secure.winred.com Open in urlscan Pro
2606:4700::6812:9b15 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://click.campaigns.rnchq.com/?qs=fae92772902f5f9a27b7ba1c7552a4d03cf824429c7ca3439f32eebc0230a57dd10cf3a6084aadaa459faa7af7ea...
Effective URL:
https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&a...
Submission: On December 06 via api (December 6th 2021, 3:56:20 pm UTC) from CA — Scanned from CA

Summary HTTP 157 Redirects Links 7 Behaviour Indicators

Summary

This website contacted 27 IPs in 1 countries across 18 domains to perform 157 HTTP transactions. The main IP is 2606:4700::6812:9b15, located in United States and belongs to CLOUDFLARENET, US. The main domain is secure.winred.com.
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on October 5th 2021. Valid for: a year.

This is the only time secure.winred.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	13.111.145.38 13.111.145.38	22606 (EXACT-7) (EXACT-7)
11	2606:4700::68... 2606:4700::6812:9b15	13335 (CLOUDFLAR...) (CLOUDFLARENET)
27	13.225.214.16 13.225.214.16	16509 (AMAZON-02) (AMAZON-02)
4	2607:f8b0:400... 2607:f8b0:4006:80c::200a	15169 (GOOGLE) (GOOGLE)
4	13.225.63.73 13.225.63.73	16509 (AMAZON-02) (AMAZON-02)
4	2607:f8b0:400... 2607:f8b0:4006:81e::2008	15169 (GOOGLE) (GOOGLE)
1	69.192.26.112 69.192.26.112	16625 (AKAMAI-AS) (AKAMAI-AS)
6	23.208.216.220 23.208.216.220	16625 (AKAMAI-AS) (AKAMAI-AS)
1	69.192.20.36 69.192.20.36	16625 (AKAMAI-AS) (AKAMAI-AS)
41	54.187.119.242 54.187.119.242	16509 (AMAZON-02) (AMAZON-02)
4	2607:f8b0:400... 2607:f8b0:400d:c08::5c	15169 (GOOGLE) (GOOGLE)
21	2607:f8b0:400... 2607:f8b0:4006:807::200e	15169 (GOOGLE) (GOOGLE)
1 3	142.250.80.38 142.250.80.38	15169 (GOOGLE) (GOOGLE)
4	2a03:2880:f01... 2a03:2880:f012:8:face:b00c:0:1	32934 (FACEBOOK) (FACEBOOK)
2	13.225.214.66 13.225.214.66	16509 (AMAZON-02) (AMAZON-02)
2	34.201.87.201 34.201.87.201	14618 (AMAZON-AES) (AMAZON-AES)
1 1	142.250.72.98 142.250.72.98	15169 (GOOGLE) (GOOGLE)
1	34.197.188.108 34.197.188.108	14618 (AMAZON-AES) (AMAZON-AES)
1	2607:f8b0:400... 2607:f8b0:4006:822::2002	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:402... 2607:f8b0:4023:1404::9a	15169 (GOOGLE) (GOOGLE)
5	2607:f8b0:400... 2607:f8b0:4006:822::2003	15169 (GOOGLE) (GOOGLE)
1	52.6.2.255 52.6.2.255	14618 (AMAZON-AES) (AMAZON-AES)
1	52.88.27.164 52.88.27.164	16509 (AMAZON-02) (AMAZON-02)
2	2607:f8b0:400... 2607:f8b0:4006:81d::2004	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:4006:81e::2003	15169 (GOOGLE) (GOOGLE)
5	2a03:2880:f11... 2a03:2880:f112:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	142.251.35.162 142.251.35.162	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:80c::2002	15169 (GOOGLE) (GOOGLE)
1	34.233.21.26 34.233.21.26	14618 (AMAZON-AES) (AMAZON-AES)
157	27

1 13.111.145.38 (United States) 1 redirects

ASN22606 (EXACT-7, US)
PTR: click.campaigns.rnchq.com

click.campaigns.rnchq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2606:4700::6812:9b15 (United States)

ASN13335 (CLOUDFLARENET, US)

secure.winred.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
app.winred.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

27 13.225.214.16 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-214-16.ewr50.r.cloudfront.net

js.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4006:80c::200a (United States)

ASN15169 (GOOGLE, US)

maps.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 13.225.63.73 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-63-73.ewr53.r.cloudfront.net

d35ligi1n5bgzc.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4006:81e::2008 (United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.192.26.112 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a69-192-26-112.deploy.static.akamaitechnologies.com

cdn-pci.optimizely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 23.208.216.220 (Edison, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-208-216-220.deploy.static.akamaitechnologies.com

tags.tiqcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.192.20.36 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a69-192-20-36.deploy.static.akamaitechnologies.com

a8416096648.cdn-pci.optimizely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

41 54.187.119.242 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ip-54-187-119-242.stripe.com

q.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
r.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:400d:c08::5c (Morganton, United States)

ASN15169 (GOOGLE, US)

pay.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 2607:f8b0:4006:807::200e (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
play.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.80.38 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: lga34s34-in-f6.1e100.net

9323526.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f012:8:face:b00c:0:1 (Secaucus, United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.225.214.66 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-214-66.ewr50.r.cloudfront.net

m.stripe.network	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.201.87.201 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-201-87-201.compute-1.amazonaws.com

collect.tealiumiq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.72.98 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: lga34s32-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.197.188.108 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-197-188-108.compute-1.amazonaws.com

datacloud.tealiumiq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:822::2002 (United States)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4023:1404::9a (Columbus, United States)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2607:f8b0:4006:822::2003 (United States)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.6.2.255 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-6-2-255.compute-1.amazonaws.com

visitor-service-us-east-1.tealiumiq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.88.27.164 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-88-27-164.us-west-2.compute.amazonaws.com

m.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:81d::2004 (United States)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:81e::2003 (United States)

ASN15169 (GOOGLE, US)

www.google.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a03:2880:f112:83:face:b00c:0:25de (Secaucus, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.35.162 (United States)

ASN15169 (GOOGLE, US)
PTR: lga25s78-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:80c::2002 (United States)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.233.21.26 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-233-21-26.compute-1.amazonaws.com

logx.optimizely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
69	stripe.com js.stripe.com q.stripe.com r.stripe.com m.stripe.com	793 KB
20	google.com pay.google.com adservice.google.com www.google.com play.google.com	379 KB
11	winred.com secure.winred.com app.winred.com	253 KB
8	google-analytics.com www.google-analytics.com	116 KB
7	doubleclick.net 2 redirects 9323526.fls.doubleclick.net cm.g.doubleclick.net stats.g.doubleclick.net googleads.g.doubleclick.net	4 KB
6	tiqcdn.com tags.tiqcdn.com	22 KB
5	facebook.com www.facebook.com	866 B
5	gstatic.com www.gstatic.com	103 KB
4	tealiumiq.com collect.tealiumiq.com datacloud.tealiumiq.com visitor-service-us-east-1.tealiumiq.com	3 KB
4	facebook.net connect.facebook.net	202 KB
4	googletagmanager.com www.googletagmanager.com	217 KB
4	cloudfront.net d35ligi1n5bgzc.cloudfront.net	494 KB
4	googleapis.com maps.googleapis.com	169 KB
3	optimizely.com cdn-pci.optimizely.com a8416096648.cdn-pci.optimizely.com logx.optimizely.com	110 KB
2	google.ca www.google.ca	565 B
2	stripe.network m.stripe.network	16 KB
1	googleadservices.com www.googleadservices.com	14 KB
1	rnchq.com 1 redirects click.campaigns.rnchq.com	506 B
157	18

	Domain	Requested by
32	r.stripe.com	js.stripe.com
27	js.stripe.com	secure.winred.com js.stripe.com
13	play.google.com	www.gstatic.com
10	secure.winred.com	secure.winred.com
9	q.stripe.com	secure.winred.com
8	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com secure.winred.com www.gstatic.com
6	tags.tiqcdn.com	secure.winred.com tags.tiqcdn.com
5	www.facebook.com	secure.winred.com
5	www.gstatic.com	pay.google.com www.gstatic.com
4	connect.facebook.net	secure.winred.com connect.facebook.net
4	pay.google.com	js.stripe.com pay.google.com secure.winred.com www.gstatic.com
4	www.googletagmanager.com	secure.winred.com www.googletagmanager.com
4	d35ligi1n5bgzc.cloudfront.net	secure.winred.com
4	maps.googleapis.com	secure.winred.com maps.googleapis.com
3	9323526.fls.doubleclick.net	1 redirects www.googletagmanager.com secure.winred.com
2	www.google.ca	secure.winred.com
2	www.google.com	secure.winred.com
2	stats.g.doubleclick.net	www.google-analytics.com
2	collect.tealiumiq.com	tags.tiqcdn.com
2	m.stripe.network	js.stripe.com m.stripe.network
1	logx.optimizely.com	cdn-pci.optimizely.com
1	googleads.g.doubleclick.net	www.googleadservices.com
1	www.googleadservices.com	www.googletagmanager.com
1	m.stripe.com	m.stripe.network
1	visitor-service-us-east-1.tealiumiq.com	tags.tiqcdn.com
1	adservice.google.com	9323526.fls.doubleclick.net
1	datacloud.tealiumiq.com	secure.winred.com
1	cm.g.doubleclick.net	1 redirects
1	a8416096648.cdn-pci.optimizely.com	cdn-pci.optimizely.com
1	app.winred.com	secure.winred.com
1	cdn-pci.optimizely.com	secure.winred.com
1	click.campaigns.rnchq.com	1 redirects
157	32

This site contains links to these domains. Also see Links.

Domain
winred.com
www.80810-info.com
www.gop.com

Subject Issuer	Validity	Valid
www.winred.com DigiCert SHA2 Extended Validation Server CA	`2021-10-05` - `2022-10-26`	a year	crt.sh
a.stripecdn.com DigiCert SHA2 Extended Validation Server CA	`2021-10-21` - `2022-02-02`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.cloudfront.net Amazon	`2021-03-19` - `2022-03-17`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
cdn-pci.optimizely.com DigiCert SHA2 Secure Server CA	`2021-02-17` - `2022-02-21`	a year	crt.sh
*.tiqcdn.com DigiCert SHA2 Secure Server CA	`2021-04-19` - `2022-04-27`	a year	crt.sh
*.cdn-pci.optimizely.com DigiCert SHA2 Secure Server CA	`2021-02-17` - `2022-02-21`	a year	crt.sh
*.stripe.com DigiCert SHA2 Secure Server CA	`2021-09-08` - `2022-09-07`	a year	crt.sh
*.google.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-09-14` - `2021-12-13`	3 months	crt.sh
*.tealiumiq.com Amazon	`2021-09-24` - `2022-10-23`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
m.stripe.com DigiCert TLS RSA SHA256 2020 CA1	`2021-10-20` - `2022-02-02`	3 months	crt.sh
www.google.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.google.ca GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
logx.optimizely.com Amazon	`2021-08-23` - `2022-09-21`	a year	crt.sh

This page contains 14 frames:

Primary Page: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_text_contribute_top_5_nd
Frame ID: 0704BEF53772003760AA4A2101C1B797
Requests: 60 HTTP requests in this frame

Frame: https://js.stripe.com/v3/m-outer-f7902241893e7a497417843cb15dc858.html
Frame ID: 7F0CBA2D62235CB0939B1231D11CDC67
Requests: 3 HTTP requests in this frame

Frame: https://js.stripe.com/v3/controller-4b2a0f6fa6eaf0d5f5e2c2d0b0102078.html
Frame ID: 6976885F97F1F973A07D7A8145CF6500
Requests: 16 HTTP requests in this frame

Frame: https://js.stripe.com/v3/elements-inner-card-378af023188ba17d45ed1ebc05831546.html
Frame ID: E980378C00C89611AD7C8C12BF563BF5
Requests: 7 HTTP requests in this frame

Frame: https://js.stripe.com/v3/controller-4b2a0f6fa6eaf0d5f5e2c2d0b0102078.html
Frame ID: 8FAD907704929340B4F51249DF6F2732
Requests: 24 HTTP requests in this frame

Frame: https://js.stripe.com/v3/payment-request-inner-google-pay-60c82d552399a5dd4abfa20b710458c0.html
Frame ID: A35B0434D15037737507DDD3EAEB6168
Requests: 5 HTTP requests in this frame

Frame: https://js.stripe.com/v3/payment-request-inner-browser-1c4bf5a6899d19fb1761d102cda7bcc6.html
Frame ID: 77A8FAA996EB08E93A003E1EC47EDA25
Requests: 4 HTTP requests in this frame

Frame: https://a8416096648.cdn-pci.optimizely.com/client_storage/a8416096648.html
Frame ID: 12ED4375C8C26769C3B13A359394A423
Requests: 1 HTTP requests in this frame

Frame: https://9323526.fls.doubleclick.net/activityi;dc_pre=CPbGtt7Ez_QCFacG0AQdezkMEQ;src=9323526;type=landi0;cat=gop_d0;ord=8724695368488;gtm=2wgc10;auiddc=520031146.1638806173;ps=1;~oref=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-supporters%3Famount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26amt5%3D100%26amt6%3D500%26amt7%3D2800%26utm_medium%3Demail%26utm_source%3DET_105%26utm_campaign%3D20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc%26utm_content%3Dgop_direct-ask_text_contribute_top_5_nd
Frame ID: A2997A63AB1AF6A9BB3BD30156FB63A3
Requests: 2 HTTP requests in this frame

Frame: https://m.stripe.network/inner.html
Frame ID: 4AC208A101ADA4C5731ABACF763B1AB2
Requests: 5 HTTP requests in this frame

Frame: https://pay.google.com/gp/p/ui/payframe?origin=https%3A%2F%2Fjs.stripe.com&mid=
Frame ID: 08550ED3AB1A7B178454F57432447605
Requests: 16 HTTP requests in this frame

Frame: https://js.stripe.com/v3/elements-inner-payment-request-925c170ec154d4f37ad142e0a248f069.html
Frame ID: EBBEBD996A592BA08ADDC2D7C07611A0
Requests: 6 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 472DBF2FE1FFA4E59392D2D2B34FFE2C
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 269FC5629DCA5B7EDE407AD460DC17C2
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Republican National Committee

Page URL History Show full URLs

https://click.campaigns.rnchq.com/?qs=fae92772902f5f9a27b7ba1c7552a4d03cf824429c7ca3439f32eebc0230a57dd10cf3a6... HTTP 302
https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20... Page URL

Page Statistics

157
Requests

99 %
HTTPS

45 %
IPv6

18
Domains

32
Subdomains

27
IPs

1
Countries

2895 kB
Transfer

8664 kB
Size

23
Cookies

7 Outgoing links

These are links going to different origins than the main page.

URL: https://winred.com/terms/donor-terms/
Title: terms of use

Search URL Search Domain Scan URL

URL: https://winred.com/privacy
Title: privacy policy

Search URL Search Domain Scan URL

URL: http://www.80810-info.com/
Title: www.80810-info.com

Search URL Search Domain Scan URL

URL: http://www.gop.com/
Title: www.gop.com

Search URL Search Domain Scan URL

URL: https://winred.com/
Title: Powered by

Search URL Search Domain Scan URL

URL: https://winred.com/about-our-ads/
Title: About Our Ads

Search URL Search Domain Scan URL

URL: https://winred.com/support/
Title: Questions about your charge? Go to our Support Center

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://click.campaigns.rnchq.com/?qs=fae92772902f5f9a27b7ba1c7552a4d03cf824429c7ca3439f32eebc0230a57dd10cf3a6084aadaa459faa7af7eaa1ae8ee37aca83e03270 HTTP 302
https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_text_contribute_top_5_nd Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 47

https://9323526.fls.doubleclick.net/activityi;src=9323526;type=landi0;cat=gop_d0;ord=8724695368488;gtm=2wgc10;auiddc=520031146.1638806173;ps=1;~oref=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-supporters%3Famount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26amt5%3D100%26amt6%3D500%26amt7%3D2800%26utm_medium%3Demail%26utm_source%3DET_105%26utm_campaign%3D20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc%26utm_content%3Dgop_direct-ask_text_contribute_top_5_nd HTTP 302
https://9323526.fls.doubleclick.net/activityi;dc_pre=CPbGtt7Ez_QCFacG0AQdezkMEQ;src=9323526;type=landi0;cat=gop_d0;ord=8724695368488;gtm=2wgc10;auiddc=520031146.1638806173;ps=1;~oref=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-supporters%3Famount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26amt5%3D100%26amt6%3D500%26amt7%3D2800%26utm_medium%3Demail%26utm_source%3DET_105%26utm_campaign%3D20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc%26utm_content%3Dgop_direct-ask_text_contribute_top_5_nd

Request Chain 84

https://cm.g.doubleclick.net/pixel?tealium_cookie_sync=true&google_nid=tealium_dmp&google_cm&tealium_vid=017d9075b571001ac91d2044068f03072014b06a00b08&tealium_account=gop&tealium_profile=main HTTP 302
https://datacloud.tealiumiq.com/vdata/i.gif?tealium_cookie_sync=true&tealium_vid=017d9075b571001ac91d2044068f03072014b06a00b08&tealium_account=gop&tealium_profile=main&google_gid=CAESEPPrkulsHTtOKE_w9Slk9rU&google_cver=1

157 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request trump-social-founding-supporters Show response
secure.winred.com/rnc/
Redirect Chain

https://click.campaigns.rnchq.com/?qs=fae92772902f5f9a27b7ba1c7552a4d03cf824429c7ca3439f32eebc0230a57dd10cf3a6084aadaa459faa7af7eaa1ae8ee37aca83e03270
https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_tr...

44 KB
13 KB

191ms
101ms

Document
text/html

2606:4700::6812:9b15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_text_contribute_top_5_nd

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:9b15 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4e55c5b97682d9d3f44c5ea16c603d40eee56a4832d6af7ca6746265f15c421f

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

date: Mon, 06 Dec 2021 15:56:12 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
cache-control: no-store, no-cache, must-revalidate, private, max-age=0
x-revv-cache: Hit from Revv
x-request-id: 142cb8fb-d09a-4c6d-98a7-1f5b4d87b921
x-runtime: 0.024188
x-rack-cors: miss; no-origin
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6b96b3f0faa4714a-YUL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Redirect headers

Cache-Control: private
Content-Type: text/html; charset=utf-8
Location: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_text_contribute_top_5_nd
Date: Mon, 06 Dec 2021 15:56:11 GMT
Connection: close
Content-Length: 492

GET
H2 200 / Show response
js.stripe.com/v3/ 268 KB
71 KB 74ms
27ms Script
application/javascript 13.225.214.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_text_contribute_top_5_nd

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.16 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-16.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

3ed1f78a1ee89c913a730637376afbd17148beec7eca98ed43e46713bb585898

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 15:55:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 53
x-cache: Hit from cloudfront
strict-transport-security: max-age=31556926; includeSubDomains; preload
access-control-allow-origin: *
last-modified: Fri, 03 Dec 2021 23:13:39 GMT
server: Cloudfront
etag: W/"da8eae94c6390a2e9b43e620a7d73207"
vary: Accept-Encoding,Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 cae77502d3847ca96378af9649c50cb4.cloudfront.net (CloudFront)
cache-control: max-age=60
x-amz-cf-pop: EWR50-C1
timing-allow-origin: *
x-amz-cf-id: YycP8XdP2kBBZy-kZrx5k7X7_mBhlC59-aBV3hKmzHTGtsWOOd1HWg==

GET
H2 200 landing_page-4d8ad4ae71325632689399f3673f1196d135dd83520986c3531e8e646912ad13.css
secure.winred.com/assets/ 217 KB
34 KB 36ms
34ms Stylesheet
text/css 2606:4700::6812:9b15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/assets/landing_page-4d8ad4ae71325632689399f3673f1196d135dd83520986c3531e8e646912ad13.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:9b15 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bbe935971411b547760ad22c28a55c7573abd06b49bcd13a361444dc94fa1c0e

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_text_contribute_top_5_nd
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 15:56:12 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 73
cf-polished: origSize=225723
last-modified: Fri, 03 Dec 2021 01:43:59 GMT
strict-transport-security: max-age=0; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id: 87Z32R0MDF838TXK
x-amz-id-2: bPoMTaa8DGvul/LUZyFNZQRxT7MYpF/7LdXksUnG3jwD+TSN7o/dIs8WsXQHGXW97w04RT8hwco=
cf-bgj: minify
server: cloudflare
etag: W/"9bd66b1efebd8bfddb9730e61146964c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
x-amz-version-id: tzVSTXYyLkLRTSTDBeRwPs8KVSDcmmSY
cf-ray: 6b96b3f1cb95714a-YUL
expires: Mon, 06 Dec 2021 19:56:12 GMT

GET
H2 200 1638551770.css
secure.winred.com/stylesheets/rv_page_01fm52qbrcp63q2sbneyd1jw28/ 8 KB
2 KB 33ms
32ms Stylesheet
text/css 2606:4700::6812:9b15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/stylesheets/rv_page_01fm52qbrcp63q2sbneyd1jw28/1638551770.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:9b15 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f7297ef321f1b682622a9adacc3ada5ba2d6912115f57dd9948ffec18d33cb41

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_text_contribute_top_5_nd
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-rack-cors: miss; no-origin
date: Mon, 06 Dec 2021 15:56:12 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 231848
cf-polished: origSize=8437
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-xss-protection: 1; mode=block
x-request-id: 3c0d30eb-95f2-444f-a68c-877d1ce7f29f
x-runtime: 0.051315
expires: Tue, 06 Dec 2022 21:45:24 GMT
last-modified: Fri, 03 Dec 2021 17:25:47 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains
content-type: text/css; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=31556952
cf-ray: 6b96b3f1cb98714a-YUL
cf-bgj: minify

GET
H2 200 js Show response
maps.googleapis.com/maps/api/ 154 KB
50 KB 92ms
45ms Script
text/javascript 2607:f8b0:4006:80c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

mafe /

Resource Hash

18c33eea07a67aef897ec1cda0bee45cab46d25b88b98a875f010f51c2af3af8

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 15:56:12 GMT
content-encoding: gzip
vary: Accept-Language
server: mafe
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1800
cross-origin-resource-policy: cross-origin
server-timing: gfet4t7; dur=20
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51189
x-xss-protection: 0
expires: Mon, 06 Dec 2021 16:26:12 GMT

GET
H2 200 application-landing-page-36cd0a6085201393f2fabbfa8313d174e8533225bd2d05c67cfcfa56a4ecae3a.js Show response
secure.winred.com/assets/ 612 KB
172 KB 45ms
44ms Script
application/javascript 2606:4700::6812:9b15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/assets/application-landing-page-36cd0a6085201393f2fabbfa8313d174e8533225bd2d05c67cfcfa56a4ecae3a.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:9b15 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3f7fb4c1f2d3ee57a3767048afa62cdf8d4187c4f85ee32bdf91976c2bc72ad6

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_text_contribute_top_5_nd
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 15:56:12 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 73
cf-polished: origSize=627317
last-modified: Fri, 03 Dec 2021 01:43:58 GMT
strict-transport-security: max-age=0; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id: 87Z07885GEA9GYZ5
x-amz-id-2: C/S68yF8x+SELXUZUVaVp9IfxCwlqkAYC/GspMB4udQLIIPBWCOJyVgv82ziYJzuaOqh48kIQQc=
cf-bgj: minify
server: cloudflare
etag: W/"cbdde4319e62c173bcbb5df4621dfcbb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=14400
x-amz-version-id: YktyhJTK4DpeR7OSNg_udb.E71SxF80Q
cf-ray: 6b96b3f1cb9a714a-YUL
expires: Mon, 06 Dec 2021 19:56:12 GMT

GET
H3 200 api.js Show response
secure.winred.com/cdn-cgi/bm/cv/669835187/ 35 KB
9 KB 18ms
18ms Script
text/javascript 2606:4700::6812:9b15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/cdn-cgi/bm/cv/669835187/api.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:9b15 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0d3118e306c6a26f1d2efcb698984e6922c5e7e155c94a84760e36e5592a3c11

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_text_contribute_top_5_nd
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 15:56:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains
content-type: text/javascript
vary: Accept-Encoding
cache-control: max-age=604800, public
cf-ray: 6b96b3f2dabdca57-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 20210126_GOP_TMAGAC_EOM_Eom_Web_Pop-Ups_Jan-2021_V2-Nancy-Chuck_2450x1628_%281%29.png
d35ligi1n5bgzc.cloudfront.net/widget_images/images/000/072/089/medium/ 198 KB
199 KB 116ms
20ms Image
image/png 13.225.63.73
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d35ligi1n5bgzc.cloudfront.net/widget_images/images/000/072/089/medium/20210126_GOP_TMAGAC_EOM_Eom_Web_Pop-Ups_Jan-2021_V2-Nancy-Chuck_2450x1628_%281%29.png
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_text_contribute_top_5_nd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.63.73 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-63-73.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0330d92f80895c477e7bf33190ec17d06bc1a4eed429a65bc7384507855dc743

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-version-id: s7tI8l7qLc_B4JRQEzxbHXJXvN2kOwdG
via: 1.1 1ffe498380a643d1bb2efaa624b761a6.cloudfront.net (CloudFront)
etag: "1fc1ef83ebd8473806455daa01ba93a9"
last-modified: Sat, 17 Jul 2021 13:08:16 GMT
server: AmazonS3
age: 13845
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: image/png
date: Mon, 06 Dec 2021 12:05:28 GMT
x-amz-cf-pop: EWR53-C1
accept-ranges: bytes
content-length: 202763
x-amz-cf-id: n1W4GBH_zmbCl1X5CcbcOkywOfdTPJ-5sLtbmvWCxMrVWEMQVGYo8A==

GET
H2 200 1200px-Republican_Disc.svg.png
d35ligi1n5bgzc.cloudfront.net/profiles/images/000/012/049/square/ 7 KB
8 KB 79ms
39ms Image
image/png 13.225.63.73
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d35ligi1n5bgzc.cloudfront.net/profiles/images/000/012/049/square/1200px-Republican_Disc.svg.png
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_text_contribute_top_5_nd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.63.73 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-63-73.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c885ef025f7d73741c3fae1f63830e9beec3f662f0ca17ea7746b534b34ac5d5

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-version-id: gbL12paoPRxv210hmmexw4Iij5jW0Goh
via: 1.1 1ffe498380a643d1bb2efaa624b761a6.cloudfront.net (CloudFront)
etag: "7c98913b783795d6b02b742196b9a24a"
last-modified: Sat, 17 Jul 2021 18:30:39 GMT
server: AmazonS3
age: 13976
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: image/png
date: Mon, 06 Dec 2021 12:03:17 GMT
x-amz-cf-pop: EWR53-C1
accept-ranges: bytes
content-length: 7348
x-amz-cf-id: EdEI9s853gOFDDksjEhwozHd-01VrxVuFpBpjzvyx3moXWGPic_b1A==

GET
H3 200 win-red-mark-small-24c5e97a925e2a929cae4a87ecdfcdf27f56974fd8172bdd34af91145aebca91.png
secure.winred.com/assets/ 9 KB
9 KB 37ms
35ms Image
image/webp 2606:4700::6812:9b15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.winred.com/assets/win-red-mark-small-24c5e97a925e2a929cae4a87ecdfcdf27f56974fd8172bdd34af91145aebca91.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:9b15 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

36f0bf882a876b13aeb20cf7a495421a43f336da5422072a58f58ce303fb6284

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_text_contribute_top_5_nd
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 15:56:12 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 5578
cf-polished: origFmt=png, origSize=11635
content-length: 8708
content-disposition: inline; filename="win-red-mark-small-24c5e97a925e2a929cae4a87ecdfcdf27f56974fd8172bdd34af91145aebca91.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id: A3FVF60T8JBSMA4A
x-amz-id-2: y3yq2fOiUgIRAL9BTbBy+q+ANVjEtGWeZZPcC9mPAT3O9JTNXVEGDcH7f1aHsSR5ykd3XX/kzYo=
expires: Mon, 06 Dec 2021 19:56:12 GMT
last-modified: Tue, 09 Nov 2021 03:32:15 GMT
server: cloudflare
etag: "972c0cca8d1e490484e89513f902e847"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains
content-type: image/webp
vary: Accept
cache-control: public, max-age=14400
x-amz-version-id: VTcW9ork7TOvvSB02l.TGI7mplJh2Key
accept-ranges: bytes
cf-ray: 6b96b3f33b0dca57-YUL
cf-bgj: imgq:85,h2pri

GET
H3 200 win-red-full-red-5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848.svg
secure.winred.com/assets/ 19 KB
8 KB 38ms
36ms Image
image/svg+xml 2606:4700::6812:9b15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.winred.com/assets/win-red-full-red-5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848.svg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:9b15 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_text_contribute_top_5_nd
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 15:56:12 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 72
content-type: image/svg+xml
strict-transport-security: max-age=0; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id: YVVF8GQKCV8N82S7
x-amz-id-2: 6UuSH/xU0Ig4KRJevmkT4XoSG69IjlNwJISDblCq+IFRmwtSaELtXbs1WxP7jcBMbMBekBC2kyc=
last-modified: Sun, 01 Aug 2021 04:38:40 GMT
server: cloudflare
etag: W/"d31530d4186af669daf4f47099614593"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: Mx.E1m3nz1bm4vsF8Q.JawodiIk.JRm8
cache-control: public, max-age=14400
cf-ray: 6b96b3f33b0eca57-YUL
expires: Mon, 06 Dec 2021 19:56:12 GMT

GET
H3 200 email-decode.min.js Show response
secure.winred.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
960 B 28ms
27ms Script
application/javascript 2606:4700::6812:9b15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:9b15 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_text_contribute_top_5_nd
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 15:56:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 01 Dec 2021 12:21:00 GMT
server: cloudflare
etag: W/"61a768ac-4d7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: DENY
content-type: application/javascript
cache-control: max-age=172800, public
strict-transport-security: max-age=0; includeSubDomains
cf-ray: 6b96b3f25a51ca57-YUL
vary: Accept-Encoding
expires: Wed, 08 Dec 2021 15:56:12 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 262 KB
63 KB 85ms
36ms Script
application/javascript 2607:f8b0:4006:81e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4cb7a0480dd16fd92f87639018a66efba6a2c4c975384c84bc8856de4a9a33f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 15:56:12 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 63951
x-xss-protection: 0
last-modified: Mon, 06 Dec 2021 15:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 06 Dec 2021 15:56:12 GMT

GET
H2 200 8416096648.js Show response
cdn-pci.optimizely.com/js/ 421 KB
109 KB 61ms
19ms Script
text/javascript 69.192.26.112
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-pci.optimizely.com/js/8416096648.js
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_text_contribute_top_5_nd
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 69.192.26.112 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a69-192-26-112.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 0c4d83d7ed629fcf090ecc239a585be39101f7237e8e45f68cfab655ff00d71a

Request headers

Referer: https://secure.winred.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

x-amz-meta-pci_enabled: True
x-amz-version-id: FZv7Y0vG_r1MLd_cH84parTMbLEEiXj_
content-encoding: gzip
etag: "940eae59b1c9007134d9371ae76fac66"
x-amz-request-id: CKT0PQSVKEFV75BX
x-amz-meta-revision: 74566
x-amz-replication-status: PENDING
vary: Accept-Encoding
content-length: 110520
x-amz-id-2: cXv5piKjezetPbbbRdipbRZiZEVf833wXZAWCCLGiGR1MulcbvFcLHao8Oe6hAods41/wnfkUv8=
last-modified: Sun, 05 Dec 2021 23:42:30 GMT
server: AmazonS3
date: Mon, 06 Dec 2021 15:56:12 GMT
access-control-max-age: 86400
access-control-allow-methods: GET, HEAD
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: x-amz-meta-revision
cache-control: max-age=120
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: *

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 278 KB
80 KB 109ms
60ms Script
application/javascript 2607:f8b0:4006:81e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-KQQBPQZ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a2563da3bbe32602e4925f4982e4f32912519ef8beb6f618f8d4d41852a42a48

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 15:56:12 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 81792
x-xss-protection: 0
last-modified: Mon, 06 Dec 2021 15:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 06 Dec 2021 15:56:12 GMT

GET
H3 200 gen_204 Show response
maps.googleapis.com/maps/api/mapsjs/ 3 B
45 B 84ms
58ms XHR
application/json 2607:f8b0:4006:80c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80c::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 15:56:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
server: scaffolding on HTTPServer2
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://secure.winred.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
vary: Origin, X-Origin, Referer
content-length: 23
x-xss-protection: 0

GET
H2 200 20210719_GOP_2021_RNC-FUNDRAISING_GENERIC-WINRED-PETITION_TRUMP_EA-DESKTOP_VARIANT-3_2450X1628.jpg
d35ligi1n5bgzc.cloudfront.net/backgrounds/images/000/103/233/large/ 212 KB
213 KB 62ms
28ms Image
image/jpeg 13.225.63.73
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d35ligi1n5bgzc.cloudfront.net/backgrounds/images/000/103/233/large/20210719_GOP_2021_RNC-FUNDRAISING_GENERIC-WINRED-PETITION_TRUMP_EA-DESKTOP_VARIANT-3_2450X1628.jpg
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/stylesheets/rv_page_01fm52qbrcp63q2sbneyd1jw28/1638551770.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.63.73 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-63-73.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 75fb90521d1e7155f5aee298e5c171e0f2e536ec07208d07026bcc9eb7122915

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Sun, 05 Dec 2021 23:11:48 GMT
via: 1.1 1ffe498380a643d1bb2efaa624b761a6.cloudfront.net (CloudFront)
last-modified: Mon, 26 Jul 2021 23:12:54 GMT
server: AmazonS3
age: 60265
etag: "9850f1b559292e2f241f63a58a735aec"
x-cache: Hit from cloudfront
x-amz-version-id: HkcTIJ9zx4wXCPixj6m6o0kqQnoABBZH
x-amz-cf-pop: EWR53-C1
accept-ranges: bytes
content-type: image/jpeg
content-length: 217234
x-amz-cf-id: 9QbuFdTuYW3hwFBd2fWxI961fePqxiciyrMVWeXUzVAfWuXjNap-eA==

GET
H2 200 utag.js Show response
tags.tiqcdn.com/utag/gop/main/prod/ 29 KB
9 KB 65ms
21ms Script
application/x-javascript 23.208.216.220
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/gop/main/prod/utag.js
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_text_contribute_top_5_nd
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.208.216.220 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-208-216-220.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 626e124aafce560a521c9ce7e4cc884ea850ad2ab2228389ebc02350bcda0e92

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 15:56:12 GMT
content-encoding: gzip
last-modified: Tue, 09 Jun 2020 18:29:15 GMT
server: AkamaiNetStorage
etag: "d3a4917f0b04f7f490bed307234c1b79:1591727355.318358"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=300
accept-ranges: bytes
content-length: 9387
expires: Mon, 06 Dec 2021 16:01:12 GMT

GET
H2 200 m-outer-f7902241893e7a497417843cb15dc858.html Show response
js.stripe.com/v3/ Frame 7F0C 240 B
959 B 21ms
21ms Document
text/html 13.225.214.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/m-outer-f7902241893e7a497417843cb15dc858.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.16 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-16.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

1969520bd7b0ea7b84b1cbdda4a8ae93c321abe6eaeff82b5fa496680bf88a0f

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src https://m.stripe.network; img-src https://q.stripe.com; font-src 'none'; media-src 'none'; object-src 'none'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/

Response headers

content-type: text/html; charset=utf-8
content-length: 240
last-modified: Wed, 27 Oct 2021 22:19:31 GMT
accept-ranges: bytes
server: Cloudfront
access-control-allow-origin: *
x-content-type-options: nosniff
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-security-policy: default-src 'self'; connect-src 'self' https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src https://m.stripe.network; img-src https://q.stripe.com; font-src 'none'; media-src 'none'; object-src 'none'; report-uri https://q.stripe.com/csp-report
timing-allow-origin: *
date: Mon, 06 Dec 2021 15:55:39 GMT
cache-control: max-age=60
etag: "f7902241893e7a497417843cb15dc858"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 cae77502d3847ca96378af9649c50cb4.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR50-C1
x-amz-cf-id: RQKT6EockDZCJvhm5RsUlUhGRXuT7H7I-6A6kneA6Fj259VejlcjUg==
age: 34

GET
H2 200 controller-4b2a0f6fa6eaf0d5f5e2c2d0b0102078.html Show response
js.stripe.com/v3/ Frame 6976 349 B
1 KB 22ms
21ms Document
text/html 13.225.214.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/controller-4b2a0f6fa6eaf0d5f5e2c2d0b0102078.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.16 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-16.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

32d4644b89b4c67b6db6b306cadc64f32d9283a4edefb88d1c95bcd45694270d

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/

Response headers

content-type: text/html; charset=utf-8
content-length: 349
last-modified: Fri, 03 Dec 2021 22:47:13 GMT
accept-ranges: bytes
server: Cloudfront
access-control-allow-origin: *
x-content-type-options: nosniff
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-security-policy: default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self'; report-uri https://q.stripe.com/csp-report
timing-allow-origin: *
date: Mon, 06 Dec 2021 15:55:36 GMT
cache-control: max-age=60
etag: "4b2a0f6fa6eaf0d5f5e2c2d0b0102078"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 cae77502d3847ca96378af9649c50cb4.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR50-C1
x-amz-cf-id: RwgcE9V6dpfTHZwq1ez3LVcUQAXi_wrgroVVx9gfNjW99nDkPjInOg==
age: 38

GET
H2 200 elements-inner-card-378af023188ba17d45ed1ebc05831546.html Show response
js.stripe.com/v3/ Frame E980 6 KB
2 KB 21ms
21ms Document
text/html 13.225.214.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/elements-inner-card-378af023188ba17d45ed1ebc05831546.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.16 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-16.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

02f6346535d658a846962a682488d1fdd568a1fff592036667d2d7a853511fe9

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/

Response headers

content-type: text/html; charset=utf-8
last-modified: Fri, 03 Dec 2021 22:47:20 GMT
server: Cloudfront
access-control-allow-origin: *
x-content-type-options: nosniff
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-security-policy: default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self'; report-uri https://q.stripe.com/csp-report
timing-allow-origin: *
content-encoding: gzip
date: Mon, 06 Dec 2021 15:55:24 GMT
cache-control: max-age=60
etag: W/"378af023188ba17d45ed1ebc05831546"
vary: Accept-Encoding,Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 cae77502d3847ca96378af9649c50cb4.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR50-C1
x-amz-cf-id: PtCq0YCBcJXjjYi1YRgNwXz9eX15hMXnrBrWC9iaTWhZRihmAkI62Q==
age: 48

GET
H2 200 current_with_info Show response
app.winred.com/api/v3/users/ 162 B
2 KB 82ms
81ms XHR
application/vnd.api+json 2606:4700::6812:9b15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.winred.com/api/v3/users/current_with_info?organization_token=rv_org_6KNvU36Z2qWJ2gfUBWqGZGoc&redirect=https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_text_contribute_top_5_nd

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/assets/application-landing-page-36cd0a6085201393f2fabbfa8313d174e8533225bd2d05c67cfcfa56a4ecae3a.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:9b15 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0c465bda1a82d147d88ff25d5adc5eaec6c25898d0c88a28612e5596cfc0ec8c

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://secure.winred.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-rack-cors-original-access-control-allow-origin: https://secure.winred.com
date: Mon, 06 Dec 2021 15:56:12 GMT
x-rack-cors-original-access-control-max-age: 0
x-rack-cors-original-access-control-allow-credentials: true
cf-cache-status: DYNAMIC
x-rack-cors-original-access-control-allow-methods: GET, POST, OPTIONS
access-control-max-age: 0
x-rack-cors-original-access-control-expose-headers
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-request-id: db6080b4-5670-418d-bedc-d6afc2a8c908
x-runtime: 0.008184
server: cloudflare
etag: W/"0c465bda1a82d147d88ff25d5adc5eae"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/vnd.api+json
access-control-allow-origin: https://secure.winred.com
vary: Origin
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
cf-ray: 6b96b3f41ea6714a-YUL
x-rack-cors: hit
x-content-type-options: nosniff
access-control-expose-headers

POST
H3 201 live Show response
secure.winred.com/api/v3/donations/ 412 B
2 KB 175ms
175ms XHR
application/json 2606:4700::6812:9b15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/api/v3/donations/live

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/assets/application-landing-page-36cd0a6085201393f2fabbfa8313d174e8533225bd2d05c67cfcfa56a4ecae3a.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:9b15 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5ff1440c280f3e8cdbb21de78d464571da46a17d551fb251f44260bd7f7ed16b

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

X-CSRF-Token: /Gb7Sxrx0OGeKgtYV8bowT6fsgJhk20uZprsouNkwbkv2BRhE6tZFmFAgO9PaO47oGIQB6JMsS8e8LjbQMQgPg==
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept: application/json, text/javascript, */*; q=0.01
Referer: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_text_contribute_top_5_nd
X-Requested-With: XMLHttpRequest
X-Revv-Apikey: cnZfb3JnX1R4blVmTW1ReFNtUlVGcDNxaEJ6bnhmNjo6Y1ZzbW9oUzE5bkxRVTVyK3RvL1Vydz09SHQzSERNSkhWUHBKcG85YnhhTDVnUFZvbHlmZW91WUxwaDdzT1IwRU8xSGNCK1AxcEVyK2tTWU5tSStCRzVxOE9UejBIZEpmMUV2NnFoMWEyTE9Fd01DK1hlTE9aa0J2L3VDL2dBRT0=

Response headers

x-rack-cors-original-access-control-allow-origin: https://secure.winred.com
date: Mon, 06 Dec 2021 15:56:12 GMT
x-rack-cors-original-access-control-max-age: 0
x-rack-cors-original-access-control-allow-credentials: true
cf-cache-status: DYNAMIC
x-rack-cors-original-access-control-allow-methods: GET, POST, OPTIONS
access-control-max-age: 0
x-rack-cors-original-access-control-expose-headers
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-request-id: f8d9e76f-ec5b-4ac0-bfff-9b33753b9e32
x-runtime: 0.089727
server: cloudflare
etag: W/"5ff1440c280f3e8cdbb21de78d464571"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://secure.winred.com
vary: Origin
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
cf-ray: 6b96b3f42bd7ca57-YUL
x-rack-cors: hit
x-content-type-options: nosniff
access-control-expose-headers

GET
H2 200 controller-4b2a0f6fa6eaf0d5f5e2c2d0b0102078.html Show response
js.stripe.com/v3/ Frame 8FAD 349 B
1 KB 19ms
19ms Document
text/html 13.225.214.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/controller-4b2a0f6fa6eaf0d5f5e2c2d0b0102078.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.16 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-16.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

32d4644b89b4c67b6db6b306cadc64f32d9283a4edefb88d1c95bcd45694270d

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/

Response headers

content-type: text/html; charset=utf-8
content-length: 349
last-modified: Fri, 03 Dec 2021 22:47:13 GMT
accept-ranges: bytes
server: Cloudfront
access-control-allow-origin: *
x-content-type-options: nosniff
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-security-policy: default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self'; report-uri https://q.stripe.com/csp-report
timing-allow-origin: *
date: Mon, 06 Dec 2021 15:55:36 GMT
cache-control: max-age=60
etag: "4b2a0f6fa6eaf0d5f5e2c2d0b0102078"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 cae77502d3847ca96378af9649c50cb4.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR50-C1
x-amz-cf-id: mLjQAFbyk3fLGoAnXdOcOHk0ye5VlfpJLRfzV9IRGYfJzrwaW7seNA==
age: 38

GET
H2 200 payment-request-inner-google-pay-60c82d552399a5dd4abfa20b710458c0.html Show response
js.stripe.com/v3/ Frame A35B 434 B
1 KB 20ms
19ms Document
text/html 13.225.214.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/payment-request-inner-google-pay-60c82d552399a5dd4abfa20b710458c0.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.16 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-16.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

f0b6e7438d98877c3085761d380c763545784389620bbbc8254bd5e30e83a3eb

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; connect-src 'self' https://r.stripe.com https://google.com/pay https://pay.google.com; script-src 'self' https://pay.google.com; style-src 'self' 'unsafe-inline'; frame-src https://pay.google.com; img-src https://q.stripe.com https://www.gstatic.com; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/

Response headers

content-type: text/html; charset=utf-8
content-length: 434
last-modified: Fri, 03 Dec 2021 22:47:20 GMT
accept-ranges: bytes
server: Cloudfront
access-control-allow-origin: *
x-content-type-options: nosniff
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-security-policy: default-src 'none'; connect-src 'self' https://r.stripe.com https://google.com/pay https://pay.google.com; script-src 'self' https://pay.google.com; style-src 'self' 'unsafe-inline'; frame-src https://pay.google.com; img-src https://q.stripe.com https://www.gstatic.com; report-uri https://q.stripe.com/csp-report
timing-allow-origin: *
date: Mon, 06 Dec 2021 15:55:36 GMT
cache-control: max-age=60
etag: "60c82d552399a5dd4abfa20b710458c0"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 cae77502d3847ca96378af9649c50cb4.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR50-C1
x-amz-cf-id: MYLdZHvtpleLNhiZoQov2lQHCyRIr0VEGGtzytYEVpTxPwSWde69bw==
age: 39

GET
H2 200 payment-request-inner-browser-1c4bf5a6899d19fb1761d102cda7bcc6.html Show response
js.stripe.com/v3/ Frame 77A8 370 B
1 KB 20ms
20ms Document
text/html 13.225.214.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/payment-request-inner-browser-1c4bf5a6899d19fb1761d102cda7bcc6.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.16 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-16.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

5ebf765fb54f6bcbe0e6cd23a33c3096f26bb86aaa27f885e6d574ffe6a63114

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://google.com/pay https://pay.google.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com https://www.gstatic.com; font-src data: https:; media-src 'none'; object-src 'self'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/

Response headers

content-type: text/html; charset=utf-8
content-length: 370
last-modified: Fri, 03 Dec 2021 22:47:13 GMT
accept-ranges: bytes
server: Cloudfront
access-control-allow-origin: *
x-content-type-options: nosniff
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-security-policy: default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://google.com/pay https://pay.google.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com https://www.gstatic.com; font-src data: https:; media-src 'none'; object-src 'self'; report-uri https://q.stripe.com/csp-report
timing-allow-origin: *
date: Mon, 06 Dec 2021 15:55:47 GMT
cache-control: max-age=60
etag: "1c4bf5a6899d19fb1761d102cda7bcc6"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 cae77502d3847ca96378af9649c50cb4.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR50-C1
x-amz-cf-id: 3jEOBM-NIgL0yIrxUU8al4om0usRum-73MiTz6FDJ1SevKFQk2CKTg==
age: 30

GET
H2 200 a8416096648.html Show response
a8416096648.cdn-pci.optimizely.com/client_storage/ Frame 12ED 2 KB
1 KB 62ms
19ms Document
text/html 69.192.20.36
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://a8416096648.cdn-pci.optimizely.com/client_storage/a8416096648.html
Requested by: Host: cdn-pci.optimizely.com
URL: https://cdn-pci.optimizely.com/js/8416096648.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 69.192.20.36 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a69-192-20-36.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 19d2e43a96b539c5bfee8691baa248a6560e8bacd2bdc2350bc9f740af273a02

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/

Response headers

x-amz-id-2: 52ksQNhPUbL3lAi51xK9Wvn221C+xzWyodIU2c927oJbcFqwXw8N9Rj1C/Qj9y9C+oAXthPswJg=
x-amz-request-id: WC11KYGVM1399R23
x-amz-replication-status: COMPLETED
last-modified: Sun, 05 Dec 2021 23:41:57 GMT
etag: "babba104758b256b59a40b5b04e1c534"
x-amz-meta-pci_enabled: True
content-encoding: gzip
x-amz-version-id: 63SgUfGImE8zm1qsicPdUKTwIDVKYMJt
accept-ranges: bytes
content-type: text/html; charset=utf-8
server: AmazonS3
content-length: 891
vary: Accept-Encoding
cache-control: max-age=120
date: Mon, 06 Dec 2021 15:56:12 GMT

POST
H2 200 csp-report
q.stripe.com/ Frame 7F0C 0
347 B 282ms
94ms Other
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://q.stripe.com/csp-report
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_text_contribute_top_5_nd
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-119-242.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
server: nginx
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://js.stripe.com
access-control-expose-headers: Server, Range, Content-Type
x-envoy-upstream-service-time: 2
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
content-length: 0

POST
H2 200 csp-report
q.stripe.com/ Frame 6976 0
347 B 396ms
214ms Other
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://q.stripe.com/csp-report
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_text_contribute_top_5_nd
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-119-242.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
server: nginx
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://js.stripe.com
access-control-expose-headers: Server, Range, Content-Type
x-envoy-upstream-service-time: 110
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
content-length: 0

POST
H2 200 csp-report
q.stripe.com/ Frame E980 0
346 B 285ms
106ms Other
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://q.stripe.com/csp-report
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_text_contribute_top_5_nd
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-119-242.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
server: nginx
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://js.stripe.com
access-control-expose-headers: Server, Range, Content-Type
x-envoy-upstream-service-time: 2
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
content-length: 0

POST
H2 200 csp-report
q.stripe.com/ Frame 8FAD 0
346 B 281ms
105ms Other
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://q.stripe.com/csp-report
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_text_contribute_top_5_nd
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-119-242.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
server: nginx
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://js.stripe.com
access-control-expose-headers: Server, Range, Content-Type
x-envoy-upstream-service-time: 2
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
content-length: 0

POST
H2 200 csp-report
q.stripe.com/ Frame A35B 0
347 B 380ms
213ms Other
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://q.stripe.com/csp-report
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_text_contribute_top_5_nd
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-119-242.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
server: nginx
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://js.stripe.com
access-control-expose-headers: Server, Range, Content-Type
x-envoy-upstream-service-time: 121
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
content-length: 0

POST
H2 200 csp-report
q.stripe.com/ Frame 77A8 0
346 B 265ms
102ms Other
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://q.stripe.com/csp-report
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_text_contribute_top_5_nd
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-119-242.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
server: nginx
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://js.stripe.com
access-control-expose-headers: Server, Range, Content-Type
x-envoy-upstream-service-time: 2
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
content-length: 0

GET
H2 200 m-outer-639174098ea8fe7fede6fa654790e8ec.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 7F0C 1 KB
1 KB 23ms
22ms Script
application/javascript 13.225.214.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/m-outer-639174098ea8fe7fede6fa654790e8ec.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/m-outer-f7902241893e7a497417843cb15dc858.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.16 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-16.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

6b5402ff8932ed835d39a31b75c6bc737a80f6ddcd6269a1fa53556485ca3ad8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/m-outer-f7902241893e7a497417843cb15dc858.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 43
x-cache: Hit from cloudfront
date: Mon, 06 Dec 2021 15:55:30 GMT
via: 1.1 cae77502d3847ca96378af9649c50cb4.cloudfront.net (CloudFront)
last-modified: Mon, 25 Oct 2021 19:35:20 GMT
server: Cloudfront
etag: W/"5213886b88cd72e6d0aebc89868e5d13"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
x-amz-cf-pop: EWR50-C1
timing-allow-origin: *
x-amz-cf-id: C_jidmqemAE4E2frbc9oDU2KeWvL06KYSJMVDRQMRch6B9NsNq8CRQ==

GET
H2 200 shared-81d67bdc5b083df068e5c3ff7fb127b3.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 6976 197 KB
54 KB 24ms
22ms Script
application/javascript 13.225.214.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/controller-4b2a0f6fa6eaf0d5f5e2c2d0b0102078.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.16 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-16.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

dae3dcabf7b6ce492e82906c84bf1151d406eacbcd59ceaedaaa9e0819585c4e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/controller-4b2a0f6fa6eaf0d5f5e2c2d0b0102078.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 35
x-cache: Hit from cloudfront
date: Mon, 06 Dec 2021 15:55:38 GMT
via: 1.1 cae77502d3847ca96378af9649c50cb4.cloudfront.net (CloudFront)
last-modified: Fri, 03 Dec 2021 22:47:14 GMT
server: Cloudfront
etag: W/"5dfa4dd7157aaee1fd4068b2d01eebca"
vary: Accept-Encoding,Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
x-amz-cf-pop: EWR50-C1
timing-allow-origin: *
x-amz-cf-id: GHDubCseWBTeA-8CchwcjWpxJKMIGExXbPlGU9w3oh62bIs4n3tulg==

GET
H2 200 controller-757ad3cd84aa3526116ef1c0095afef2.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 6976 306 KB
85 KB 36ms
34ms Script
application/javascript 13.225.214.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/controller-757ad3cd84aa3526116ef1c0095afef2.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/controller-4b2a0f6fa6eaf0d5f5e2c2d0b0102078.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.16 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-16.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

b43f598121b061463cc62dba6ac8e7582d667eb35d8223b06a4ac933b447199c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/controller-4b2a0f6fa6eaf0d5f5e2c2d0b0102078.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
x-amz-cf-pop: EWR50-C1
x-cache: Hit from cloudfront
date: Mon, 06 Dec 2021 15:56:12 GMT
via: 1.1 cae77502d3847ca96378af9649c50cb4.cloudfront.net (CloudFront)
last-modified: Fri, 03 Dec 2021 22:47:14 GMT
server: Cloudfront
etag: W/"de903a6ff74c7ac43fc0a675bc111f3e"
vary: Accept-Encoding,Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
timing-allow-origin: *
x-amz-cf-id: xEuu3iuhcjmt5JICc_x8iSZyI17nWWASzkNBdtnJt6axfgpNxiBwOQ==

GET
H2 200 ui-shared-46e93b3755a485133d7e5e7e1db48eaf.css
js.stripe.com/v3/fingerprinted/css/ Frame E980 15 KB
3 KB 27ms
26ms Stylesheet
text/css 13.225.214.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/css/ui-shared-46e93b3755a485133d7e5e7e1db48eaf.css

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-card-378af023188ba17d45ed1ebc05831546.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.16 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-16.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

d9f33ed9fdd936a670993b9a8e6ca44e7a358d0f7b217b6c6638b502f66a8015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-card-378af023188ba17d45ed1ebc05831546.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 9
x-cache: Hit from cloudfront
date: Mon, 06 Dec 2021 15:56:08 GMT
via: 1.1 cae77502d3847ca96378af9649c50cb4.cloudfront.net (CloudFront)
last-modified: Wed, 03 Nov 2021 22:14:27 GMT
server: Cloudfront
etag: W/"7c0a4ba6a732ed01cc27774f97bbe8bd"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=60
x-amz-cf-pop: EWR50-C1
timing-allow-origin: *
x-amz-cf-id: 3SbffUtYCewHTKFUWGb5f_d5DOAQEYvb6aEMz7xv9tqCni52CKGX2A==

GET
H2 200 shared-81d67bdc5b083df068e5c3ff7fb127b3.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame E980 197 KB
54 KB 27ms
26ms Script
application/javascript 13.225.214.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-card-378af023188ba17d45ed1ebc05831546.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.16 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-16.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

dae3dcabf7b6ce492e82906c84bf1151d406eacbcd59ceaedaaa9e0819585c4e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-card-378af023188ba17d45ed1ebc05831546.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 35
x-cache: Hit from cloudfront
date: Mon, 06 Dec 2021 15:55:38 GMT
via: 1.1 cae77502d3847ca96378af9649c50cb4.cloudfront.net (CloudFront)
last-modified: Fri, 03 Dec 2021 22:47:14 GMT
server: Cloudfront
etag: W/"5dfa4dd7157aaee1fd4068b2d01eebca"
vary: Accept-Encoding,Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
x-amz-cf-pop: EWR50-C1
timing-allow-origin: *
x-amz-cf-id: VWnBp30QkdefpTfv1-7tGtnETiLzDfT2ZD362niQz8cI7a8iT18Lzw==

GET
H2 200 ui-shared-edf311672d554521839b8daa26afdc33.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame E980 216 KB
66 KB 42ms
42ms Script
application/javascript 13.225.214.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/ui-shared-edf311672d554521839b8daa26afdc33.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-card-378af023188ba17d45ed1ebc05831546.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.16 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-16.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

381ebeeec0644d9fcbfeb6d1f3b692cbecb1b020a4c2ce5a712887d7c652db42

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-card-378af023188ba17d45ed1ebc05831546.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 29
x-cache: Hit from cloudfront
date: Mon, 06 Dec 2021 15:56:08 GMT
via: 1.1 cae77502d3847ca96378af9649c50cb4.cloudfront.net (CloudFront)
last-modified: Mon, 22 Nov 2021 23:04:51 GMT
server: Cloudfront
etag: W/"043c0ce9389f1c1479f40a32fa726309"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
x-amz-cf-pop: EWR50-C1
timing-allow-origin: *
x-amz-cf-id: sjjs7ZdSrHD-nsAA1FetrefsIQ6hXuVRR51RUFOZCytfAY1qK3aEGQ==

GET
H2 200 elements-inner-card-f168cb5e237dc04a5625532edb08f52d.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame E980 46 KB
12 KB 44ms
44ms Script
application/javascript 13.225.214.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/elements-inner-card-f168cb5e237dc04a5625532edb08f52d.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-card-378af023188ba17d45ed1ebc05831546.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.16 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-16.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

d0c4620ce8318742733f6d4b9ff6881018b9b2c51b2ae13f16dfc284461faa73

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-card-378af023188ba17d45ed1ebc05831546.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
x-amz-cf-pop: EWR50-C1
x-cache: Hit from cloudfront
date: Mon, 06 Dec 2021 15:56:12 GMT
via: 1.1 cae77502d3847ca96378af9649c50cb4.cloudfront.net (CloudFront)
last-modified: Thu, 18 Nov 2021 21:18:10 GMT
server: Cloudfront
etag: W/"64ac4bf7f6b6d9ed8cee940c632f347f"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
timing-allow-origin: *
x-amz-cf-id: PWBQRPbBGc3kZ6WgGjb00EwhcRbyDZimswDBVIT5O2ug0PLIzC87hw==

GET
H2 200 shared-81d67bdc5b083df068e5c3ff7fb127b3.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 8FAD 197 KB
54 KB 35ms
35ms Script
application/javascript 13.225.214.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/controller-4b2a0f6fa6eaf0d5f5e2c2d0b0102078.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.16 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-16.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

dae3dcabf7b6ce492e82906c84bf1151d406eacbcd59ceaedaaa9e0819585c4e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/controller-4b2a0f6fa6eaf0d5f5e2c2d0b0102078.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 35
x-cache: Hit from cloudfront
date: Mon, 06 Dec 2021 15:55:38 GMT
via: 1.1 cae77502d3847ca96378af9649c50cb4.cloudfront.net (CloudFront)
last-modified: Fri, 03 Dec 2021 22:47:14 GMT
server: Cloudfront
etag: W/"5dfa4dd7157aaee1fd4068b2d01eebca"
vary: Accept-Encoding,Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
x-amz-cf-pop: EWR50-C1
timing-allow-origin: *
x-amz-cf-id: EhQ1W8tk-lmoxLSevgXMQ2WvzKELdgo8HMVUrM2u8ZUkflBwYXvBkw==

GET
H2 200 controller-757ad3cd84aa3526116ef1c0095afef2.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 8FAD 306 KB
85 KB 37ms
37ms Script
application/javascript 13.225.214.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/controller-757ad3cd84aa3526116ef1c0095afef2.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/controller-4b2a0f6fa6eaf0d5f5e2c2d0b0102078.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.16 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-16.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

b43f598121b061463cc62dba6ac8e7582d667eb35d8223b06a4ac933b447199c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/controller-4b2a0f6fa6eaf0d5f5e2c2d0b0102078.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
x-amz-cf-pop: EWR50-C1
x-cache: Hit from cloudfront
date: Mon, 06 Dec 2021 15:56:12 GMT
via: 1.1 cae77502d3847ca96378af9649c50cb4.cloudfront.net (CloudFront)
last-modified: Fri, 03 Dec 2021 22:47:14 GMT
server: Cloudfront
etag: W/"de903a6ff74c7ac43fc0a675bc111f3e"
vary: Accept-Encoding,Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
timing-allow-origin: *
x-amz-cf-id: sfMo29nJD9vQcKVnjbkCJ5JwKEPeZujZ92835AsNdb1Ca4RHnZOf0g==

GET
H2 200 pay.js Show response
pay.google.com/gp/p/js/ Frame A35B 95 KB
31 KB 126ms
57ms Script
application/javascript 2607:f8b0:400d:c08::5c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pay.google.com/gp/p/js/pay.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/payment-request-inner-google-pay-60c82d552399a5dd4abfa20b710458c0.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c08::5c Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

658d3728e3878a01e5a054d6ba34ca6c574e7320933b9b9d46ad370465b8cca7

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendHttp/cspreport, script-src 'report-sample' 'nonce-/EigBSAAAqXyaul6Xl+MTg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendHttp/cspreport;worker-src 'self', script-src 'nonce-/EigBSAAAqXyaul6Xl+MTg' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendHttp/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
cross-origin-opener-policy: same-origin
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: private, max-age=600
cross-origin-resource-policy: cross-origin
content-security-policy: require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendHttp/cspreport, script-src 'report-sample' 'nonce-/EigBSAAAqXyaul6Xl+MTg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendHttp/cspreport;worker-src 'self', script-src 'nonce-/EigBSAAAqXyaul6Xl+MTg' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendHttp/cspreport
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=utf-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
expires: Mon, 06 Dec 2021 15:56:13 GMT

GET
H2 200 shared-81d67bdc5b083df068e5c3ff7fb127b3.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame A35B 197 KB
54 KB 24ms
23ms Script
application/javascript 13.225.214.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/payment-request-inner-google-pay-60c82d552399a5dd4abfa20b710458c0.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.16 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-16.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

dae3dcabf7b6ce492e82906c84bf1151d406eacbcd59ceaedaaa9e0819585c4e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/payment-request-inner-google-pay-60c82d552399a5dd4abfa20b710458c0.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 35
x-cache: Hit from cloudfront
date: Mon, 06 Dec 2021 15:55:38 GMT
via: 1.1 cae77502d3847ca96378af9649c50cb4.cloudfront.net (CloudFront)
last-modified: Fri, 03 Dec 2021 22:47:14 GMT
server: Cloudfront
etag: W/"5dfa4dd7157aaee1fd4068b2d01eebca"
vary: Accept-Encoding,Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
x-amz-cf-pop: EWR50-C1
timing-allow-origin: *
x-amz-cf-id: aLQy7D2rub8yt3h2HVV1febSt3sNT6aSSJxxNo2FSGc7c7vC1NVM0w==

GET
H2 200 payment-request-inner-google-pay-4645f70b2486dff134650d5d522fad20.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame A35B 13 KB
5 KB 27ms
26ms Script
application/javascript 13.225.214.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/payment-request-inner-google-pay-4645f70b2486dff134650d5d522fad20.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/payment-request-inner-google-pay-60c82d552399a5dd4abfa20b710458c0.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.16 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-16.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

032b2cd62ca53bd3edf67462afb364442044e4338d4eedf1269375bc238682d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/payment-request-inner-google-pay-60c82d552399a5dd4abfa20b710458c0.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 47
x-cache: Hit from cloudfront
date: Mon, 06 Dec 2021 15:55:32 GMT
via: 1.1 cae77502d3847ca96378af9649c50cb4.cloudfront.net (CloudFront)
last-modified: Wed, 10 Nov 2021 20:01:25 GMT
server: Cloudfront
etag: W/"e54b5138e0469d998089f7239d6f9aeb"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
x-amz-cf-pop: EWR50-C1
timing-allow-origin: *
x-amz-cf-id: 2Gs6YbaZMUuxtwrkGFkUld0tSAqE92zDi5Sxzx-zziIWQv1wjbVkYQ==

GET
H2 200 shared-81d67bdc5b083df068e5c3ff7fb127b3.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 77A8 197 KB
54 KB 22ms
21ms Script
application/javascript 13.225.214.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/payment-request-inner-browser-1c4bf5a6899d19fb1761d102cda7bcc6.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.16 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-16.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

dae3dcabf7b6ce492e82906c84bf1151d406eacbcd59ceaedaaa9e0819585c4e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/payment-request-inner-browser-1c4bf5a6899d19fb1761d102cda7bcc6.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 35
x-cache: Hit from cloudfront
date: Mon, 06 Dec 2021 15:55:38 GMT
via: 1.1 cae77502d3847ca96378af9649c50cb4.cloudfront.net (CloudFront)
last-modified: Fri, 03 Dec 2021 22:47:14 GMT
server: Cloudfront
etag: W/"5dfa4dd7157aaee1fd4068b2d01eebca"
vary: Accept-Encoding,Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
x-amz-cf-pop: EWR50-C1
timing-allow-origin: *
x-amz-cf-id: 8gcQG1HKrodtodKifeORjnktMBBIipkIg4VY22T6q3njmAFbH5nVJw==

GET
H2 200 payment-request-inner-browser-f2a776258b5d03fabd63ccb663dcf89a.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 77A8 11 KB
5 KB 26ms
25ms Script
application/javascript 13.225.214.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/payment-request-inner-browser-f2a776258b5d03fabd63ccb663dcf89a.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/payment-request-inner-browser-1c4bf5a6899d19fb1761d102cda7bcc6.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.16 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-16.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

71a55578d53e666ef644669139972f47092d97114a67c8b251f155ef6c19c15d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/payment-request-inner-browser-1c4bf5a6899d19fb1761d102cda7bcc6.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 37
x-cache: Hit from cloudfront
date: Mon, 06 Dec 2021 15:55:39 GMT
via: 1.1 cae77502d3847ca96378af9649c50cb4.cloudfront.net (CloudFront)
last-modified: Mon, 25 Oct 2021 19:35:22 GMT
server: Cloudfront
etag: W/"10d818482d8e44820136b10d6f9b02e4"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
x-amz-cf-pop: EWR50-C1
timing-allow-origin: *
x-amz-cf-id: xubdG6ciJDIf0txmsBVNAxzXXxc8PI8fCeE99Bzfh_DA8PVdsnQy5Q==

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 71ms
18ms Script
text/javascript 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 5658
date: Mon, 06 Dec 2021 14:21:55 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Mon, 06 Dec 2021 16:21:55 GMT

GET
H3

200

activityi;dc_pre=CPbGtt7Ez_QCFacG0AQdezkMEQ;src=9323526;type=landi0;cat=gop_d0;ord=8724695368488;gtm=2wgc10;auiddc=520031146.1638806173;ps=1;~oref=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-soci... Show response
9323526.fls.doubleclick.net/ Frame A299
Redirect Chain

https://9323526.fls.doubleclick.net/activityi;src=9323526;type=landi0;cat=gop_d0;ord=8724695368488;gtm=2wgc10;auiddc=520031146.1638806173;ps=1;~oref=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-so...
https://9323526.fls.doubleclick.net/activityi;dc_pre=CPbGtt7Ez_QCFacG0AQdezkMEQ;src=9323526;type=landi0;cat=gop_d0;ord=8724695368488;gtm=2wgc10;auiddc=520031146.1638806173;ps=1;~oref=https%3A%2F%2F...

753 B
541 B

117ms
90ms

Document
text/html

142.250.80.38
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://9323526.fls.doubleclick.net/activityi;dc_pre=CPbGtt7Ez_QCFacG0AQdezkMEQ;src=9323526;type=landi0;cat=gop_d0;ord=8724695368488;gtm=2wgc10;auiddc=520031146.1638806173;ps=1;~oref=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-supporters%3Famount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26amt5%3D100%26amt6%3D500%26amt7%3D2800%26utm_medium%3Demail%26utm_source%3DET_105%26utm_campaign%3D20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc%26utm_content%3Dgop_direct-ask_text_contribute_top_5_nd?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KQQBPQZ

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.38 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s34-in-f6.1e100.net

Software

cafe /

Resource Hash

7a082bd7dcead9ea41c677b4acdfc9389b50c3eff3b61b8ae78036c9e053afef

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: about:blank

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Mon, 06 Dec 2021 15:56:13 GMT
expires: Mon, 06 Dec 2021 15:56:13 GMT
cache-control: private, max-age=0
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 516
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Mon, 06 Dec 2021 15:56:13 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://9323526.fls.doubleclick.net/activityi;dc_pre=CPbGtt7Ez_QCFacG0AQdezkMEQ;src=9323526;type=landi0;cat=gop_d0;ord=8724695368488;gtm=2wgc10;auiddc=520031146.1638806173;ps=1;~oref=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-supporters%3Famount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26amt5%3D100%26amt6%3D500%26amt7%3D2800%26utm_medium%3Demail%26utm_source%3DET_105%26utm_campaign%3D20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc%26utm_content%3Dgop_direct-ask_text_contribute_top_5_nd?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 87 KB
35 KB 58ms
33ms Script
application/javascript 2607:f8b0:4006:81e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-9323526

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KQQBPQZ

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0c971e6db21f464c3c85d6d37ac2d8f18008e66ec112c7891a00fdf721ab3a1a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35939
x-xss-protection: 0
last-modified: Mon, 06 Dec 2021 15:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 06 Dec 2021 15:56:13 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 98 KB
26 KB 64ms
21ms Script
application/x-javascript 2a03:2880:f012:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

b23807a4c5d90afca0dc47d688c0a05302779429dab75f5e6182562dcc2970f6

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length: 25965
x-xss-protection: 0
pragma: public
x-fb-debug: naSu0IncygCpUj2+8nYBg0NOGcZFK9x6+jCzCeWGPfRMkWZEqRYBUr4Gin9Y3LxX+AvYzqhUqbgmCXz8qG7YBQ==
x-fb-trip-id: 2050670934
x-frame-options: DENY
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Mon, 06 Dec 2021 15:56:13 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 activityi;register_conversion=1;src=9323526;type=landi0;cat=gop_d0;ord=8724695368488;gtm=2wgc10;auiddc=520031146.1638806173;ps=1;~oref=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-...
9323526.fls.doubleclick.net/ 0
0 78ms
37ms Image
text/html 142.250.80.38
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://9323526.fls.doubleclick.net/activityi;register_conversion=1;src=9323526;type=landi0;cat=gop_d0;ord=8724695368488;gtm=2wgc10;auiddc=520031146.1638806173;ps=1;~oref=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-supporters%3Famount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26amt5%3D100%26amt6%3D500%26amt7%3D2800%26utm_medium%3Demail%26utm_source%3DET_105%26utm_campaign%3D20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc%26utm_content%3Dgop_direct-ask_text_contribute_top_5_nd?
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_text_contribute_top_5_nd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.80.38 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga34s34-in-f6.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

GET
H2 200 utag.39.js Show response
tags.tiqcdn.com/utag/gop/main/prod/ 3 KB
2 KB 23ms
21ms Script
application/x-javascript 23.208.216.220
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/gop/main/prod/utag.39.js?utv=ut4.46.201909121401
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gop/main/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.208.216.220 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-208-216-220.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: af4b8dcbb0f1beb04e333fb40d352f763415cc15b83b6c79646d773c4d5893b6

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
content-encoding: gzip
last-modified: Thu, 12 Sep 2019 14:01:06 GMT
server: AkamaiNetStorage
etag: "0f7ae16a39aeb401a433557708bafd97:1568296866.396571"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1452
expires: Tue, 21 Dec 2021 15:56:13 GMT

GET
H2 200 utag.5.js Show response
tags.tiqcdn.com/utag/gop/main/prod/ 13 KB
4 KB 24ms
23ms Script
application/x-javascript 23.208.216.220
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/gop/main/prod/utag.5.js?utv=ut4.46.201909102207
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gop/main/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.208.216.220 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-208-216-220.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 2646d818e258e85ba1721270d71684413d53dfa2dd8ac6957738d56a86ab1b5f

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
content-encoding: gzip
last-modified: Tue, 10 Sep 2019 22:07:42 GMT
server: AkamaiNetStorage
etag: "606a7fe5adc12f074e7ad290ea7644d9:1568153262.338063"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 4177
expires: Tue, 21 Dec 2021 15:56:13 GMT

GET
H2 200 utag.44.js Show response
tags.tiqcdn.com/utag/gop/main/prod/ 3 KB
1 KB 24ms
24ms Script
application/x-javascript 23.208.216.220
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/gop/main/prod/utag.44.js?utv=ut4.46.202002071856
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gop/main/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.208.216.220 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-208-216-220.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 048ab7812899a24caacd50b1921fc17d5a3f7cd1fde2863d439a024a2245c6f8

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
content-encoding: gzip
last-modified: Fri, 07 Feb 2020 18:56:58 GMT
server: AkamaiNetStorage
etag: "624aec441dbcaae3f4aef04be799a630:1581101818.286578"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1190
expires: Tue, 21 Dec 2021 15:56:13 GMT

GET
H2 200 utag.45.js Show response
tags.tiqcdn.com/utag/gop/main/prod/ 14 KB
5 KB 25ms
25ms Script
application/x-javascript 23.208.216.220
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/gop/main/prod/utag.45.js?utv=ut4.46.202006091829
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gop/main/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.208.216.220 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-208-216-220.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: aa920fa4fdea358365f980f78d82a992fa119070a07cb21d3aeee419d88429aa

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
content-encoding: gzip
last-modified: Tue, 09 Jun 2020 18:29:15 GMT
server: AkamaiNetStorage
etag: "598807775548ec7884f6579c1db8fbdb:1591727355.818648"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 4582
expires: Tue, 21 Dec 2021 15:56:13 GMT

GET
H2 200 inner.html Show response
m.stripe.network/ Frame 4AC2 932 B
2 KB 90ms
19ms Document
text/html 13.225.214.66
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.network/inner.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/m-outer-639174098ea8fe7fede6fa654790e8ec.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.66 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-66.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

ed34a59f182c66e2b25c602f3c9b0f21435a8f475d5dbc9e6830ff4c7929f5cd

Security Headers

Name	Value
Content-Security-Policy	connect-src 'self' https://m.stripe.com; default-src 'self'; font-src data: https:; frame-src 'self' https://js.stripe.com; img-src 'self' https://m.stripe.com; media-src 'none'; object-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/

Response headers

content-type: text/html; charset=utf-8
content-length: 932
last-modified: Thu, 04 Nov 2021 19:04:57 GMT
accept-ranges: bytes
server: Cloudfront
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
x-content-type-options: nosniff
content-security-policy-report-only: base-uri 'none'; connect-src 'self' https://m.stripe.com; default-src 'none'; font-src 'self'; frame-src 'self' https://js.stripe.com; img-src 'self' https://m.stripe.com; script-src 'self' 'sha256-Qj6AdMOUjZkBBUTjGW/OORBoqx2Pohcq8Bg/ZvZzgYw='; style-src 'self'; report-uri https://q.stripe.com/csp-report
content-security-policy: connect-src 'self' https://m.stripe.com; default-src 'self'; font-src data: https:; frame-src 'self' https://js.stripe.com; img-src 'self' https://m.stripe.com; media-src 'none'; object-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; report-uri https://q.stripe.com/csp-report
date: Mon, 06 Dec 2021 15:52:25 GMT
cache-control: max-age=300, public
etag: "f6254e6dd0cb06228801a1c8baf0939f"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 cae77502d3847ca96378af9649c50cb4.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR50-C1
x-amz-cf-id: LKY-vACD-VJ_ShMMkn6fVZOe36R9Dh2sakcwdskIAriF-BvBCl-1cg==
age: 228

POST
H3 204 result Show response
secure.winred.com/cdn-cgi/bm/cv/ 0
536 B 17ms
17ms XHR
text/plain 2606:4700::6812:9b15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/cdn-cgi/bm/cv/result?req_id=6b96b3f0faa4714a

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/cdn-cgi/bm/cv/669835187/api.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:9b15 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_text_contribute_top_5_nd
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/json

Response headers

strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
server: cloudflare
date: Mon, 06 Dec 2021 15:56:13 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
cf-ray: 6b96b3f60d58ca57-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 countryRanges-ed6f8980af15d82ca172d25916879a5c.json Show response
js.stripe.com/v3/fingerprinted/data/ Frame E980 143 KB
36 KB 21ms
21ms XHR
application/json 13.225.214.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/data/countryRanges-ed6f8980af15d82ca172d25916879a5c.json

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.16 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-16.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

5785c083b1cf0a752958975ebf6365d60896c3e809e7fd9bd94dc6e11bc75004

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://js.stripe.com/v3/elements-inner-card-378af023188ba17d45ed1ebc05831546.html
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 42
x-cache: Hit from cloudfront
date: Mon, 06 Dec 2021 15:55:32 GMT
via: 1.1 cae77502d3847ca96378af9649c50cb4.cloudfront.net (CloudFront)
last-modified: Mon, 25 Oct 2021 19:35:30 GMT
server: Cloudfront
etag: W/"ed6f8980af15d82ca172d25916879a5c"
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=60
x-amz-cf-pop: EWR50-C1
timing-allow-origin: *
x-amz-cf-id: GwY2IE_3IHlrQrXKFpaa0UwpVZWgilQeOuDHUiQ7WbCcCeKe8UIf9A==

POST
H2 200 0 Show response
r.stripe.com/ Frame 6976 0
213 B 96ms
94ms XHR
application/octet-stream 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

GET
H3 200 js Show response
www.google-analytics.com/gtm/ 87 KB
34 KB 64ms
38ms Script
application/javascript 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/gtm/js?id=GTM-K942VSZ&t=gtm16&cid=608955462.1638806173

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4eff4388d8e116284931c115697a5bfe1fd4aa7be10a39d1b0bb58cbab413afc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34985
x-xss-protection: 0
last-modified: Mon, 06 Dec 2021 15:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 06 Dec 2021 15:56:13 GMT

POST
H2 200 0 Show response
r.stripe.com/ Frame 8FAD 0
213 B 95ms
94ms XHR
application/octet-stream 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

GET
H3 200 payframe Show response
pay.google.com/gp/p/ui/ Frame 0855 17 KB
7 KB 98ms
63ms Document
text/html 2607:f8b0:400d:c08::5c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pay.google.com/gp/p/ui/payframe?origin=https%3A%2F%2Fjs.stripe.com&mid=

Requested by

Host: pay.google.com
URL: https://pay.google.com/gp/p/js/pay.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c08::5c Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

31d88b9f1d22deef09af5239d7c70c22201925286477a3db77f69530f3dc9770

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport script-src 'report-sample' 'nonce-pPgDO4LbPuQJWEUsN+NOaQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport;worker-src 'self' script-src 'nonce-pPgDO4LbPuQJWEUsN+NOaQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/

Response headers

content-type: text/html; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-ua-compatible: IE=edge
expires: Mon, 06 Dec 2021 15:56:13 GMT
date: Mon, 06 Dec 2021 15:56:13 GMT
cache-control: private, max-age=3600
strict-transport-security: max-age=31536000
cross-origin-resource-policy: same-site
content-security-policy: require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport script-src 'report-sample' 'nonce-pPgDO4LbPuQJWEUsN+NOaQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport;worker-src 'self' script-src 'nonce-pPgDO4LbPuQJWEUsN+NOaQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport
cross-origin-opener-policy: same-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 csp-report
q.stripe.com/ Frame 4AC2 0
121 B 201ms
200ms Other
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://m.stripe.network/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
x-envoy-upstream-service-time: 106
server: nginx
content-length: 0
strict-transport-security: max-age=31556926; includeSubDomains; preload

POST
H2 200 csp-report
q.stripe.com/ Frame 4AC2 0
121 B 201ms
200ms Other
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://m.stripe.network/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
x-envoy-upstream-service-time: 106
server: nginx
content-length: 0
strict-transport-security: max-age=31556926; includeSubDomains; preload

POST
H2 200 0 Show response
r.stripe.com/ Frame 6976 0
213 B 100ms
100ms XHR
application/octet-stream 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 3
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 6976 0
213 B 98ms
98ms XHR
application/octet-stream 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 6976 0
213 B 99ms
99ms XHR
application/octet-stream 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 6976 0
213 B 98ms
98ms XHR
application/octet-stream 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 6976 0
213 B 95ms
95ms XHR
application/octet-stream 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

GET
H3 200 1171422386625841 Show response
connect.facebook.net/signals/config/ 5 KB
2 KB 37ms
18ms Script
application/x-javascript 2a03:2880:f012:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1171422386625841?v=2.9.48&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d68eb8e1826d9711bd5b411fbce0f61516fb7da1b8dd5d090251e6d3f2bf0cd5

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length: 2266
x-xss-protection: 0
pragma: public
x-fb-debug: 8OZVrs6tNRz2++pLjlwZgMet+Y5qAsmJB0OED+uR2wCd5PqVPE1eLVwCvZls9TJt7D1+UQRRYS8pBcJYfo87tQ==
x-frame-options: DENY
date: Mon, 06 Dec 2021 15:56:13 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H2 200 i.gif Show response
collect.tealiumiq.com/gop/main/2/ 43 B
747 B 84ms
33ms XHR
image/gif 34.201.87.201
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://collect.tealiumiq.com/gop/main/2/i.gif
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gop/main/prod/utag.45.js?utv=ut4.46.202006091829
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.201.87.201 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-201-87-201.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://secure.winred.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryuH9cTRMUU6stNypn

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
vary: Origin
x-serverid: uconnect_i-0d2a544ed4675b3bd
x-tid: 017d9075b571001ac91d2044068f03072014b06a00b08
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CUR ADM DEV OUR BUS"
x-acc: gop:main:2:datacloud
x-region: us-east-1
content-length: 43
pragma: no-cache
x-did: 017d9075b571001ac91d2044068f03072014b06a00b08
content-type: image/gif
access-control-allow-origin: https://secure.winred.com
access-control-expose-headers: X-Region
cache-control: no-transform,private,no-cache,no-store,max-age=0,s-maxage=0
access-control-allow-credentials: true
x-ulver: f8f5e005b8b6e369c2cee0a0923be629b8a9d3a5-SNAPSHOT
x-uuid: 4078c228-968f-4283-bd2f-daeb5fb59d27
expires: Mon, 06 Dec 2021 15:56:13 GMT

POST
H2 200 0 Show response
r.stripe.com/ Frame 6976 0
213 B 94ms
94ms XHR
application/octet-stream 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 6976 0
213 B 95ms
95ms XHR
application/octet-stream 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 6976 0
213 B 94ms
94ms XHR
application/octet-stream 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 8FAD 0
213 B 101ms
100ms XHR
application/octet-stream 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 8FAD 0
213 B 100ms
100ms XHR
application/octet-stream 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 8FAD 0
213 B 101ms
100ms XHR
application/octet-stream 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 8FAD 0
213 B 101ms
101ms XHR
application/octet-stream 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 3
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 8FAD 0
213 B 100ms
100ms XHR
application/octet-stream 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 8FAD 0
213 B 99ms
99ms XHR
application/octet-stream 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 8FAD 0
213 B 100ms
99ms XHR
application/octet-stream 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 8FAD 0
213 B 102ms
101ms XHR
application/octet-stream 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 3
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 8FAD 0
213 B 100ms
100ms XHR
application/octet-stream 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 3
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 8FAD 0
213 B 99ms
98ms XHR
application/octet-stream 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

GET
H2

200

i.gif
datacloud.tealiumiq.com/vdata/
Redirect Chain

https://cm.g.doubleclick.net/pixel?tealium_cookie_sync=true&google_nid=tealium_dmp&google_cm&tealium_vid=017d9075b571001ac91d2044068f03072014b06a00b08&tealium_account=gop&tealium_profile=main
https://datacloud.tealiumiq.com/vdata/i.gif?tealium_cookie_sync=true&tealium_vid=017d9075b571001ac91d2044068f03072014b06a00b08&tealium_account=gop&tealium_profile=main&google_gid=CAESEPPrkulsHTtOKE...

43 B
967 B

79ms
24ms

Image
image/gif

34.197.188.108
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://datacloud.tealiumiq.com/vdata/i.gif?tealium_cookie_sync=true&tealium_vid=017d9075b571001ac91d2044068f03072014b06a00b08&tealium_account=gop&tealium_profile=main&google_gid=CAESEPPrkulsHTtOKE_w9Slk9rU&google_cver=1
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_text_contribute_top_5_nd
Protocol: H2
Server: 34.197.188.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-197-188-108.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 15:56:13 GMT
x-serverid: uconnect_i-054cb9fbdbffa2ed1
x-did: 017d9075b571001ac91d2044068f03072014b06a00b08
x-tid: 017d9075b571001ac91d2044068f03072014b06a00b08
vary: Origin
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CUR ADM DEV OUR BUS"
x-acc: gop:main:2:vdata
cache-control: no-transform,private,no-cache,no-store,max-age=0,s-maxage=0
x-region: us-east-1
content-type: image/gif
x-ulver: f8f5e005b8b6e369c2cee0a0923be629b8a9d3a5-SNAPSHOT
content-length: 43
x-uuid: d8aa2eab-9237-4ebd-a8a5-905e985318eb
expires: Mon, 06 Dec 2021 15:56:13 GMT

Redirect headers

pragma: no-cache
date: Mon, 06 Dec 2021 15:56:13 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://datacloud.tealiumiq.com/vdata/i.gif?tealium_cookie_sync=true&tealium_vid=017d9075b571001ac91d2044068f03072014b06a00b08&tealium_account=gop&tealium_profile=main&google_gid=CAESEPPrkulsHTtOKE_w9Slk9rU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 437
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 i.gif Show response
collect.tealiumiq.com/gop/main/2/ 43 B
746 B 63ms
41ms XHR
image/gif 34.201.87.201
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://collect.tealiumiq.com/gop/main/2/i.gif
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gop/main/prod/utag.5.js?utv=ut4.46.201909102207
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.201.87.201 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-201-87-201.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://secure.winred.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryRo30pYYCUWocFSBX

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
vary: Origin
x-serverid: uconnect_i-0a5b3efa87782bfa9
x-tid: 017d9075b571001ac91d2044068f03072014b06a00b08
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CUR ADM DEV OUR BUS"
x-acc: gop:main:2:datacloud
x-region: us-east-1
content-length: 43
pragma: no-cache
x-did: 017d9075b571001ac91d2044068f03072014b06a00b08
content-type: image/gif
access-control-allow-origin: https://secure.winred.com
access-control-expose-headers: X-Region
cache-control: no-transform,private,no-cache,no-store,max-age=0,s-maxage=0
access-control-allow-credentials: true
x-ulver: f8f5e005b8b6e369c2cee0a0923be629b8a9d3a5-SNAPSHOT
x-uuid: e7f71cb5-84eb-4385-8468-4e173d044afb
expires: Mon, 06 Dec 2021 15:56:13 GMT

GET
H2 200 utag.v.js Show response
tags.tiqcdn.com/utag/tiqapp/ 2 B
202 B 19ms
19ms Script
application/x-javascript 23.208.216.220
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=gop/main/202006091829&cb=1638806173333
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gop/main/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.208.216.220 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-208-216-220.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
last-modified: Thu, 14 Apr 2016 16:57:51 GMT
server: AkamaiNetStorage
etag: "7bc0ee636b3b83484fc3b9348863bd22:1460653071"
content-type: application/x-javascript
cache-control: max-age=600
accept-ranges: bytes
content-length: 2
expires: Mon, 06 Dec 2021 16:06:13 GMT

POST
H2 200 0 Show response
r.stripe.com/ Frame 6976 0
213 B 114ms
114ms XHR
application/octet-stream 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

GET
H2 200 dc_pre=CPbGtt7Ez_QCFacG0AQdezkMEQ;src=9323526;type=landi0;cat=gop_d0;ord=8724695368488;gtm=2wgc10;auiddc=*;ps=1;~oref=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-supporters%3Famou...
adservice.google.com/ddm/fls/z/ Frame A299 42 B
494 B 94ms
46ms Image
image/gif 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CPbGtt7Ez_QCFacG0AQdezkMEQ;src=9323526;type=landi0;cat=gop_d0;ord=8724695368488;gtm=2wgc10;auiddc=*;ps=1;~oref=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-supporters%3Famount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26amt5%3D100%26amt6%3D500%26amt7%3D2800%26utm_medium%3Demail%26utm_source%3DET_105%26utm_campaign%3D20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc%26utm_content%3Dgop_direct-ask_text_contribute_top_5_nd

Requested by

Host: 9323526.fls.doubleclick.net
URL: https://9323526.fls.doubleclick.net/activityi;dc_pre=CPbGtt7Ez_QCFacG0AQdezkMEQ;src=9323526;type=landi0;cat=gop_d0;ord=8724695368488;gtm=2wgc10;auiddc=520031146.1638806173;ps=1;~oref=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-supporters%3Famount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26amt5%3D100%26amt6%3D500%26amt7%3D2800%26utm_medium%3Demail%26utm_source%3DET_105%26utm_campaign%3D20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc%26utm_content%3Dgop_direct-ask_text_contribute_top_5_nd?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://9323526.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 15:56:13 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 out-4.5.41.js Show response
m.stripe.network/ Frame 4AC2 85 KB
14 KB 24ms
24ms Script
text/javascript 13.225.214.66
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.network/out-4.5.41.js

Requested by

Host: m.stripe.network
URL: https://m.stripe.network/inner.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.66 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-66.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

a2f6b81396ab1150effea054efbf1623212ea0419976389ce8f10e909d39e4c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://m.stripe.network/inner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
age: 65
x-cache: Hit from cloudfront
date: Mon, 06 Dec 2021 15:55:09 GMT
last-modified: Thu, 04 Nov 2021 19:04:57 GMT
server: Cloudfront
etag: W/"2db385faf28cf5f9393cf01a0a1edfa2"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
via: 1.1 cae77502d3847ca96378af9649c50cb4.cloudfront.net (CloudFront)
cache-control: max-age=300, public
x-amz-cf-pop: EWR50-C1
timing-allow-origin: *
x-amz-cf-id: TdK7vKRZ2jEN7bUA4W0eyzmsU2KRdX2cfoj1Kz0k7oIk1mN0kdDQUg==

GET
H3 200 657928937632482 Show response
connect.facebook.net/signals/config/ 305 KB
87 KB 19ms
18ms Script
application/x-javascript 2a03:2880:f012:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/657928937632482?v=2.9.48&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

511b9d16faa374c5a400579ce33a42e5e5ff293335cedc2e5f6a310e778944e8

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length: 88942
x-xss-protection: 0
pragma: public
x-fb-debug: 6v15Z5n2X2x4pg6cLEPSuuNy5LG5NeI8KLkou5p8iJ78EfuV9rqDXnNwx3wcfAzO0qoOWaQ28KrAxmhAmEpD1g==
x-frame-options: DENY
date: Mon, 06 Dec 2021 15:56:13 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
443 B 129ms
52ms XHR
text/plain 2607:f8b0:4023:1404::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-73658561-7&cid=608955462.1638806173&jid=839156550&gjid=1233238629&_gid=1408659342.1638806173&_u=aGDAiEADRAAAAE~&z=1977068572

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4023:1404::9a Columbus, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Mon, 06 Dec 2021 15:56:13 GMT
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.google-analytics.com/gtm/ 129 KB
42 KB 38ms
38ms Script
application/javascript 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/gtm/js?id=OPT-NTPH8CG&t=gtm42&cid=608955462.1638806173

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

83b5496f5ea55212aaa895649c3736a21062d853d129e0bdc64736ea0086ab31

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43384
x-xss-protection: 0
expires: Mon, 06 Dec 2021 15:56:13 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 21ms
19ms Image
image/gif 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=556201389&t=pageview&_s=1&dl=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-supporters%3Famount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26amt5%3D100%26amt6%3D500%26amt7%3D2800%26utm_medium%3Demail%26utm_source%3DET_105%26utm_campaign%3D20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc%26utm_content%3Dgop_direct-ask_text_contribute_top_5_nd&ul=en-us&de=UTF-8&dt=Republican%20National%20Committee&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGDAiEADR~&jid=839156550&gjid=1233238629&cid=608955462.1638806173&tid=UA-73658561-7&_gid=1408659342.1638806173&gtm=2wgc10NTQZ9N&cd61=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-supporters%3Famount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26amt5%3D100%26amt6%3D500%26amt7%3D2800%26utm_medium%3Demail%26utm_source%3DET_105%26utm_campaign%3D20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc%26utm_content%3Dgop_direct-ask_text_contribute_top_5_nd&z=600249293

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 15:18:37 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 2256
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 21ms
20ms Image
image/gif 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=556201389&t=event&ni=0&_s=1&dl=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-supporters%3Famount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26amt5%3D100%26amt6%3D500%26amt7%3D2800%26utm_medium%3Demail%26utm_source%3DET_105%26utm_campaign%3D20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc%26utm_content%3Dgop_direct-ask_text_contribute_top_5_nd&ul=en-us&de=UTF-8&dt=Republican%20National%20Committee&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=donation%20landing%20page&ea=user%20session%20start&el=landing%20page%20settings&_u=aGDAiEADRAAAAE~&jid=&gjid=&cid=608955462.1638806173&tid=UA-73658561-7&_gid=1408659342.1638806173&gtm=2wgc10NTQZ9N&cd41=anonymous&cd58=t&cd61=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-supporters%3Famount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26amt5%3D100%26amt6%3D500%26amt7%3D2800%26utm_medium%3Demail%26utm_source%3DET_105%26utm_campaign%3D20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc%26utm_content%3Dgop_direct-ask_text_contribute_top_5_nd&z=761930497

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 15:18:37 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 2256
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 404 cspreport
pay.google.com/_/InstantbuyFrontendBuyflowPayframeUi/ Frame 0855 2 KB
2 KB 32ms
31ms Other
text/html 2607:f8b0:400d:c08::5c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://pay.google.com/_/InstantbuyFrontendBuyflowPayframeUi/cspreport
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_text_contribute_top_5_nd
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400d:c08::5c Morganton, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: d6ff339ddb4525268c21fa26ded66b0703f177e742281dc9bcd558288f8e1101

Request headers

Referer: https://pay.google.com/gp/p/ui/payframe?origin=https%3A%2F%2Fjs.stripe.com&mid=
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
referrer-policy: no-referrer
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1608
content-type: text/html; charset=UTF-8

GET
H2 200 m=_b,_tp Show response
www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/am=BgAC/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AM... Frame 0855 147 KB
52 KB 73ms
23ms Script
text/javascript 2607:f8b0:4006:822::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/am=BgAC/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrjxCApCTeEZd__vduiQwZD3SnqNGg/m=_b,_tp

Requested by

Host: pay.google.com
URL: https://pay.google.com/gp/p/ui/payframe?origin=https%3A%2F%2Fjs.stripe.com&mid=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:822::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ad6945a0f0f97fb15a8997a2a1d10ad6b4291985a7467c530434e7c04c124505

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Fri, 03 Dec 2021 17:12:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 254613
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/payments-consumer-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 52727
x-xss-protection: 0
last-modified: Fri, 03 Dec 2021 03:45:46 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/payments-consumer-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/payments-consumer-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="boq-infra/payments-consumer-boq-js-css-signers"
expires: Sat, 03 Dec 2022 17:12:40 GMT

GET
H3 200 1660815514223309 Show response
connect.facebook.net/signals/config/ 305 KB
87 KB 22ms
22ms Script
application/x-javascript 2a03:2880:f012:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1660815514223309?v=2.9.48&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

fc2ccef085594d1720ce27023740483286cb0f8e0702011ea99622ffa75a4a42

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length: 89005
x-xss-protection: 0
pragma: public
x-fb-debug: chRk9I4WR9KrTvsSGfxf1/tS8eoo3b+a7huj8KohN7edUz8VkZNOqzd6zrJgW8r0E/eI0s7Rk14D488Z4UrTKg==
x-frame-options: DENY
date: Mon, 06 Dec 2021 15:56:13 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 017d9075b571001ac91d2044068f03072014b06a00b08 Show response
visitor-service-us-east-1.tealiumiq.com/gop/main/ 898 B
1 KB 79ms
24ms Script
application/javascript 52.6.2.255
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://visitor-service-us-east-1.tealiumiq.com/gop/main/017d9075b571001ac91d2044068f03072014b06a00b08?callback=utag.ut%5B%22writevamain%22%5D&rnd=1638806173501

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gop/main/prod/utag.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.6.2.255 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-6-2-255.compute-1.amazonaws.com

Software

Resource Hash

38bb83c3eae45622fd8829672dbbbf1ca62132b46a313d78a29182e254ddcd74

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-version: f8f5e005b8b6e369c2cee0a0923be629b8a9d3a5-SNAPSHOT
date: Mon, 06 Dec 2021 15:56:13 GMT
x-region: us-east-1
content-length: 898
strict-transport-security: max-age=31536000; includeSubdomains
x-nodeid: i-0c6743303e45e3129
content-type: application/javascript; charset=utf-8

POST
H2 200 6 Show response
m.stripe.com/ Frame 4AC2 156 B
523 B 289ms
100ms XHR
application/json 52.88.27.164
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.com/6

Requested by

Host: m.stripe.network
URL: https://m.stripe.network/out-4.5.41.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.88.27.164 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-88-27-164.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

6eeeb979a764c5137829d14e9b74d41f7ed9348b711c41d49677bca673a6a8c6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://m.stripe.network/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
x-content-type-options: nosniff
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/json;charset=utf-8
access-control-allow-origin: https://m.stripe.network
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 156

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
501 B 89ms
41ms Image
image/gif 2607:f8b0:4006:81d::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-73658561-7&cid=608955462.1638806173&jid=839156550&_u=aGDAiEADRAAAAE~&z=568240187

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2004 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 15:56:13 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.ca/ads/ 42 B
501 B 93ms
39ms Image
image/gif 2607:f8b0:4006:81e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-73658561-7&cid=608955462.1638806173&jid=839156550&_u=aGDAiEADRAAAAE~&z=568240187

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 15:56:13 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 33ms
32ms XHR
text/plain 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=556201389&t=pageview&_s=1&dl=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-supporters%3Famount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26amt5%3D100%26amt6%3D500%26amt7%3D2800%26utm_medium%3Demail%26utm_source%3DET_105%26utm_campaign%3D20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc%26utm_content%3Dgop_direct-ask_text_contribute_top_5_nd&ul=en-us&de=UTF-8&dt=Republican%20National%20Committee&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aHDACEADRAAAAG~&jid=755350869&gjid=811140921&cid=608955462.1638806173&tid=UA-2431644-99&_gid=1408659342.1638806173&_r=1&gtm=2wgc10KQQBPQZ&z=631429765

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 15:56:13 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 Recurring_Uncheck_Popup.jpg
d35ligi1n5bgzc.cloudfront.net/widget_images/images/000/086/541/original/ 74 KB
75 KB 19ms
19ms Image
image/jpeg 13.225.63.73
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d35ligi1n5bgzc.cloudfront.net/widget_images/images/000/086/541/original/Recurring_Uncheck_Popup.jpg
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_text_contribute_top_5_nd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.63.73 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-63-73.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ebbd3a4b27adf2b4cfb8ff1aeb3f60c0090ee800443cd0b82da7a1874dc6b634

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Mon, 06 Dec 2021 15:42:20 GMT
via: 1.1 1ffe498380a643d1bb2efaa624b761a6.cloudfront.net (CloudFront)
last-modified: Sat, 17 Jul 2021 13:34:26 GMT
server: AmazonS3
age: 834
etag: "6029c4183843891a6eb4e504f9d3d2d5"
x-cache: Hit from cloudfront
x-amz-version-id: SbmaijjJGZAXrktWwHCqF_pxNnP68RcL
x-amz-cf-pop: EWR53-C1
accept-ranges: bytes
content-type: image/jpeg
content-length: 76066
x-amz-cf-id: LEeYEmYKrlG88qyU1DizHHHzkakrLDyKCSGUJhQzxpjxzTA4kpOrwQ==

GET
H2 200 /
www.facebook.com/tr/ 44 B
407 B 59ms
19ms Image
image/gif 2a03:2880:f112:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1171422386625841&ev=PageView&dl=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-supporters%3Famount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26amt5%3D100%26amt6%3D500%26amt7%3D2800%26utm_medium%3Demail%26utm_source%3DET_105%26utm_campaign%3D20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc%26utm_content%3Dgop_direct-ask_text_contribute_top_5_nd&rl=&if=false&ts=1638806173562&sw=1600&sh=1200&v=2.9.48&r=stable&ec=0&o=28&it=1638806173288&coo=false&exp=p1&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600
content-length: 44
expires: Mon, 06 Dec 2021 15:56:13 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
213 B 60ms
20ms Image
image/gif 2a03:2880:f112:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=657928937632482&ev=PageView&dl=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-supporters%3Famount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26amt5%3D100%26amt6%3D500%26amt7%3D2800%26utm_medium%3Demail%26utm_source%3DET_105%26utm_campaign%3D20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc%26utm_content%3Dgop_direct-ask_text_contribute_top_5_nd&rl=&if=false&ts=1638806173566&sw=1600&sh=1200&v=2.9.48&r=stable&ec=0&o=30&fbp=fb.1.1638806173565.1080462344&it=1638806173288&coo=false&exp=p1&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600
content-length: 44
expires: Mon, 06 Dec 2021 15:56:13 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
213 B 59ms
20ms Image
image/gif 2a03:2880:f112:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1660815514223309&ev=PageView&dl=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-supporters%3Famount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26amt5%3D100%26amt6%3D500%26amt7%3D2800%26utm_medium%3Demail%26utm_source%3DET_105%26utm_campaign%3D20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc%26utm_content%3Dgop_direct-ask_text_contribute_top_5_nd&rl=&if=false&ts=1638806173568&sw=1600&sh=1200&v=2.9.48&r=stable&ec=0&o=30&fbp=fb.1.1638806173565.1080462344&it=1638806173288&coo=false&exp=p1&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600
content-length: 44
expires: Mon, 06 Dec 2021 15:56:13 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 19ms
18ms Image
image/gif 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=556201389&t=event&ni=1&_s=1&dl=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-supporters%3Famount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26amt5%3D100%26amt6%3D500%26amt7%3D2800%26utm_medium%3Demail%26utm_source%3DET_105%26utm_campaign%3D20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc%26utm_content%3Dgop_direct-ask_text_contribute_top_5_nd&ul=en-us&de=UTF-8&dt=Republican%20National%20Committee&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Google%20Optimize&ea=t2gbJrM9QpmSN5KrZn0uCQ&_u=aHDACEADRAAAAG~&jid=&gjid=&cid=608955462.1638806173&tid=UA-2431644-99&_gid=1408659342.1638806173&gtm=2wgc10KQQBPQZ&z=530073902

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 15:18:37 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 2256
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 m=byfTOb,lsjVmc,LEikZe Show response
www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.QCF... Frame 0855 36 KB
13 KB 47ms
20ms Script
text/javascript 2607:f8b0:4006:822::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.QCFvUZxGfng.L.B1.O/am=BgAC/d=1/exm=_b,_tp/excm=_b,_tp,payframeview/esmo=1/ed=1/wt=2/rs=AMitfrjR-xq119NGsi7rkSpL4akPvJ_yfw/ee=cEt90b:ws9Tlc;uY49fb:COQbmf;Oj465e:KG2eXe;yEQyxe:p8L0ob;yxTchf:KUM7Z;qddgKe:xQtZb;wR5FRb:siKnQd;iFQyKf:vfuNJf;dIoSBb:SpsfSb;nAFL3:NTMZac;oGtAuc:sOXFj;eBAeSb:zbML3c;NPKaK:PVlQOd;LBgRLc:XVMNvd;NSEoX:lazG7b;io8t5d:yDVVkb;j7137d:KG2eXe;ul9GGd:JrBFQb;sP4Vbe:VwDzFe;kMFpHd:blwjVc;SNUn3:ZwDk9d/m=byfTOb,lsjVmc,LEikZe

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/am=BgAC/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrjxCApCTeEZd__vduiQwZD3SnqNGg/m=_b,_tp

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f2d9f427387d66c1e47f6fc9338e3877a8493526fbcf277cdb7f3e55d77cd85a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Fri, 03 Dec 2021 17:21:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 254094
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/payments-consumer-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13458
x-xss-protection: 0
last-modified: Tue, 30 Nov 2021 23:41:24 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/payments-consumer-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/payments-consumer-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="boq-infra/payments-consumer-boq-js-css-signers"
expires: Sat, 03 Dec 2022 17:21:19 GMT

POST
H3 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
22 B 95ms
54ms XHR
text/plain 2607:f8b0:4023:1404::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-2431644-99&cid=608955462.1638806173&jid=755350869&gjid=811140921&_gid=1408659342.1638806173&_u=aHDACEADRAAAAG~&z=1508736393

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4023:1404::9a Columbus, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Mon, 06 Dec 2021 15:56:13 GMT
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 m=IZT63,ws9Tlc,p8L0ob,vfuNJf,PrPYRd,Ru0Pgb,hc6Ubd,ZyYHPb,Das5Le Show response
www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.QCF... Frame 0855 73 KB
27 KB 45ms
22ms Script
text/javascript 2607:f8b0:4006:822::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.QCFvUZxGfng.L.B1.O/am=BgAC/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,payframeview/esmo=1/ed=1/wt=2/rs=AMitfrjR-xq119NGsi7rkSpL4akPvJ_yfw/ee=cEt90b:ws9Tlc;uY49fb:COQbmf;Oj465e:KG2eXe;yEQyxe:p8L0ob;yxTchf:KUM7Z;qddgKe:xQtZb;wR5FRb:siKnQd;iFQyKf:vfuNJf;dIoSBb:SpsfSb;nAFL3:NTMZac;oGtAuc:sOXFj;eBAeSb:zbML3c;NPKaK:PVlQOd;LBgRLc:XVMNvd;NSEoX:lazG7b;io8t5d:yDVVkb;j7137d:KG2eXe;ul9GGd:JrBFQb;sP4Vbe:VwDzFe;kMFpHd:blwjVc;SNUn3:ZwDk9d/m=IZT63,ws9Tlc,p8L0ob,vfuNJf,PrPYRd,Ru0Pgb,hc6Ubd,ZyYHPb,Das5Le

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/am=BgAC/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrjxCApCTeEZd__vduiQwZD3SnqNGg/m=_b,_tp

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

058d6bb45f407a87de0e1aafd110a5e3422d7d35f6c8b33b4f43e577fd1e0281

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Fri, 03 Dec 2021 17:21:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 254094
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/payments-consumer-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27350
x-xss-protection: 0
last-modified: Tue, 30 Nov 2021 23:41:24 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/payments-consumer-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/payments-consumer-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="boq-infra/payments-consumer-boq-js-css-signers"
expires: Sat, 03 Dec 2022 17:21:19 GMT

GET
H3 200 analytics.js Show response
www.google-analytics.com/ Frame 0855 49 KB
20 KB 20ms
19ms Script
text/javascript 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.QCFvUZxGfng.L.B1.O/am=BgAC/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,payframeview/esmo=1/ed=1/wt=2/rs=AMitfrjR-xq119NGsi7rkSpL4akPvJ_yfw/ee=cEt90b:ws9Tlc;uY49fb:COQbmf;Oj465e:KG2eXe;yEQyxe:p8L0ob;yxTchf:KUM7Z;qddgKe:xQtZb;wR5FRb:siKnQd;iFQyKf:vfuNJf;dIoSBb:SpsfSb;nAFL3:NTMZac;oGtAuc:sOXFj;eBAeSb:zbML3c;NPKaK:PVlQOd;LBgRLc:XVMNvd;NSEoX:lazG7b;io8t5d:yDVVkb;j7137d:KG2eXe;ul9GGd:JrBFQb;sP4Vbe:VwDzFe;kMFpHd:blwjVc;SNUn3:ZwDk9d/m=IZT63,ws9Tlc,p8L0ob,vfuNJf,PrPYRd,Ru0Pgb,hc6Ubd,ZyYHPb,Das5Le

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 5658
date: Mon, 06 Dec 2021 14:21:55 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Mon, 06 Dec 2021 16:21:55 GMT

GET
H3 200 pay Show response
pay.google.com/gp/p/ui/ Frame 0855 1 MB
337 KB 65ms
65ms XHR
text/html 2607:f8b0:400d:c08::5c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pay.google.com/gp/p/ui/pay

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/am=BgAC/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrjxCApCTeEZd__vduiQwZD3SnqNGg/m=_b,_tp

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c08::5c Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ab271482d480689cff3b92414a008768ed9c6ba3121c48a2fe3f3eed2831256d

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport, script-src 'report-sample' 'nonce-o+AgEVlnNeGpaU73eJiAVg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport;worker-src 'self', script-src 'nonce-o+AgEVlnNeGpaU73eJiAVg' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com https://sandbox.google.com https://payments.google.com https://pay.google.com https://pay.sandbox.google.com;report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport
cross-origin-resource-policy: same-site
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
x-ua-compatible: IE=edge
server: ESF
cross-origin-opener-policy: unsafe-none
x-frame-options: DENY
strict-transport-security: max-age=31536000
content-type: text/html; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
cache-control: private, max-age=3600
content-security-policy: require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport, script-src 'report-sample' 'nonce-o+AgEVlnNeGpaU73eJiAVg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport;worker-src 'self', script-src 'nonce-o+AgEVlnNeGpaU73eJiAVg' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com https://sandbox.google.com https://payments.google.com https://pay.google.com https://pay.sandbox.google.com;report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport
expires: Mon, 06 Dec 2021 15:56:13 GMT

POST
H3 200 log Show response
play.google.com/ Frame 0855 131 B
152 B 87ms
58ms XHR
text/plain 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/am=BgAC/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrjxCApCTeEZd__vduiQwZD3SnqNGg/m=_b,_tp

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pay.google.com/
X-Goog-AuthUser: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
content-encoding: gzip
server: Playlog
access-control-allow-headers: X-Playlog-Web
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131
x-xss-protection: 0

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 86ms
35ms Preflight
text/plain 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: x-goog-authuser
Origin: https://pay.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: https://pay.google.com
access-control-allow-methods: GET, POST, OPTIONS
access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
content-type: text/plain; charset=UTF-8
date: Mon, 06 Dec 2021 15:56:13 GMT
server: Playlog
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 log Show response
play.google.com/ Frame 0855 131 B
152 B 84ms
58ms XHR
text/plain 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/am=BgAC/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrjxCApCTeEZd__vduiQwZD3SnqNGg/m=_b,_tp

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pay.google.com/
X-Goog-AuthUser: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
content-encoding: gzip
server: Playlog
access-control-allow-headers: X-Playlog-Web
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131
x-xss-protection: 0

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 76ms
36ms Preflight
text/plain 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: x-goog-authuser
Origin: https://pay.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: https://pay.google.com
access-control-allow-methods: GET, POST, OPTIONS
access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
content-type: text/plain; charset=UTF-8
date: Mon, 06 Dec 2021 15:56:13 GMT
server: Playlog
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 log Show response
play.google.com/ Frame 0855 131 B
152 B 97ms
73ms XHR
text/plain 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/am=BgAC/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrjxCApCTeEZd__vduiQwZD3SnqNGg/m=_b,_tp

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pay.google.com/
X-Goog-AuthUser: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
content-encoding: gzip
server: Playlog
access-control-allow-headers: X-Playlog-Web
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131
x-xss-protection: 0

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 69ms
36ms Preflight
text/plain 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: x-goog-authuser
Origin: https://pay.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: https://pay.google.com
access-control-allow-methods: GET, POST, OPTIONS
access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
content-type: text/plain; charset=UTF-8
date: Mon, 06 Dec 2021 15:56:13 GMT
server: Playlog
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 log Show response
play.google.com/ Frame 0855 131 B
152 B 85ms
61ms XHR
text/plain 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/am=BgAC/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrjxCApCTeEZd__vduiQwZD3SnqNGg/m=_b,_tp

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pay.google.com/
X-Goog-AuthUser: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
content-encoding: gzip
server: Playlog
access-control-allow-headers: X-Playlog-Web
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131
x-xss-protection: 0

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 62ms
37ms Preflight
text/plain 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: x-goog-authuser
Origin: https://pay.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: https://pay.google.com
access-control-allow-methods: GET, POST, OPTIONS
access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
content-type: text/plain; charset=UTF-8
date: Mon, 06 Dec 2021 15:56:13 GMT
server: Playlog
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 log Show response
play.google.com/ Frame 0855 131 B
152 B 86ms
60ms XHR
text/plain 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/am=BgAC/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrjxCApCTeEZd__vduiQwZD3SnqNGg/m=_b,_tp

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pay.google.com/
X-Goog-AuthUser: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
content-encoding: gzip
server: Playlog
access-control-allow-headers: X-Playlog-Web
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131
x-xss-protection: 0

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 54ms
36ms Preflight
text/plain 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: x-goog-authuser
Origin: https://pay.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: https://pay.google.com
access-control-allow-methods: GET, POST, OPTIONS
access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
content-type: text/plain; charset=UTF-8
date: Mon, 06 Dec 2021 15:56:13 GMT
server: Playlog
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 0 Show response
r.stripe.com/ Frame 6976 0
213 B 96ms
96ms XHR
application/octet-stream 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

GET
H3 200 m=Wt6vjf,hhhU8,FCpbqb,WhJNk Show response
www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.QCF... Frame 0855 17 KB
7 KB 20ms
19ms Script
text/javascript 2607:f8b0:4006:822::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.QCFvUZxGfng.L.B1.O/am=BgAC/d=1/exm=Das5Le,IZT63,LEikZe,PrPYRd,Ru0Pgb,ZyYHPb,_b,_tp,byfTOb,hc6Ubd,lsjVmc,p8L0ob,vfuNJf,ws9Tlc/excm=_b,_tp,payframeview/esmo=1/ed=1/wt=2/rs=AMitfrjR-xq119NGsi7rkSpL4akPvJ_yfw/ee=cEt90b:ws9Tlc;uY49fb:COQbmf;Oj465e:KG2eXe;yEQyxe:p8L0ob;yxTchf:KUM7Z;qddgKe:xQtZb;wR5FRb:siKnQd;iFQyKf:vfuNJf;dIoSBb:SpsfSb;nAFL3:NTMZac;oGtAuc:sOXFj;eBAeSb:zbML3c;NPKaK:PVlQOd;LBgRLc:XVMNvd;NSEoX:lazG7b;io8t5d:yDVVkb;j7137d:KG2eXe;ul9GGd:JrBFQb;sP4Vbe:VwDzFe;kMFpHd:blwjVc;SNUn3:ZwDk9d/m=Wt6vjf,hhhU8,FCpbqb,WhJNk

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/am=BgAC/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrjxCApCTeEZd__vduiQwZD3SnqNGg/m=_b,_tp

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8664390f269923cfc07cec5a2f94704ff85786a0ee80ebf564654041e822fd3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Fri, 03 Dec 2021 17:21:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 254093
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/payments-consumer-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7265
x-xss-protection: 0
last-modified: Tue, 30 Nov 2021 23:41:24 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/payments-consumer-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/payments-consumer-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="boq-infra/payments-consumer-boq-js-css-signers"
expires: Sat, 03 Dec 2022 17:21:20 GMT

GET
H3 200 m=lwddkf,EFQ78c Show response
www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.QCF... Frame 0855 8 KB
3 KB 21ms
21ms Script
text/javascript 2607:f8b0:4006:822::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.QCFvUZxGfng.L.B1.O/am=BgAC/d=1/exm=Das5Le,FCpbqb,IZT63,LEikZe,PrPYRd,Ru0Pgb,WhJNk,Wt6vjf,ZyYHPb,_b,_tp,byfTOb,hc6Ubd,hhhU8,lsjVmc,p8L0ob,vfuNJf,ws9Tlc/excm=_b,_tp,payframeview/esmo=1/ed=1/wt=2/rs=AMitfrjR-xq119NGsi7rkSpL4akPvJ_yfw/ee=cEt90b:ws9Tlc;uY49fb:COQbmf;Oj465e:KG2eXe;yEQyxe:p8L0ob;yxTchf:KUM7Z;qddgKe:xQtZb;wR5FRb:siKnQd;iFQyKf:vfuNJf;dIoSBb:SpsfSb;nAFL3:NTMZac;oGtAuc:sOXFj;eBAeSb:zbML3c;NPKaK:PVlQOd;LBgRLc:XVMNvd;NSEoX:lazG7b;io8t5d:yDVVkb;j7137d:KG2eXe;ul9GGd:JrBFQb;sP4Vbe:VwDzFe;kMFpHd:blwjVc;SNUn3:ZwDk9d/m=lwddkf,EFQ78c

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/am=BgAC/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrjxCApCTeEZd__vduiQwZD3SnqNGg/m=_b,_tp

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

40a3be1a3422a8d3afc05bc4cf5b8a559ccc414022040153343dac7060335c0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Fri, 03 Dec 2021 17:21:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 254093
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/payments-consumer-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3333
x-xss-protection: 0
last-modified: Tue, 30 Nov 2021 23:41:24 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/payments-consumer-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/payments-consumer-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="boq-infra/payments-consumer-boq-js-css-signers"
expires: Sat, 03 Dec 2022 17:21:20 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 97 KB
39 KB 36ms
36ms Script
application/javascript 2607:f8b0:4006:81e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-855990581

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KQQBPQZ

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d9a2a58152da21139bd31f6246ad165c851486b59e504cebbeba31fb88278967

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39633
x-xss-protection: 0
last-modified: Mon, 06 Dec 2021 15:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 06 Dec 2021 15:56:13 GMT

POST
H3 200 log Show response
play.google.com/ Frame 0855 131 B
152 B 79ms
60ms XHR
text/plain 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/am=BgAC/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrjxCApCTeEZd__vduiQwZD3SnqNGg/m=_b,_tp

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pay.google.com/
X-Goog-AuthUser: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
content-encoding: gzip
server: Playlog
access-control-allow-headers: X-Playlog-Web
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131
x-xss-protection: 0

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 37ms
37ms Preflight
text/plain 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: x-goog-authuser
Origin: https://pay.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: https://pay.google.com
access-control-allow-methods: GET, POST, OPTIONS
access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
content-type: text/plain; charset=UTF-8
date: Mon, 06 Dec 2021 15:56:13 GMT
server: Playlog
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 0 Show response
r.stripe.com/ Frame 8FAD 0
213 B 95ms
95ms XHR
application/octet-stream 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 3
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 8FAD 0
213 B 94ms
94ms XHR
application/octet-stream 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 8FAD 0
213 B 96ms
95ms XHR
application/octet-stream 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 8FAD 0
213 B 96ms
96ms XHR
application/octet-stream 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

GET
H2 200 elements-inner-payment-request-925c170ec154d4f37ad142e0a248f069.html Show response
js.stripe.com/v3/ Frame EBBE 8 KB
3 KB 25ms
24ms Document
text/html 13.225.214.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/elements-inner-payment-request-925c170ec154d4f37ad142e0a248f069.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.16 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-16.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

511675914ab8ffc93b9bea8ab7dd40b4a92fa69a38dfa867b41e155f90bcb9bd

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/

Response headers

content-type: text/html; charset=utf-8
last-modified: Fri, 03 Dec 2021 22:47:13 GMT
server: Cloudfront
access-control-allow-origin: *
x-content-type-options: nosniff
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-security-policy: default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self'; report-uri https://q.stripe.com/csp-report
timing-allow-origin: *
content-encoding: gzip
date: Mon, 06 Dec 2021 15:55:30 GMT
cache-control: max-age=60
etag: W/"925c170ec154d4f37ad142e0a248f069"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 cae77502d3847ca96378af9649c50cb4.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR50-C1
x-amz-cf-id: suB0rv8nDY9cmrg3o4LSioh6-Cuc0PoGPiofa4dQFBEo_rUG8DieOw==
age: 47

POST
H2 200 log Show response
play.google.com/ Frame 0855 131 B
519 B 94ms
46ms XHR
text/plain 2607:f8b0:4006:807::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.Kn1kiau-K74.es5.O/am=BgAC/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrjxCApCTeEZd__vduiQwZD3SnqNGg/m=_b,_tp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:807::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://pay.google.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
content-encoding: gzip
server: Playlog
access-control-allow-headers: X-Playlog-Web
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131
x-xss-protection: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 8FAD 0
213 B 97ms
89ms XHR
application/octet-stream 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 3
content-length: 0

POST
H2 200 csp-report
q.stripe.com/ Frame EBBE 0
347 B 117ms
116ms Other
text/plain 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://q.stripe.com/csp-report
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_text_contribute_top_5_nd
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-119-242.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
server: nginx
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://js.stripe.com
access-control-expose-headers: Server, Range, Content-Type
x-envoy-upstream-service-time: 24
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
content-length: 0

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 37 KB
14 KB 143ms
87ms Script
text/javascript 142.251.35.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-855990581

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.35.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s78-in-f2.1e100.net

Software

cafe /

Resource Hash

7317a02358b2b617ba0934b570c313ee76f29176c4821a9a5fd1656413e5f41b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14333
x-xss-protection: 0
server: cafe
etag: 8469929769973419123
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 06 Dec 2021 15:56:13 GMT

GET
H2 200 ui-shared-46e93b3755a485133d7e5e7e1db48eaf.css
js.stripe.com/v3/fingerprinted/css/ Frame EBBE 15 KB
3 KB 22ms
21ms Stylesheet
text/css 13.225.214.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/css/ui-shared-46e93b3755a485133d7e5e7e1db48eaf.css

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-payment-request-925c170ec154d4f37ad142e0a248f069.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.16 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-16.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

d9f33ed9fdd936a670993b9a8e6ca44e7a358d0f7b217b6c6638b502f66a8015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-payment-request-925c170ec154d4f37ad142e0a248f069.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 10
x-cache: Hit from cloudfront
date: Mon, 06 Dec 2021 15:56:08 GMT
via: 1.1 cae77502d3847ca96378af9649c50cb4.cloudfront.net (CloudFront)
last-modified: Wed, 03 Nov 2021 22:14:27 GMT
server: Cloudfront
etag: W/"7c0a4ba6a732ed01cc27774f97bbe8bd"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=60
x-amz-cf-pop: EWR50-C1
timing-allow-origin: *
x-amz-cf-id: Iv7knYBMtyJsLgvmhU-5UgeMhZN7dfbKkyqjkuZaAyLvbWhqLvzhcQ==

GET
H2 200 shared-81d67bdc5b083df068e5c3ff7fb127b3.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame EBBE 197 KB
54 KB 22ms
21ms Script
application/javascript 13.225.214.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-payment-request-925c170ec154d4f37ad142e0a248f069.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.16 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-16.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

dae3dcabf7b6ce492e82906c84bf1151d406eacbcd59ceaedaaa9e0819585c4e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-payment-request-925c170ec154d4f37ad142e0a248f069.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 36
x-cache: Hit from cloudfront
date: Mon, 06 Dec 2021 15:55:38 GMT
via: 1.1 cae77502d3847ca96378af9649c50cb4.cloudfront.net (CloudFront)
last-modified: Fri, 03 Dec 2021 22:47:14 GMT
server: Cloudfront
etag: W/"5dfa4dd7157aaee1fd4068b2d01eebca"
vary: Accept-Encoding,Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
x-amz-cf-pop: EWR50-C1
timing-allow-origin: *
x-amz-cf-id: wEDlr2BW0RVmx_duB460F-wcMSAAjrPZOENhOBoN1R5wGE0xxhpu1A==

GET
H2 200 ui-shared-edf311672d554521839b8daa26afdc33.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame EBBE 216 KB
66 KB 24ms
24ms Script
application/javascript 13.225.214.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/ui-shared-edf311672d554521839b8daa26afdc33.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-payment-request-925c170ec154d4f37ad142e0a248f069.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.16 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-16.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

381ebeeec0644d9fcbfeb6d1f3b692cbecb1b020a4c2ce5a712887d7c652db42

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-payment-request-925c170ec154d4f37ad142e0a248f069.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 30
x-cache: Hit from cloudfront
date: Mon, 06 Dec 2021 15:56:08 GMT
via: 1.1 cae77502d3847ca96378af9649c50cb4.cloudfront.net (CloudFront)
last-modified: Mon, 22 Nov 2021 23:04:51 GMT
server: Cloudfront
etag: W/"043c0ce9389f1c1479f40a32fa726309"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
x-amz-cf-pop: EWR50-C1
timing-allow-origin: *
x-amz-cf-id: hj-wdio-C4ofQRVbf_B0-PqzgorOaQrKjKS5FXlbD1JVJ5fHYQGGRQ==

GET
H2 200 elements-inner-payment-request-0d10a69033631bfe544b3980c5f4db2d.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame EBBE 44 KB
14 KB 31ms
31ms Script
application/javascript 13.225.214.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/elements-inner-payment-request-0d10a69033631bfe544b3980c5f4db2d.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-payment-request-925c170ec154d4f37ad142e0a248f069.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.16 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-16.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

6f688e7295480921d6bc7f3bc1ad03cd2874ae3f04315efc95d3ca439c0436f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-payment-request-925c170ec154d4f37ad142e0a248f069.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
x-amz-cf-pop: EWR50-C1
x-cache: Hit from cloudfront
date: Mon, 06 Dec 2021 15:56:13 GMT
via: 1.1 cae77502d3847ca96378af9649c50cb4.cloudfront.net (CloudFront)
last-modified: Mon, 22 Nov 2021 23:04:48 GMT
server: Cloudfront
etag: W/"7912344645a92469680eceb8450d1619"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
timing-allow-origin: *
x-amz-cf-id: eoinvFde7JigcMROe7hYyPL-K9E63q0q9jGqzmzSZbSALhrLO2qQzw==

POST
H2 200 0 Show response
r.stripe.com/ Frame 8FAD 0
213 B 94ms
94ms XHR
application/octet-stream 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 8FAD 0
213 B 94ms
94ms XHR
application/octet-stream 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 8FAD 0
213 B 93ms
93ms XHR
application/octet-stream 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 15:56:13 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 8FAD 0
213 B 94ms
93ms XHR
application/octet-stream 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 15:56:14 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/855990581/ 3 KB
2 KB 91ms
43ms Script
text/javascript 2607:f8b0:4006:80c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/855990581/?random=1638806173993&cv=9&fst=1638806173993&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oac10&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-supporters%3Famount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26amt5%3D100%26amt6%3D500%26amt7%3D2800%26utm_medium%3Demail%26utm_source%3DET_105%26utm_campaign%3D20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc%26utm_content%3Dgop_direct-ask_text_contribute_top_5_nd&tiba=Republican%20National%20Committee&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

008eed9345905aaf44ec5910fe5b55ecce9cf2467561a7ede25d78d019c2d3e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 15:56:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1224
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 / Show response
www.facebook.com/tr/ Frame 472D 0
15 B 44ms
22ms Document
text/plain 2a03:2880:f112:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
Origin: https://secure.winred.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/

Response headers

content-type: text/plain
access-control-allow-origin: https://secure.winred.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600
priority: u=3,i
date: Mon, 06 Dec 2021 15:56:14 GMT

POST
H3 200 / Show response
www.facebook.com/tr/ Frame 269F 0
18 B 28ms
21ms Document
text/plain 2a03:2880:f112:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
Origin: https://secure.winred.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/

Response headers

content-type: text/plain
access-control-allow-origin: https://secure.winred.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600
priority: u=3,i
date: Mon, 06 Dec 2021 15:56:14 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/855990581/ 42 B
64 B 99ms
70ms Image
image/gif 2607:f8b0:4006:81d::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/855990581/?random=1638806173993&cv=9&fst=1638802800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oac10&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-supporters%3Famount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26amt5%3D100%26amt6%3D500%26amt7%3D2800%26utm_medium%3Demail%26utm_source%3DET_105%26utm_campaign%3D20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc%26utm_content%3Dgop_direct-ask_text_contribute_top_5_nd&tiba=Republican%20National%20Committee&async=1&fmt=3&is_vtc=1&random=2812621028&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2004 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 15:56:14 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.ca/pagead/1p-user-list/855990581/ 42 B
64 B 65ms
39ms Image
image/gif 2607:f8b0:4006:81e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-user-list/855990581/?random=1638806173993&cv=9&fst=1638802800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oac10&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsecure.winred.com%2Frnc%2Ftrump-social-founding-supporters%3Famount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26amt5%3D100%26amt6%3D500%26amt7%3D2800%26utm_medium%3Demail%26utm_source%3DET_105%26utm_campaign%3D20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc%26utm_content%3Dgop_direct-ask_text_contribute_top_5_nd&tiba=Republican%20National%20Committee&async=1&fmt=3&is_vtc=1&random=2812621028&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 06 Dec 2021 15:56:14 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 204
No Content events Show response
logx.optimizely.com/v1/ 0
362 B 99ms
25ms XHR
text/plain 34.233.21.26
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://logx.optimizely.com/v1/events
Requested by: Host: cdn-pci.optimizely.com
URL: https://cdn-pci.optimizely.com/js/8416096648.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.233.21.26 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-233-21-26.compute-1.amazonaws.com
Software: nginx/1.17.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://secure.winred.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Mon, 06 Dec 2021 15:56:14 GMT
Server: nginx/1.17.2
Content-Type: text/plain
Access-Control-Allow-Origin: https://secure.winred.com
Access-Control-Expose-Headers: X-Results-Data-Source
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
X-Request-Id: b0f77a20-179d-4f05-a532-fa18effcb59b

GET
H3 200 common.js Show response
maps.googleapis.com/maps-api-v3/api/js/47/2/ 77 KB
28 KB 45ms
19ms Script
text/javascript 2607:f8b0:4006:80c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps-api-v3/api/js/47/2/common.js

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80c::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

085346e55834af33cdee2afcdb902bcff88841f0ce214258f3a60301b1047d0f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 14:17:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5914
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28707
x-xss-protection: 0
last-modified: Mon, 29 Nov 2021 17:54:34 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="maps-api-js"
vary: Accept-Encoding, Origin
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 06 Dec 2022 14:17:43 GMT

GET
H3 200 util.js Show response
maps.googleapis.com/maps-api-v3/api/js/47/2/ 297 KB
91 KB 46ms
20ms Script
text/javascript 2607:f8b0:4006:80c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps-api-v3/api/js/47/2/util.js

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80c::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8cdf739cfcec04930c7c4036a0065a9a4e21ae471827649efee0d1bb95e6aeaf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Fri, 03 Dec 2021 23:30:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 231963
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 92814
x-xss-protection: 0
last-modified: Mon, 29 Nov 2021 17:54:34 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="maps-api-js"
vary: Accept-Encoding, Origin
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 03 Dec 2022 23:30:14 GMT

GET
H2 200 trusted-types-checker-cda1635e27dc416e23614def05f39e01.js Show response
js.stripe.com/v3/fingerprinted/js/ 172 B
672 B 21ms
20ms Script
application/javascript 13.225.214.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/trusted-types-checker-cda1635e27dc416e23614def05f39e01.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.214.16 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-214-16.ewr50.r.cloudfront.net

Software

Cloudfront /

Resource Hash

95606fd79e5ed034243c781bbfdacc97d7fbc04174981a4a45cd4ad63008afed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
via: 1.1 cae77502d3847ca96378af9649c50cb4.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 27
x-cache: Hit from cloudfront
date: Mon, 06 Dec 2021 15:55:54 GMT
content-length: 172
last-modified: Fri, 05 Nov 2021 21:06:48 GMT
server: Cloudfront
etag: "c78a4d54d725874984ae69d553523207"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
x-amz-cf-pop: EWR50-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: S416j84voFaDExNfYGN7vbhnoG18syV2wZiYGZHq0KF9n6K9IpriZQ==

POST
H2 200 0 Show response
r.stripe.com/ Frame 6976 0
213 B 95ms
94ms XHR
application/octet-stream 54.187.119.242
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-81d67bdc5b083df068e5c3ff7fb127b3.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.187.119.242 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-119-242.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 06 Dec 2021 15:56:18 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

Verdicts & Comments Add Verdict or Comment

72 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

23 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
app.winred.com/api/v3/users	1970-01-21 19:02:52	Name: rvid Value: d4c6cc6f-03a4-4bc2-9e39-ea89f9604430
secure.winred.com/	1969-12-31 23:59:59	Name: origin_url Value: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_text_contribute_top_5_nd
secure.winred.com/	1969-12-31 23:59:59	Name: sso_tries Value: 1
secure.winred.com/	1970-01-21 19:01:26	Name: rvid Value: d4c6cc6f-03a4-4bc2-9e39-ea89f9604430
.winred.com/	1970-01-20 01:23:02	Name: _gcl_au Value: 1.1.520031146.1638806173
.winred.com/	1969-12-31 23:59:59	Name: _revv_v3_session Value: b0lBVGN1d29lcDRpRDVWdnB6d1VKSko0TkxmMUlleGpCQlJXWjFqaG9jRk5TVkE2YzhGaFBDcy9qaUF1aC85WGIyT0Q5WHhmeldOaHloRFR4cmZGT3JVZEMvL3ZPTVQ5cGpWTGQ3c0RlbDhPUWRrWWxEaWxFZjZHM0xFSDRLRTVrWUh4RHdkeUpOWkNkdklUeU9RbjVKZUFWOXVBZDZPcVhVM2FFNS9SYjdGN09xWUk2ajBBOVdkNStXenFEekRHdEIyZnJzYWlVakVXU1FiVVZJZXVqdWZxcmxJTHZDNWx3ZmVFSm9UUm9qQmVHbHZSaXV2VlpwelMzL3BPalpOcmYyL3NzRDlIOHBiZmZNVkptVTRocUZnL1c1UmhKRmVUTlIxN0l3NFhqa0cwcWJzVFA4UnV0clIvQXhTVCtuYVMreVFuNEdqRHZRZ0psbUhnQ1ZVZ1A1U2xoWE9WemR3VWtNT3ozVDVoUlV0cUVNNnM0OGloT1FiM2dIVTZ1YzRCejZ5QzdrZDNyTmFJY0NqZTg1NTgzTnM2Nk8vKzVZeEJXV2o5SU1TWk1xNE9RS2RDbCtINEZ4SkYrNHN5QVIvQ3lNRDdYZnEvc2F5ZS9aekdoZ0t0S1IxU0Ziem5menBMOThMbG9PaERTcEVJakZpS0VFWmx1WXlnOFAycnZpTHViUDM2Z2xWNFpZNXlreGpJdnc5MVZuWGRBTEZndDA5aVk0OE9KQWk1b1lmVEViWFdOOGlrZzZDdE1yOFNLb0xwakVJbE95TElELzBTSVZycnlBNG9TUVg3YzNXZ2I4OTMvdWZvanhUaVBDNWJ1QzRmUmFJU2xYVkNMMUJUaVJBYkFmNE5pdE8vNnlVRFp5R0lqUEZsS05CRzNTdXlJdXBnNmJHUWZVdGNvaUdiUHBmc3BLZnNWUVVNdnpiT0ZRazdPaGZjNXVwdUpYWHhCRHF5bENIRllGU1J0bE5iaTdnaExqQUFZUDlhdUxpWXJzckVIYUhHNEYwckRkdWF1eExsSnpuWDNUSytSMEswVmpLc1VWcTBuMzVzRDdSQjZEeko3N2hCU1dhd0NqODFzd2pqblFNWHp0OG9Ub2Z4RXpaZS0tbnAxWDB4dDNCKzYrb2hEbDVTNEE0dz09--6d4c345defc6b812576d2736ece4581008eafa63
.google.com/	1970-01-20 03:36:57	Name: NID Value: 511=h4PdECEsHHl-91pusEW9HhaWfxvEPx2mxb3qBbAW7zh-IA13P-DhwlJcFRxoElzvPfVPiTBQbS9r_RMD_T3PViKzV7ZDwkIrhwUiBBHvkrg0LuPCWr6169alJFqay88zlX7N_QPbgNZdoURAzBnfkZb9q62MiubybPJaUWnARvc
.secure.winred.com/	1970-01-19 23:13:27	Name: __cf_bm Value: 6hGPHnZxVVuJV6yAb3kZemKXzFtFiJ5iuINgk.Wnb94-1638806173-0-AZh06kTMYe7GS6wflyuS91OmgYFbkHN/6a+90alcgf8dtgZFQGp5SLclLbPPTbIb/obl5Y7EdebY6Hol9t+cNGElMuDK2U6JhY49ehJyy3+zo8akwzvg/uiMLLS34PC4kqv9jaakkiovqadVEqhyXQEObhPeYZecPjGV6DFLSVoClbCBkX7hFFNV03Y7R+TYBQ==
.winred.com/	1970-01-20 16:44:38	Name: _ga Value: GA1.2.608955462.1638806173
.winred.com/	1970-01-19 23:14:52	Name: _gid Value: GA1.2.1408659342.1638806173
.doubleclick.net/	1970-01-20 16:44:38	Name: IDE Value: AHWqTUnkckL5k_CckZ6akRkwzlZm-nq09jEhWEDhnJr8xrEhxElrTFdP9vGzhEyCy7k
.winred.com/	1970-01-19 23:13:26	Name: _dc_gtm_UA-73658561-7 Value: 1
.tealiumiq.com/	1970-01-20 07:59:02	Name: TAPID Value: gop/main>017d9075b571001ac91d2044068f03072014b06a00b08\|
.winred.com/	1970-01-20 07:59:02	Name: utag_main Value: v_id:017d9075b571001ac91d2044068f03072014b06a00b08$_sn:1$_se:1$_ss:1$_st:1638807973042$ses_id:1638806173042%3Bexp-session$_pn:1%3Bexp-session$dc_visit:1$dc_event:2%3Bexp-session$dcsyncran:1%3Bexp-session$dc_region:us-east-1%3Bexp-session
.winred.com/	1970-01-19 23:13:26	Name: _gat_UA-2431644-99 Value: 1
.tealiumiq.com/	1970-01-20 03:35:30	Name: tcs.google_gid Value: eyJnb3AvbWFpbiI6IkNBRVNFUFBya3Vsc0hUdE9LRV93OVNsazlyVXwxNjM4ODA2MTczNTQxIn0=
.tealiumiq.com/	1970-01-20 03:35:30	Name: tcs.google_cver Value: eyJnb3AvbWFpbiI6IjF8MTYzODgwNjE3MzU0MSJ9
.winred.com/	1970-01-20 01:23:02	Name: _fbp Value: fb.1.1638806173565.1080462344
.winred.com/	1970-01-20 03:32:38	Name: optimizelyEndUserId Value: oeu1638806173601r0.8655702350753449
.facebook.com/	1970-01-20 01:23:02	Name: fr Value: 0CvrKqSBgJbdY43Ln..BhrjKd...1.0.BhrjKd.
m.stripe.com/	1970-01-20 16:44:38	Name: m Value: 5060e1fd-b3c0-4ccf-8484-1f86a25dbd183c055b
.secure.winred.com/	1970-01-20 07:59:02	Name: __stripe_mid Value: 4781c328-2a3f-42bf-8890-519bcbe802dfa24162
.secure.winred.com/	1970-01-19 23:13:27	Name: __stripe_sid Value: 71157f09-9e29-4181-98f5-5d9d6b0b048e0e5858

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_text_contribute_top_5_nd(Line 66) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdn-pci.optimizely.com/js/8416096648.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://secure.winred.com/rnc/trump-social-founding-supporters?amount=5&amt1=5&amt2=10&amt3=15&amt4=20&amt5=100&amt6=500&amt7=2800&utm_medium=email&utm_source=ET_105&utm_campaign=20211205_113335_trump-social-founding-supporters-payment-pending-fwd-lpd-nd_aaronpersonalaccount_rnc&utm_content=gop_direct-ask_text_contribute_top_5_nd(Line 66) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdn-pci.optimizely.com/js/8416096648.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'sha256-Qj6AdMOUjZkBBUTjGW/OORBoqx2Pohcq8Bg/ZvZzgYw='".
deprecation	warning	URL: https://js.stripe.com/v3/fingerprinted/js/payment-request-inner-browser-f2a776258b5d03fabd63ccb663dcf89a.js Message: The 'basic-card' payment method is deprecated and will be removed in M100, around March 2022. See https://www.chromestatus.com/features/5730051011117056 for more details.
security	error	(Line 6) Message: This document requires 'TrustedScript' assignment.
network	error	URL: https://pay.google.com/_/InstantbuyFrontendBuyflowPayframeUi/cspreport Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

9323526.fls.doubleclick.net
a8416096648.cdn-pci.optimizely.com
adservice.google.com
app.winred.com
cdn-pci.optimizely.com
click.campaigns.rnchq.com
cm.g.doubleclick.net
collect.tealiumiq.com
connect.facebook.net
d35ligi1n5bgzc.cloudfront.net
datacloud.tealiumiq.com
googleads.g.doubleclick.net
js.stripe.com
logx.optimizely.com
m.stripe.com
m.stripe.network
maps.googleapis.com
pay.google.com
play.google.com
q.stripe.com
r.stripe.com
secure.winred.com
stats.g.doubleclick.net
tags.tiqcdn.com
visitor-service-us-east-1.tealiumiq.com
www.facebook.com
www.google-analytics.com
www.google.ca
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.gstatic.com
13.111.145.38
13.225.214.16
13.225.214.66
13.225.63.73
142.250.72.98
142.250.80.38
142.251.35.162
23.208.216.220
2606:4700::6812:9b15
2607:f8b0:4006:807::200e
2607:f8b0:4006:80c::2002
2607:f8b0:4006:80c::200a
2607:f8b0:4006:81d::2004
2607:f8b0:4006:81e::2003
2607:f8b0:4006:81e::2008
2607:f8b0:4006:822::2002
2607:f8b0:4006:822::2003
2607:f8b0:400d:c08::5c
2607:f8b0:4023:1404::9a
2a03:2880:f012:8:face:b00c:0:1
2a03:2880:f112:83:face:b00c:0:25de
34.197.188.108
34.201.87.201
34.233.21.26
52.6.2.255
52.88.27.164
54.187.119.242
69.192.20.36
69.192.26.112
008eed9345905aaf44ec5910fe5b55ecce9cf2467561a7ede25d78d019c2d3e7
02f6346535d658a846962a682488d1fdd568a1fff592036667d2d7a853511fe9
032b2cd62ca53bd3edf67462afb364442044e4338d4eedf1269375bc238682d8
0330d92f80895c477e7bf33190ec17d06bc1a4eed429a65bc7384507855dc743
048ab7812899a24caacd50b1921fc17d5a3f7cd1fde2863d439a024a2245c6f8
058d6bb45f407a87de0e1aafd110a5e3422d7d35f6c8b33b4f43e577fd1e0281
085346e55834af33cdee2afcdb902bcff88841f0ce214258f3a60301b1047d0f
0c465bda1a82d147d88ff25d5adc5eaec6c25898d0c88a28612e5596cfc0ec8c
0c4d83d7ed629fcf090ecc239a585be39101f7237e8e45f68cfab655ff00d71a
0c971e6db21f464c3c85d6d37ac2d8f18008e66ec112c7891a00fdf721ab3a1a
0d3118e306c6a26f1d2efcb698984e6922c5e7e155c94a84760e36e5592a3c11
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
18c33eea07a67aef897ec1cda0bee45cab46d25b88b98a875f010f51c2af3af8
1969520bd7b0ea7b84b1cbdda4a8ae93c321abe6eaeff82b5fa496680bf88a0f
19d2e43a96b539c5bfee8691baa248a6560e8bacd2bdc2350bc9f740af273a02
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
2646d818e258e85ba1721270d71684413d53dfa2dd8ac6957738d56a86ab1b5f
31d88b9f1d22deef09af5239d7c70c22201925286477a3db77f69530f3dc9770
32d4644b89b4c67b6db6b306cadc64f32d9283a4edefb88d1c95bcd45694270d
36f0bf882a876b13aeb20cf7a495421a43f336da5422072a58f58ce303fb6284
381ebeeec0644d9fcbfeb6d1f3b692cbecb1b020a4c2ce5a712887d7c652db42
38bb83c3eae45622fd8829672dbbbf1ca62132b46a313d78a29182e254ddcd74
3ed1f78a1ee89c913a730637376afbd17148beec7eca98ed43e46713bb585898
3f7fb4c1f2d3ee57a3767048afa62cdf8d4187c4f85ee32bdf91976c2bc72ad6
40a3be1a3422a8d3afc05bc4cf5b8a559ccc414022040153343dac7060335c0c
4cb7a0480dd16fd92f87639018a66efba6a2c4c975384c84bc8856de4a9a33f9
4e55c5b97682d9d3f44c5ea16c603d40eee56a4832d6af7ca6746265f15c421f
4eff4388d8e116284931c115697a5bfe1fd4aa7be10a39d1b0bb58cbab413afc
502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358
511675914ab8ffc93b9bea8ab7dd40b4a92fa69a38dfa867b41e155f90bcb9bd
511b9d16faa374c5a400579ce33a42e5e5ff293335cedc2e5f6a310e778944e8
5785c083b1cf0a752958975ebf6365d60896c3e809e7fd9bd94dc6e11bc75004
5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848
5ebf765fb54f6bcbe0e6cd23a33c3096f26bb86aaa27f885e6d574ffe6a63114
5ff1440c280f3e8cdbb21de78d464571da46a17d551fb251f44260bd7f7ed16b
626e124aafce560a521c9ce7e4cc884ea850ad2ab2228389ebc02350bcda0e92
658d3728e3878a01e5a054d6ba34ca6c574e7320933b9b9d46ad370465b8cca7
6b5402ff8932ed835d39a31b75c6bc737a80f6ddcd6269a1fa53556485ca3ad8
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6eeeb979a764c5137829d14e9b74d41f7ed9348b711c41d49677bca673a6a8c6
6f688e7295480921d6bc7f3bc1ad03cd2874ae3f04315efc95d3ca439c0436f2
71a55578d53e666ef644669139972f47092d97114a67c8b251f155ef6c19c15d
7317a02358b2b617ba0934b570c313ee76f29176c4821a9a5fd1656413e5f41b
75fb90521d1e7155f5aee298e5c171e0f2e536ec07208d07026bcc9eb7122915
7a082bd7dcead9ea41c677b4acdfc9389b50c3eff3b61b8ae78036c9e053afef
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
83b5496f5ea55212aaa895649c3736a21062d853d129e0bdc64736ea0086ab31
8664390f269923cfc07cec5a2f94704ff85786a0ee80ebf564654041e822fd3d
8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50
8cdf739cfcec04930c7c4036a0065a9a4e21ae471827649efee0d1bb95e6aeaf
95606fd79e5ed034243c781bbfdacc97d7fbc04174981a4a45cd4ad63008afed
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a2563da3bbe32602e4925f4982e4f32912519ef8beb6f618f8d4d41852a42a48
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
a2f6b81396ab1150effea054efbf1623212ea0419976389ce8f10e909d39e4c7
aa920fa4fdea358365f980f78d82a992fa119070a07cb21d3aeee419d88429aa
ab271482d480689cff3b92414a008768ed9c6ba3121c48a2fe3f3eed2831256d
ad6945a0f0f97fb15a8997a2a1d10ad6b4291985a7467c530434e7c04c124505
af4b8dcbb0f1beb04e333fb40d352f763415cc15b83b6c79646d773c4d5893b6
b23807a4c5d90afca0dc47d688c0a05302779429dab75f5e6182562dcc2970f6
b43f598121b061463cc62dba6ac8e7582d667eb35d8223b06a4ac933b447199c
bbe935971411b547760ad22c28a55c7573abd06b49bcd13a361444dc94fa1c0e
c885ef025f7d73741c3fae1f63830e9beec3f662f0ca17ea7746b534b34ac5d5
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
d0c4620ce8318742733f6d4b9ff6881018b9b2c51b2ae13f16dfc284461faa73
d68eb8e1826d9711bd5b411fbce0f61516fb7da1b8dd5d090251e6d3f2bf0cd5
d6ff339ddb4525268c21fa26ded66b0703f177e742281dc9bcd558288f8e1101
d9a2a58152da21139bd31f6246ad165c851486b59e504cebbeba31fb88278967
d9f33ed9fdd936a670993b9a8e6ca44e7a358d0f7b217b6c6638b502f66a8015
dae3dcabf7b6ce492e82906c84bf1151d406eacbcd59ceaedaaa9e0819585c4e
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ebbd3a4b27adf2b4cfb8ff1aeb3f60c0090ee800443cd0b82da7a1874dc6b634
ed34a59f182c66e2b25c602f3c9b0f21435a8f475d5dbc9e6830ff4c7929f5cd
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0b6e7438d98877c3085761d380c763545784389620bbbc8254bd5e30e83a3eb
f2d9f427387d66c1e47f6fc9338e3877a8493526fbcf277cdb7f3e55d77cd85a
f7297ef321f1b682622a9adacc3ada5ba2d6912115f57dd9948ffec18d33cb41
fc2ccef085594d1720ce27023740483286cb0f8e0702011ea99622ffa75a4a42

secure.winred.com Open in urlscan Pro 2606:4700::6812:9b15 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

157 Requests

99 %HTTPS

45 %IPv6

18 Domains

32 Subdomains

27 IPs

1 Countries

2895 kBTransfer

8664 kBSize

23 Cookies

7 Outgoing links

Page URL History

Redirected requests

157 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

secure.winred.com Open in urlscan Pro
2606:4700::6812:9b15 Public Scan

Screenshot
Live screenshot

Full Image

157
Requests

99 %
HTTPS

45 %
IPv6

18
Domains

32
Subdomains

27
IPs

1
Countries

2895 kB
Transfer

8664 kB
Size

23
Cookies

157 HTTP transactions
0 data transactions