 Aug 2025 06:23:21 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 01 Aug 2025 06:23:21 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1099:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1099:0
content-length: 155522
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 51 KB
21 KB 226ms
77ms Script
text/javascript 2001:4860:4802:32::178
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-1592302-4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:32::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

f1a61277e3f902f50ab42015d8b07218db9b7601bb0967e54a52bfdcb4fa7e81

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

content-encoding: gzip
age: 5711
report-to: {"group":"ascnsrsgac:225:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Aug 2025 06:48:10 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 01 Aug 2025 04:48:10 GMT
last-modified: Tue, 15 Jul 2025 00:44:26 GMT
content-type: text/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgac:225:0
content-length: 20737
server: Golfe2

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 321 KB
115 KB 173ms
172ms Script
application/javascript 2607:f8b0:4006:80e::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10952545820&cx=c&gtm=457e57u1za200&tag_exp=101509157~103116026~103200004~103233427~104684208~104684211~105087538~105087540~105103161~105103163

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-1592302-4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2008 Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

21a052b68b494712201c0be763d964c8b7c7dcbfc08fce4b8fdc95027b8eac79

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

content-encoding: zstd
report-to: {"group":"ascgcycc:1099:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1099:0"}],}
expires: Fri, 01 Aug 2025 06:23:21 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 01 Aug 2025 06:23:21 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 01 Aug 2025 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1099:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1099:0
content-length: 117932
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 346 KB
122 KB 208ms
207ms Script
application/javascript 2607:f8b0:4006:80e::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-664724290&cx=c&gtm=457e57u1za200&tag_exp=101509157~103116026~103200004~103233427~104684208~104684211~105087538~105087540~105103161~105103163

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-1592302-4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2008 Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4c268d04bf0932e203ce0e88939fb0f64dc32e02ec0a46cdee736e6bca500f9f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

content-encoding: zstd
report-to: {"group":"ascgcycc:1099:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1099:0"}],}
expires: Fri, 01 Aug 2025 06:23:21 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 01 Aug 2025 06:23:21 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 01 Aug 2025 06:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1099:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1099:0
content-length: 124441
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 /
www.facebook.com/privacy_sandbox/topics/registration/ 67 B
0 303ms
170ms Fetch
image/png 31.13.80.36
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://www.facebook.com/privacy_sandbox/topics/registration/?id=404669578233644

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/signals/config/404669578233644?v=2.9.221&r=stable&domain=www.markskousen.com&hme=6531127cc5702b048f1a4e2975833edefec3a60f8f391fe8ffb9a77b3d2626d1&ex_m=83%2C143%2C124%2C18%2C117%2C58%2C40%2C118%2C64%2C57%2C131%2C72%2C13%2C82%2C26%2C112%2C103%2C62%2C65%2C111%2C128%2C91%2C133%2C7%2C3%2C4%2C6%2C5%2C2%2C73%2C81%2C134%2C206%2C155%2C52%2C211%2C208%2C209%2C45%2C170%2C25%2C61%2C215%2C214%2C158%2C28%2C51%2C8%2C54%2C77%2C78%2C79%2C84%2C107%2C27%2C24%2C110%2C106%2C105%2C125%2C63%2C127%2C126%2C41%2C108%2C50%2C100%2C12%2C130%2C37%2C197%2C199%2C165%2C21%2C22%2C23%2C15%2C16%2C36%2C33%2C34%2C68%2C74%2C76%2C89%2C116%2C119%2C38%2C90%2C19%2C17%2C94%2C59%2C31%2C121%2C120%2C122%2C113%2C20%2C30%2C49%2C88%2C129%2C29%2C180%2C151%2C86%2C109%2C67%2C98%2C44%2C39%2C96%2C97%2C102%2C48%2C14%2C104%2C95%2C55%2C43%2C46%2C0%2C80%2C132%2C1%2C101%2C11%2C99%2C255%2C195%2C141%2C183%2C176%2C9%2C47%2C75%2C53%2C123%2C56%2C93%2C71%2C70%2C42%2C114%2C69%2C66%2C60%2C92%2C85%2C35%2C115%2C32%2C87%2C10%2C135

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.80.36 Toronto, Canada, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-yyz1.facebook.com

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'nonce-SSJY29qE' blob: 'self' connect.facebook.net 'wasm-unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://trustly.one/ https://.trustly.one/ https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;child-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net accounts.meta.com .accounts.meta.com https://trustly.one/ https://.trustly.one/ https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;manifest-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;object-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

access-control-expose-headers: X-FB-Debug, X-Loader-Length, X-Stack, Error-MID
content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7533498914212725983&cpp=C3&cv=1025400200&st=1754029401532"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
observe-browsing-topics: ?1
expires: Sat, 01 Jan 2000 00:00:00 GMT
access-control-allow-methods: OPTIONS
alt-svc: h3=":443"; ma=86400
date: Fri, 01 Aug 2025 06:23:21 GMT
content-type: image/png
vary: Origin, Accept-Encoding
x-fb-debug: ju5Fa4hfRTJ9mccadzuNXkylf8w2csBvoiLz/IWXHBv23Su86rahoxED47nO876z4R0utXBURaKceTfAMPkfww==
priority: u=1,i
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7533498914212725983&cpp=C3&cv=1025400200&st=1754029401532", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-SSJY29qE' blob: 'self' connect.facebook.net 'wasm-unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com *.accounts.meta.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: GOOD; q=0.7, rtt=127, rtx=0, c=24, mss=1232, tbw=8709, tp=13, tpl=0, uplat=32, ullat=0
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
pragma: no-cache
cross-origin-resource-policy: same-origin
access-control-allow-credentials: true
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: *
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H3 200 /
www.facebook.com/tr/ 0
16 B 262ms
128ms Image
text/plain 31.13.80.36
FACEBOOK

General

Check archive.org

Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=404669578233644&ev=PageView&dl=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fsource%3DCAFE1%26utm_source%3D%26utm_medium%3Demail%26utm_campaign%3D%26utm_content%3D%26osl%3D%26recip_id%3D%26bcid%3D%26step%3D2&rl=&if=false&ts=1754029401306&sw=1600&sh=1200&v=2.9.221&r=stable&ec=0&o=12318&fbp=fb.1.1754029401303.414542839347540463&ler=empty&cdl=API_unavailable&pmd[title]=1-800-211-7661%20For%20Immediate%20Service!&plt=2312.7000007629395&it=1754029401025&coo=false&rqm=GET

Requested by

Host: www.markskousen.com
URL: https://www.markskousen.com/offer/tnt-default/?source=CAFE1&utm_source=&utm_medium=email&utm_campaign=&utm_content=&osl=&recip_id=&bcid=&step=2

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.80.36 Toronto, Canada, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-yyz1.facebook.com

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: GOOD; q=0.7, rtt=127, rtx=0, c=24, mss=1232, tbw=8757, tp=14, tpl=0, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Fri, 01 Aug 2025 06:23:21 GMT
content-type: text/plain
server: proxygen-bolt
priority: u=3,i

GET
H3 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
202 B 339ms
206ms Image
image/png 31.13.80.36
FACEBOOK

General

Check archive.org

Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=404669578233644&ev=PageView&dl=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fsource%3DCAFE1%26utm_source%3D%26utm_medium%3Demail%26utm_campaign%3D%26utm_content%3D%26osl%3D%26recip_id%3D%26bcid%3D%26step%3D2&rl=&if=false&ts=1754029401306&sw=1600&sh=1200&v=2.9.221&r=stable&ec=0&o=12318&fbp=fb.1.1754029401303.414542839347540463&ler=empty&cdl=API_unavailable&pmd[title]=1-800-211-7661%20For%20Immediate%20Service!&plt=2312.7000007629395&it=1754029401025&coo=false&rqm=FGET

Requested by

Host: www.markskousen.com
URL: https://www.markskousen.com/offer/tnt-default/?source=CAFE1&utm_source=&utm_medium=email&utm_campaign=&utm_content=&osl=&recip_id=&bcid=&step=2

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.80.36 Toronto, Canada, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-yyz1.facebook.com

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'nonce-wQJcmDrs' blob: 'self' connect.facebook.net 'wasm-unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://trustly.one/ https://.trustly.one/ https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;child-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net accounts.meta.com .accounts.meta.com https://trustly.one/ https://.trustly.one/ https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;manifest-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;object-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7533498913943863316&cpp=C3&cv=1025400200&st=1754029401532"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 01 Aug 2025 06:23:21 GMT
content-type: image/png
vary: Accept-Encoding
x-fb-debug: zjV8PXpydDI0OlQZu4P03R6iuw4/wPN7DqITTZOQHBAHWHEI+22v+mybnIiYax8iPBZruw8xhKQmar0xLSR8Tw==
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7533498913943863316&cpp=C3&cv=1025400200&st=1754029401532", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-wQJcmDrs' blob: 'self' connect.facebook.net 'wasm-unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com *.accounts.meta.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: GOOD; q=0.7, rtt=127, rtx=0, c=24, mss=1232, tbw=9077, tp=16, tpl=0, uplat=77, ullat=0
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
pragma: no-cache
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 all.css
use.fontawesome.com/releases/v5.0.6/css/ Frame 71CD 34 KB
9 KB 316ms
92ms Stylesheet
text/css 2606:4700:3037::ac43:8ef5
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://use.fontawesome.com/releases/v5.0.6/css/all.css
Requested by: Host: portal.publishersserviceassociates.com
URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:8ef5 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ed0f122470c4d13d86bbabdc38046d743d0228204a56d786d2e17bd83fd358ce

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://portal.publishersserviceassociates.com/

Response headers

cache-control: max-age=31556926
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
cf-cache-status: HIT
etag: W/"42eaa52604673b64d6b356c2fd7f87e3"
age: 1790391
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=skPEvVIi%2FdzKARh1KD8wdsXOS2RdH8rKZKVgkR9ocEZlME0Pph%2Fjgl21V6swlPbAEp39v2f%2BE55%2BtQLzq7BvL0Nb9t5S6BmGDTML1c0YFjYy%2FxOSndSjiSd6LDgYQhPnlKRg7gIfB%2FKIpk%2FUx7TGeEBz"}],"group":"cf-nel","max_age":604800}
cf-ray: 96833f100ab969b7-LAX
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=68398&min_rtt=67674&rtt_var=14926&sent=7&recv=10&lost=0&retrans=0&sent_bytes=4003&recv_bytes=2214&delivery_rate=57298&cwnd=253&unsent_bytes=0&cid=7bcf54d58b937af7&ts=99&x=0"
date: Fri, 01 Aug 2025 06:23:21 GMT
content-type: text/css
last-modified: Fri, 22 Sep 2023 01:44:11 GMT
vary: Accept-Encoding
server: cloudflare

GET
H/1.1 200
OK jquery-3.3.1.min.js Show response
portal.publishersserviceassociates.com/api_new_order/eaglestep/lib/js/ Frame 71CD 85 KB
85 KB 136ms
131ms Script
application/javascript 98.83.182.201
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/lib/js/jquery-3.3.1.min.js
Requested by: Host: portal.publishersserviceassociates.com
URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 98.83.182.201 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-98-83-182-201.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1

Response headers

Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 86927
Keep-Alive: timeout=5, max=99
Date: Fri, 01 Aug 2025 06:23:21 GMT
Last-Modified: Sat, 26 Apr 2025 12:05:30 GMT
Content-Type: application/javascript
Server: Apache

GET
H3 200 popper.min.js Show response
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/ Frame 71CD 19 KB
7 KB 191ms
97ms Script
application/javascript 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js

Requested by

Host: portal.publishersserviceassociates.com
URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 , Ascension Island, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Origin: https://portal.publishersserviceassociates.com
Referer: https://portal.publishersserviceassociates.com/

Response headers

cf-cdnjs-via: cfworker/kv
content-encoding: br
cf-cache-status: HIT
etag: "5eb03fa9-4af4"
age: 1559515
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wP2oMMrJLV5r7RHR9nKd7WoO7Jt0Snkfy7DeYK9IzybuOELtCUzdSXxbakHbvHQ1OtRecA1iATbrlzJWNigyJB5X0AnOpPuUlHbPlpl%2Bk4DEgVhlFyseuTXD%2FEYS5R7iLJ7bQFXI"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Wed, 22 Jul 2026 06:23:21 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 01 Aug 2025 06:23:21 GMT
content-type: application/javascript; charset=utf-8
last-modified: Mon, 04 May 2020 16:15:37 GMT
vary: Accept-Encoding
priority: u=1,i=?0
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 96833f0f3f991682-SJC
accept-ranges: bytes
access-control-allow-origin: *
content-length: 6157
server: cloudflare

GET
H3 200 bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/ Frame 71CD 141 KB
22 KB 222ms
136ms Stylesheet
text/css 104.18.10.207
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.10.207 , Ascension Island, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Origin: https://portal.publishersserviceassociates.com
Referer: https://portal.publishersserviceassociates.com/

Response headers

cdn-status: 200
content-encoding: br
cf-cache-status: HIT
etag: "450fc463b8b1a349df717056fbb3e078"
age: 1527645
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 01 Aug 2025 06:23:21 GMT
last-modified: Mon, 25 Jan 2021 22:04:04 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
cdn-cache: HIT
cdn-cachedat: 11/06/2024 03:50:35
cdn-requestpullcode: 200
priority: u=0,i=?0
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31919000
cdn-requestpullsuccess: True
timing-allow-origin: *
cdn-requesttime: 0
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 0f69ee99c5dbaca0816f63a1d3acd903
cross-origin-resource-policy: cross-origin
cdn-pullzone: 252412
cdn-proxyver: 1.06
cf-ray: 96833f0f2c88092a-LAX
access-control-allow-origin: *
cdn-edgestorageid: 994
server: cloudflare
cdn-requestcountrycode: US

GET
H3 200 bootstrap.min.js Show response
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/ Frame 71CD 48 KB
14 KB 173ms
88ms Script
application/javascript 104.18.10.207
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.10.207 , Ascension Island, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Origin: https://portal.publishersserviceassociates.com
Referer: https://portal.publishersserviceassociates.com/

Response headers

cdn-status: 200
content-encoding: br
cf-cache-status: HIT
etag: "14d449eb8876fa55e1ef3c2cc52b0c17"
age: 1522268
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 01 Aug 2025 06:23:21 GMT
last-modified: Mon, 25 Jan 2021 22:04:04 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
cdn-cache: HIT
cdn-cachedat: 01/19/2025 11:33:42
cdn-requestpullcode: 200
priority: u=1,i=?0
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31919000
cdn-requestpullsuccess: True
timing-allow-origin: *
cdn-requesttime: 0
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 5b51f286b7e7cd95e6b823c0a96f5d65
cross-origin-resource-policy: cross-origin
cdn-pullzone: 252412
cdn-proxyver: 1.07
cf-ray: 96833f0f2c8b092a-LAX
access-control-allow-origin: *
cdn-edgestorageid: 1001
server: cloudflare
cdn-requestcountrycode: US

GET
H/1.1 200
OK sweetalert-min.js Show response
portal.publishersserviceassociates.com/api_new_order/eaglestep/lib/sweetalert/dist/ Frame 71CD 17 KB
17 KB 392ms
131ms Script
application/javascript 98.83.182.201
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/lib/sweetalert/dist/sweetalert-min.js
Requested by: Host: portal.publishersserviceassociates.com
URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 98.83.182.201 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-98-83-182-201.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 7a056fc64aba501090c8acd106b0c7bbc9a267914e695ae34aa42a6ae2a094a7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1

Response headers

Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 16977
Keep-Alive: timeout=5, max=100
Date: Fri, 01 Aug 2025 06:23:21 GMT
Last-Modified: Sat, 26 Apr 2025 12:05:34 GMT
Content-Type: application/javascript
Server: Apache

GET
H/1.1 200
OK sweetalert-dev.js Show response
portal.publishersserviceassociates.com/api_new_order/eaglestep/lib/sweetalert/dist/ Frame 71CD 119 KB
119 KB 409ms
131ms Script
application/javascript 98.83.182.201
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/lib/sweetalert/dist/sweetalert-dev.js
Requested by: Host: portal.publishersserviceassociates.com
URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 98.83.182.201 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-98-83-182-201.compute-1.amazonaws.com
Software: Apache /
Resource Hash: aeb1029c722f633ac0973d12883b9e1f6025d5d5a4ff54d6efaada31595866d4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1

Response headers

Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 121799
Keep-Alive: timeout=5, max=98
Date: Fri, 01 Aug 2025 06:23:21 GMT
Last-Modified: Sat, 26 Apr 2025 12:05:34 GMT
Content-Type: application/javascript
Server: Apache

GET
H/1.1 200
OK fonts.css
portal.publishersserviceassociates.com/api_new_order/eaglestep/lib/css/fonts/ Frame 71CD 2 KB
3 KB 389ms
130ms Stylesheet
text/css 98.83.182.201
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/lib/css/fonts/fonts.css
Requested by: Host: portal.publishersserviceassociates.com
URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 98.83.182.201 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-98-83-182-201.compute-1.amazonaws.com
Software: Apache /
Resource Hash: fdcf8ec0ab19bed1fe68c8b014aeea1a4f9e2371d90317d3fb1714b98ee20bd0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1

Response headers

Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 2354
Keep-Alive: timeout=5, max=100
Date: Fri, 01 Aug 2025 06:23:21 GMT
Last-Modified: Sat, 26 Apr 2025 12:05:15 GMT
Content-Type: text/css
Server: Apache

GET
H/1.1 200
OK ccStyles.css
portal.publishersserviceassociates.com/api_new_order/eaglestep/lib/css/ Frame 71CD 2 KB
2 KB 390ms
131ms Stylesheet
text/css 98.83.182.201
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/lib/css/ccStyles.css
Requested by: Host: portal.publishersserviceassociates.com
URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 98.83.182.201 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-98-83-182-201.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 21c889e49fa852e60c3d490969f3b70bc1c0e36934901494282f65f1a2bcd94b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1

Response headers

Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 1916
Keep-Alive: timeout=5, max=100
Date: Fri, 01 Aug 2025 06:23:21 GMT
Last-Modified: Sat, 26 Apr 2025 12:05:08 GMT
Content-Type: text/css
Server: Apache

GET
H/1.1 200
OK myCss.css
portal.publishersserviceassociates.com/api_new_order/eaglestep/lib/css/ Frame 71CD 4 KB
4 KB 391ms
132ms Stylesheet
text/css 98.83.182.201
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/lib/css/myCss.css
Requested by: Host: portal.publishersserviceassociates.com
URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 98.83.182.201 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-98-83-182-201.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 6a49a4427b7260eb569eed0bc6ba6873b5d0ee09f5af60467d8af1a7fbfec74f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1

Response headers

Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 3633
Keep-Alive: timeout=5, max=100
Date: Fri, 01 Aug 2025 06:23:21 GMT
Last-Modified: Sat, 26 Apr 2025 12:05:28 GMT
Content-Type: text/css
Server: Apache

GET
H/1.1 200
OK sweetalert.css
portal.publishersserviceassociates.com/api_new_order/eaglestep/lib/sweetalert/dist/ Frame 71CD 26 KB
26 KB 391ms
133ms Stylesheet
text/css 98.83.182.201
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/lib/sweetalert/dist/sweetalert.css
Requested by: Host: portal.publishersserviceassociates.com
URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 98.83.182.201 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-98-83-182-201.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 79fbd2b7c75abab376338d23ffc36142090a20e85f8a565d9cbd356369ab3376

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1

Response headers

Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 26484
Keep-Alive: timeout=5, max=100
Date: Fri, 01 Aug 2025 06:23:21 GMT
Last-Modified: Sat, 26 Apr 2025 12:05:34 GMT
Content-Type: text/css
Server: Apache

GET
H/1.1 200
OK jquery.payform.min.js Show response
portal.publishersserviceassociates.com/api_new_order/eaglestep/lib/js/payform/ Frame 71CD 12 KB
12 KB 522ms
130ms Script
application/javascript 98.83.182.201
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/lib/js/payform/jquery.payform.min.js
Requested by: Host: portal.publishersserviceassociates.com
URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 98.83.182.201 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-98-83-182-201.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 36ffdd405b6980a907fdab4c5374bc2e7230e941d3256352f222af866c3300e0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1

Response headers

Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 12509
Keep-Alive: timeout=5, max=99
Date: Fri, 01 Aug 2025 06:23:21 GMT
Last-Modified: Sat, 26 Apr 2025 12:05:31 GMT
Content-Type: application/javascript
Server: Apache

GET
H/1.1 200
OK payform.min.js Show response
portal.publishersserviceassociates.com/api_new_order/eaglestep/lib/js/payform/ Frame 71CD 11 KB
11 KB 523ms
131ms Script
application/javascript 98.83.182.201
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/lib/js/payform/payform.min.js
Requested by: Host: portal.publishersserviceassociates.com
URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 98.83.182.201 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-98-83-182-201.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 29f8b2ccdea52ea5390c1a39788e92f5ed74259c271370997b583eb87bc84558

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1

Response headers

Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 11503
Keep-Alive: timeout=5, max=99
Date: Fri, 01 Aug 2025 06:23:21 GMT
Last-Modified: Sat, 26 Apr 2025 12:05:31 GMT
Content-Type: application/javascript
Server: Apache

GET
H/1.1 200
OK ccScript.js Show response
portal.publishersserviceassociates.com/api_new_order/eaglestep/lib/js/ Frame 71CD 3 KB
3 KB 527ms
134ms Script
application/javascript 98.83.182.201
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/lib/js/ccScript.js
Requested by: Host: portal.publishersserviceassociates.com
URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 98.83.182.201 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-98-83-182-201.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 1796f3d848ccc9704e0a846d1d15239fa98072afd955c339d07fdb39aa16f850

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1

Response headers

Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 2587
Keep-Alive: timeout=5, max=99
Date: Fri, 01 Aug 2025 06:23:21 GMT
Last-Modified: Sat, 26 Apr 2025 12:05:30 GMT
Content-Type: application/javascript
Server: Apache

GET
H/1.1 200
OK myScript.js Show response
portal.publishersserviceassociates.com/api_new_order/eaglestep/lib/js/ Frame 71CD 3 KB
3 KB 555ms
131ms Script
application/javascript 98.83.182.201
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/lib/js/myScript.js
Requested by: Host: portal.publishersserviceassociates.com
URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 98.83.182.201 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-98-83-182-201.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 7ff12bc5d49a7ae9ef0746710ec99ffe75911d50eeeb926f8238239bb59fae8f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1

Response headers

Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 2792
Keep-Alive: timeout=5, max=97
Date: Fri, 01 Aug 2025 06:23:21 GMT
Last-Modified: Sat, 26 Apr 2025 12:05:30 GMT
Content-Type: application/javascript
Server: Apache

GET
H/1.1 200
OK validate.js Show response
portal.publishersserviceassociates.com/api_new_order/eaglestep/lib/js/ Frame 71CD 1 KB
1 KB 651ms
131ms Script
application/javascript 98.83.182.201
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/lib/js/validate.js
Requested by: Host: portal.publishersserviceassociates.com
URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 98.83.182.201 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-98-83-182-201.compute-1.amazonaws.com
Software: Apache /
Resource Hash: aad35927e32b1b042ca39cf0be49c7294024abf292548af7146263cd09f072ad

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1

Response headers

Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 1240
Keep-Alive: timeout=5, max=99
Date: Fri, 01 Aug 2025 06:23:21 GMT
Last-Modified: Sat, 26 Apr 2025 12:05:31 GMT
Content-Type: application/javascript
Server: Apache

GET
H/1.1 200
OK creditcard.js Show response
portal.publishersserviceassociates.com/includes/js/ Frame 71CD 6 KB
7 KB 654ms
131ms Script
application/javascript 98.83.182.201
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://portal.publishersserviceassociates.com/includes/js/creditcard.js
Requested by: Host: portal.publishersserviceassociates.com
URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 98.83.182.201 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-98-83-182-201.compute-1.amazonaws.com
Software: Apache /
Resource Hash: ebd8f94863810d3212d7aeed8e4194757e9f709eb885d9dff414808d5bf643f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1

Response headers

Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 6642
Keep-Alive: timeout=5, max=99
Date: Fri, 01 Aug 2025 06:23:21 GMT
Last-Modified: Tue, 28 Jul 2020 14:45:22 GMT
Content-Type: application/javascript
Server: Apache

GET
H/1.1 200
OK email.js Show response
portal.publishersserviceassociates.com/includes/js/ Frame 71CD 14 KB
14 KB 659ms
131ms Script
application/javascript 98.83.182.201
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://portal.publishersserviceassociates.com/includes/js/email.js
Requested by: Host: portal.publishersserviceassociates.com
URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 98.83.182.201 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-98-83-182-201.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 45f94e41488f521fd6bf9ba0c125e0ec4311a7d3ee85f0cc0ceb25355612ed0c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1

Response headers

Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 14108
Keep-Alive: timeout=5, max=98
Date: Fri, 01 Aug 2025 06:23:21 GMT
Last-Modified: Mon, 18 Oct 2021 12:53:16 GMT
Content-Type: application/javascript
Server: Apache

GET
H3 200 api.js Show response
www.google.com/recaptcha/ Frame 71CD 2 KB
1023 B 427ms
155ms Script
text/javascript 142.251.40.196
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google.com/recaptcha/api.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.196 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

903ea4bc840182256e71fe24df3c64406f2b66f7a1e7e5a3a8f6482fea49ac34

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://portal.publishersserviceassociates.com/

Response headers

cache-control: private, max-age=300
content-encoding: gzip
cross-origin-resource-policy: cross-origin
report-to: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
x-content-type-options: nosniff
expires: Fri, 01 Aug 2025 06:23:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
date: Fri, 01 Aug 2025 06:23:22 GMT
x-xss-protection: 0
content-type: text/javascript; charset=utf-8
server: ESF
x-frame-options: SAMEORIGIN

GET
H2 200 giphy.gif
media.giphy.com/media/VmcExEoWjpKpi/ Frame 71CD 404 KB
405 KB 413ms
134ms Image
image/gif 199.232.37.155
FASTLY

General

Check archive.org

Download Go to Show image

Full URL

https://media.giphy.com/media/VmcExEoWjpKpi/giphy.gif

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

199.232.37.155 New York, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

8377cc53127cd4199615d1524851679c737c2af63665e35888051079f5e71875

Security Headers

Name	Value
Strict-Transport-Security	max-age=15465600

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://portal.publishersserviceassociates.com/

Response headers

x-robots-tag: noai, noimageai
etag: "cf93a92d19fd43e340b84c224e574dd0"
age: 1351989
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT, HIT
date: Fri, 01 Aug 2025 06:23:21 GMT
last-modified: Tue, 22 Apr 2025 16:36:29 GMT
content-type: image/gif
x-served-by: cache-iad-kiad7000162-IAD, cache-iad-kiad7000162-IAD, cache-lga21972-LGA
x-cache-hits: 736, 0
strict-transport-security: max-age=15465600
cache-control: max-age=604800
x-timer: S1754029402.697848,VS0,VE1
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
x-fastly-origin: 1
content-length: 414046

GET
H/1.1 200
OK discover.jpg
portal.publishersserviceassociates.com/api_new_order/eaglestep/lib/css/img/ Frame 71CD 17 KB
18 KB 130ms
129ms Image
image/jpeg 98.83.182.201
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/lib/css/img/discover.jpg
Requested by: Host: portal.publishersserviceassociates.com
URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 98.83.182.201 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-98-83-182-201.compute-1.amazonaws.com
Software: Apache /
Resource Hash: d4b9c68bb00d464f6f14d48f2425c46c769936450c7f3c42e97176261203682d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1

Response headers

Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 17892
Keep-Alive: timeout=5, max=98
Date: Fri, 01 Aug 2025 06:23:21 GMT
Last-Modified: Sat, 26 Apr 2025 12:05:28 GMT
Content-Type: image/jpeg
Server: Apache

GET
H/1.1 200
OK amex.jpg
portal.publishersserviceassociates.com/api_new_order/eaglestep/lib/css/img/ Frame 71CD 18 KB
19 KB 130ms
130ms Image
image/jpeg 98.83.182.201
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/lib/css/img/amex.jpg
Requested by: Host: portal.publishersserviceassociates.com
URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 98.83.182.201 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-98-83-182-201.compute-1.amazonaws.com
Software: Apache /
Resource Hash: c954bc020b00b069f510aa44616c3103be0c427dfd561ff91900d71407ef0837

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1

Response headers

Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 18750
Keep-Alive: timeout=5, max=97
Date: Fri, 01 Aug 2025 06:23:22 GMT
Last-Modified: Sat, 26 Apr 2025 12:05:28 GMT
Content-Type: image/jpeg
Server: Apache

GET
H/1.1 200
OK mastercard.jpg
portal.publishersserviceassociates.com/api_new_order/eaglestep/lib/css/img/ Frame 71CD 22 KB
22 KB 131ms
130ms Image
image/jpeg 98.83.182.201
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/lib/css/img/mastercard.jpg
Requested by: Host: portal.publishersserviceassociates.com
URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 98.83.182.201 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-98-83-182-201.compute-1.amazonaws.com
Software: Apache /
Resource Hash: bd08dda2128b59285816bb1cff72687dc7f9745b4772129147cc3afc93b41d15

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1

Response headers

Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 22554
Keep-Alive: timeout=5, max=96
Date: Fri, 01 Aug 2025 06:23:22 GMT
Last-Modified: Sat, 26 Apr 2025 12:05:28 GMT
Content-Type: image/jpeg
Server: Apache

GET
H/1.1 200
OK visa.jpg
portal.publishersserviceassociates.com/api_new_order/eaglestep/lib/css/img/ Frame 71CD 20 KB
20 KB 132ms
131ms Image
image/jpeg 98.83.182.201
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/lib/css/img/visa.jpg
Requested by: Host: portal.publishersserviceassociates.com
URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 98.83.182.201 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-98-83-182-201.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 5962768954c0ea0e4a1f59fcbcce1bfd8066e1d67438b56e21bc7023e01f3113

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1

Response headers

Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 20023
Keep-Alive: timeout=5, max=97
Date: Fri, 01 Aug 2025 06:23:22 GMT
Last-Modified: Sat, 26 Apr 2025 12:05:28 GMT
Content-Type: image/jpeg
Server: Apache

POST
H3 200 collect
www.google.com/ccm/ 0
0 426ms
153ms Ping
text/plain 142.251.40.196
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google.com/ccm/collect?tid=AW-664724290&en=page_view&dl=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F&scrsrc=www.googletagmanager.com&frm=0&rnd=1884187447.1754029401&dt=1-800-211-7661%20For%20Immediate%20Service!&auid=1251415113.1754029401&navt=n&npa=0&gtm=45be57u1v9166407685za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~103116026~103200004~103233427~104684208~104684211~104948813~105087538~105087540~105103161~105103163~105113532&tft=1754029401385&tfd=3153&apve=1&apvf=sb
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-664724290
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.40.196 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga34s38-in-f4.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/664724290/ 4 KB
2 KB 425ms
156ms Script
text/javascript 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/664724290/?random=1754029401371&cv=11&fst=1754029401371&bg=ffffff&guid=ON&async=1&en=gtag.config&gtm=45be57u1v9166407685za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~103116026~103200004~103233427~104684208~104684211~104948813~105087538~105087540~105103161~105103163~105113532&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fsource%3DCAFE1%26utm_source%3D%26utm_medium%3Demail%26utm_campaign%3D%26utm_content%3D%26osl%3D%26recip_id%3D%26bcid%3D%26step%3D2&hn=www.googleadservices.com&frm=0&tiba=1-800-211-7661%20For%20Immediate%20Service!&npa=0&pscdl=noapi&auid=1251415113.1754029401&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-664724290

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c01f6a5c5d37b4a904e1b82c235b8191a595f21f303756b741de36451684aaf1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2106
date: Fri, 01 Aug 2025 06:23:21 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 664724290 Show response
td.doubleclick.net/td/rul/ Frame 1A4C 13 B
176 B 446ms
162ms Document
text/html 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://td.doubleclick.net/td/rul/664724290?random=1754029401371&cv=11&fst=1754029401371&fmt=3&bg=ffffff&guid=ON&async=1&en=gtag.config&gtm=45be57u1v9166407685za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~103116026~103200004~103233427~104684208~104684211~104948813~105087538~105087540~105103161~105103163~105113532&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fsource%3DCAFE1%26utm_source%3D%26utm_medium%3Demail%26utm_campaign%3D%26utm_content%3D%26osl%3D%26recip_id%3D%26bcid%3D%26step%3D2&hn=www.googleadservices.com&frm=0&tiba=1-800-211-7661%20For%20Immediate%20Service!&npa=0&pscdl=noapi&auid=1251415113.1754029401&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-664724290

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b633a587c652d02386c4f16f8c6f6aab7352d97f16367c3c40576214372dd628

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.markskousen.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 01 Aug 2025 06:23:21 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 664724290
google.com/ccm/form-data/ 0
20 B 421ms
148ms Ping
text/plain 142.250.72.110
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://google.com/ccm/form-data/664724290?gtm=45be57u1pfv9166407685za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~103116026~103200004~103233427~104684208~104684211~104948813~105087538~105087540~105103161~105103163~105113532&npa=0&frm=0&pscdl=noapi&auid=1251415113.1754029401&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_mode=a&em=tv.1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-664724290
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.72.110 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga34s32-in-f14.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:67:0
report-to: {"group":"ascnsrsgac:67:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:67:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.markskousen.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgac:67:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 01 Aug 2025 06:23:21 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/664724290/ 4 KB
2 KB 420ms
163ms Script
text/javascript 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/664724290/?random=1754029401410&cv=11&fst=1754029401410&bg=ffffff&guid=ON&async=1&en=checkout_progress&gtm=45be57u1v9166407685za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~103116026~103200004~103233427~104684208~104684211~104948813~105087538~105087540~105103161~105103163~105113532&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fsource%3DCAFE1%26utm_source%3D%26utm_medium%3Demail%26utm_campaign%3D%26utm_content%3D%26osl%3D%26recip_id%3D%26bcid%3D%26step%3D2&hn=www.googleadservices.com&frm=0&tiba=1-800-211-7661%20For%20Immediate%20Service!&npa=0&pscdl=noapi&auid=1251415113.1754029401&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dcheckout_progress%3Bcheckout_step%3D3%3Bid%3DSIXTEEN&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-664724290

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9634874f7448fd47593dfcc39e254dc6e14f248a2e940f77c2bc3f22298d60bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2124
date: Fri, 01 Aug 2025 06:23:21 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 664724290 Show response
td.doubleclick.net/td/rul/ Frame 0037 13 B
523 B 429ms
157ms Document
text/html 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://td.doubleclick.net/td/rul/664724290?random=1754029401410&cv=11&fst=1754029401410&fmt=3&bg=ffffff&guid=ON&async=1&en=checkout_progress&gtm=45be57u1v9166407685za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~103116026~103200004~103233427~104684208~104684211~104948813~105087538~105087540~105103161~105103163~105113532&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fsource%3DCAFE1%26utm_source%3D%26utm_medium%3Demail%26utm_campaign%3D%26utm_content%3D%26osl%3D%26recip_id%3D%26bcid%3D%26step%3D2&hn=www.googleadservices.com&frm=0&tiba=1-800-211-7661%20For%20Immediate%20Service!&npa=0&pscdl=noapi&auid=1251415113.1754029401&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dcheckout_progress%3Bcheckout_step%3D3%3Bid%3DSIXTEEN

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-664724290

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b633a587c652d02386c4f16f8c6f6aab7352d97f16367c3c40576214372dd628

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.markskousen.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 01 Aug 2025 06:23:21 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 1x1.gif
a.mgid.com/ 43 B
300 B 140ms
140ms Image
image/gif 104.17.199.65
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://a.mgid.com/1x1.gif?id=686589&type=c&tg=&r=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fsource%3DCAFE1%26utm_source%3D%26utm_medium%3Demail%26utm_campaign%3D%26utm_content%3D%26osl%3D%26recip_id%3D%26bcid%3D%26step%3D2&nv=1&clid=&d=1754029401424

Requested by

Host: www.markskousen.com
URL: https://www.markskousen.com/offer/tnt-default/?source=CAFE1&utm_source=&utm_medium=email&utm_campaign=&utm_content=&osl=&recip_id=&bcid=&step=2

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.199.65 , Ascension Island, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

strict-transport-security: max-age=15552000; includeSubDomains; preload
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
cf-ray: 96833f0f2865ed39-SJC
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
content-length: 43
date: Fri, 01 Aug 2025 06:23:21 GMT
content-type: image/gif
server: cloudflare
priority: u=3,i

GET
H2 200 sw_iframe.html Show response
www.googletagmanager.com/static/service_worker/57v0/ Frame 23ED 3 KB
2 KB 407ms
134ms Document
text/html 2607:f8b0:4006:80e::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/static/service_worker/57v0/sw_iframe.html?origin=https%3A%2F%2Fwww.markskousen.com

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-664724290

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2008 Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2ada301d803d8f4b2ba210c9c57091378255ed54b96e4236a9e2ce587a2a4035

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 50643
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 1486
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="analytics-container-tag-serving"
cross-origin-resource-policy: cross-origin
date: Thu, 31 Jul 2025 16:19:18 GMT
expires: Fri, 31 Jul 2026 16:19:18 GMT
last-modified: Thu, 31 Jul 2025 09:38:00 GMT
report-to: {"group":"analytics-container-tag-serving","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/analytics-container-tag-serving"}]}
server: sffe
service-worker-allowed: /static/service_worker
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 topics_api Show response
psb.taboola.com/ 65 B
284 B 1090ms
221ms Fetch
text/html 151.101.129.44
FASTLY

General

Check archive.org

Download Go to

Full URL: https://psb.taboola.com/topics_api
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1255890/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: e7112b70eed95d42b178135728e6153e34f07001827870748de87cd7dec3538e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

cache-control: private, max-age=2592000
retry-after: 0
x-timer: S1754029402.425565,VS0,VE0
observe-browsing-topics: ?1
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
x-cache: HIT
content-length: 65
date: Fri, 01 Aug 2025 06:23:22 GMT
content-type: text/html; charset=utf-8
x-served-by: cache-toj-leto2350052-TOJ
server: Varnish
x-cache-hits: 0

GET
H2 200 json Show response
trc.taboola.com/1255890/trc/3/ 3 KB
2 KB 293ms
272ms Script
application/javascript 151.101.193.44
FASTLY

General

Check archive.org

Download Go to

Full URL: https://trc.taboola.com/1255890/trc/3/json?tim=1754029401471&data=%7B%22id%22%3A798%2C%22ii%22%3A%22%2Foffer%2Ftnt-default%22%2C%22it%22%3A%22video%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22vi%22%3A1754029401441%2C%22cv%22%3A%2220250727-18-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D2%22%2C%22e%22%3Anull%2C%22cb%22%3A%22TFASC.trkCallback%22%2C%22qs%22%3A%22%3Fsource%3DCAFE1%26utm_source%3D%26utm_medium%3Demail%26utm_campaign%3D%26utm_content%3D%26osl%3D%26recip_id%3D%26bcid%3D%26step%3D2%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-tracking%22%2C%22s%22%3A0%2C%22uim%22%3A%22rbox-tracking%3Apub%3Deaglepub-sc%3Aabp%3D0%22%2C%22uip%22%3A%22rbox-tracking%22%2C%22orig_uip%22%3A%22rbox-tracking%22%7D%5D%2C%22mpvd%22%3A%7B%22en%22%3A%22page_view%22%2C%22tim%22%3A1754029401469%2C%22ref%22%3Anull%2C%22item-url%22%3A%22https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fsource%3DCAFE1%26utm_source%3D%26utm_medium%3Demail%26utm_campaign%3D%26utm_content%3D%26osl%3D%26recip_id%3D%26bcid%3D%26step%3D2%22%2C%22tos%22%3A20%2C%22ssd%22%3A1%2C%22scd%22%3A0%2C%22it%22%3A%22JS_PIXEL%22%2C%22supv%22%3Atrue%7D%2C%22pa%22%3A%7B%22su%22%3Atrue%7D%2C%22psb%22%3Atrue%7D&pubit=i
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1255890/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.44 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 181811b860bdd1dec3b61706c40584296979aa1841c36642c1abef80b623358b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

content-encoding: gzip
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-log-content-encoding: gzip
date: Fri, 01 Aug 2025 06:23:21 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-mad22055-MAD
x-cache-hits: 0
vary: Accept-Encoding
x-fastly-to-nlb-rtt: 25783
x-timer: S1754029402.606945,VS0,VE48
x-vcl-time-ms: 48
access-control-allow-credentials: true
via: 1.1 varnish
cpu: 0.1535
accept-ranges: bytes
access-control-allow-origin: *
x-service-version: v1
server: nginx

GET
H2 200 saq_pxl Show response
tags.srv.stackadapt.com/ 116 B
313 B 133ms
132ms XHR
text/plain 3.226.40.10
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://tags.srv.stackadapt.com/saq_pxl?uid=Rnj95QK_KHf0X2j-7pY9AQ&is_js=true&landing_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fsource%3DCAFE1%26utm_source%3D%26utm_medium%3Demail%26utm_campaign%3D%26utm_content%3D%26osl%3D%26recip_id%3D%26bcid%3D%26step%3D2&t=1-800-211-7661%20For%20Immediate%20Service!&tip=1FixHHqoLAHKSPb_Eyulx2PGYdiCvbWi7Obku5hCtnI&host=https%3A%2F%2Fwww.markskousen.com&l_src=&l_src_d=&u_src=&u_src_d=&shop=false&sa-user-id-v3=s%253AAQAKINP6C5bZG_PyMfHFoncdHsbe8k9lUqMWqcqZCt20K5mcENYBGAQg2LqxxAYwAToE-HPLOkIEsgsgRA.q3gdMHdZ6nO%252FuQeDiBxhPr0iQ41jf%252BVeXTncE1sap0s&sa-user-id-v2=s%253AMgoQMWusXnRTIiMc0uYG6KL1zvg.UZfu3FaMjn13l7lhfIidXL%252BmjOlPQ4OgKtJPEMPImjA&sa-user-id=s%253A0-320a1031-6bac-5e74-5322-231cd2e606e8.u01W8L7ei1eTPnE8d7R8XI7bZc6EN1PQH6%252FFCFl5hlw
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.226.40.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-226-40-10.compute-1.amazonaws.com
Software: /
Resource Hash: 096e6d22b36ca5706d4d1246cc50392c381081f87aa03990ae4231ae23509bf9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

access-control-allow-methods: GET
access-control-allow-origin: https://www.markskousen.com
content-length: 116
date: Fri, 01 Aug 2025 06:23:21 GMT
content-type: text/plain; charset=utf-8
access-control-allow-credentials: true
access-control-allow-headers: *

GET
H2 200 pixie
ib.adnxs.com/ 42 B
229 B 128ms
126ms Image
image/gif 68.67.181.103
ASN-APPNEX

General

Check archive.org

Download Go to Show image

Full URL: https://ib.adnxs.com/pixie?e=PageView&pi=4be06a77-58f6-4195-bd1f-04e0c4ad8369&it=1754029400940&v=0.0.45&u=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fsource%3DCAFE1%26utm_source%3D%26utm_medium%3Demail%26utm_campaign%3D%26utm_content%3D%26osl%3D%26recip_id%3D%26bcid%3D%26step%3D2&st=1754029400940&et=1754029401476&if=0&uetmsmid=629cd16f-3c3a-46c3-95c8-92ad51d091e3&asce=0&ascc=0&tcfhl=0&tcfe=0&tcfgdpr=0&tcfc=0
Requested by: Host: www.markskousen.com
URL: https://www.markskousen.com/offer/tnt-default/?source=CAFE1&utm_source=&utm_medium=email&utm_campaign=&utm_content=&osl=&recip_id=&bcid=&step=2
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 68.67.181.103 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS: 1041.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software: nginx/1.25.5 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 42
date: Fri, 01 Aug 2025 06:23:21 GMT
content-type: image/gif
server: nginx/1.25.5
x-proxy-origin: 162.245.206.248; 162.245.206.248; 1041.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com

GET
H2 200 ec.js Show response
www.google-analytics.com/plugins/ua/ 3 KB
1 KB 70ms
67ms Script
text/javascript 2001:4860:4802:32::178
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/ec.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:32::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

content-encoding: br
age: 537
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
x-content-type-options: nosniff
expires: Fri, 01 Aug 2025 07:14:24 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 01 Aug 2025 06:14:24 GMT
last-modified: Tue, 27 Jun 2023 17:28:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=3600
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
content-length: 1129
x-xss-protection: 0
server: sffe

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10952545820/ 4 KB
2 KB 166ms
165ms Script
text/javascript 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10952545820/?random=1754029401630&cv=11&fst=1754029401630&bg=ffffff&guid=ON&async=1&en=gtag.config&gtm=45be57u1v890172026za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~103116026~103200004~103233427~104684208~104684211~104948813~105087538~105087540~105103161~105103163~105174035&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fsource%3DCAFE1%26utm_source%3D%26utm_medium%3Demail%26utm_campaign%3D%26utm_content%3D%26osl%3D%26recip_id%3D%26bcid%3D%26step%3D2&hn=www.googleadservices.com&frm=0&tiba=1-800-211-7661%20For%20Immediate%20Service!&npa=0&pscdl=noapi&auid=1251415113.1754029401&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10952545820&cx=c&gtm=457e57u1za200&tag_exp=101509157~103116026~103200004~103233427~104684208~104684211~105087538~105087540~105103161~105103163

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8dfd8d9c85feb943bb1c27ccf740584c80cdb27b1882e222094ebb80fd2f93fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2105
date: Fri, 01 Aug 2025 06:23:21 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 10952545820 Show response
td.doubleclick.net/td/rul/ Frame 2ED9 13 B
176 B 176ms
160ms Document
text/html 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://td.doubleclick.net/td/rul/10952545820?random=1754029401630&cv=11&fst=1754029401630&fmt=3&bg=ffffff&guid=ON&async=1&en=gtag.config&gtm=45be57u1v890172026za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~103116026~103200004~103233427~104684208~104684211~104948813~105087538~105087540~105103161~105103163~105174035&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fsource%3DCAFE1%26utm_source%3D%26utm_medium%3Demail%26utm_campaign%3D%26utm_content%3D%26osl%3D%26recip_id%3D%26bcid%3D%26step%3D2&hn=www.googleadservices.com&frm=0&tiba=1-800-211-7661%20For%20Immediate%20Service!&npa=0&pscdl=noapi&auid=1251415113.1754029401&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b633a587c652d02386c4f16f8c6f6aab7352d97f16367c3c40576214372dd628

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.markskousen.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 01 Aug 2025 06:23:21 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10952545820/ 4 KB
2 KB 167ms
167ms Script
text/javascript 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10952545820/?random=1754029401678&cv=11&fst=1754029401678&bg=ffffff&guid=ON&async=1&en=checkout_progress&gtm=45be57u1v890172026za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~103116026~103200004~103233427~104684208~104684211~104948813~105087538~105087540~105103161~105103163~105174035&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fsource%3DCAFE1%26utm_source%3D%26utm_medium%3Demail%26utm_campaign%3D%26utm_content%3D%26osl%3D%26recip_id%3D%26bcid%3D%26step%3D2&hn=www.googleadservices.com&frm=0&tiba=1-800-211-7661%20For%20Immediate%20Service!&npa=0&pscdl=noapi&auid=1251415113.1754029401&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dcheckout_progress%3Bcheckout_step%3D3%3Bid%3DSIXTEEN&rfmt=3&fmt=4

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b1c8d3d68af1f70f781830bb2a68cbf4862f464c3c50ff5a4c603bd1fb491df5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2129
date: Fri, 01 Aug 2025 06:23:21 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 10952545820 Show response
td.doubleclick.net/td/rul/ Frame ECE5 13 B
176 B 165ms
158ms Document
text/html 2607:f8b0:4006:821::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://td.doubleclick.net/td/rul/10952545820?random=1754029401678&cv=11&fst=1754029401678&fmt=3&bg=ffffff&guid=ON&async=1&en=checkout_progress&gtm=45be57u1v890172026za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~103116026~103200004~103233427~104684208~104684211~104948813~105087538~105087540~105103161~105103163~105174035&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fsource%3DCAFE1%26utm_source%3D%26utm_medium%3Demail%26utm_campaign%3D%26utm_content%3D%26osl%3D%26recip_id%3D%26bcid%3D%26step%3D2&hn=www.googleadservices.com&frm=0&tiba=1-800-211-7661%20For%20Immediate%20Service!&npa=0&pscdl=noapi&auid=1251415113.1754029401&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dcheckout_progress%3Bcheckout_step%3D3%3Bid%3DSIXTEEN

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2002 Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b633a587c652d02386c4f16f8c6f6aab7352d97f16367c3c40576214372dd628

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.markskousen.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 01 Aug 2025 06:23:21 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 collect
analytics.google.com/g/ 0
0 249ms
95ms Fetch
text/plain 2001:4860:4802:34::181
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-KRLWBDB6PF&gtm=45je57u1v896270233za200&_p=1754029400494&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101509157~103116026~103200004~103233427~104684208~104684211~104948813~105087538~105087540~105091133~105103161~105103163&cid=2073291301.1754029402&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AAAI&_s=1&sid=1754029401&sct=1&seg=0&dl=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fsource%3DCAFE1%26utm_source%3D%26utm_medium%3Demail%26utm_campaign%3D%26utm_content%3D%26osl%3D%26recip_id%3D%26bcid%3D%26step%3D2&dt=1-800-211-7661%20For%20Immediate%20Service!&en=page_view&_fv=1&_ss=1&tfd=3545
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-KRLWBDB6PF&cx=c&gtm=457e57u1za200&tag_exp=101509157~103116026~103200004~103233427~104684208~104684211~105087538~105087540~105103161~105103163
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:158:0
report-to: {"group":"ascnsrsggc:158:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:158:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.markskousen.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:158:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 01 Aug 2025 06:23:22 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
551 B 427ms
135ms Ping
text/plain 2607:f8b0:4004:c25::9c
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-KRLWBDB6PF&cid=2073291301.1754029402&gtm=45je57u1v896270233za200&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=101509157~103116026~103200004~103233427~104684208~104684211~104948813~105087538~105087540~105091133~105103161~105103163
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-KRLWBDB6PF&cx=c&gtm=457e57u1za200&tag_exp=101509157~103116026~103200004~103233427~104684208~104684211~105087538~105087540~105103161~105103163
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c25::9c Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:127:0
report-to: {"group":"ascnsrsggc:127:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:127:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.markskousen.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:127:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 01 Aug 2025 06:23:22 GMT
content-type: text/plain
server: Golfe2

GET
H2

200

sid Show response
mug.criteo.com/ Frame 91C3
Redirect Chain

https://gum.criteo.com/sid/json?origin=onetag&domain=markskousen.com&sn=ChromeSyncframe&so=undefined&topUrl=www.markskousen.com&topicsavail=1&fledgeavail=1
https://mug.criteo.com/sid?cpp=9ueeJXwzbnVGTG9XVEdxVUpYRUZiRlVJSlFMV1F1anRUanhDNEtNc3JET0F1aVgxaWZLak9vU0ZwK3pmSWI0dnVTVVVheXIzNVFFc2J1TVQzVE1lRHNmRzFOSDdkQlZDUUJEOEt5NWREZE5GSjdzWjVHQ2xuRmk1cjlQU2...

452 B
1006 B

458ms
129ms

Fetch
application/json

74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://mug.criteo.com/sid?cpp=9ueeJXwzbnVGTG9XVEdxVUpYRUZiRlVJSlFMV1F1anRUanhDNEtNc3JET0F1aVgxaWZLak9vU0ZwK3pmSWI0dnVTVVVheXIzNVFFc2J1TVQzVE1lRHNmRzFOSDdkQlZDUUJEOEt5NWREZE5GSjdzWjVHQ2xuRmk1cjlQU2NJd21uZks1UkxQUVRiZi8wbnVzZ1pjdzRFOWhXWTV0TTZpcmlmOGpnbUVmVWpMczhucUhjQTBIT0wwaU41Q2xleWpkZ3J5bnJxSGlCN3dlVkMzMWlsMVZHakJ4UUZPOVBNQUlxMUQxN0k4VUczazhjcHRHZnVUSzhaV2tCb3NlbTBTU1B1cUFyMTRBMUlQbU1NUFpMNE5HRlp1M3JiSjAwcWhYWEM3bGlqbTdXWEIvTEJnOD18&cppv=2

Requested by

Host: www.markskousen.com
URL: https://www.markskousen.com/offer/tnt-default/?source=CAFE1&utm_source=&utm_medium=email&utm_campaign=&utm_content=&osl=&recip_id=&bcid=&step=2

Protocol

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

d6956343c643ef36e350472f0a3e25c8dc779ebfec0dda70eb8c1e6f2780e299

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://gum.criteo.com/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 965020
expires: 0
access-control-allow-origin: https://gum.criteo.com
date: Fri, 01 Aug 2025 06:23:21 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
location: https://mug.criteo.com/sid?cpp=9ueeJXwzbnVGTG9XVEdxVUpYRUZiRlVJSlFMV1F1anRUanhDNEtNc3JET0F1aVgxaWZLak9vU0ZwK3pmSWI0dnVTVVVheXIzNVFFc2J1TVQzVE1lRHNmRzFOSDdkQlZDUUJEOEt5NWREZE5GSjdzWjVHQ2xuRmk1cjlQU2NJd21uZks1UkxQUVRiZi8wbnVzZ1pjdzRFOWhXWTV0TTZpcmlmOGpnbUVmVWpMczhucUhjQTBIT0wwaU41Q2xleWpkZ3J5bnJxSGlCN3dlVkMzMWlsMVZHakJ4UUZPOVBNQUlxMUQxN0k4VUczazhjcHRHZnVUSzhaV2tCb3NlbTBTU1B1cUFyMTRBMUlQbU1NUFpMNE5HRlp1M3JiSjAwcWhYWEM3bGlqbTdXWEIvTEJnOD18&cppv=2
pragma: no-cache
server-processing-duration-in-ticks: 333258
expires: 0
content-length: 0
date: Fri, 01 Aug 2025 06:23:21 GMT
server: Kestrel

GET
H2 200 cds-pips.js Show response
cdn.taboola.com/scripts/ 3 KB
2 KB 226ms
223ms Script
application/javascript 151.101.193.44
FASTLY

General

Check archive.org

Download Go to

Full URL: https://cdn.taboola.com/scripts/cds-pips.js
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1255890/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.44 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: bce4b47b8fc12de49fac0a00e9039e38aa568aba0ee9154b93d20465f0289cfa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

x-fastly-object-storage: false
content-encoding: gzip
etag: "c52aa1ea682aef8ad5ebf7aff9662e35"
x-amz-version-id: uLMchp7BESXZGZqPSJ8.FcfKBYdWFxIf
age: 2943
x-cache: HIT
date: Fri, 01 Aug 2025 06:23:21 GMT
last-modified: Sun, 29 Oct 2023 14:06:32 GMT
x-served-by: cache-mad22055-MAD
x-cache-hits: 5324
content-type: application/javascript
x-amz-id-2: 1elwLDivEV9M9yCy3iTSOm9qEW1ljGyHEnfh1+yYE1XdmBdD6r5CyeXXxXvxGldmPCYtnRAmmvQ=
vary: Accept-Encoding
x-amz-replication-status: COMPLETED
cache-control: private, max-age=3600
x-timer: S1754029402.972087,VS0,VE0
via: 1.1 varnish
x-amz-request-id: 9NN7EBV5KCEAVGPV
accept-ranges: bytes
access-control-allow-origin: *
abp: 43
content-length: 1347
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 eid.es5.js Show response
cdn.taboola.com/scripts/ 17 KB
7 KB 229ms
226ms Script
application/javascript 151.101.193.44
FASTLY

General

Check archive.org

Download Go to

Full URL: https://cdn.taboola.com/scripts/eid.es5.js
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1255890/tfa.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.193.44 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 12b5eaccd8a9d81a6a12512566d2b72aa7c100b4a261a08ee6aae4679a9e36b4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

x-fastly-object-storage: false
content-encoding: gzip
etag: "2fdf3e79d5e851201a0d52a886453d8b"
x-amz-version-id: Bqo64Ai0BniIkPPSnUb8_cZLJGu.sClo
age: 27517
x-cache: HIT
date: Fri, 01 Aug 2025 06:23:21 GMT
last-modified: Sun, 02 Apr 2023 13:09:57 GMT
x-served-by: cache-mad22055-MAD
x-cache-hits: 1333
content-type: application/javascript
x-amz-id-2: zk5wnQ1Gj4KJFVyANPFpDrq58zMQAZ6mYNqAbz49mSb+WisKN8KcxpW45kbznU/72MuL9bdr4xEJnzZVMxjrt8mNqwNo6QXa
vary: Accept-Encoding
x-amz-replication-status: COMPLETED
cache-control: private,max-age=14400
x-timer: S1754029402.972349,VS0,VE0
via: 1.1 varnish
x-amz-request-id: F00JD60BQH4R3Q2A
accept-ranges: bytes
access-control-allow-origin: *
abp: 25
content-length: 6467
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H3 200 /
www.google.com/pagead/1p-user-list/664724290/ 42 B
64 B 157ms
156ms Image
image/gif 142.251.40.196
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/664724290/?random=1754029401371&cv=11&fst=1754028000000&bg=ffffff&guid=ON&async=1&en=gtag.config&gtm=45be57u1v9166407685za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~103116026~103200004~103233427~104684208~104684211~104948813~105087538~105087540~105103161~105103163~105113532&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fsource%3DCAFE1%26utm_source%3D%26utm_medium%3Demail%26utm_campaign%3D%26utm_content%3D%26osl%3D%26recip_id%3D%26bcid%3D%26step%3D2&hn=www.googleadservices.com&frm=0&tiba=1-800-211-7661%20For%20Immediate%20Service!&npa=0&pscdl=noapi&auid=1251415113.1754029401&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSfADZpuyzsAiG9unxvNoEGCYwlPIEbtYeDBhOXGLa3tELrmV4mDDLSmDgpocuEaGRSAWehsHf3XI6b_fZhpd-VuAB7ZMeFVmTWdOqXg3JX54WVGcZLa2YwvQ5jYU-x8lIOxxEs_ZhJwrbi1LySEV7mlN0aXra1RCaZpAJ9VA&random=3146553583&rmt_tld=0&ipr=y

Requested by

Host: www.markskousen.com
URL: https://www.markskousen.com/offer/tnt-default/?source=CAFE1&utm_source=&utm_medium=email&utm_campaign=&utm_content=&osl=&recip_id=&bcid=&step=2

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.196 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 01 Aug 2025 06:23:21 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 /
www.google.com/pagead/1p-user-list/664724290/ 42 B
64 B 156ms
155ms Image
image/gif 142.251.40.196
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/664724290/?random=1754029401410&cv=11&fst=1754028000000&bg=ffffff&guid=ON&async=1&en=checkout_progress&gtm=45be57u1v9166407685za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~103116026~103200004~103233427~104684208~104684211~104948813~105087538~105087540~105103161~105103163~105113532&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fsource%3DCAFE1%26utm_source%3D%26utm_medium%3Demail%26utm_campaign%3D%26utm_content%3D%26osl%3D%26recip_id%3D%26bcid%3D%26step%3D2&hn=www.googleadservices.com&frm=0&tiba=1-800-211-7661%20For%20Immediate%20Service!&npa=0&pscdl=noapi&auid=1251415113.1754029401&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dcheckout_progress%3Bcheckout_step%3D3%3Bid%3DSIXTEEN&rfmt=3&fmt=3&is_vtc=1&cid=CAQSfADZpuyzxDVdxK42KFxmGem2aOJU5NgtNbrxwfyON-LEIbh8HxMmGCwtlfMcUwc_L0tQMUnxPASCdifNAIfN_Dkc2rf1CUoNIlkWucmrxP7Dtf6skU8YsYjIuRYxDgIKASqnZdOAmtXuI7pFE0zN8FP4-W4XWhYTjecOOOI&random=1711620999&rmt_tld=0&ipr=y

Requested by

Host: www.markskousen.com
URL: https://www.markskousen.com/offer/tnt-default/?source=CAFE1&utm_source=&utm_medium=email&utm_campaign=&utm_content=&osl=&recip_id=&bcid=&step=2

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.196 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 01 Aug 2025 06:23:21 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 /
www.google.com/pagead/1p-user-list/10952545820/ 42 B
64 B 157ms
156ms Image
image/gif 142.251.40.196
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10952545820/?random=1754029401630&cv=11&fst=1754028000000&bg=ffffff&guid=ON&async=1&en=gtag.config&gtm=45be57u1v890172026za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~103116026~103200004~103233427~104684208~104684211~104948813~105087538~105087540~105103161~105103163~105174035&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fsource%3DCAFE1%26utm_source%3D%26utm_medium%3Demail%26utm_campaign%3D%26utm_content%3D%26osl%3D%26recip_id%3D%26bcid%3D%26step%3D2&hn=www.googleadservices.com&frm=0&tiba=1-800-211-7661%20For%20Immediate%20Service!&npa=0&pscdl=noapi&auid=1251415113.1754029401&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSfADZpuyz298F6-ebRG97NDik0fAZCoVvY0qOK9_VxwrqnAZ5t9BukoIPZ3Vr2nuJoY1cQHC4RR47oqRn8ExkE1Zq-OVoyil4s3AKkJcXtR1gLtIpI_26QvAFEWrT07lG6uaKV5Ipnrh6rRcNHt5CTFbT2L-OyM9rsaAvG8Y&random=3503472574&rmt_tld=0&ipr=y

Requested by

Host: www.markskousen.com
URL: https://www.markskousen.com/offer/tnt-default/?source=CAFE1&utm_source=&utm_medium=email&utm_campaign=&utm_content=&osl=&recip_id=&bcid=&step=2

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.196 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 01 Aug 2025 06:23:21 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 /
www.google.com/pagead/1p-user-list/10952545820/ 42 B
64 B 155ms
155ms Image
image/gif 142.251.40.196
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10952545820/?random=1754029401678&cv=11&fst=1754028000000&bg=ffffff&guid=ON&async=1&en=checkout_progress&gtm=45be57u1v890172026za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101509157~103116026~103200004~103233427~104684208~104684211~104948813~105087538~105087540~105103161~105103163~105174035&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fsource%3DCAFE1%26utm_source%3D%26utm_medium%3Demail%26utm_campaign%3D%26utm_content%3D%26osl%3D%26recip_id%3D%26bcid%3D%26step%3D2&hn=www.googleadservices.com&frm=0&tiba=1-800-211-7661%20For%20Immediate%20Service!&npa=0&pscdl=noapi&auid=1251415113.1754029401&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dcheckout_progress%3Bcheckout_step%3D3%3Bid%3DSIXTEEN&rfmt=3&fmt=3&is_vtc=1&cid=CAQSfADZpuyzqhmtod3OP60mU1z8BguC7qjycqwERTif2YT1dnKwAtMiLbcGgcCM95mAtmXZXB9LW6S-yOVLEUn-tOn5NadO2-O9A4654KjylE5iPPN1ARLK5JJDEN9UyibrtBEtxt3dw8OUuUn4MaYDSfNF3_U5EjGBsFOe6eE&random=2708372372&rmt_tld=0&ipr=y

Requested by

Host: www.markskousen.com
URL: https://www.markskousen.com/offer/tnt-default/?source=CAFE1&utm_source=&utm_medium=email&utm_campaign=&utm_content=&osl=&recip_id=&bcid=&step=2

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.196 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 01 Aug 2025 06:23:21 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 css
fonts.googleapis.com/ Frame 71CD 2 KB
651 B 434ms
154ms Stylesheet
text/css 2607:f8b0:4006:81f::200a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fonts.googleapis.com/css?family=Raleway

Requested by

Host: portal.publishersserviceassociates.com
URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/lib/css/fonts/fonts.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81f::200a Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

83aae1dac90c8e8634f3865e5939f84b501cf2d86d3576de1cf20784aa3579d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://portal.publishersserviceassociates.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Fri, 01 Aug 2025 06:23:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 01 Aug 2025 06:23:22 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Fri, 01 Aug 2025 06:07:07 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 css
fonts.googleapis.com/ Frame 71CD 2 KB
499 B 438ms
159ms Stylesheet
text/css 2607:f8b0:4006:81f::200a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fonts.googleapis.com/css?family=Crete+Round:400,400italic&subset=latin,latin-ext

Requested by

Host: portal.publishersserviceassociates.com
URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/lib/css/fonts/fonts.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81f::200a Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c055fad0d806a8d2522b8736368ecca069082bd1f59f5e30f47ad6c9373b88f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://portal.publishersserviceassociates.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Fri, 01 Aug 2025 06:23:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 01 Aug 2025 06:23:22 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Fri, 01 Aug 2025 06:23:22 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 css
fonts.googleapis.com/ Frame 71CD 3 KB
1002 B 432ms
153ms Stylesheet
text/css 2607:f8b0:4006:81f::200a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fonts.googleapis.com/css?family=Judson:400,400italic,700

Requested by

Host: portal.publishersserviceassociates.com
URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/lib/css/fonts/fonts.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81f::200a Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

99cd0db2d1b226671c99205f5dca09f5a68608b56bb4702623fbad2d3f18156d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://portal.publishersserviceassociates.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Fri, 01 Aug 2025 06:23:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 01 Aug 2025 06:23:22 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Fri, 01 Aug 2025 06:23:22 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 css
fonts.googleapis.com/ Frame 71CD 3 KB
785 B 442ms
163ms Stylesheet
text/css 2607:f8b0:4006:81f::200a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fonts.googleapis.com/css?family=Corben|Cormorant+Garamond|IM+Fell+Double+Pica+SC

Requested by

Host: portal.publishersserviceassociates.com
URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/lib/css/fonts/fonts.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81f::200a Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e6449e18bb0ac633c11f4326638b42066228b905e3b8f32822344ffe30f22e17

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://portal.publishersserviceassociates.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Fri, 01 Aug 2025 06:23:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 01 Aug 2025 06:23:22 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Fri, 01 Aug 2025 06:23:22 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 css
fonts.googleapis.com/ Frame 71CD 4 KB
822 B 435ms
156ms Stylesheet
text/css 2607:f8b0:4006:81f::200a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fonts.googleapis.com/css?family=Coustard|Roboto+Slab|Titillium+Web

Requested by

Host: portal.publishersserviceassociates.com
URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/lib/css/fonts/fonts.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81f::200a Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

9fbed57b8ab733f49489493e5dcf5f9d8e833429f4bc8fb7565f4526293a9208

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://portal.publishersserviceassociates.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Fri, 01 Aug 2025 06:23:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 01 Aug 2025 06:23:22 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Fri, 01 Aug 2025 06:23:22 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 / Show response
pips.taboola.com/ 4 B
91 B 229ms
222ms XHR
text/plain 151.101.129.44
FASTLY

General

Check archive.org

Download Go to

Full URL: https://pips.taboola.com/
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/scripts/cds-pips.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.44 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: fb329000228cc5a24c264c57139de8bf854fc86fc18bf1c04ab61a2b5cb4b921

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

cache-control: no-store
retry-after: 0
access-control-allow-methods: GET
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: https://www.markskousen.com
x-cache: HIT
content-length: 4
date: Fri, 01 Aug 2025 06:23:22 GMT
x-served-by: cache-toj-leto2350052-TOJ
server: Varnish
x-cache-hits: 0

POST
H/1.1 200
OK eagle_get_tax_rate_state.php Show response
portal.publishersserviceassociates.com/Production2.0/includes/ Frame 71CD 218 B
406 B 132ms
130ms XHR
text/html 98.83.182.201
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://portal.publishersserviceassociates.com/Production2.0/includes/eagle_get_tax_rate_state.php
Requested by: Host: portal.publishersserviceassociates.com
URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 98.83.182.201 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-98-83-182-201.compute-1.amazonaws.com
Software: Apache /
Resource Hash: ef9653c13769c161ba475e9917b7ae3dc1b215098d133de047c1454eff41a05d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1

Response headers

Keep-Alive: timeout=5, max=95
Content-Length: 218
Date: Fri, 01 Aug 2025 06:23:22 GMT
Content-Type: text/html; charset=UTF-8
Server: Apache
Connection: Keep-Alive

GET
H/1.1 200
OK submitbuttonlock.png
portal.publishersserviceassociates.com/images/ Frame 71CD 9 KB
9 KB 132ms
131ms Image
image/png 98.83.182.201
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://portal.publishersserviceassociates.com/images/submitbuttonlock.png
Requested by: Host: portal.publishersserviceassociates.com
URL: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 98.83.182.201 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-98-83-182-201.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 4cf12e60de32891dd16f2d306c79da71861eb8842734e55735931cfbbd51cd46

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://portal.publishersserviceassociates.com/api_new_order/eaglestep/index.php?term_52=%3Cp%3E%3Cimg+src%3D%22https%3A%2F%2Fmedia.giphy.com%2Fmedia%2FVmcExEoWjpKpi%2Fgiphy.gif%22+alt%3D%22%22+width%3D%2250%22+%2F%3E%C2%A0%C2%A0%3Cfont+color%3D%22red%22%3E%3Cb%3EGreat+Deal%21%3C%2Fb%3E%3C%2Ffont%3E+1+Year+of+%3Cb%3E%3Ci%3ETNT+Trader%3C%2Fi%3E%3C%2Fb%3E+for+%241%2C995.%0D%0A%3C%2Fol%3E&PUB_CODE=SIXTEEN&slug=tnt-default&return_url=https%3A%2F%2Fwww.markskousen.com%2Foffer%2Ftnt-default%2F%3Fstep%3D3%26pubcode%3DSIXTEEN%26slug%3Dtnt-default%26original_offer%3D27793%26offer_id%3D27793%26source%3DCAFE1&listrak_id=CbsA6prgn83q&offername=TNT+Web+Default+%28Full+Price%29&def_term=52&tracking_code=CAFE1

Response headers

Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 8922
Keep-Alive: timeout=5, max=98
Date: Fri, 01 Aug 2025 06:23:22 GMT
Last-Modified: Tue, 28 Mar 2023 18:41:48 GMT
Content-Type: image/png
Server: Apache

GET
H2 204 / Show response
cds.taboola.com/ 0
82 B 447ms
145ms XHR
text/plain 141.226.224.32
TABOOLA-AS Tabool...

General

Check archive.org

Download Go to

Full URL: https://cds.taboola.com/?uid=a4832cf5-13d4-4185-9daa-03f25f2093ea-tuctf85e2d9&mbl=ZmFsc2U=
Requested by: Host: cdn.taboola.com
URL: https://cdn.taboola.com/scripts/cds-pips.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.224.32 Newark, United States, ASN200478 (TABOOLA-AS Taboola.com ltd, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

access-control-allow-origin: *
cache-control: no-store
date: Fri, 01 Aug 2025 06:23:22 GMT
server: nginx

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/ngcIAHyEnHQZZIKkyKneDTW3/ Frame 71CD 774 KB
333 KB 419ms
136ms Script
text/javascript 2607:f8b0:4006:823::2003
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/ngcIAHyEnHQZZIKkyKneDTW3/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2003 Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

13ef4faf327d81294e4156ffc3517706114d054ebf2367decc77b6c9aedbc929

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Origin: https://portal.publishersserviceassociates.com
Referer: https://portal.publishersserviceassociates.com/

Response headers

content-encoding: gzip
age: 38049
report-to: {"group":"recaptcha-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha-scs"}]}
x-content-type-options: nosniff
expires: Fri, 31 Jul 2026 19:49:14 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 31 Jul 2025 19:49:14 GMT
last-modified: Mon, 21 Jul 2025 02:01:33 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha-scs"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha-scs
accept-ranges: bytes
access-control-allow-origin: *
content-length: 339847
x-xss-protection: 0
server: sffe

GET
H2 200 event Show response
sslwidget.criteo.com/ 11 KB
5 KB 390ms
134ms Script
application/x-javascript 74.119.117.16
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://sslwidget.criteo.com/event?a=113755&v=5.39.0&otl=1&p0=e%3Dexd%26site_type%3Dd&p1=e%3Dvb%26p%3D%255Bi%25253D1%252526pr%25253D0%252526q%25253D1%255D&p2=e%3Ddis&bundle=QoSBtV9yVVdCWlR2MGdmU1NSZ2haJTJCZkR4NzBoODdkcjR0amZwa1B1MEEzT2slMkJudEw5eFNEWXQ1R1NoM2N4OCUyRkJFaW0wNG1BTUx6M3FFRFA5NjYwQUJybzV5UW1KSU1vcDE2cDFaWGdrUjhFSnA3c3k1dzlKdVNYS0hKMmtQMGlaU2dMT05zU09mRXVUZUt4ZEoxRUVXN0JhVElCdm53R0loUUxkd2t1elNRMmlkVGslM0Q&sc=%7B%22fbp%22%3A%22fb.1.1754029401303.414542839347540463%22%7D&tld=markskousen.com&dy=1&fu=https%253A%252F%252Fwww.markskousen.com%252Foffer%252Ftnt-default%252F%253Fsource%253DCAFE1%2526utm_source%253D%2526utm_medium%253Demail%2526utm_campaign%253D%2526utm_content%253D%2526osl%253D%2526recip_id%253D%2526bcid%253D%2526step%253D2&ceid=05081e89-cdd5-46af-937e-e74e7a533585

Requested by

Host: dynamic.criteo.com
URL: https://dynamic.criteo.com/js/ld/ld.js?a=113755

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.16 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

947592caa78f00ceff4c92a949b6ebbb6c98a71728c7db118b1213e1a277953f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache
timing-allow-origin: *
content-encoding: gzip
pragma: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 7661288
expires: 0
access-control-allow-origin: *
p3p: NON DSP COR CURa PSA PSD OUR BUS NAV STA
date: Fri, 01 Aug 2025 06:23:22 GMT
content-type: application/x-javascript
server: Kestrel

GET
H3 200 anchor Show response
www.google.com/recaptcha/api2/ Frame B20E 74 KB
42 KB 171ms
170ms Document
text/html 142.251.40.196
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LflUQ8aAAAAAJxsqWnPCnQvoCxQUIZ8jgtGRO48&co=aHR0cHM6Ly9wb3J0YWwucHVibGlzaGVyc3NlcnZpY2Vhc3NvY2lhdGVzLmNvbTo0NDM.&hl=en&v=ngcIAHyEnHQZZIKkyKneDTW3&size=normal&anchor-ms=20000&execute-ms=15000&cb=71hlm018qgel

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/ngcIAHyEnHQZZIKkyKneDTW3/recaptcha__en.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.196 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

17af17c4feb097914acb817d7cc60b3a547aa05b52841ddeb2855aa89ee762ba

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-zhDjMb_62wfmXglAtQgYcg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://portal.publishersserviceassociates.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-zhDjMb_62wfmXglAtQgYcg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Fri, 01 Aug 2025 06:23:23 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/ngcIAHyEnHQZZIKkyKneDTW3/ Frame B20E 78 KB
41 KB 276ms
135ms Stylesheet
text/css 142.251.40.131
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/ngcIAHyEnHQZZIKkyKneDTW3/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LflUQ8aAAAAAJxsqWnPCnQvoCxQUIZ8jgtGRO48&co=aHR0cHM6Ly9wb3J0YWwucHVibGlzaGVyc3NlcnZpY2Vhc3NvY2lhdGVzLmNvbTo0NDM.&hl=en&v=ngcIAHyEnHQZZIKkyKneDTW3&size=normal&anchor-ms=20000&execute-ms=15000&cb=71hlm018qgel

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0c12c7ce2580d9289cc0a427d48927938296cad86fae0600c65ce915eaca45a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.google.com/

Response headers

content-encoding: gzip
age: 168175
report-to: {"group":"recaptcha-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha-scs"}]}
x-content-type-options: nosniff
expires: Thu, 30 Jul 2026 07:40:29 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Jul 2025 07:40:29 GMT
last-modified: Mon, 21 Jul 2025 02:01:33 GMT
content-type: text/css
vary: Accept-Encoding
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha-scs"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha-scs
accept-ranges: bytes
content-length: 42123
x-xss-protection: 0
server: sffe

GET
H3 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/ngcIAHyEnHQZZIKkyKneDTW3/ Frame B20E 774 KB
332 KB 394ms
253ms Script
text/javascript 142.251.40.131
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/ngcIAHyEnHQZZIKkyKneDTW3/recaptcha__en.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

13ef4faf327d81294e4156ffc3517706114d054ebf2367decc77b6c9aedbc929

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.google.com/

Response headers

content-encoding: gzip
age: 134793
report-to: {"group":"recaptcha-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha-scs"}]}
x-content-type-options: nosniff
expires: Thu, 30 Jul 2026 16:56:51 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Jul 2025 16:56:51 GMT
last-modified: Mon, 21 Jul 2025 02:01:33 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha-scs"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha-scs
accept-ranges: bytes
access-control-allow-origin: *
content-length: 339847
x-xss-protection: 0
server: sffe

GET webworker.js
www.google.com/recaptcha/api2/ Frame B20E 0
0

GET
DATA 200
OK truncated
/ Frame B20E 31 KB
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 729a362f1853f41187ee6cee30a03a4f57fd8cca731b254232377dc3a25480ef

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame B20E 1 KB
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f311691846ce2403d3572677ad695d6d7e493d954a5b71712c69a357150cdb7c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3 200 logo_48.png
www.gstatic.com/recaptcha/api2/ Frame B20E 2 KB
2 KB 136ms
135ms Image
image/png 142.251.40.131
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/logo_48.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/ngcIAHyEnHQZZIKkyKneDTW3/styles__ltr.css

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.gstatic.com/recaptcha/releases/ngcIAHyEnHQZZIKkyKneDTW3/styles__ltr.css

Response headers

age: 127483
report-to: {"group":"recaptcha-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha-scs"}]}
x-content-type-options: nosniff
expires: Wed, 06 Aug 2025 18:58:42 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Jul 2025 18:58:42 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: image/png
cache-control: public, max-age=604800
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha-scs"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha-scs
accept-ranges: bytes
content-length: 2228
x-xss-protection: 0
server: sffe

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame B20E 15 KB
15 KB 278ms
135ms Font
font/woff2 142.250.80.67
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.67 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

server-18-238-80-87.jfk52.r.cloudfront.net

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Origin: https://www.google.com
Referer: https://www.google.com/

Response headers

age: 148157
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 30 Jul 2026 13:14:08 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Jul 2025 13:14:08 GMT
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 15344
x-xss-protection: 0
server: sffe

GET
H2

200

sync
x.bidswitch.net/ul_cb/ Frame DE3E
Redirect Chain

https://x.bidswitch.net/sync?dsp_id=46&user_id=k-qdYkNaMxA25KdrK2w6OG3sCsQ0pd7m2lA05SNQ&expires=30
https://x.bidswitch.net/ul_cb/sync?dsp_id=46&user_id=k-qdYkNaMxA25KdrK2w6OG3sCsQ0pd7m2lA05SNQ&expires=30

43 B
287 B

143ms
140ms

Image
image/gif

35.211.202.130
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/ul_cb/sync?dsp_id=46&user_id=k-qdYkNaMxA25KdrK2w6OG3sCsQ0pd7m2lA05SNQ&expires=30
Protocol: H2
Server: 35.211.202.130 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 130.202.211.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Fri, 01 Aug 2025 06:23:25 GMT
content-type: image/gif

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: https://x.bidswitch.net/ul_cb/sync?dsp_id=46&user_id=k-qdYkNaMxA25KdrK2w6OG3sCsQ0pd7m2lA05SNQ&expires=30
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 01 Aug 2025 06:23:25 GMT

GET
H2

200

cookiematch.aspx
dis.criteo.com/dis/rtb/google/ Frame DE3E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_sc&google_ula=913071&CriteoUserId=k-sDwGbqMxA25KdrK2w6OG3sCsQ0pvx4NQNNP9Aw&google_cm&google_hm=ay1zRHdHYnFNeEEyNUtkcksydzZPRzNzQ3NRMHB2eDROU...
https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&CriteoUserId=k-sDwGbqMxA25KdrK2w6OG3sCsQ0pvx4NQNNP9Aw&google_error=15

43 B
706 B

127ms
127ms

Image
image/gif

74.119.117.16
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL

https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&CriteoUserId=k-sDwGbqMxA25KdrK2w6OG3sCsQ0pvx4NQNNP9Aw&google_error=15

Protocol

Server

74.119.117.16 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 250570
expires: Mon, 26 Jul 1997 05:00:00 GMT
p3p: CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA'
date: Fri, 01 Aug 2025 06:23:25 GMT
content-type: image/gif
server: Kestrel

Redirect headers

cache-control: no-cache, must-revalidate
location: https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&CriteoUserId=k-sDwGbqMxA25KdrK2w6OG3sCsQ0pvx4NQNNP9Aw&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
report-to: {"group":"ad-exchange-cookie-matcher","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/httpsserver2/ad-exchange-cookie-matcher"}]}
content-security-policy-report-only: script-src 'none';form-action 'none';frame-src 'none'; report-uri https://csp.withgoogle.com/csp/httpsserver2/ad-exchange-cookie-matcher
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 333
date: Fri, 01 Aug 2025 06:23:25 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

cookiematch.aspx
dis.criteo.com/dis/rtb/appnexus/ Frame DE3E
Redirect Chain

https://ib.adnxs.com/getuid?https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=$UID
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fdis.criteo.com%2Fdis%2Frtb%2Fappnexus%2Fcookiematch.aspx%3Fappnxsid%3D%24UID
https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=6125957857287055747

43 B
721 B

142ms
128ms

Image
image/gif

74.119.117.16
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL

https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=6125957857287055747

Protocol

Server

74.119.117.16 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1223646
expires: Mon, 26 Jul 1997 05:00:00 GMT
p3p: CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA'
date: Fri, 01 Aug 2025 06:23:24 GMT
content-type: image/gif
server: Kestrel

Redirect headers

cache-control: no-store, no-cache, private
location: https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=6125957857287055747
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.248; 162.245.206.248; 1041.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: f14949d5-b839-4f10-99a3-436ef2229d15
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 01 Aug 2025 06:23:25 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.25.5

GET

tpid=08221740-6ea0-11f0-a56c-a944d2b45942
sync.crwdcntrl.net/map/c=14717/tp=MWSP/ Frame DE3E
Redirect Chain

https://partner.mediawallahscript.com/?account_id=1043&partner_id=1048&uid=k-sDwGbqMxA25KdrK2w6OG3sCsQ0pvx4NQNNP9Aw&custom=&tag_format=img&tag_action=sync&custom=&cb=de133098-abac-47aa-9a5d-1ec0ab5...
https://partner.mediawallahscript.com/?account_id=1043&partner_id=1048&uid=k-sDwGbqMxA25KdrK2w6OG3sCsQ0pvx4NQNNP9Aw&custom%5B0%5D=&custom%5B1%5D=&tag_format=img&tag_action=sync&cb=de133098-abac-47a...
https://secure.adnxs.com/getuid?https://partner.mediawallahscript.com/?account_id=2016&partner_id=2087&uid=$UID&tag_format=img&tag_action=sync
https://partner.mediawallahscript.com/?account_id=2016&partner_id=2087&uid=6125957857287055747&tag_format=img&tag_action=sync
https://sync.crwdcntrl.net/map/c=14717/tp=MWSP/tpid=08221740-6ea0-11f0-a56c-a944d2b45942?https%3A%2F%2Fpartner.mediawallahscript.com%2F%3Faccount_id%3D2023%26partner_id%3D2118%26uid%3D%24%7Bprofile...

0
0

GET
H2

200

rum
r.casalemedia.com/ Frame DE3E
Redirect Chain

https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-Jnb2DaMxA25KdrK2w6OG3sCsQ0r7WQYnXg_C9A
https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-Jnb2DaMxA25KdrK2w6OG3sCsQ0r7WQYnXg_C9A&C=1

43 B
325 B

93ms
92ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-Jnb2DaMxA25KdrK2w6OG3sCsQ0r7WQYnXg_C9A&C=1
Protocol: H2
Server: 104.18.26.193 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=55xkVGvSEkY3kKXMAhu3KvpdBkOR2LUiSzy1rQThFAKwDTiCjZOX2wbb1vwTYrOShD%2Fcrs%2Ba4hIHghTFaoBnUc2lSvRUfdrT4jx6GDj2hWsCPlD4OyPkIqQ%2FZHVBch91xngU"}],"group":"cf-nel","max_age":604800}
cf-ray: 96833f296f2578de-LAX
expires: 0
alt-svc: h3=":443"; ma=86400
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Fri, 01 Aug 2025 06:23:25 GMT
content-type: image/gif
vary: Accept-Encoding
server: cloudflare

Redirect headers

cache-control: no-cache
location: /rum?cm_dsp_id=20&external_user_id=k-Jnb2DaMxA25KdrK2w6OG3sCsQ0r7WQYnXg_C9A&C=1
cf-cache-status: DYNAMIC
pragma: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9Jzi%2F7uPs%2FC6vEBKj6U5vW1n8%2B6QqbngjrydNDG0s%2F%2BfTAdiLjryZiPP4l3daZpA8yDHztWgYsm7gCSzZM6pQKXI%2FQfAJq7jTK97b9JaVoEZtBUecv7KLwSH%2F%2FKSe6stFA3u"}],"group":"cf-nel","max_age":604800}
cf-ray: 96833f28ce8f78de-LAX
expires: 0
alt-svc: h3=":443"; ma=86400
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Fri, 01 Aug 2025 06:23:25 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 dspreply
public-prod-dspcookiematching.dmxleo.com/ Frame DE3E 0
263 B 443ms
159ms Image
text/plain 18.238.80.87
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://public-prod-dspcookiematching.dmxleo.com/dspreply?dspId=1521&dspUserId=k-iQlZAKMxA25KdrK2w6OG3sCsQ0oQz-ApHEyhRg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.238.80.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 922a8d3fd8f61d324f544f33d8d3a304.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
content-length: 0
x-amz-cf-id: Ip75tmGNv2_jPDPNamPY00yItcJ32AHrdJ7NwJBWBanl-0F73U1yqg==
date: Fri, 01 Aug 2025 06:23:25 GMT
x-amz-cf-pop: JFK52-P5

GET
H2

200

demconf.jpg
dpm.demdex.net/ Frame DE3E
Redirect Chain

https://gum.criteo.com/sync?c=8&r=1&a=1&u=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D28645%26dpuuid%3D%40USERID%40
https://dpm.demdex.net/ibs:dpid=28645&dpuuid=_yPb219mJTJCSTFMcERLbDAlMkJKTjBXZUQ1dUZnZU1ld1hSMlVlU3Bya05ENndNTjVVayUzRA
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=28645&dpuuid=_yPb219mJTJCSTFMcERLbDAlMkJKTjBXZUQ1dUZnZU1ld1hSMlVlU3Bya05ENndNTjVVayUzRA

42 B
716 B

134ms
134ms

Image
image/gif

52.2.111.26
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=28645&dpuuid=_yPb219mJTJCSTFMcERLbDAlMkJKTjBXZUQ1dUZnZU1ld1hSMlVlU3Bya05ENndNTjVVayUzRA

Protocol

Server

52.2.111.26 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-2-111-26.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-va6-2-v077-0df1340f0.edge-va6.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: W1tXjgQ4Two=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Fri, 01 Aug 2025 06:23:26 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=28645&dpuuid=_yPb219mJTJCSTFMcERLbDAlMkJKTjBXZUQ1dUZnZU1ld1hSMlVlU3Bya05ENndNTjVVayUzRA
dcs: dcs-prod-va6-2-v077-0ac4a1980.edge-va6.demdex.com 0 ms
pragma: no-cache
x-tid: CnX91AAOQEw=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Fri, 01 Aug 2025 06:23:26 GMT

GET
H/1.1 200 user-registering
ads.stickyadstv.com/ Frame DE3E 43 B
662 B 551ms
132ms Image
image/gif 38.134.110.231
FREEWHEEL

General

Check archive.org

Download Go to Show image

Full URL: https://ads.stickyadstv.com/user-registering?dataProviderId=434&userId=k-dnqH3qMxA25KdrK2w6OG3sCsQ0rTqyMmWpFofA
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 38.134.110.231 Ashburn, United States, ASN26558 (FREEWHEEL, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

Transfer-Encoding: chunked
Cache-Control: no-cache
Pragma: no-cache
x-sticky-vk: 1754029405838069-112
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Date: Fri, 01 Aug 2025 06:23:25 GMT
Content-Type: image/gif
Server: nginx

GET
H2

200

match
ad.360yield.com/ul_cb/ Frame DE3E
Redirect Chain

https://ad.360yield.com/match?publisher_dsp_id=38&external_user_id=k-G48S-6MxA25KdrK2w6OG3sCsQ0q4HgbDujPFMA
https://ad.360yield.com/ul_cb/match?publisher_dsp_id=38&external_user_id=k-G48S-6MxA25KdrK2w6OG3sCsQ0q4HgbDujPFMA

43 B
477 B

135ms
135ms

Image
image/gif

44.210.177.108
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ad.360yield.com/ul_cb/match?publisher_dsp_id=38&external_user_id=k-G48S-6MxA25KdrK2w6OG3sCsQ0q4HgbDujPFMA
Protocol: H2
Server: 44.210.177.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-210-177-108.compute-1.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

access-control-allow-origin: *
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Fri, 01 Aug 2025 06:23:25 GMT
content-type: image/gif

Redirect headers

access-control-allow-origin: *
location: https://ad.360yield.com/ul_cb/match?publisher_dsp_id=38&external_user_id=k-G48S-6MxA25KdrK2w6OG3sCsQ0q4HgbDujPFMA
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Fri, 01 Aug 2025 06:23:25 GMT
content-type: text/plain

GET

sync
live.rezync.com/ Frame DE3E
Redirect Chain

https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k--lAb36MxA25KdrK2w6OG3sCsQ0priYcSqy4Pew
https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k--lAb36MxA25KdrK2w6OG3sCsQ0priYcSqy4Pew&_li_chk=true&previous_uuid=cf1aeaf3acf442b6a742c4b0e8fcd600
https://live.rezync.com/sync?c=0aa2530f29e4f4a05b5d5d9bb35d60c2&p=93c1662463a616a7155169889dd99651&pid=cf1aeaf3-acf4-42b6-a742-c4b0e8fcd600

0
0

GET
H2 200 cksync.php
contextual.media.net/ Frame DE3E 43 B
893 B 454ms
166ms Image
image/gif 104.77.220.25
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=3&type=crt&ovsid=k-XJZ_caMxA25KdrK2w6OG3sCsQ0rNFx70xzb3ZA

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.77.220.25 Secaucus, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-77-220-25.deploy.static.akamaitechnologies.com

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=0, no-cache, no-store
timing-allow-origin: *
content-encoding: gzip
pragma: no-cache
expires: Fri, 01 Aug 2025 06:23:25 GMT
alt-svc: h3=":443"; ma=93600
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
content-length: 55
date: Fri, 01 Aug 2025 06:23:25 GMT
content-type: image/gif
vary: Accept-Encoding

GET
H2 200 push
exchange.mediavine.com/usersync/ Frame DE3E 0
879 B 410ms
131ms Image
text/plain 34.200.99.137
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://exchange.mediavine.com/usersync/push?partner=criteo&partnerId=k-bZc8TKMxA25KdrK2w6OG3sCsQ0px6cgWXG0jLw
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.200.99.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-200-99-137.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

content-length: 0
date: Fri, 01 Aug 2025 06:23:26 GMT
content-type: text/plain; charset=utf-8
vary: Origin
access-control-allow-credentials: true

GET
H2 200 c.gif
c.bing.com/ Frame DE3E 42 B
691 B 342ms
100ms Image
image/gif 2620:1ec:33::10
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://c.bing.com/c.gif?Red3=CTOMS_pd&cbid=k-z-LnfKMxA25KdrK2w6OG3sCsQ0q5nl9kZbH5pA
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

cache-control: private, no-cache, proxy-revalidate, no-store
pragma: no-cache
etag: "c448a07e23fbdb1:0"
x-msedge-ref: Ref A: AAE4F23E05CF4842938689BF67811F79 Ref B: LAX311000112051 Ref C: 2025-08-01T06:23:26Z
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 42
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Fri, 01 Aug 2025 06:23:25 GMT
content-type: image/gif
last-modified: Tue, 22 Jul 2025 16:13:00 GMT
x-powered-by: ASP.NET

GET
H2 200 1017
jadserve.postrelease.com/suid/ Frame DE3E 43 B
533 B 403ms
130ms Image
image/gif 13.223.112.180
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://jadserve.postrelease.com/suid/1017?vk=k-4plwDqMxA25KdrK2w6OG3sCsQ0riUDN5GZDFNA
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.223.112.180 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-13-223-112-180.compute-1.amazonaws.com
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
expires: Mon, 1 Jan 1990 12:00:00 GMT
access-control-allow-origin: *
content-length: 43
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 01 Aug 2025 06:23:26 GMT
content-type: image/gif
server: nginx

GET
H/1.1 200
OK cookie-sync
sync.outbrain.com/ Frame DE3E 0
360 B 442ms
149ms Image
text/plain 70.42.32.159
AS-OUTBRAIN

General

Check archive.org

Download Go to Show image

Full URL

https://sync.outbrain.com/cookie-sync?p=criteo&uid=k-a2gUsaMxA25KdrK2w6OG3sCsQ0q0chVhkk-O7g&initiator=partner

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

70.42.32.159 , United States, ASN22075 (AS-OUTBRAIN, US),

Reverse DNS

ny.outbrain.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache
content-length: 0
date: Fri, 01 Aug 2025 06:23:26 GMT
x-traceid: 9cc61ae6bdfac7220f9bebfa513c4ef9

GET
H2 200 Pug
simage2.pubmatic.com/AdServer/ Frame DE3E 42 B
604 B 404ms
129ms Image
image/gif 8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL

https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:k-FNcoSqMxA25KdrK2w6OG3sCsQ0o_H7KA3bMmug

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),

Reverse DNS

Software

nginx /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=16070400; includeSubDomains
cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Fri, 01 Aug 2025 06:23:26 GMT
content-type: image/gif; charset=utf-8
server: nginx

GET pixel_sync
trends.revcontent.com/cm/ Frame DE3E 0
0

GET
H/1.1 200
OK tap.php
pixel.rubiconproject.com/ Frame DE3E 42 B
1 KB 395ms
126ms Image
image/gif 69.173.146.5
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=6434&nid=2149&put=k-qMeOJaMxA25KdrK2w6OG3sCsQ0rvY6htBKci4g&expires=30
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.146.5 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 05d0eac68696352057e42dda5e42f3fc
Pragma: no-cache
content-length: 42
Content-Type: image/gif

GET /
rtb-csync.smartadserver.com/redir/ Frame DE3E 0
0

GET /
sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/ Frame DE3E 0
0

GET
H2 200 1
tapestry.tapad.com/tapestry/ Frame DE3E 95 B
532 B 246ms
98ms Image
image/png 34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL

https://tapestry.tapad.com/tapestry/1?ta_partner_id=2052&ta_partner_did=k-mQdRmqMxA25KdrK2w6OG3sCsQ0qW6lnqsHI-kg&ta_format=png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

Jetty(11.0.25) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 95
date: Fri, 01 Aug 2025 06:23:26 GMT
content-type: image/png
server: Jetty(11.0.25)

GET um
criteo-sync.teads.tv/ Frame DE3E 0
0

GET sync
criteo-partners.tremorhub.com/ Frame DE3E 0
0

GET sync.htm
ade.clmbtech.com/uid/ Frame DE3E 0
0

GET pixelCt.tpmn
ad.tpmn.co.kr/ Frame DE3E 0
0

GET xuid
eb2.3lift.com/ Frame DE3E 0
0

GET k-nbjETqMxA25KdrK2w6OG3sCsQ0rW_NVwkOo2sg
sync.1rx.io/usersync/criteodsp/ Frame DE3E 0
0

GET
H3

200

cropped-mark-skousen-32x32.png
www.markskousen.com/wp-content/uploads/
Redirect Chain

https://www.markskousen.com/favicon.ico
https://www.markskousen.com/wp-content/uploads/cropped-mark-skousen-32x32.png

1020 B
1 KB

83ms
82ms

Other
image/png

192.124.249.5
SUCURI-SEC

General

Check archive.org

Download Go to

Full URL

https://www.markskousen.com/wp-content/uploads/cropped-mark-skousen-32x32.png

Protocol

Server

192.124.249.5 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

Software

Sucuri/Cloudproxy /

Resource Hash

e53fa937f6a5fb6f2a767b59cc72989b0bb95d2502ce09d4b6013c0303f791c2

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.markskousen.com/offer/tnt-default/?source=CAFE1&utm_source=&utm_medium=email&utm_campaign=&utm_content=&osl=&recip_id=&bcid=&step=2

Response headers

x-sucuri-cache: HIT
etag: "3fc-619adbb4fa1e5"
x-content-type-options: nosniff
expires: Thu, 31 Dec 2037 23:55:55 GMT
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000
date: Fri, 01 Aug 2025 06:23:25 GMT
content-type: image/png
last-modified: Thu, 30 May 2024 15:43:42 GMT
x-frame-options: SAMEORIGIN
x-sucuri-id: 11005
content-security-policy: upgrade-insecure-requests;
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 1020
x-xss-protection: 1; mode=block
server: Sucuri/Cloudproxy

Redirect headers

x-sucuri-cache: HIT
x-content-type-options: nosniff
expires: Thu, 31 Dec 2037 23:55:55 GMT
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000
date: Fri, 01 Aug 2025 06:23:25 GMT
content-type: text/html; charset=UTF-8
x-frame-options: SAMEORIGIN
x-redirect-by: WordPress
x-sucuri-id: 11005
link: <https://www.markskousen.com/wp-json/>; rel="https://api.w.org/"
content-security-policy: upgrade-insecure-requests;
cache-control: max-age=315360000
location: /wp-content/uploads/cropped-mark-skousen-32x32.png
content-length: 0
x-xss-protection: 1; mode=block
server: Sucuri/Cloudproxy

GET
H3 200 bframe Show response
www.google.com/recaptcha/api2/ Frame 2B41 8 KB
1 KB 161ms
160ms Document
text/html 142.251.40.196
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=en&v=ngcIAHyEnHQZZIKkyKneDTW3&k=6LflUQ8aAAAAAJxsqWnPCnQvoCxQUIZ8jgtGRO48

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/ngcIAHyEnHQZZIKkyKneDTW3/recaptcha__en.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.196 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1ee2bbb9333f92fa3eca02d246a916309bb2d5d0036f2ec0b59eb8b40708dccd

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-HtA-wiZxuIq7d5axJpttQg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://portal.publishersserviceassociates.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-HtA-wiZxuIq7d5axJpttQg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Fri, 01 Aug 2025 06:23:25 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/ngcIAHyEnHQZZIKkyKneDTW3/ Frame 2B41 78 KB
0 1ms
1ms Stylesheet
text/css 142.251.40.131
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/ngcIAHyEnHQZZIKkyKneDTW3/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=en&v=ngcIAHyEnHQZZIKkyKneDTW3&k=6LflUQ8aAAAAAJxsqWnPCnQvoCxQUIZ8jgtGRO48

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0c12c7ce2580d9289cc0a427d48927938296cad86fae0600c65ce915eaca45a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.google.com/

Response headers

content-encoding: gzip
age: 168175
report-to: {"group":"recaptcha-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha-scs"}]}
x-content-type-options: nosniff
expires: Thu, 30 Jul 2026 07:40:29 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Jul 2025 07:40:29 GMT
last-modified: Mon, 21 Jul 2025 02:01:33 GMT
content-type: text/css
vary: Accept-Encoding
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha-scs"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha-scs
accept-ranges: bytes
content-length: 42123
x-xss-protection: 0
server: sffe

GET
H3 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/ngcIAHyEnHQZZIKkyKneDTW3/ Frame 2B41 774 KB
0 2ms
2ms Script
text/javascript 142.251.40.131
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/ngcIAHyEnHQZZIKkyKneDTW3/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=en&v=ngcIAHyEnHQZZIKkyKneDTW3&k=6LflUQ8aAAAAAJxsqWnPCnQvoCxQUIZ8jgtGRO48

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

13ef4faf327d81294e4156ffc3517706114d054ebf2367decc77b6c9aedbc929

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer: https://www.google.com/

Response headers

content-encoding: gzip
age: 134793
report-to: {"group":"recaptcha-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha-scs"}]}
x-content-type-options: nosniff
expires: Thu, 30 Jul 2026 16:56:51 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 30 Jul 2025 16:56:51 GMT
last-modified: Mon, 21 Jul 2025 02:01:33 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha-scs"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha-scs
accept-ranges: bytes
access-control-allow-origin: *
content-length: 339847
x-xss-protection: 0
server: sffe

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 2B41 15 KB
0 278ms
135ms Font
font/woff2 142.250.80.67
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=en&v=ngcIAHyEnHQZZIKkyKneDTW3&k=6LflUQ8aAAAAAJxsqWnPCnQvoCxQUIZ8jgtGRO48

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.67 , United States, ASN15169 (GOOGLE, US),

Reverse DNS