secure.winred.com Open in urlscan Pro
104.19.212.89 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://click.email.rondesantis.com/?qs=fadfe8730a8d3704e16ba04cabbfb7f06e18bc202dec0d68333ecf03378849c8dec3638cb7ce6fabba44242d86c1...
Effective URL:
https://secure.winred.com/desantis/october-eom-dtc?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-10-31_success-over-...
Submission: On December 20 via api (December 20th 2023, 2:10:10 am UTC) from CA — Scanned from CA

Summary HTTP 250 Redirects Links 10 Behaviour Indicators

Summary

This website contacted 43 IPs in 3 countries across 32 domains to perform 250 HTTP transactions. The main IP is 104.19.212.89, located in and belongs to CLOUDFLARENET, US. The main domain is secure.winred.com. The Cisco Umbrella rank of the primary domain is 81536.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on February 21st 2023. Valid for: a year.

This is the only time secure.winred.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	13.110.197.228 13.110.197.228	14340 (SALESFORCE) (SALESFORCE)
1 13	104.19.212.89 104.19.212.89	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	172.253.63.97 172.253.63.97	15169 (GOOGLE) (GOOGLE)
42	52.85.151.117 52.85.151.117	16509 (AMAZON-02) (AMAZON-02)
10	142.251.163.95 142.251.163.95	15169 (GOOGLE) (GOOGLE)
2	99.86.229.15 99.86.229.15	16509 (AMAZON-02) (AMAZON-02)
1	104.16.57.101 104.16.57.101	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.17.25.14 104.17.25.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	142.251.111.155 142.251.111.155	15169 (GOOGLE) (GOOGLE)
1	146.75.28.157 146.75.28.157	54113 (FASTLY) (FASTLY)
2	13.32.206.122 13.32.206.122	16509 (AMAZON-02) (AMAZON-02)
2	157.240.244.1 157.240.244.1	32934 (FACEBOOK) (FACEBOOK)
1	34.117.162.98 34.117.162.98	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
4	142.251.16.138 142.251.16.138	15169 (GOOGLE) (GOOGLE)
1	104.19.211.89 104.19.211.89	13335 (CLOUDFLAR...) (CLOUDFLARENET)
26	142.251.111.190 142.251.111.190	15169 (GOOGLE) (GOOGLE)
4	142.251.16.92 142.251.16.92	15169 (GOOGLE) (GOOGLE)
48	54.186.23.98 54.186.23.98	16509 (AMAZON-02) (AMAZON-02)
5 7	172.253.63.155 172.253.63.155	15169 (GOOGLE) (GOOGLE)
3 6	172.253.62.105 172.253.62.105	15169 (GOOGLE) (GOOGLE)
6	142.251.179.94 142.251.179.94	15169 (GOOGLE) (GOOGLE)
3	104.244.42.197 104.244.42.197	13414 (TWITTER) (TWITTER)
3	104.244.42.131 104.244.42.131	13414 (TWITTER) (TWITTER)
2	172.253.122.155 172.253.122.155	15169 (GOOGLE) (GOOGLE)
2	104.16.249.69 104.16.249.69	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	34.111.186.1 34.111.186.1	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
5	151.101.0.176 151.101.0.176	54113 (FASTLY) (FASTLY)
4	142.251.16.94 142.251.16.94	15169 (GOOGLE) (GOOGLE)
2	198.202.176.141 198.202.176.141	16509 (AMAZON-02) (AMAZON-02)
1	172.253.122.113 172.253.122.113	15169 (GOOGLE) (GOOGLE)
2	172.253.115.148 172.253.115.148	15169 (GOOGLE) (GOOGLE)
1	157.240.229.35 157.240.229.35	32934 (FACEBOOK) (FACEBOOK)
2	142.251.16.95 142.251.16.95	15169 (GOOGLE) (GOOGLE)
1	172.253.62.119 172.253.62.119	15169 (GOOGLE) (GOOGLE)
2	142.251.163.132 142.251.163.132	15169 (GOOGLE) (GOOGLE)
8	172.253.115.94 172.253.115.94	15169 (GOOGLE) (GOOGLE)
2	74.125.0.9 74.125.0.9	15169 (GOOGLE) (GOOGLE)
8	209.85.164.234 209.85.164.234	15169 (GOOGLE) (GOOGLE)
3	44.233.104.20 44.233.104.20	16509 (AMAZON-02) (AMAZON-02)
12	142.251.167.100 142.251.167.100	15169 (GOOGLE) (GOOGLE)
4	104.19.218.90 104.19.218.90	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	104.19.219.90 104.19.219.90	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 3	15.197.193.217 15.197.193.217	16509 (AMAZON-02) (AMAZON-02)
2 2	68.67.160.132 68.67.160.132	() ()
250	43

1 13.110.197.228 (United States) 1 redirects

ASN14340 (SALESFORCE, US)
PTR: click.email.rondesantis.com

click.email.rondesantis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 104.19.212.89 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

secure.winred.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.253.63.97 (United States)

ASN15169 (GOOGLE, US)
PTR: bi-in-f97.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

42 52.85.151.117 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-151-117.iad89.r.cloudfront.net

js.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 142.251.163.95 (United States)

ASN15169 (GOOGLE, US)
PTR: wv-in-f95.1e100.net

maps.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
jnn-pa.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 99.86.229.15 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-229-15.iad79.r.cloudfront.net

d35ligi1n5bgzc.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.57.101 (None, )

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.25.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.251.111.155 (United States)

ASN15169 (GOOGLE, US)
PTR: bk-in-f155.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.75.28.157 (Ashburn, United States)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.32.206.122 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-206-122.iad66.r.cloudfront.net

js.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 157.240.244.1 (Apodaca, Mexico)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-01-mty2.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.117.162.98 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 98.162.117.34.bc.googleusercontent.com

pixel.byspotify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.251.16.138 (United States)

ASN15169 (GOOGLE, US)
PTR: bl-in-f138.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.19.211.89 (None, )

ASN13335 (CLOUDFLARENET, US)

app.revv.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

26 142.251.111.190 (United States)

ASN15169 (GOOGLE, US)
PTR: bk-in-f190.1e100.net

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.251.16.92 (United States)

ASN15169 (GOOGLE, US)
PTR: bl-in-f92.1e100.net

pay.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

48 54.186.23.98 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ip-54-186-23-98.stripe.com

q.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
r.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 172.253.63.155 (United States) 5 redirects

ASN15169 (GOOGLE, US)
PTR: bi-in-f155.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 172.253.62.105 (United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: bc-in-f105.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.251.179.94 (United States)

ASN15169 (GOOGLE, US)
PTR: pd-in-f94.1e100.net

www.google.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.244.42.197 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.244.42.131 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.253.122.155 (United States)

ASN15169 (GOOGLE, US)
PTR: bh-in-f155.1e100.net

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.16.249.69 (None, )

ASN13335 (CLOUDFLARENET, US)

gtm.winred.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.111.186.1 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 1.186.111.34.bc.googleusercontent.com

evnt.byspotify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 151.101.0.176 (United States)

ASN54113 (FASTLY, US)

m.stripe.network	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.stripecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.251.16.94 (United States)

ASN15169 (GOOGLE, US)
PTR: bl-in-f94.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 198.202.176.141 (United States)

ASN16509 (AMAZON-02, US)

merchant-ui-api.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.253.122.113 (United States)

ASN15169 (GOOGLE, US)
PTR: bh-in-f113.1e100.net

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.253.115.148 (United States)

ASN15169 (GOOGLE, US)
PTR: bg-in-f148.1e100.net

static.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 157.240.229.35 (Ashburn, United States)

ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-02-iad3.facebook.com

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.251.16.95 (United States)

ASN15169 (GOOGLE, US)
PTR: bl-in-f95.1e100.net

jnn-pa.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.253.62.119 (United States)

ASN15169 (GOOGLE, US)
PTR: bc-in-f119.1e100.net

i.ytimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.251.163.132 (United States)

ASN15169 (GOOGLE, US)
PTR: wv-in-f132.1e100.net

yt3.ggpht.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 172.253.115.94 (United States)

ASN15169 (GOOGLE, US)
PTR: bg-in-f94.1e100.net

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 74.125.0.9 (United States)

ASN15169 (GOOGLE, US)
PTR: yyz12s12-in-f9.1e100.net

rr4---sn-tt1elnel.googlevideo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 209.85.164.234 (United States)

ASN15169 (GOOGLE, US)
PTR: ord38s15-in-f10.1e100.net

rr5---sn-vgqsrne6.googlevideo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 44.233.104.20 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-44-233-104-20.us-west-2.compute.amazonaws.com

m.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 142.251.167.100 (United States)

ASN15169 (GOOGLE, US)
PTR: ww-in-f100.1e100.net

play.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.19.218.90 (None, )

ASN13335 (CLOUDFLARENET, US)

hcaptcha.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
newassets.hcaptcha.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
api.hcaptcha.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.19.219.90 (None, )

ASN13335 (CLOUDFLARENET, US)

newassets.hcaptcha.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
api.hcaptcha.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 15.197.193.217 (Seattle, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 68.67.160.132 (None, ) 2 redirects

ASN- ()

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
95	stripe.com js.stripe.com — Cisco Umbrella Rank: 1282 q.stripe.com — Cisco Umbrella Rank: 7730 merchant-ui-api.stripe.com — Cisco Umbrella Rank: 5257 r.stripe.com — Cisco Umbrella Rank: 3529 m.stripe.com — Cisco Umbrella Rank: 1245	2 MB
26	youtube.com www.youtube.com — Cisco Umbrella Rank: 71	2 MB
23	google.com 3 redirects pay.google.com — Cisco Umbrella Rank: 2109 www.google.com — Cisco Umbrella Rank: 2 analytics.google.com — Cisco Umbrella Rank: 152 play.google.com — Cisco Umbrella Rank: 32	466 KB
15	winred.com 1 redirects secure.winred.com — Cisco Umbrella Rank: 81536 gtm.winred.com — Cisco Umbrella Rank: 152554	204 KB
12	gstatic.com fonts.gstatic.com www.gstatic.com	196 KB
12	googleapis.com maps.googleapis.com — Cisco Umbrella Rank: 357 jnn-pa.googleapis.com — Cisco Umbrella Rank: 203	257 KB
11	doubleclick.net 5 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 33 stats.g.doubleclick.net — Cisco Umbrella Rank: 75 static.doubleclick.net — Cisco Umbrella Rank: 248	5 KB
10	googlevideo.com rr4---sn-tt1elnel.googlevideo.com — Cisco Umbrella Rank: 139795 rr5---sn-vgqsrne6.googlevideo.com — Cisco Umbrella Rank: 30452	642 KB
6	hcaptcha.com hcaptcha.com — Cisco Umbrella Rank: 7101 newassets.hcaptcha.com — Cisco Umbrella Rank: 9853 api.hcaptcha.com — Cisco Umbrella Rank: 9601	405 KB
6	google.ca www.google.ca — Cisco Umbrella Rank: 9252	948 B
5	adsrvr.org 1 redirects js.adsrvr.org — Cisco Umbrella Rank: 1355 insight.adsrvr.org — Cisco Umbrella Rank: 557 match.adsrvr.org — Cisco Umbrella Rank: 331	5 KB
4	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 27	21 KB
4	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 36	365 KB
3	stripecdn.com b.stripecdn.com — Cisco Umbrella Rank: 35663	45 KB
3	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 713	2 KB
3	t.co t.co — Cisco Umbrella Rank: 589	784 B
3	byspotify.com pixel.byspotify.com — Cisco Umbrella Rank: 10581 evnt.byspotify.com — Cisco Umbrella Rank: 10539	7 KB
3	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 138	6 KB
2	adnxs.com 2 redirects ib.adnxs.com	2 KB
2	ggpht.com yt3.ggpht.com — Cisco Umbrella Rank: 226	7 KB
2	stripe.network m.stripe.network — Cisco Umbrella Rank: 1361	16 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 168	90 KB
2	cloudfront.net d35ligi1n5bgzc.cloudfront.net	90 KB
1	ytimg.com i.ytimg.com — Cisco Umbrella Rank: 89	2 KB
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 98	185 B
1	revv.co app.revv.co — Cisco Umbrella Rank: 306523	1 KB
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 678	15 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 204	4 KB
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 864	7 KB
1	rondesantis.com 1 redirects click.email.rondesantis.com — Cisco Umbrella Rank: 722621	428 B
0	yahoo.com Failed ups.analytics.yahoo.com Failed
0	rubiconproject.com Failed pixel.rubiconproject.com Failed
250	32

	Domain	Requested by
42	js.stripe.com	secure.winred.com js.stripe.com
31	r.stripe.com	js.stripe.com
26	www.youtube.com	secure.winred.com www.youtube.com
17	q.stripe.com	secure.winred.com
13	secure.winred.com	1 redirects secure.winred.com static.cloudflareinsights.com
12	play.google.com	www.gstatic.com
8	rr5---sn-vgqsrne6.googlevideo.com	www.youtube.com
8	www.gstatic.com	pay.google.com www.youtube.com www.gstatic.com
8	jnn-pa.googleapis.com	www.youtube.com
7	googleads.g.doubleclick.net	5 redirects www.youtube.com
6	www.google.ca	secure.winred.com
6	www.google.com	3 redirects www.youtube.com secure.winred.com
4	fonts.gstatic.com	www.youtube.com
4	pay.google.com	js.stripe.com pay.google.com secure.winred.com www.gstatic.com
4	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com secure.winred.com
4	maps.googleapis.com	secure.winred.com maps.googleapis.com
4	www.googletagmanager.com	secure.winred.com www.googletagmanager.com
3	newassets.hcaptcha.com	hcaptcha.com newassets.hcaptcha.com
3	m.stripe.com	m.stripe.network
3	b.stripecdn.com	js.stripe.com b.stripecdn.com
3	analytics.twitter.com	secure.winred.com
3	t.co	secure.winred.com
3	www.googleadservices.com	www.googletagmanager.com
2	ib.adnxs.com	2 redirects
2	match.adsrvr.org	js.adsrvr.org
2	api.hcaptcha.com	newassets.hcaptcha.com
2	rr4---sn-tt1elnel.googlevideo.com	www.youtube.com
2	yt3.ggpht.com	www.youtube.com
2	static.doubleclick.net	www.youtube.com
2	merchant-ui-api.stripe.com	js.stripe.com
2	m.stripe.network	js.stripe.com m.stripe.network
2	evnt.byspotify.com	pixel.byspotify.com
2	gtm.winred.com	www.googletagmanager.com
2	stats.g.doubleclick.net	www.google-analytics.com www.googletagmanager.com
2	connect.facebook.net	secure.winred.com connect.facebook.net
2	js.adsrvr.org	www.googletagmanager.com match.adsrvr.org
2	d35ligi1n5bgzc.cloudfront.net	secure.winred.com
1	insight.adsrvr.org	1 redirects
1	hcaptcha.com	b.stripecdn.com
1	i.ytimg.com	www.youtube.com
1	www.facebook.com	secure.winred.com
1	analytics.google.com	www.googletagmanager.com
1	app.revv.co	secure.winred.com
1	pixel.byspotify.com	secure.winred.com
1	static.ads-twitter.com	www.googletagmanager.com
1	cdnjs.cloudflare.com	secure.winred.com
1	static.cloudflareinsights.com	secure.winred.com
1	click.email.rondesantis.com	1 redirects
0	ups.analytics.yahoo.com Failed	js.adsrvr.org
0	pixel.rubiconproject.com Failed	js.adsrvr.org
250	50

This site contains links to these domains. Also see Links.

Domain
rondesantis.com
winred.com

Subject Issuer	Validity	Valid
secure.winred.com Cloudflare Inc ECC CA-3	`2023-02-21` - `2024-02-21`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
a.stripecdn.com DigiCert SHA2 Extended Validation Server CA	`2023-10-30` - `2024-01-25`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2023-10-10` - `2024-09-19`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-04-10` - `2024-04-09`	a year	crt.sh
www.googleadservices.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
ads-twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-21` - `2024-07-19`	a year	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2023-04-12` - `2024-05-13`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-09-28` - `2023-12-27`	3 months	crt.sh
pixel.byspotify.com GTS CA 1D4	`2023-11-06` - `2024-02-04`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.stripe.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-10-09` - `2024-01-18`	3 months	crt.sh
t.co DigiCert TLS RSA SHA256 2020 CA1	`2023-02-01` - `2024-02-01`	a year	crt.sh
*.twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-11-07` - `2024-11-05`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
prfx.byspotify.com GTS CA 1D4	`2023-11-11` - `2024-02-09`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.google.ca GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
edgestatic.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.googleusercontent.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.c.docs.google.com GTS CA 1C3	`2023-12-12` - `2024-02-20`	2 months	crt.sh
m.stripe.com DigiCert TLS RSA SHA256 2020 CA1	`2023-10-05` - `2024-01-18`	3 months	crt.sh

This page contains 21 frames:

Primary Page: https://secure.winred.com/desantis/october-eom-dtc?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com&amount=25
Frame ID: 463DC7F724B5E2181B2644C427FBDE6F
Requests: 57 HTTP requests in this frame

Frame: https://js.stripe.com/v3/m-outer-27c67c0d52761104439bb051c7856ab1.html
Frame ID: 157EDF9E7F5F7962A7919EDFA3F4AD62
Requests: 4 HTTP requests in this frame

Frame: https://js.stripe.com/v3/controller-b22056080a36e4a3571fab5c1e67752d.html
Frame ID: 4553F564706A37B32A056676495356CC
Requests: 20 HTTP requests in this frame

Frame: https://js.stripe.com/v3/elements-inner-card-4f22a78d7e8a5e7d999d864bb3c9d998.html
Frame ID: 0B15C3932ECFB3B051974502CF7D78E0
Requests: 13 HTTP requests in this frame

Frame: https://js.stripe.com/v3/controller-b22056080a36e4a3571fab5c1e67752d.html
Frame ID: 1EFB99BFBDA26C2427B6851ECB5E7130
Requests: 23 HTTP requests in this frame

Frame: https://js.stripe.com/v3/payment-request-inner-google-pay-e2b1e542dbeb527e6471bb69e94e4f44.html
Frame ID: 3BEBF5680F9C4134AE9AEF9A985E7465
Requests: 6 HTTP requests in this frame

Frame: https://js.stripe.com/v3/payment-request-inner-browser-ea22ca5912b348f7255859b7529cbbe7.html
Frame ID: 4F64E0B83403C16BD111D13DAAB4F91E
Requests: 5 HTTP requests in this frame

Frame: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&&loop=1&mute=1&playlist=jeD5dxpNSLo
Frame ID: EC09230F1A217C4D84ADC59AD5FC714C
Requests: 18 HTTP requests in this frame

Frame: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&autoplay=1&loop=1&mute=1&playlist=jeD5dxpNSLo
Frame ID: F1D8F5AF8F5AB82417F929D07B69B378
Requests: 41 HTTP requests in this frame

Frame: https://secure.winred.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/main.js
Frame ID: EEDA9CAFD2114BDEDA78590F3B264D53
Requests: 2 HTTP requests in this frame

Frame: https://m.stripe.network/inner.html
Frame ID: 12E6E6BF01E1FBF6CFA97E6AB4C99EA3
Requests: 6 HTTP requests in this frame

Frame: https://pay.google.com/gp/p/ui/payframe?origin=https%3A%2F%2Fjs.stripe.com&mid=
Frame ID: FF00EA0E77E880DB9B49A6406823F508
Requests: 13 HTTP requests in this frame

Frame: https://js.stripe.com/v3/hcaptcha-invisible-21d0f7b9caac917a250454733d386bfa.html
Frame ID: EF296CBCF58C6CB519DF706AE354DBB5
Requests: 3 HTTP requests in this frame

Frame: https://js.stripe.com/v3/elements-inner-link-button-for-card-0e45e2a27e4f7a57fe49a1f7c9e465be.html
Frame ID: 41C1F4EF03A01489775F1EE6F24FE94B
Requests: 6 HTTP requests in this frame

Frame: https://b.stripecdn.com/stripethirdparty-srv/assets/v19.2/HCaptchaInvisible.html?id=446e0bb5-4863-43c8-a36e-f7fa521f28fe&origin=https%3A%2F%2Fjs.stripe.com
Frame ID: 28F77CBB0E87F9284F6EC1267A5C4302
Requests: 5 HTTP requests in this frame

Frame: https://js.stripe.com/v3/elements-inner-payment-request-de6d778d5bab030655df68532a0212a5.html
Frame ID: B0EDAD02489044FE0B35A819E86E2446
Requests: 9 HTTP requests in this frame

Frame: https://newassets.hcaptcha.com/captcha/v1/1bcdbdd/static/hcaptcha.html?_v=8qvmi0v77xk
Frame ID: F21248CCA25C61FB36F6A74FD60CC8B6
Requests: 5 HTTP requests in this frame

Frame: https://match.adsrvr.org/track/upb/?adv=8gutl3m&ref=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Foctober-eom-dtc%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com%26amount%3D25&upid=ssuhzkp&upv=1.1.0&td1=undefined&td2=undefined&td3=undefined&td4=undefined&td5=undefined&td6=undefined&td7=undefined&v=undefined
Frame ID: CCA8E844ADC5CC6E23F636F59E6A7AA9
Requests: 2 HTTP requests in this frame

Frame: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=196be6b4-00cb-48b9-92e6-e2d883ace57c&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon
Frame ID: A1B85558F42DD1175CD0CBB3E8CA0251
Requests: 1 HTTP requests in this frame

Frame: https://ups.analytics.yahoo.com/ups/55953/sync?uid=196be6b4-00cb-48b9-92e6-e2d883ace57c&_origin=1&redir=true&gdpr=0&gdpr_consent=&redir=true
Frame ID: 18C9316CCD874E7964428B1AA2B3BCD7
Requests: 1 HTTP requests in this frame

Frame: https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=5949987524205005609&ttd_tdid=196be6b4-00cb-48b9-92e6-e2d883ace57c
Frame ID: 70BF31526FBF2EAD66FA251AB539C2D9
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Support Ron DeSantis!

Page URL History Show full URLs

https://click.email.rondesantis.com/?qs=fadfe8730a8d3704e16ba04cabbfb7f06e18bc202dec0d68333ecf03378849c8dec3638c... HTTP 302
https://secure.winred.com/desantis/october-eom-dtc?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023... Page URL

Detected technologies

Google Maps (Maps) Expand

Overall confidence: 100%
Detected patterns

//maps\.google(?:apis)?\.com/maps/api/js

YouTube (Video Players) Expand

Overall confidence: 100%
Detected patterns

<(?:param|embed|iframe)[^>]+youtube(?:-nocookie)?\.com/(?:v|embed)

Google Pay (Payment processors) Expand

Overall confidence: 100%
Detected patterns

pay\.google\.com/([a-z/]+)/pay\.js

Stripe (Payment Processors) Expand

Overall confidence: 100%
Detected patterns

js\.stripe\.com

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/ns\.html[^>]+></iframe>
googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

hCaptcha (Security) Expand

Overall confidence: 100%
Detected patterns

https://hcaptcha.com/([\d]+?)/api.js

Page Statistics

250
Requests

97 %
HTTPS

0 %
IPv6

32
Domains

50
Subdomains

43
IPs

3
Countries

6673 kB
Transfer

21606 kB
Size

35
Cookies

10 Outgoing links

These are links going to different origins than the main page.

URL: https://rondesantis.com/privacy-policy/?_gl=1ug5h6b_gcl_awR0NMLjE2OTQ2MTUxMjUuQ2p3S0NBand1NFdvQmhCa0Vpd0Fvak5kWHM3NHNvN0UyU1IwcFpPSWpob09wV2tmS2hWRlRROHZBWTktbEhIV1V4MVU2aVdIR0ROMElSb0NjRDhRQXZEX0J3RQ.._gcl_auODk4MjUwODM1LjE2OTIwMjMyMTcuNDg2NTk2ODc4LjE2OTIyOTExMTQuMTY5MjI5MTExMw..
Title: Privacy policy

Search URL Search Domain Scan URL

URL: https://rondesantis.com/terms-of-use/?_gl=1ug5h6b_gcl_awR0NMLjE2OTQ2MTUxMjUuQ2p3S0NBand1NFdvQmhCa0Vpd0Fvak5kWHM3NHNvN0UyU1IwcFpPSWpob09wV2tmS2hWRlRROHZBWTktbEhIV1V4MVU2aVdIR0ROMElSb0NjRDhRQXZEX0J3RQ.._gcl_auODk4MjUwODM1LjE2OTIwMjMyMTcuNDg2NTk2ODc4LjE2OTIyOTExMTQuMTY5MjI5MTExMw..
Title: terms of use

Search URL Search Domain Scan URL

URL: https://rondesantis.com/mobile-terms/?_gl=1ug5h6b_gcl_awR0NMLjE2OTQ2MTUxMjUuQ2p3S0NBand1NFdvQmhCa0Vpd0Fvak5kWHM3NHNvN0UyU1IwcFpPSWpob09wV2tmS2hWRlRROHZBWTktbEhIV1V4MVU2aVdIR0ROMElSb0NjRDhRQXZEX0J3RQ.._gcl_auODk4MjUwODM1LjE2OTIwMjMyMTcuNDg2NTk2ODc4LjE2OTIyOTExMTQuMTY5MjI5MTExMw..
Title: mobile terms

Search URL Search Domain Scan URL

URL: https://winred.com/terms/donor-terms/
Title: terms of use

Search URL Search Domain Scan URL

URL: https://winred.com/privacy
Title: privacy policy

Search URL Search Domain Scan URL

URL: https://rondesantis.com/privacy-policy/
Title: privacy policy

Search URL Search Domain Scan URL

URL: https://rondesantis.com/terms-of-use
Title: terms of use

Search URL Search Domain Scan URL

URL: https://rondesantis.com/mobile-terms
Title: mobile terms

Search URL Search Domain Scan URL

URL: https://winred.com/
Title: Powered by

Search URL Search Domain Scan URL

URL: https://winred.com/support/
Title: Questions about your charge? Go to our Support Center

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://click.email.rondesantis.com/?qs=fadfe8730a8d3704e16ba04cabbfb7f06e18bc202dec0d68333ecf03378849c8dec3638cb7ce6fabba44242d86c183ca665b884ac255e719f0fea5fb427a370e HTTP 302
https://secure.winred.com/desantis/october-eom-dtc?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com&amount=25 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 34

https://secure.winred.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
https://secure.winred.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/main.js

Request Chain 63

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11188077750/?random=893379787&cv=11&fst=1703038200977&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Foctober-eom-dtc%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com%26amount%3D25&label=tNBiCNPx_KIYELaJ8tYp&hn=www.googleadservices.com&frm=0&tiba=Support%20Ron%20DeSantis!&value=0&auid=1525999704.1703038201&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&ocp_id=-UyCZe3uBPCVoPMPqdCC-AM&sscte=1&crd=&eitems=ChEIgJuFrAYQsaWC8uL41eLTARIdAOBcHGdByHJgkroXe5eRCnEo9Ipb0R6Sk1-gOS4&pscrd=Ek5DaEFJZ0p1RnJBWVFxczZHc04tS2g4dG9FaVlBaUQwSi1ldzl2MklHQ2owRVBlOU9mRXdteUI0dVFycWNrcC1mN2tiT3ZGTXBrc3NtN3caWkNoRUlnSnVGckFZUXpLRGJzNVdJeWZLdkFSSXVBUHBDa1NfZi16RWJSRFJCeWNrU2I0MVlMeWc4VGQzN2VlcTBsSjJtTEgxckd4bzhJOFJWQzdnTFdNT01HZyITCK3Pjtj3nIMDFfAKaAgdKagAPw HTTP 302
https://www.google.com/pagead/1p-conversion/11188077750/?random=893379787&cv=11&fst=1703038200977&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Foctober-eom-dtc%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com%26amount%3D25&label=tNBiCNPx_KIYELaJ8tYp&hn=www.googleadservices.com&frm=0&tiba=Support%20Ron%20DeSantis!&value=0&auid=1525999704.1703038201&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek5DaEFJZ0p1RnJBWVFxczZHc04tS2g4dG9FaVlBaUQwSi1ldzl2MklHQ2owRVBlOU9mRXdteUI0dVFycWNrcC1mN2tiT3ZGTXBrc3NtN3caWkNoRUlnSnVGckFZUXpLRGJzNVdJeWZLdkFSSXVBUHBDa1NfZi16RWJSRFJCeWNrU2I0MVlMeWc4VGQzN2VlcTBsSjJtTEgxckd4bzhJOFJWQzdnTFdNT01HZyITCK3Pjtj3nIMDFfAKaAgdKagAPw&is_vtc=1&ocp_id=-UyCZe3uBPCVoPMPqdCC-AM&cid=CAQSGwAvHhf_RaYewoE2aI0O476143j2stiurE4VnQ&eitems=ChEIgJuFrAYQsaWC8uL41eLTARIdAOBcHGftK1eFtGojeAADrhOYU2Y80YZ9zoMRPGU&random=2026676161 HTTP 302
https://www.google.ca/pagead/1p-conversion/11188077750/?random=893379787&cv=11&fst=1703038200977&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Foctober-eom-dtc%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com%26amount%3D25&label=tNBiCNPx_KIYELaJ8tYp&hn=www.googleadservices.com&frm=0&tiba=Support%20Ron%20DeSantis!&value=0&auid=1525999704.1703038201&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek5DaEFJZ0p1RnJBWVFxczZHc04tS2g4dG9FaVlBaUQwSi1ldzl2MklHQ2owRVBlOU9mRXdteUI0dVFycWNrcC1mN2tiT3ZGTXBrc3NtN3caWkNoRUlnSnVGckFZUXpLRGJzNVdJeWZLdkFSSXVBUHBDa1NfZi16RWJSRFJCeWNrU2I0MVlMeWc4VGQzN2VlcTBsSjJtTEgxckd4bzhJOFJWQzdnTFdNT01HZyITCK3Pjtj3nIMDFfAKaAgdKagAPw&is_vtc=1&ocp_id=-UyCZe3uBPCVoPMPqdCC-AM&cid=CAQSGwAvHhf_RaYewoE2aI0O476143j2stiurE4VnQ&eitems=ChEIgJuFrAYQsaWC8uL41eLTARIdAOBcHGftK1eFtGojeAADrhOYU2Y80YZ9zoMRPGU&random=2026676161&ipr=y&ezwbk=AZuM4hDAcXf1JlNwyfWq_zkiFiMSA66zQFz0aY28_wQinSopqDakTPfjH5dVKKtYfRFcLu0W17CYiZKXQI7aCOTMSFsr

Request Chain 64

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11263458299/?random=340129217&cv=11&fst=1703038200993&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Foctober-eom-dtc%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com%26amount%3D25&label=e3Q7CJi9neAYEPv36vop&hn=www.googleadservices.com&frm=0&tiba=Support%20Ron%20DeSantis!&value=0&auid=1525999704.1703038201&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&ocp_id=-UyCZdfxBLS2oPMP_qCN-AI&sscte=1&crd=&eitems=ChEIgJuFrAYQsaWC8uL41eLTARIdAOBcHGfNNgiqPpQZNIYHK_a7wbB2RQ404so7WlQ&pscrd=Ek5DaEFJZ0p1RnJBWVFxczZHc04tS2g4dG9FaVlBaUQwSi1ldzl2MklHQ2owRVBlOU9mRXdteUI0dVFycWNrcC1mN2tiT3ZGTXBrc3NtN3caWkNoRUlnSnVGckFZUXpLRGJzNVdJeWZLdkFSSXVBUHBDa1M4Zmw3N09mZ0xDSzdxV3poWVBoeGJCeW5mbVpMaDNHVXFNWDNxSGVTRGx2NHYxUGd4NExBV1JKZyITCJfSjtj3nIMDFTQbaAgdflADLw HTTP 302
https://www.google.com/pagead/1p-conversion/11263458299/?random=340129217&cv=11&fst=1703038200993&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Foctober-eom-dtc%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com%26amount%3D25&label=e3Q7CJi9neAYEPv36vop&hn=www.googleadservices.com&frm=0&tiba=Support%20Ron%20DeSantis!&value=0&auid=1525999704.1703038201&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek5DaEFJZ0p1RnJBWVFxczZHc04tS2g4dG9FaVlBaUQwSi1ldzl2MklHQ2owRVBlOU9mRXdteUI0dVFycWNrcC1mN2tiT3ZGTXBrc3NtN3caWkNoRUlnSnVGckFZUXpLRGJzNVdJeWZLdkFSSXVBUHBDa1M4Zmw3N09mZ0xDSzdxV3poWVBoeGJCeW5mbVpMaDNHVXFNWDNxSGVTRGx2NHYxUGd4NExBV1JKZyITCJfSjtj3nIMDFTQbaAgdflADLw&is_vtc=1&ocp_id=-UyCZdfxBLS2oPMP_qCN-AI&cid=CAQSGwAvHhf_8dMlxBRs3HJ0Pnna6yLI3dUEveBvJg&eitems=ChEIgJuFrAYQsaWC8uL41eLTARIdAOBcHGeUqv_kVMf-_eyZ-nH0x05SvxAspsK6S0E&random=171321602 HTTP 302
https://www.google.ca/pagead/1p-conversion/11263458299/?random=340129217&cv=11&fst=1703038200993&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Foctober-eom-dtc%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com%26amount%3D25&label=e3Q7CJi9neAYEPv36vop&hn=www.googleadservices.com&frm=0&tiba=Support%20Ron%20DeSantis!&value=0&auid=1525999704.1703038201&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek5DaEFJZ0p1RnJBWVFxczZHc04tS2g4dG9FaVlBaUQwSi1ldzl2MklHQ2owRVBlOU9mRXdteUI0dVFycWNrcC1mN2tiT3ZGTXBrc3NtN3caWkNoRUlnSnVGckFZUXpLRGJzNVdJeWZLdkFSSXVBUHBDa1M4Zmw3N09mZ0xDSzdxV3poWVBoeGJCeW5mbVpMaDNHVXFNWDNxSGVTRGx2NHYxUGd4NExBV1JKZyITCJfSjtj3nIMDFTQbaAgdflADLw&is_vtc=1&ocp_id=-UyCZdfxBLS2oPMP_qCN-AI&cid=CAQSGwAvHhf_8dMlxBRs3HJ0Pnna6yLI3dUEveBvJg&eitems=ChEIgJuFrAYQsaWC8uL41eLTARIdAOBcHGeUqv_kVMf-_eyZ-nH0x05SvxAspsK6S0E&random=171321602&ipr=y&ezwbk=AZuM4hCz9OrCWZ04AEiizdnEgi2g-ncVwZpfp_ant36pmeIyPfo85SF1yYuQSqoroKQ1CsMSWv85Su_sp20559X_tGSB

Request Chain 65

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11198202606/?random=290248036&cv=11&fst=1703038200985&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Foctober-eom-dtc%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com%26amount%3D25&label=M51RCOmQgKgYEO6F3Nsp&hn=www.googleadservices.com&frm=0&tiba=Support%20Ron%20DeSantis!&value=0&auid=1525999704.1703038201&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&ocp_id=-UyCZaO0BY7BoPMPg_y4uAg&sscte=1&crd=&eitems=ChEIgJuFrAYQsaWC8uL41eLTARIdAOBcHGemmxk7eCi_u4Nlln0Nq0bkp4nihTOo60M&pscrd=Ek5DaEFJZ0p1RnJBWVFxczZHc04tS2g4dG9FaVlBaUQwSi1ldzl2MklHQ2owRVBlOU9mRXdteUI0dVFycWNrcC1mN2tiT3ZGTXBrc3NtN3caWkNoRUlnSnVGckFZUXpLRGJzNVdJeWZLdkFSSXVBUHBDa1M4YWtuR2cxSEJxYkZsbWVFZmFIbXNXa2JLZTF2TDJxLW1XcndLaUw2ajBBSkt4QUR5UTE2MF9EUSITCOOUj9j3nIMDFY4gaAgdAz4Ohw HTTP 302
https://www.google.com/pagead/1p-conversion/11198202606/?random=290248036&cv=11&fst=1703038200985&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Foctober-eom-dtc%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com%26amount%3D25&label=M51RCOmQgKgYEO6F3Nsp&hn=www.googleadservices.com&frm=0&tiba=Support%20Ron%20DeSantis!&value=0&auid=1525999704.1703038201&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek5DaEFJZ0p1RnJBWVFxczZHc04tS2g4dG9FaVlBaUQwSi1ldzl2MklHQ2owRVBlOU9mRXdteUI0dVFycWNrcC1mN2tiT3ZGTXBrc3NtN3caWkNoRUlnSnVGckFZUXpLRGJzNVdJeWZLdkFSSXVBUHBDa1M4YWtuR2cxSEJxYkZsbWVFZmFIbXNXa2JLZTF2TDJxLW1XcndLaUw2ajBBSkt4QUR5UTE2MF9EUSITCOOUj9j3nIMDFY4gaAgdAz4Ohw&is_vtc=1&ocp_id=-UyCZaO0BY7BoPMPg_y4uAg&cid=CAQSGwAvHhf_tLWyXaJ3vFxbHXczcsLESnexQuscpQ&eitems=ChEIgJuFrAYQsaWC8uL41eLTARIdAOBcHGdIZGR3WAd7IXDsi1XRsHUgkYwHQkROgqw&random=1341597385 HTTP 302
https://www.google.ca/pagead/1p-conversion/11198202606/?random=290248036&cv=11&fst=1703038200985&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Foctober-eom-dtc%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com%26amount%3D25&label=M51RCOmQgKgYEO6F3Nsp&hn=www.googleadservices.com&frm=0&tiba=Support%20Ron%20DeSantis!&value=0&auid=1525999704.1703038201&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek5DaEFJZ0p1RnJBWVFxczZHc04tS2g4dG9FaVlBaUQwSi1ldzl2MklHQ2owRVBlOU9mRXdteUI0dVFycWNrcC1mN2tiT3ZGTXBrc3NtN3caWkNoRUlnSnVGckFZUXpLRGJzNVdJeWZLdkFSSXVBUHBDa1M4YWtuR2cxSEJxYkZsbWVFZmFIbXNXa2JLZTF2TDJxLW1XcndLaUw2ajBBSkt4QUR5UTE2MF9EUSITCOOUj9j3nIMDFY4gaAgdAz4Ohw&is_vtc=1&ocp_id=-UyCZaO0BY7BoPMPg_y4uAg&cid=CAQSGwAvHhf_tLWyXaJ3vFxbHXczcsLESnexQuscpQ&eitems=ChEIgJuFrAYQsaWC8uL41eLTARIdAOBcHGdIZGR3WAd7IXDsi1XRsHUgkYwHQkROgqw&random=1341597385&ipr=y&ezwbk=AZuM4hAGF944gcyrUOZCfgcX229b82K1MLGfQ_cgPgX53FPVFGWw5HC6u3IAAWp8F-7LJyPXVtpBfAlOKD8nSPQr3XJK

Request Chain 104

https://googleads.g.doubleclick.net/pagead/id HTTP 302
https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

Request Chain 107

https://googleads.g.doubleclick.net/pagead/id HTTP 302
https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

Request Chain 243

https://insight.adsrvr.org/track/up?adv=8gutl3m&ref=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Foctober-eom-dtc%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com%26amount%3D25&upid=ssuhzkp&upv=1.1.0&td1=undefined&td2=undefined&td3=undefined&td4=undefined&td5=undefined&td6=undefined&td7=undefined&v=undefined HTTP 302
https://match.adsrvr.org/track/upb/?adv=8gutl3m&ref=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Foctober-eom-dtc%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com%26amount%3D25&upid=ssuhzkp&upv=1.1.0&td1=undefined&td2=undefined&td3=undefined&td4=undefined&td5=undefined&td6=undefined&td7=undefined&v=undefined

Request Chain 249

https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=196be6b4-00cb-48b9-92e6-e2d883ace57c HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fmatch.adsrvr.org%252ftrack%252fcmf%252fappnexus%253fttd%253d1%2526anid%253d%2524UID%26ttd_tdid%3D196be6b4-00cb-48b9-92e6-e2d883ace57c HTTP 302
https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=5949987524205005609&ttd_tdid=196be6b4-00cb-48b9-92e6-e2d883ace57c

250 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request october-eom-dtc Show response
secure.winred.com/desantis/
Redirect Chain

https://click.email.rondesantis.com/?qs=fadfe8730a8d3704e16ba04cabbfb7f06e18bc202dec0d68333ecf03378849c8dec3638cb7ce6fabba44242d86c183ca665b884ac255e719f0fea5fb427a370e
https://secure.winred.com/desantis/october-eom-dtc?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_&first_name=Jed&last_name=Weeks...

51 KB
14 KB

191ms
135ms

Document
text/html

104.19.212.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/desantis/october-eom-dtc?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com&amount=25

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.212.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f182d6ddf4c696841c5d8c992043ef548264832e3984c9d6b1e65461ede39df5

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate, private, max-age=0
cf-cache-status: DYNAMIC
cf-ray: 838458b11cb53972-YYZ
content-encoding: br
content-type: text/html; charset=utf-8
date: Wed, 20 Dec 2023 02:10:00 GMT
server: cloudflare
strict-transport-security: max-age=0; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-rack-cors: miss; no-origin
x-request-id: 7855325b-51b4-4bae-8bcd-de4f2f7aa2b4
x-revv-cache: Hit from Revv
x-robots-tag: noindex, nofollow, noarchive
x-runtime: 0.048143
x-xss-protection: 1; mode=block

Redirect headers

Cache-Control: private
Connection: close
Content-Length: 406
Content-Type: text/html; charset=utf-8
Date: Wed, 20 Dec 2023 02:09:59 GMT
Location: https://secure.winred.com/desantis/october-eom-dtc?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com&amount=25

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 440 KB
97 KB 154ms
80ms Script
application/javascript 172.253.63.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/desantis/october-eom-dtc?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com&amount=25

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

ef57d7f7ebe5a199ba8451468d80f03eb0da671c8820cba15bf6ec90e26d668a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 02:10:00 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 99686
x-xss-protection: 0
last-modified: Wed, 20 Dec 2023 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 20 Dec 2023 02:10:00 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 268 KB
89 KB 126ms
53ms Script
application/javascript 172.253.63.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-M4TW6TX

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

af2d7d51d77af73d6e33519c8565b3e9c33f628d0bf148f045911c18c809c426

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 02:10:00 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 90513
x-xss-protection: 0
last-modified: Wed, 20 Dec 2023 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 20 Dec 2023 02:10:00 GMT

GET
H2 200 / Show response
js.stripe.com/v3/ 579 KB
143 KB 134ms
43ms Script
text/javascript 52.85.151.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-117.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

4491ac8726434020a36b04e7815addf9341d5f8c19d3b9a9ba7d6b2bf7e3feaa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 02:09:35 GMT
content-encoding: br
via: 1.1 2f66aa06710fece8ed203ab0ea81eb56.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 26
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Tue, 19 Dec 2023 21:49:10 GMT
server: Cloudfront
etag: W/"bd1739a40e63c5f1443843f0ee68177c"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
timing-allow-origin: *
x-amz-cf-id: jo5BULkQSC7wVr_a99l31J13HX6Nj1l7YHvY6fFejHlgVZYdL8yYcg==

GET
H2 200 landing_page-b5085350195c50801834c19cd56b1cabc8b9ea2b81e3a74f8486f6b3e2ae2898.css
secure.winred.com/assets/ 219 KB
34 KB 51ms
50ms Stylesheet
text/css 104.19.212.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/assets/landing_page-b5085350195c50801834c19cd56b1cabc8b9ea2b81e3a74f8486f6b3e2ae2898.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.212.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

961951e588ed2cbd0dadda321becf5c4d27451bb0896262f86e7d922da5794ca

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/desantis/october-eom-dtc?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com&amount=25
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 02:10:00 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
x-amz-version-id: 4RBMbG_c3G5laVKEwPaykYWu8oOdV56f
cf-cache-status: HIT
x-amz-request-id: DDMQVQGGNFGNG5XJ
age: 64
cf-polished: origSize=227667
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-amz-id-2: k6N5K878OsGFrKoNRtPSGWmqDbeO9qVc9Qj8yo2WJpb194sQUAabaMYdrQXbK48tJzsHALgmOX0=
cf-bgj: minify
last-modified: Tue, 28 Nov 2023 01:42:36 GMT
server: cloudflare
etag: W/"57df3b6cebff9962c43c29347b45123f"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
cf-ray: 838458b22ed93972-YYZ
expires: Wed, 20 Dec 2023 06:10:00 GMT

GET
H2 200 1698937088.css
secure.winred.com/stylesheets/rv_page_01hd1gx9bvcmr11759d0y20keb/ 9 KB
3 KB 70ms
68ms Stylesheet
text/css 104.19.212.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/stylesheets/rv_page_01hd1gx9bvcmr11759d0y20keb/1698937088.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.212.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

225d1680fd98dfb76eedb90b8ca678b1ea9daf5efb2a1b3289d3cc4c8ea6f5b5

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/desantis/october-eom-dtc?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com&amount=25
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-rack-cors: miss; no-origin
date: Wed, 20 Dec 2023 02:10:00 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 7429
cf-polished: origSize=9744
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
x-request-id: 1a21cabc-72c1-4eff-9797-41c1f5a73993
x-runtime: 0.061359
cf-bgj: minify
last-modified: Wed, 20 Dec 2023 00:06:11 GMT
server: cloudflare
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
cache-control: public, max-age=31556952
cf-ray: 838458b22edd3972-YYZ
expires: Thu, 19 Dec 2024 07:59:12 GMT

GET
H2 200 js Show response
maps.googleapis.com/maps/api/ 194 KB
65 KB 133ms
62ms Script
text/javascript 142.251.163.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f95.1e100.net

Software

scaffolding on HTTPServer2 /

Resource Hash

6b63b6eea6c3175e453b0960009d25681013318ea7c565f2081a5e8bd1df6fe2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 02:10:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Accept-Language, Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66476
x-xss-protection: 0

GET
H2 200 application-landing-page-7ea440a608ae6761bd5abd3174137469ab09ceae7c9b01ceba0ceddb65802b52.js Show response
secure.winred.com/assets/ 486 KB
136 KB 70ms
70ms Script
application/javascript 104.19.212.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/assets/application-landing-page-7ea440a608ae6761bd5abd3174137469ab09ceae7c9b01ceba0ceddb65802b52.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.212.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bf15413499b81555136c08dd340efaf4b00a8eb7ac1067d558e70bf6fbbfb07f

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/desantis/october-eom-dtc?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com&amount=25
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 02:10:00 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
x-amz-version-id: dbzxATFmqrrik1B4lI2.BR2h86hlZo0z
cf-cache-status: HIT
x-amz-request-id: EWQSC57WRPQZF717
age: 6597
cf-polished: origSize=497469
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 2GJ6VkG4D9rrvAn2tMQBsOwe9yzo/N9/0BVUjP34pyu9js+3VjMQQAuRStK97qlePxHzLfRH8j8=
cf-bgj: minify
last-modified: Tue, 28 Nov 2023 01:42:31 GMT
server: cloudflare
etag: W/"c9a1d576fe79597fb8399634c6208524"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 838458b22ee03972-YYZ
expires: Wed, 20 Dec 2023 06:10:00 GMT

GET
H2 200 desantis.png
d35ligi1n5bgzc.cloudfront.net/profiles/images/000/671/066/square/ 22 KB
22 KB 138ms
60ms Image
image/png 99.86.229.15
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d35ligi1n5bgzc.cloudfront.net/profiles/images/000/671/066/square/desantis.png
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/desantis/october-eom-dtc?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com&amount=25
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.229.15 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-229-15.iad79.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f0e8e07da0f7e8df81ad353aaf53faceea8164f905e39b4987f78e2cb9885142

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-amz-version-id: OAHS40j6d3wVYtWQz3FqMkbWp6.jd7gU
date: Tue, 19 Dec 2023 19:46:56 GMT
via: 1.1 c3fbf93d9b0f1f9b36fcc420314f3186.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD79-C3
age: 22985
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 22185
last-modified: Thu, 13 Jul 2023 18:01:31 GMT
server: AmazonS3
etag: "8d35322e12a99ab9f40164223826b7a9"
vary: Accept-Encoding
content-type: image/png
accept-ranges: bytes
x-amz-cf-id: v9vDFDS6sUF2FFRRDzreZw5pYk1dCEj7U2tXfTdI_nt8TTqfo34Fcg==

GET
H2 200 win-red-full-red-5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848.svg
secure.winred.com/assets/ 19 KB
7 KB 66ms
65ms Image
image/svg+xml 104.19.212.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.winred.com/assets/win-red-full-red-5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.212.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/desantis/october-eom-dtc?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com&amount=25
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 02:10:00 GMT
x-amz-version-id: f1JFLNaL.a2v3vTaKefRH3mKI0iL1aS2
x-content-type-options: nosniff
strict-transport-security: max-age=0; includeSubDomains
cf-cache-status: HIT
x-amz-request-id: DR221M7BV09V5M4K
age: 6597
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-amz-id-2: o3mwkPmqaNRV7lmkKby0loB41Op/Qye+l92VE5ENqVVaInfkxBejRsvNGOTW7eq4u/uhUH6RRT8=
last-modified: Tue, 28 Nov 2023 01:42:37 GMT
server: cloudflare
etag: W/"d31530d4186af669daf4f47099614593"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=14400
cf-ray: 838458b22ee43972-YYZ
expires: Wed, 20 Dec 2023 06:10:00 GMT

GET
H3 200 email-decode.min.js Show response
secure.winred.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
897 B 29ms
29ms Script
application/javascript 104.19.212.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.212.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/desantis/october-eom-dtc?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com&amount=25
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 02:10:00 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
last-modified: Fri, 08 Dec 2023 17:59:01 GMT
server: cloudflare
content-encoding: gzip
etag: W/"65735965-4d7"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript
cache-control: max-age=172800, public
cf-ray: 838458b29e5736fb-YYZ
expires: Fri, 22 Dec 2023 02:10:00 GMT

GET
H2 200 v84a3a4012de94ce1a686ba8c167c359c1696973893317 Show response
static.cloudflareinsights.com/beacon.min.js/ 20 KB
7 KB 106ms
68ms Script
text/javascript 104.16.57.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/v84a3a4012de94ce1a686ba8c167c359c1696973893317
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/desantis/october-eom-dtc?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com&amount=25
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.57.101 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101

Request headers

Referer: https://secure.winred.com/
Origin: https://secure.winred.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 02:10:00 GMT
content-encoding: gzip
last-modified: Tue, 10 Oct 2023 21:38:13 GMT
server: cloudflare
etag: W/"2023.10.0"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 838458b3cd4e36d8-YYZ

GET
H2 200 Untitled_design_-_2023-08-16T174354.206_11zon.jpg
d35ligi1n5bgzc.cloudfront.net/backgrounds/images/000/700/520/large/ 67 KB
68 KB 41ms
40ms Image
image/jpeg 99.86.229.15
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d35ligi1n5bgzc.cloudfront.net/backgrounds/images/000/700/520/large/Untitled_design_-_2023-08-16T174354.206_11zon.jpg
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/stylesheets/rv_page_01hd1gx9bvcmr11759d0y20keb/1698937088.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.229.15 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-229-15.iad79.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: be680e4067f8c29773b5c545eb53e75dfea28aceeba5c2e3d5f624f9c04e0686

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-amz-version-id: DjifGUEOLvf8ypwhKsz0Vs9EdpE4VANn
date: Tue, 19 Dec 2023 21:03:05 GMT
via: 1.1 c3fbf93d9b0f1f9b36fcc420314f3186.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD79-C3
age: 18416
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 68903
last-modified: Wed, 16 Aug 2023 21:46:42 GMT
server: AmazonS3
etag: "1a7f1054b6526da27d916f84f9cff551"
vary: Accept-Encoding
content-type: image/jpeg
accept-ranges: bytes
x-amz-cf-id: 1YKDpsHk1WfAxQOx89AW0RFnbNrkUKeFdelsp7Ppxrq1U9Kqgw73YA==

GET
H2 200 sha256.min.js Show response
cdnjs.cloudflare.com/ajax/libs/js-sha256/0.9.0/ 9 KB
4 KB 64ms
26ms Script
application/javascript 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/js-sha256/0.9.0/sha256.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7157511697db744d384a5a2a8646af23f3c90560abf93bb240fdd690b29a898a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Origin: https://secure.winred.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 02:10:01 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 1776232
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 2977
last-modified: Mon, 04 May 2020 16:11:50 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec6-2339"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7guoDHHh6bAgreL620WE0MrLjYcg8M4i0NOsckvCwEJ4md4%2BEFMQV3ymLyH26nLRsINz%2B6VWCHCWFUd5zzqpKaGLJrxXPgKUZjBrUY2WxjtH6gMa3Q12ge6XQNDKcVXmk5oEN7m3"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 838458b45bbd39ef-YYZ
expires: Mon, 09 Dec 2024 02:10:01 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 274 KB
91 KB 55ms
54ms Script
application/javascript 172.253.63.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-LDP16YY77N&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M4TW6TX

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

3100edb838a335dc077854e521ca7a3db25782cfbcd1a5f7245e71e1a268f4f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 02:10:01 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 92998
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 20 Dec 2023 02:10:01 GMT

GET
H2 200 / Show response
www.googleadservices.com/pagead/conversion/11188077750/ 3 KB
2 KB 122ms
50ms Script
text/javascript 142.251.111.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/11188077750/?random=1703038200977&cv=11&fst=1703038200977&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Foctober-eom-dtc%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com%26amount%3D25&label=tNBiCNPx_KIYELaJ8tYp&hn=www.googleadservices.com&frm=0&tiba=Support%20Ron%20DeSantis!&value=0&bttype=purchase&auid=1525999704.1703038201&uamb=0&uaw=0&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M4TW6TX

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.111.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f155.1e100.net

Software

cafe /

Resource Hash

b7c8d7e0552d05dbe386dab179f440d96422b129647e15c56866806643a06ecc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Dec 2023 02:10:01 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1790
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
www.googleadservices.com/pagead/conversion/11198202606/ 3 KB
2 KB 128ms
59ms Script
text/javascript 142.251.111.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/11198202606/?random=1703038200985&cv=11&fst=1703038200985&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Foctober-eom-dtc%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com%26amount%3D25&label=M51RCOmQgKgYEO6F3Nsp&hn=www.googleadservices.com&frm=0&tiba=Support%20Ron%20DeSantis!&value=0&bttype=purchase&auid=1525999704.1703038201&uamb=0&uaw=0&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M4TW6TX

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.111.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f155.1e100.net

Software

cafe /

Resource Hash

2f184c04ccf0a6350f145813b790f108b9f8a639414537e34fa805f19b645d63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Dec 2023 02:10:01 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1796
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 117ms
36ms Script
application/javascript 146.75.28.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M4TW6TX
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.75.28.157 Ashburn, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 02:10:01 GMT
content-encoding: gzip
last-modified: Thu, 27 Oct 2022 15:55:14 GMT
etag: "32ad004436155ec972bc50e6238b5b67+gzip"
vary: Accept-Encoding,Host
x-cache: HIT
content-type: application/javascript; charset=utf-8
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn: FT
cache-control: no-cache
accept-ranges: bytes
content-length: 15375
x-served-by: cache-iad-kiad7000078-IAD

GET
H2 200 / Show response
www.googleadservices.com/pagead/conversion/11263458299/ 3 KB
2 KB 112ms
51ms Script
text/javascript 142.251.111.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/11263458299/?random=1703038200993&cv=11&fst=1703038200993&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Foctober-eom-dtc%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com%26amount%3D25&label=e3Q7CJi9neAYEPv36vop&hn=www.googleadservices.com&frm=0&tiba=Support%20Ron%20DeSantis!&value=0&bttype=purchase&auid=1525999704.1703038201&uamb=0&uaw=0&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M4TW6TX

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.111.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f155.1e100.net

Software

cafe /

Resource Hash

1a993839c8a46fd6c9d5804b83e402301a48ce6da4875c1f91ef5a649e111bd0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Dec 2023 02:10:01 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1799
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK up_loader.1.1.0.js Show response
js.adsrvr.org/ 5 KB
3 KB 107ms
35ms Script
application/x-javascript 13.32.206.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adsrvr.org/up_loader.1.1.0.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M4TW6TX
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.206.122 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-206-122.iad66.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 899663bfeab6b11842c974c2417dc0ad88bd79bb7510b1e032384ccf2618dcc1

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Wed, 20 Dec 2023 01:34:58 GMT
Content-Encoding: gzip
Via: 1.1 e58f499d9cd10c42a7ba13215f40c914.cloudfront.net (CloudFront)
Last-Modified: Wed, 20 Dec 2023 01:34:49 GMT
Server: AmazonS3
X-Amz-Cf-Pop: IAD66-C1
Age: 2104
ETag: W/"b7474eac210849250426a8f6a39d00f3"
x-amz-server-side-encryption: AES256
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/x-javascript
X-Cache: Hit from cloudfront
Connection: keep-alive
X-Amz-Cf-Id: ZmxDQBz2PxjubTRoMs6EeNoR4oqXb3h5lbg0Twg8gbEVvgLUAJvRag==

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 202 KB
54 KB 227ms
64ms Script
application/x-javascript 157.240.244.1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.244.1 Apodaca, Mexico, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-mty2.fbcdn.net

Software

Resource Hash

3e136e77083bfc6ef14ffc5abd19da89a82bf12fc0cda3c603e01582b93303c8

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), gamepad=(), keyboard-map=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 20 Dec 2023 02:10:01 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 54273
x-xss-protection: 0
reporting-endpoints
pragma: public
x-fb-debug: hCifLCFz3KC+kXMndN7FRiQNH19nkGycVoQx2rC1SLHEih6opBcg3VQDNHcz870JjPy8U4GxSAPpMU5FVypvAA==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 ping.min.js Show response
pixel.byspotify.com/ 32 KB
7 KB 73ms
20ms Script
application/javascript 34.117.162.98
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.byspotify.com/ping.min.js
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/desantis/october-eom-dtc?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com&amount=25
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.162.98 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 98.162.117.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 20c0114a672ac0b5b31a1c0100543a2306bf389816ab20774b66e8f7b30fb60c

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 01:18:41 GMT
content-encoding: gzip
via: 1.1 google
age: 3080
x-guploader-uploadid: ABPtcPpzAhWqv-WA6d6Z7OYjMx_0Lj_-pDslc9MO-cp7Bw_MhXvO36fCXqlTjRScYstzkne_g__8THDog5QHtATNEmTVpJfT1hYk
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6158
last-modified: Wed, 11 Oct 2023 19:00:35 GMT
server: UploadServer
etag: "13069f74108a788c598831c3a4ff2cdf"
vary: Accept-Encoding
x-goog-generation: 1697050835633914
x-goog-hash: crc32c=We0+rw==, md5=EwafdBCKeIxZiDHDpP8s3w==
content-type: application/javascript;
cache-control: public, max-age=3600
x-goog-stored-content-length: 6158
accept-ranges: bytes
expires: Wed, 20 Dec 2023 02:18:41 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 259 KB
88 KB 62ms
61ms Script
application/javascript 172.253.63.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

c3ca1558fd0f68bef4efd1c1b60c881c884ba6448251a0f66b9e133442bc4417

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 02:10:01 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 89790
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 20 Dec 2023 02:10:01 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 111ms
35ms Script
text/javascript 142.251.16.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f138.1e100.net

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 20 Dec 2023 02:05:16 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 285
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Wed, 20 Dec 2023 04:05:16 GMT

GET
H2 200 m-outer-27c67c0d52761104439bb051c7856ab1.html Show response
js.stripe.com/v3/ Frame 157E 200 B
1 KB 36ms
36ms Document
text/html 52.85.151.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/m-outer-27c67c0d52761104439bb051c7856ab1.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-117.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

351ffc2bdf381352dcd801be49be5018361119588eae077650260f9e162fe7b9

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 1775
cache-control: max-age=31536000
content-length: 200
content-security-policy: base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://q.stripe.com/csp-report
content-security-policy-report-only: base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Wed, 20 Dec 2023 01:40:27 GMT
etag: "27c67c0d52761104439bb051c7856ab1"
last-modified: Mon, 18 Dec 2023 21:17:10 GMT
server: Cloudfront
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 2f66aa06710fece8ed203ab0ea81eb56.cloudfront.net (CloudFront)
x-amz-cf-id: OY-npOLWu_yVWr5e6VrDwjC73dGIKs48gbE9sVDbOhzrZdGx6UW8lg==
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
x-content-type-options: nosniff

GET
H2 200 controller-b22056080a36e4a3571fab5c1e67752d.html Show response
js.stripe.com/v3/ Frame 4553 325 B
1 KB 39ms
39ms Document
text/html 52.85.151.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/controller-b22056080a36e4a3571fab5c1e67752d.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-117.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

8e51e1f02a3f6e08c6f9416d35f3d9d819844df7003128842d8ab0a86c6fa591

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://api.stripe.com https://merchant-ui-api.stripe.com https://stripe.com/cookie-settings/enforcement-mode https://errors.stripe.com https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src 'self'; img-src 'self' https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'sha256-0hAheEzaMe6uXIKV4EehS9pu1am1lj/KnnzrOYqckXk='; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 57
cache-control: max-age=60
content-length: 325
content-security-policy: base-uri 'none'; connect-src 'self' https://api.stripe.com https://merchant-ui-api.stripe.com https://stripe.com/cookie-settings/enforcement-mode https://errors.stripe.com https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src 'self'; img-src 'self' https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'sha256-0hAheEzaMe6uXIKV4EehS9pu1am1lj/KnnzrOYqckXk='; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Wed, 20 Dec 2023 02:09:05 GMT
etag: "b22056080a36e4a3571fab5c1e67752d"
last-modified: Tue, 19 Dec 2023 21:32:01 GMT
server: Cloudfront
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 2f66aa06710fece8ed203ab0ea81eb56.cloudfront.net (CloudFront)
x-amz-cf-id: RBU3pBLB6NDBCNuJlhhnywb_6ygn-aeYbMtfdG_ODYxu6IUZbE-3bQ==
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
x-content-type-options: nosniff

GET
H2 200 elements-inner-card-4f22a78d7e8a5e7d999d864bb3c9d998.html Show response
js.stripe.com/v3/ Frame 0B15 798 B
2 KB 38ms
37ms Document
text/html 52.85.151.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/elements-inner-card-4f22a78d7e8a5e7d999d864bb3c9d998.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-117.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

c9f1eaf5de0ea164f979b66dd4e737943c3fbaa4038abe597d599d93afc5aba1

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://ppm.stripe.com; default-src 'self'; font-src data: https:; form-action 'none'; frame-src 'self' https://www.affirm.com https://checkout.link.com https://b.stripecdn.com; img-src 'self' https://q.stripe.com https://b.stripecdn.com https://js.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 1919
cache-control: max-age=31536000
content-length: 798
content-security-policy: base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://ppm.stripe.com; default-src 'self'; font-src data: https:; form-action 'none'; frame-src 'self' https://www.affirm.com https://checkout.link.com https://b.stripecdn.com; img-src 'self' https://q.stripe.com https://b.stripecdn.com https://js.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; report-uri https://q.stripe.com/csp-report
content-security-policy-report-only: base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://ppm.stripe.com; default-src 'self'; font-src data: https:; form-action 'none'; frame-src 'self' https://www.affirm.com https://checkout.link.com https://b.stripecdn.com; img-src 'self' https://q.stripe.com https://b.stripecdn.com https://js.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Wed, 20 Dec 2023 01:38:33 GMT
etag: "4f22a78d7e8a5e7d999d864bb3c9d998"
last-modified: Tue, 19 Dec 2023 21:32:01 GMT
server: Cloudfront
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 2f66aa06710fece8ed203ab0ea81eb56.cloudfront.net (CloudFront)
x-amz-cf-id: eaKOokYsradQavd2CQRAmm8AgKHQkG88-mUwPPwq_1JAYXvhDuSm_A==
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
x-content-type-options: nosniff

GET
H2 200 current_with_info Show response
app.revv.co/api/v3/users/ 162 B
1 KB 163ms
116ms XHR
application/vnd.api+json 104.19.211.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.revv.co/api/v3/users/current_with_info?organization_token=rv_org_01h0fnp3d6597cwc8tt4vbst1j&redirect=https://secure.winred.com/desantis/october-eom-dtc?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com&amount=25

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/assets/application-landing-page-7ea440a608ae6761bd5abd3174137469ab09ceae7c9b01ceba0ceddb65802b52.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.211.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5506f280f34e259d4b40ccca649ca9d716d869ce6bfde09865ff4b4d982c717f

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://secure.winred.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-rack-cors-original-access-control-allow-origin: https://secure.winred.com
x-rack-cors: hit
date: Wed, 20 Dec 2023 02:10:01 GMT
x-rack-cors-original-access-control-max-age: 0
x-rack-cors-original-access-control-allow-credentials: true
strict-transport-security: max-age=0; includeSubDomains
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
content-encoding: br
x-rack-cors-original-access-control-allow-methods: GET, POST, OPTIONS
x-rack-cors-original-access-control-expose-headers
alt-svc: h3=":443"; ma=86400
x-request-id: 5918cae2-d8f3-44b9-99ea-0b5b1f40c377
x-runtime: 0.009893
server: cloudflare
etag: W/"5506f280f34e259d4b40ccca649ca9d7"
access-control-max-age: 0
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/vnd.api+json
access-control-allow-origin: https://secure.winred.com
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
vary: Origin
cf-ray: 838458b58f2c39f9-YYZ

GET
H3 200 rv_page_01hd1gx9bvcmr11759d0y20keb-967594731cd36d01bf413ef374bd239b4e986ea9 Show response
secure.winred.com/api/v3/donations/live/ 452 B
536 B 152ms
151ms XHR
application/json 104.19.212.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/api/v3/donations/live/rv_page_01hd1gx9bvcmr11759d0y20keb-967594731cd36d01bf413ef374bd239b4e986ea9?stream_id=1b920d3e4d4bfb6f4937c0056eb0d597cc0f2f01&_=1703038200888

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/assets/application-landing-page-7ea440a608ae6761bd5abd3174137469ab09ceae7c9b01ceba0ceddb65802b52.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.212.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

49bf463494cee8a6ce2cabefb62752db4089458d562533f9dfef404562f46159

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://secure.winred.com/desantis/october-eom-dtc?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com&amount=25
X-CSRF-Token: YX4qlSGi+unbV7TGo9HeP60yBOA7qk0B1jiqolLEl27p1ZDwVa+4K59FApEsL3xvXvpQCQd8K8Izu9oMFR8chA==
X-Requested-With: XMLHttpRequest
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-rack-cors: miss; no-origin
date: Wed, 20 Dec 2023 02:10:01 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: EXPIRED
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-request-id: 10af69c9-288c-4431-adcd-928ddfcdff6a
x-runtime: 0.010360
server: cloudflare
etag: W/"49bf463494cee8a6ce2cabefb62752db"
vary: Origin, Accept-Encoding
content-type: application/json
cache-control: public, max-age=60
cf-ray: 838458b54b3136fb-YYZ
expires: Wed, 20 Dec 2023 02:11:01 GMT

GET
H2 200 controller-b22056080a36e4a3571fab5c1e67752d.html Show response
js.stripe.com/v3/ Frame 1EFB 325 B
1 KB 37ms
36ms Document
text/html 52.85.151.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/controller-b22056080a36e4a3571fab5c1e67752d.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-117.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

8e51e1f02a3f6e08c6f9416d35f3d9d819844df7003128842d8ab0a86c6fa591

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://api.stripe.com https://merchant-ui-api.stripe.com https://stripe.com/cookie-settings/enforcement-mode https://errors.stripe.com https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src 'self'; img-src 'self' https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'sha256-0hAheEzaMe6uXIKV4EehS9pu1am1lj/KnnzrOYqckXk='; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 57
cache-control: max-age=60
content-length: 325
content-security-policy: base-uri 'none'; connect-src 'self' https://api.stripe.com https://merchant-ui-api.stripe.com https://stripe.com/cookie-settings/enforcement-mode https://errors.stripe.com https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src 'self'; img-src 'self' https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'sha256-0hAheEzaMe6uXIKV4EehS9pu1am1lj/KnnzrOYqckXk='; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Wed, 20 Dec 2023 02:09:05 GMT
etag: "b22056080a36e4a3571fab5c1e67752d"
last-modified: Tue, 19 Dec 2023 21:32:01 GMT
server: Cloudfront
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 2f66aa06710fece8ed203ab0ea81eb56.cloudfront.net (CloudFront)
x-amz-cf-id: RxvoJY6kW892zXAYIg70SlVGjxMZBiuOzeWC7QXI6CrGcMH0YO8H3A==
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
x-content-type-options: nosniff

GET
H2 200 payment-request-inner-google-pay-e2b1e542dbeb527e6471bb69e94e4f44.html Show response
js.stripe.com/v3/ Frame 3BEB 408 B
1 KB 37ms
36ms Document
text/html 52.85.151.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/payment-request-inner-google-pay-e2b1e542dbeb527e6471bb69e94e4f44.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-117.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

489b773ac98678bb44e4df929d85ec9f947d7c106f61c5cd2c399eea5e9ad532

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://r.stripe.com https://google.com/pay https://www.google.com/pay https://pay.google.com; default-src 'none'; form-action 'none'; frame-src https://pay.google.com; img-src https://q.stripe.com https://www.gstatic.com; script-src 'self' https://pay.google.com; style-src 'self'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 1459
cache-control: max-age=31536000
content-length: 408
content-security-policy: base-uri 'none'; connect-src 'self' https://r.stripe.com https://google.com/pay https://www.google.com/pay https://pay.google.com; default-src 'none'; form-action 'none'; frame-src https://pay.google.com; img-src https://q.stripe.com https://www.gstatic.com; script-src 'self' https://pay.google.com; style-src 'self'; report-uri https://q.stripe.com/csp-report
content-security-policy-report-only: base-uri 'none'; connect-src 'self' https://r.stripe.com https://google.com/pay https://www.google.com/pay https://pay.google.com; default-src 'none'; form-action 'none'; frame-src https://pay.google.com; img-src https://q.stripe.com https://www.gstatic.com; script-src 'self' https://pay.google.com; style-src 'self'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Wed, 20 Dec 2023 01:47:38 GMT
etag: "e2b1e542dbeb527e6471bb69e94e4f44"
last-modified: Tue, 19 Dec 2023 21:32:16 GMT
server: Cloudfront
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 2f66aa06710fece8ed203ab0ea81eb56.cloudfront.net (CloudFront)
x-amz-cf-id: 9R7LWheq4vbFycIk3vo8f6x9ABn7SCxx9b9Nc_wEQXdZDiQwX6zdcw==
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
x-content-type-options: nosniff

GET
H2 200 payment-request-inner-browser-ea22ca5912b348f7255859b7529cbbe7.html Show response
js.stripe.com/v3/ Frame 4F64 344 B
1 KB 40ms
39ms Document
text/html 52.85.151.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/payment-request-inner-browser-ea22ca5912b348f7255859b7529cbbe7.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-117.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

0d25c4a331e29f9f58c7ce60ab833ddf50b811453f867a608ddb2f8e6209c735

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://google.com/pay https://www.google.com/pay https://pay.google.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src 'self'; img-src 'self' https://q.stripe.com https://www.gstatic.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 8
cache-control: max-age=60
content-length: 344
content-security-policy: base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://google.com/pay https://www.google.com/pay https://pay.google.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src 'self'; img-src 'self' https://q.stripe.com https://www.gstatic.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://q.stripe.com/csp-report
content-security-policy-report-only: base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://google.com/pay https://www.google.com/pay https://pay.google.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src 'self'; img-src 'self' https://q.stripe.com https://www.gstatic.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Wed, 20 Dec 2023 02:09:58 GMT
etag: "ea22ca5912b348f7255859b7529cbbe7"
last-modified: Tue, 19 Dec 2023 21:32:16 GMT
server: Cloudfront
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 2f66aa06710fece8ed203ab0ea81eb56.cloudfront.net (CloudFront)
x-amz-cf-id: PeFDu_CgX8t1GrGTbxQCk6d-1kGG7diejP-K6pJm1U9PZWgqn3RI5w==
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
x-content-type-options: nosniff

GET
H2 200 jeD5dxpNSLo Show response
www.youtube.com/embed/ Frame EC09 94 KB
41 KB 192ms
116ms Document
text/html 142.251.111.190
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&&loop=1&mute=1&playlist=jeD5dxpNSLo

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/assets/application-landing-page-7ea440a608ae6761bd5abd3174137469ab09ceae7c9b01ceba0ceddb65802b52.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.111.190 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f190.1e100.net

Software

ESF /

Resource Hash

dcd19bf9d6bcb13c2ad6dec70c6ef1c1b7140844841861386e9bda8ab01354d0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: br
content-type: text/html; charset=utf-8
cross-origin-opener-policy-report-only: same-origin; report-to="youtube_main"
cross-origin-resource-policy: cross-origin
date: Wed, 20 Dec 2023 02:10:01 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
origin-trial: AvC9UlR6RDk2crliDsFl66RWLnTbHrDbp+DiY6AYz/PNQ4G4tdUTjrHYr2sghbkhGQAVxb7jaPTHpEVBz0uzQwkAAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTcxOTUzMjc5OSwiaXNTdWJkb21haW4iOnRydWV9
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
pragma: no-cache
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
server: ESF
strict-transport-security: max-age=31536000
vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 jeD5dxpNSLo Show response
www.youtube.com/embed/ Frame F1D8 94 KB
40 KB 250ms
176ms Document
text/html 142.251.111.190
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&autoplay=1&loop=1&mute=1&playlist=jeD5dxpNSLo

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/assets/application-landing-page-7ea440a608ae6761bd5abd3174137469ab09ceae7c9b01ceba0ceddb65802b52.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.111.190 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f190.1e100.net

Software

ESF /

Resource Hash

40e0c53b489189c78e3627ed75b55f4907f8a79bce8810e5a26949570436afbe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: br
content-type: text/html; charset=utf-8
cross-origin-opener-policy-report-only: same-origin; report-to="youtube_main"
cross-origin-resource-policy: cross-origin
date: Wed, 20 Dec 2023 02:10:01 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
origin-trial: AvC9UlR6RDk2crliDsFl66RWLnTbHrDbp+DiY6AYz/PNQ4G4tdUTjrHYr2sghbkhGQAVxb7jaPTHpEVBz0uzQwkAAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTcxOTUzMjc5OSwiaXNTdWJkb21haW4iOnRydWV9
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
pragma: no-cache
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
server: ESF
strict-transport-security: max-age=31536000
vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 statistics Show response
secure.winred.com/desantis/october-eom-dtc/forms/ 2 KB
1 KB 95ms
93ms XHR
text/html 104.19.212.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/desantis/october-eom-dtc/forms/statistics

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.212.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e14a21b6d0246e94147b907252730fae0af6ff98a7df478b1d632723e9f43127

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://secure.winred.com/desantis/october-eom-dtc?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com&amount=25
X-CSRF-Token: YX4qlSGi+unbV7TGo9HeP60yBOA7qk0B1jiqolLEl27p1ZDwVa+4K59FApEsL3xvXvpQCQd8K8Izu9oMFR8chA==
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-rack-cors: miss; no-origin
date: Wed, 20 Dec 2023 02:10:01 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
x-request-id: 6d466647-d8f0-4371-9c5c-8d4781337ae2
x-runtime: 0.013877
server: cloudflare
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/html; charset=utf-8
cache-control: max-age=0, private, must-revalidate
cf-ray: 838458b57b7436fb-YYZ

GET
H3

200

main.js Show response
secure.winred.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/ Frame EEDA
Redirect Chain

https://secure.winred.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://secure.winred.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/main.js

7 KB
3 KB

41ms
33ms

Script
application/javascript

104.19.212.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/main.js

Requested by

Protocol

Server

104.19.212.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9946c0ccba03ce2826e25d6e0588f95f202437f25d171747200bae7189f1a461

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 02:10:01 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
content-encoding: br
server: cloudflare
vary: accept-encoding
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
cf-ray: 838458b6ad6636fb-YYZ
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Wed, 20 Dec 2023 02:10:01 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
server: cloudflare
vary: accept-encoding
location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/main.js
access-control-allow-origin: *
cache-control: max-age=300, public
cf-ray: 838458b59b9036fb-YYZ
alt-svc: h3=":443"; ma=86400

GET
H3 200 gen_204 Show response
maps.googleapis.com/maps/api/mapsjs/ 3 B
45 B 134ms
46ms XHR
application/json 142.251.163.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f95.1e100.net

Software

scaffolding on HTTPServer2 /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 02:10:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://secure.winred.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23
x-xss-protection: 0

GET
H2 200 m-outer-6576085ca35ee42f2f484cda6763e4aa.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 157E 631 B
1 KB 45ms
38ms Script
text/javascript 52.85.151.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/m-outer-6576085ca35ee42f2f484cda6763e4aa.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/m-outer-27c67c0d52761104439bb051c7856ab1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-117.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

f0205495d259e89d99e6c4989147f8a65bef41513bfbe3e97251cd6fb6fa5947

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/m-outer-27c67c0d52761104439bb051c7856ab1.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 01:40:44 GMT
via: 1.1 2f66aa06710fece8ed203ab0ea81eb56.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=31556926; includeSubDomains; preload
age: 1758
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
content-length: 631
last-modified: Sat, 16 Dec 2023 02:01:35 GMT
server: Cloudfront
etag: "70cacf09ae81711ac6dcbc5ee59750c4"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: 0WbeKaoPh8RauVMzr1ZqzDQI79CAgQGdd2SvXKtO0-GMQGUIssHsxg==

GET
H2 200 shared-f5b29667107ca8f92f2c8276457cfdff.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 4553 547 KB
120 KB 45ms
39ms Script
text/javascript 52.85.151.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/controller-b22056080a36e4a3571fab5c1e67752d.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-117.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

8bac8b4fe50c6203069c3386d71372ae668bb603f67bdcaa707f87c90ba45739

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/controller-b22056080a36e4a3571fab5c1e67752d.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 01:34:45 GMT
content-encoding: br
via: 1.1 2f66aa06710fece8ed203ab0ea81eb56.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 2117
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Tue, 19 Dec 2023 21:32:14 GMT
server: Cloudfront
etag: W/"50ac79781b0db4dc8141ff8720f49193"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: TSN3VUABdpv3JxGB8qWUPZqIc7R1wZx1ibKFuCN5gFqSMcHbmd7r5Q==

GET
H2 200 controller-f62759b21e2473cf5b02604b425a3279.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 4553 676 KB
158 KB 55ms
49ms Script
text/javascript 52.85.151.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/controller-f62759b21e2473cf5b02604b425a3279.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/controller-b22056080a36e4a3571fab5c1e67752d.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-117.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

94813a1029ba0435792d5e565dd27fbfde8a18f03e46082b44b7a77b679142a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/controller-b22056080a36e4a3571fab5c1e67752d.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 01:34:45 GMT
content-encoding: br
via: 1.1 2f66aa06710fece8ed203ab0ea81eb56.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 2117
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Tue, 19 Dec 2023 21:32:12 GMT
server: Cloudfront
etag: W/"f1eb676b9a3ffe6fea0cc16cc578f673"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: GC8RML1ezTx_37zutJ6lhOQGcTNEsfBlD9pySq8S3sBCmZDzq_xA-w==

GET
H2 200 shared-f5b29667107ca8f92f2c8276457cfdff.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 0B15 547 KB
120 KB 73ms
69ms Script
text/javascript 52.85.151.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-card-4f22a78d7e8a5e7d999d864bb3c9d998.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-117.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

8bac8b4fe50c6203069c3386d71372ae668bb603f67bdcaa707f87c90ba45739

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-card-4f22a78d7e8a5e7d999d864bb3c9d998.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 01:34:45 GMT
content-encoding: br
via: 1.1 2f66aa06710fece8ed203ab0ea81eb56.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 2117
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Tue, 19 Dec 2023 21:32:14 GMT
server: Cloudfront
etag: W/"50ac79781b0db4dc8141ff8720f49193"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: FQj5jj7PlOWaJ0v8UwKCUIzoUg6hDDvwlz-O61ozrSDyYSzcZyT2Cw==

GET
H2 200 ui-shared-b9c34d762c7dbd21b5b339f15f5f8aaa.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 0B15 390 KB
108 KB 95ms
91ms Script
text/javascript 52.85.151.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/ui-shared-b9c34d762c7dbd21b5b339f15f5f8aaa.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-card-4f22a78d7e8a5e7d999d864bb3c9d998.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-117.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

fe3fd5bf597db84d64ede28fec7e1787f6cc2b23108969cf42ca92e5df10b26f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-card-4f22a78d7e8a5e7d999d864bb3c9d998.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 01:35:22 GMT
content-encoding: gzip
via: 1.1 2f66aa06710fece8ed203ab0ea81eb56.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 2107
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Tue, 19 Dec 2023 21:32:15 GMT
server: Cloudfront
etag: W/"cc9fc2eeeed137b041213a9d8d973f4e"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: aHSZz_6we04BH1BmgEBbbK3-r4Cy5oJC0__PKvw0I2nqHfVf5WVGEA==

GET
H2 200 elements-inner-card-54e255e978c748cd44e29816f3f8bdf5.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 0B15 52 KB
13 KB 87ms
77ms Script
text/javascript 52.85.151.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/elements-inner-card-54e255e978c748cd44e29816f3f8bdf5.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-card-4f22a78d7e8a5e7d999d864bb3c9d998.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-117.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

af8e10cdb4b569a5390d0a327e1bee275bc43980adf821d4ea5e5276b70de92e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-card-4f22a78d7e8a5e7d999d864bb3c9d998.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 02:06:58 GMT
content-encoding: br
via: 1.1 2f66aa06710fece8ed203ab0ea81eb56.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 188
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Tue, 19 Dec 2023 18:03:41 GMT
server: Cloudfront
etag: W/"487dc57666385099983af7570d46c131"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: hG3O5lqBQw7iK8aKPQsToneRqcQmxO3Vn_lTTMIcZMkKXgxBGUIRCQ==

GET
H2 200 ui-shared-1d27f4e2b314637ba4bb9d7ff79c23c7.css
js.stripe.com/v3/fingerprinted/css/ Frame 0B15 20 KB
3 KB 70ms
66ms Stylesheet
text/css 52.85.151.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/css/ui-shared-1d27f4e2b314637ba4bb9d7ff79c23c7.css

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-card-4f22a78d7e8a5e7d999d864bb3c9d998.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-117.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

394724ca0118829643c12fb5a033cb66680e51327ba157677d18dec209278a3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-card-4f22a78d7e8a5e7d999d864bb3c9d998.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 02:02:46 GMT
content-encoding: br
via: 1.1 2f66aa06710fece8ed203ab0ea81eb56.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 440
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Sat, 16 Dec 2023 02:01:23 GMT
server: Cloudfront
etag: W/"b361d7109e9925ca18e32c9da528520f"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: xLtgYozS_mTljjr5l1MkbWof6bOxQ8Bm6ePzxlgWZCNSSRVFkS7NHg==

GET
H2 200 elements-inner-card-efe1765a974efe6433f55f443e85c0d4.css
js.stripe.com/v3/fingerprinted/css/ Frame 0B15 14 KB
2 KB 71ms
68ms Stylesheet
text/css 52.85.151.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/css/elements-inner-card-efe1765a974efe6433f55f443e85c0d4.css

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-card-4f22a78d7e8a5e7d999d864bb3c9d998.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-117.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

33111c5d00b2e2e4e89f17402709ba30a1563e8c4d2fa93cf5756b44c7d1ee97

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-card-4f22a78d7e8a5e7d999d864bb3c9d998.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 01:19:14 GMT
content-encoding: br
via: 1.1 2f66aa06710fece8ed203ab0ea81eb56.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 3050
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Mon, 18 Dec 2023 21:16:55 GMT
server: Cloudfront
etag: W/"8385166c06e8d209fc459b542697c4fb"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: Ku2bpf4MJ8ISIqm9NhGT7tq1iOyv0luQtOkQ8NaTUX2HXdLGd42SyQ==

POST
H2 204 collect
www.google-analytics.com/g/ 0
172 B 67ms
36ms Ping
text/plain 142.251.16.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-LDP16YY77N&gtm=45je3bt0v9118533250z89118299598&_p=1703038200651&gcd=11l1l1l1l1&dma=0&cid=270181744.1703038201&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1703038201&sct=1&seg=0&dl=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Foctober-eom-dtc%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com%26amount%3D25&dt=Support%20Ron%20DeSantis!&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=1076
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-LDP16YY77N&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.16.138 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bl-in-f138.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Dec 2023 02:10:01 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 shared-f5b29667107ca8f92f2c8276457cfdff.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 1EFB 547 KB
120 KB 70ms
43ms Script
text/javascript 52.85.151.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/controller-b22056080a36e4a3571fab5c1e67752d.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-117.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

8bac8b4fe50c6203069c3386d71372ae668bb603f67bdcaa707f87c90ba45739

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/controller-b22056080a36e4a3571fab5c1e67752d.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 01:34:45 GMT
content-encoding: br
via: 1.1 2f66aa06710fece8ed203ab0ea81eb56.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 2117
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Tue, 19 Dec 2023 21:32:14 GMT
server: Cloudfront
etag: W/"50ac79781b0db4dc8141ff8720f49193"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: ZI6U2oedZfKwrc0zcFCWYfoYPHm9D8GgFKjVPRFCLlR9zYGvJChwog==

GET
H2 200 controller-f62759b21e2473cf5b02604b425a3279.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 1EFB 676 KB
158 KB 83ms
57ms Script
text/javascript 52.85.151.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/controller-f62759b21e2473cf5b02604b425a3279.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/controller-b22056080a36e4a3571fab5c1e67752d.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-117.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

94813a1029ba0435792d5e565dd27fbfde8a18f03e46082b44b7a77b679142a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/controller-b22056080a36e4a3571fab5c1e67752d.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 01:34:45 GMT
content-encoding: br
via: 1.1 2f66aa06710fece8ed203ab0ea81eb56.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 2117
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Tue, 19 Dec 2023 21:32:12 GMT
server: Cloudfront
etag: W/"f1eb676b9a3ffe6fea0cc16cc578f673"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: LLe6vlV5H9u2BTEWXr1JuFqvqdVpsUxz_KE9yQlckBMNm5p8dNtyXg==

GET
H2 200 pay.js Show response
pay.google.com/gp/p/js/ Frame 3BEB 120 KB
37 KB 159ms
58ms Script
application/javascript 142.251.16.92
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pay.google.com/gp/p/js/pay.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/payment-request-inner-google-pay-e2b1e542dbeb527e6471bb69e94e4f44.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.92 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f92.1e100.net

Software

ESF /

Resource Hash

f29af0f45d2483d7b111bf75d2962e7d0a14ef3214068e7d334c09c4620379d3

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-gqaj8O8gSNFN12xQ6FnUdQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendHttp/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 02:10:01 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-gqaj8O8gSNFN12xQ6FnUdQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendHttp/cspreport
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: private, max-age=600
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Wed, 20 Dec 2023 02:10:01 GMT

GET
H2 200 shared-f5b29667107ca8f92f2c8276457cfdff.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 3BEB 547 KB
120 KB 100ms
80ms Script
text/javascript 52.85.151.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/payment-request-inner-google-pay-e2b1e542dbeb527e6471bb69e94e4f44.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-117.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

8bac8b4fe50c6203069c3386d71372ae668bb603f67bdcaa707f87c90ba45739

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/payment-request-inner-google-pay-e2b1e542dbeb527e6471bb69e94e4f44.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 01:34:45 GMT
content-encoding: br
via: 1.1 2f66aa06710fece8ed203ab0ea81eb56.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 2117
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Tue, 19 Dec 2023 21:32:14 GMT
server: Cloudfront
etag: W/"50ac79781b0db4dc8141ff8720f49193"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: I0u_SDe545Y0yo3WPzlr4mCfoxKW4Tqnb4m0dyB37Ynn9khVV15fIg==

GET
H2 200 payment-request-inner-google-pay-1b45f612f257d79a025cebe850464b33.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 3BEB 12 KB
5 KB 40ms
35ms Script
text/javascript 52.85.151.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/payment-request-inner-google-pay-1b45f612f257d79a025cebe850464b33.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/payment-request-inner-google-pay-e2b1e542dbeb527e6471bb69e94e4f44.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-117.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

a66c306af34cd3884a07a3c67d4ce9cf1fa7b044b493b2ceec049ad9c275b3e5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/payment-request-inner-google-pay-e2b1e542dbeb527e6471bb69e94e4f44.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 01:35:44 GMT
content-encoding: br
via: 1.1 2f66aa06710fece8ed203ab0ea81eb56.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 2102
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Tue, 19 Dec 2023 21:32:14 GMT
server: Cloudfront
etag: W/"bd523efff51b47c48ac1d0ad0e31d3e9"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: FAngA1ZRJrP64izspTaWx8Nk1IsS3qaMB7y-xTLRHQhQbSmUVGgBFg==

GET
H2 200 shared-f5b29667107ca8f92f2c8276457cfdff.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 4F64 547 KB
120 KB 90ms
70ms Script
text/javascript 52.85.151.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/payment-request-inner-browser-ea22ca5912b348f7255859b7529cbbe7.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-117.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

8bac8b4fe50c6203069c3386d71372ae668bb603f67bdcaa707f87c90ba45739

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/payment-request-inner-browser-ea22ca5912b348f7255859b7529cbbe7.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 01:34:45 GMT
content-encoding: br
via: 1.1 2f66aa06710fece8ed203ab0ea81eb56.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 2117
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Tue, 19 Dec 2023 21:32:14 GMT
server: Cloudfront
etag: W/"50ac79781b0db4dc8141ff8720f49193"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: rUwOW-Im3WVRvwXFBSgP3JuWDtx4ZMNR0OLQTLvfEP_5n9XS6hdUpQ==

GET
H2 200 payment-request-inner-browser-5d87d6e9e6b257fde11c15ba4e465e7e.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 4F64 13 KB
6 KB 89ms
69ms Script
text/javascript 52.85.151.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/payment-request-inner-browser-5d87d6e9e6b257fde11c15ba4e465e7e.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/payment-request-inner-browser-ea22ca5912b348f7255859b7529cbbe7.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-117.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

52f33e9ac679336b5d8f6ce2dee339772a1b6f628346a6a09f20d3f4031db342

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/payment-request-inner-browser-ea22ca5912b348f7255859b7529cbbe7.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 02:06:26 GMT
content-encoding: br
via: 1.1 2f66aa06710fece8ed203ab0ea81eb56.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 230
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Tue, 19 Dec 2023 18:03:43 GMT
server: Cloudfront
etag: W/"c01cdf32a7a8473a8ff4eb309326fe57"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: 5TUJf-fvWWCJ2u7n-vC7EhubjqhfqfM8h3QKICZCdppUcMcNbkdqWQ==

POST
H2 200 csp-report
q.stripe.com/ Frame 157E 0
717 B 398ms
153ms Other
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Wed, 20 Dec 2023 02:10:01 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1703038201723873
x-envoy-upstream-service-time: 1
content-length: 0
x-stripe-bg-intended-route-color: green
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
cross-origin-opener-policy: same-origin
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
x-stripe-server-envoy-upstream-service-time-ms: 0
access-control-allow-origin: https://js.stripe.com
x-stripe-client-envoy-start-time-us: 1703038201723446
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-expose-headers: Server, Range, Content-Type
x-robots-tag: none
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires: 0

POST
H2 200 csp-report
q.stripe.com/ Frame 157E 0
716 B 395ms
150ms Other
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Wed, 20 Dec 2023 02:10:01 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1703038201720660
x-envoy-upstream-service-time: 2
content-length: 0
x-stripe-bg-intended-route-color: green
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
cross-origin-opener-policy: same-origin
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
x-stripe-server-envoy-upstream-service-time-ms: 0
access-control-allow-origin: https://js.stripe.com
x-stripe-client-envoy-start-time-us: 1703038201719746
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-expose-headers: Server, Range, Content-Type
x-robots-tag: none
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires: 0

POST
H2 200 csp-report
q.stripe.com/ Frame 4553 0
715 B 372ms
133ms Other
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Wed, 20 Dec 2023 02:10:01 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1703038201703032
x-envoy-upstream-service-time: 1
content-length: 0
x-stripe-bg-intended-route-color: green
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
cross-origin-opener-policy: same-origin
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
x-stripe-server-envoy-upstream-service-time-ms: 0
access-control-allow-origin: https://js.stripe.com
x-stripe-client-envoy-start-time-us: 1703038201702607
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-expose-headers: Server, Range, Content-Type
x-robots-tag: none
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires: 0

POST
H2 200 csp-report
q.stripe.com/ Frame 0B15 0
715 B 388ms
151ms Other
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Wed, 20 Dec 2023 02:10:01 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1703038201720191
x-envoy-upstream-service-time: 2
content-length: 0
x-stripe-bg-intended-route-color: green
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
cross-origin-opener-policy: same-origin
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
x-stripe-server-envoy-upstream-service-time-ms: 1
access-control-allow-origin: https://js.stripe.com
x-stripe-client-envoy-start-time-us: 1703038201719701
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-expose-headers: Server, Range, Content-Type
x-robots-tag: none
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires: 0

POST
H2 200 csp-report
q.stripe.com/ Frame 0B15 0
716 B 390ms
154ms Other
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Wed, 20 Dec 2023 02:10:01 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1703038201723907
x-envoy-upstream-service-time: 2
content-length: 0
x-stripe-bg-intended-route-color: green
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
cross-origin-opener-policy: same-origin
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
x-stripe-server-envoy-upstream-service-time-ms: 0
access-control-allow-origin: https://js.stripe.com
x-stripe-client-envoy-start-time-us: 1703038201723467
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-expose-headers: Server, Range, Content-Type
x-robots-tag: none
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires: 0

GET
H3 200 icon-green-check-ce91de8dcac5d728e03301c9c9180eb5efd9b773ddd5a1aff80c073685041148.png
secure.winred.com/assets/ 1 KB
2 KB 70ms
66ms Image
image/webp 104.19.212.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.winred.com/assets/icon-green-check-ce91de8dcac5d728e03301c9c9180eb5efd9b773ddd5a1aff80c073685041148.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.212.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

be9f065a43d459c32530d9b8b1f0e2ec2af9cc052e1a2086a043bab1227fcb8b

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/desantis/october-eom-dtc?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com&amount=25
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 02:10:01 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
x-amz-version-id: b8ABM6rFCkpk.96BrJUrpMqbGaICSzna
cf-cache-status: HIT
x-amz-request-id: NHFPTQ9CM70PQPRS
age: 3977
cf-polished: origFmt=png, origSize=3273
content-disposition: inline; filename="icon-green-check-ce91de8dcac5d728e03301c9c9180eb5efd9b773ddd5a1aff80c073685041148.webp"
alt-svc: h3=":443"; ma=86400
content-length: 1172
x-amz-id-2: w09uCdELVInrhuN5dQvROYJZMqWYM/TMXtziaGhMNBBIP8f6Pwh1IJ754LAkyqC/ZKrF30sJbkI=
cf-bgj: imgq:85,h2pri
last-modified: Tue, 28 Nov 2023 01:42:35 GMT
server: cloudflare
etag: "2d1eeac16570b4e28aa71fe31761ee12"
vary: Accept
content-type: image/webp
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 838458b6bd7636fb-YYZ
expires: Wed, 20 Dec 2023 06:10:01 GMT

POST
H2 200 csp-report
q.stripe.com/ Frame 1EFB 0
715 B 372ms
151ms Other
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Wed, 20 Dec 2023 02:10:01 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1703038201720754
x-envoy-upstream-service-time: 2
content-length: 0
x-stripe-bg-intended-route-color: green
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
cross-origin-opener-policy: same-origin
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
x-stripe-server-envoy-upstream-service-time-ms: 0
access-control-allow-origin: https://js.stripe.com
x-stripe-client-envoy-start-time-us: 1703038201719716
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-expose-headers: Server, Range, Content-Type
x-robots-tag: none
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires: 0

POST
H2 200 csp-report
q.stripe.com/ Frame 3BEB 0
715 B 351ms
132ms Other
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Wed, 20 Dec 2023 02:10:01 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1703038201702952
x-envoy-upstream-service-time: 1
content-length: 0
x-stripe-bg-intended-route-color: green
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
cross-origin-opener-policy: same-origin
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
x-stripe-server-envoy-upstream-service-time-ms: 1
access-control-allow-origin: https://js.stripe.com
x-stripe-client-envoy-start-time-us: 1703038201702603
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-expose-headers: Server, Range, Content-Type
x-robots-tag: none
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires: 0

POST
H2 200 csp-report
q.stripe.com/ Frame 3BEB 0
717 B 317ms
98ms Other
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Wed, 20 Dec 2023 02:10:01 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1703038201669231
x-envoy-upstream-service-time: 1
content-length: 0
x-stripe-bg-intended-route-color: green
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
cross-origin-opener-policy: same-origin
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
x-stripe-server-envoy-upstream-service-time-ms: 0
access-control-allow-origin: https://js.stripe.com
x-stripe-client-envoy-start-time-us: 1703038201668970
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-expose-headers: Server, Range, Content-Type
x-robots-tag: none
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires: 0

POST
H2 200 csp-report
q.stripe.com/ Frame 4F64 0
715 B 348ms
131ms Other
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Wed, 20 Dec 2023 02:10:01 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1703038201702956
x-envoy-upstream-service-time: 1
content-length: 0
x-stripe-bg-intended-route-color: green
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
cross-origin-opener-policy: same-origin
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
x-stripe-server-envoy-upstream-service-time-ms: 0
access-control-allow-origin: https://js.stripe.com
x-stripe-client-envoy-start-time-us: 1703038201702619
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-expose-headers: Server, Range, Content-Type
x-robots-tag: none
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires: 0

POST
H2 200 csp-report
q.stripe.com/ Frame 4F64 0
715 B 363ms
147ms Other
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Wed, 20 Dec 2023 02:10:01 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1703038201703270
x-envoy-upstream-service-time: 1
content-length: 0
x-stripe-bg-intended-route-color: green
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
cross-origin-opener-policy: same-origin
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
x-stripe-server-envoy-upstream-service-time-ms: 0
access-control-allow-origin: https://js.stripe.com
x-stripe-client-envoy-start-time-us: 1703038201702592
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-expose-headers: Server, Range, Content-Type
x-robots-tag: none
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires: 0

GET
H2

200

/
www.google.ca/pagead/1p-conversion/11188077750/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11188077750/?random=893379787&cv=11&fst=1703038200977&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=160...
https://www.google.com/pagead/1p-conversion/11188077750/?random=893379787&cv=11&fst=1703038200977&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%...
https://www.google.ca/pagead/1p-conversion/11188077750/?random=893379787&cv=11&fst=1703038200977&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3...

42 B
154 B

938ms
51ms

Image
image/gif

142.251.179.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-conversion/11188077750/?random=893379787&cv=11&fst=1703038200977&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Foctober-eom-dtc%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com%26amount%3D25&label=tNBiCNPx_KIYELaJ8tYp&hn=www.googleadservices.com&frm=0&tiba=Support%20Ron%20DeSantis!&value=0&auid=1525999704.1703038201&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek5DaEFJZ0p1RnJBWVFxczZHc04tS2g4dG9FaVlBaUQwSi1ldzl2MklHQ2owRVBlOU9mRXdteUI0dVFycWNrcC1mN2tiT3ZGTXBrc3NtN3caWkNoRUlnSnVGckFZUXpLRGJzNVdJeWZLdkFSSXVBUHBDa1NfZi16RWJSRFJCeWNrU2I0MVlMeWc4VGQzN2VlcTBsSjJtTEgxckd4bzhJOFJWQzdnTFdNT01HZyITCK3Pjtj3nIMDFfAKaAgdKagAPw&is_vtc=1&ocp_id=-UyCZe3uBPCVoPMPqdCC-AM&cid=CAQSGwAvHhf_RaYewoE2aI0O476143j2stiurE4VnQ&eitems=ChEIgJuFrAYQsaWC8uL41eLTARIdAOBcHGftK1eFtGojeAADrhOYU2Y80YZ9zoMRPGU&random=2026676161&ipr=y&ezwbk=AZuM4hDAcXf1JlNwyfWq_zkiFiMSA66zQFz0aY28_wQinSopqDakTPfjH5dVKKtYfRFcLu0W17CYiZKXQI7aCOTMSFsr

Requested by

Protocol

Server

142.251.179.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

pd-in-f94.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Dec 2023 02:10:03 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 20 Dec 2023 02:10:02 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://www.google.ca/pagead/1p-conversion/11188077750/?random=893379787&cv=11&fst=1703038200977&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Foctober-eom-dtc%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com%26amount%3D25&label=tNBiCNPx_KIYELaJ8tYp&hn=www.googleadservices.com&frm=0&tiba=Support%20Ron%20DeSantis!&value=0&auid=1525999704.1703038201&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek5DaEFJZ0p1RnJBWVFxczZHc04tS2g4dG9FaVlBaUQwSi1ldzl2MklHQ2owRVBlOU9mRXdteUI0dVFycWNrcC1mN2tiT3ZGTXBrc3NtN3caWkNoRUlnSnVGckFZUXpLRGJzNVdJeWZLdkFSSXVBUHBDa1NfZi16RWJSRFJCeWNrU2I0MVlMeWc4VGQzN2VlcTBsSjJtTEgxckd4bzhJOFJWQzdnTFdNT01HZyITCK3Pjtj3nIMDFfAKaAgdKagAPw&is_vtc=1&ocp_id=-UyCZe3uBPCVoPMPqdCC-AM&cid=CAQSGwAvHhf_RaYewoE2aI0O476143j2stiurE4VnQ&eitems=ChEIgJuFrAYQsaWC8uL41eLTARIdAOBcHGftK1eFtGojeAADrhOYU2Y80YZ9zoMRPGU&random=2026676161&ipr=y&ezwbk=AZuM4hDAcXf1JlNwyfWq_zkiFiMSA66zQFz0aY28_wQinSopqDakTPfjH5dVKKtYfRFcLu0W17CYiZKXQI7aCOTMSFsr
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.ca/pagead/1p-conversion/11263458299/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11263458299/?random=340129217&cv=11&fst=1703038200993&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=160...
https://www.google.com/pagead/1p-conversion/11263458299/?random=340129217&cv=11&fst=1703038200993&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%...
https://www.google.ca/pagead/1p-conversion/11263458299/?random=340129217&cv=11&fst=1703038200993&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3...

42 B
108 B

940ms
53ms

Image
image/gif

142.251.179.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-conversion/11263458299/?random=340129217&cv=11&fst=1703038200993&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Foctober-eom-dtc%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com%26amount%3D25&label=e3Q7CJi9neAYEPv36vop&hn=www.googleadservices.com&frm=0&tiba=Support%20Ron%20DeSantis!&value=0&auid=1525999704.1703038201&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek5DaEFJZ0p1RnJBWVFxczZHc04tS2g4dG9FaVlBaUQwSi1ldzl2MklHQ2owRVBlOU9mRXdteUI0dVFycWNrcC1mN2tiT3ZGTXBrc3NtN3caWkNoRUlnSnVGckFZUXpLRGJzNVdJeWZLdkFSSXVBUHBDa1M4Zmw3N09mZ0xDSzdxV3poWVBoeGJCeW5mbVpMaDNHVXFNWDNxSGVTRGx2NHYxUGd4NExBV1JKZyITCJfSjtj3nIMDFTQbaAgdflADLw&is_vtc=1&ocp_id=-UyCZdfxBLS2oPMP_qCN-AI&cid=CAQSGwAvHhf_8dMlxBRs3HJ0Pnna6yLI3dUEveBvJg&eitems=ChEIgJuFrAYQsaWC8uL41eLTARIdAOBcHGeUqv_kVMf-_eyZ-nH0x05SvxAspsK6S0E&random=171321602&ipr=y&ezwbk=AZuM4hCz9OrCWZ04AEiizdnEgi2g-ncVwZpfp_ant36pmeIyPfo85SF1yYuQSqoroKQ1CsMSWv85Su_sp20559X_tGSB

Requested by

Protocol

Server

142.251.179.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

pd-in-f94.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Dec 2023 02:10:03 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 20 Dec 2023 02:10:02 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://www.google.ca/pagead/1p-conversion/11263458299/?random=340129217&cv=11&fst=1703038200993&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Foctober-eom-dtc%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com%26amount%3D25&label=e3Q7CJi9neAYEPv36vop&hn=www.googleadservices.com&frm=0&tiba=Support%20Ron%20DeSantis!&value=0&auid=1525999704.1703038201&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek5DaEFJZ0p1RnJBWVFxczZHc04tS2g4dG9FaVlBaUQwSi1ldzl2MklHQ2owRVBlOU9mRXdteUI0dVFycWNrcC1mN2tiT3ZGTXBrc3NtN3caWkNoRUlnSnVGckFZUXpLRGJzNVdJeWZLdkFSSXVBUHBDa1M4Zmw3N09mZ0xDSzdxV3poWVBoeGJCeW5mbVpMaDNHVXFNWDNxSGVTRGx2NHYxUGd4NExBV1JKZyITCJfSjtj3nIMDFTQbaAgdflADLw&is_vtc=1&ocp_id=-UyCZdfxBLS2oPMP_qCN-AI&cid=CAQSGwAvHhf_8dMlxBRs3HJ0Pnna6yLI3dUEveBvJg&eitems=ChEIgJuFrAYQsaWC8uL41eLTARIdAOBcHGeUqv_kVMf-_eyZ-nH0x05SvxAspsK6S0E&random=171321602&ipr=y&ezwbk=AZuM4hCz9OrCWZ04AEiizdnEgi2g-ncVwZpfp_ant36pmeIyPfo85SF1yYuQSqoroKQ1CsMSWv85Su_sp20559X_tGSB
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.ca/pagead/1p-conversion/11198202606/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11198202606/?random=290248036&cv=11&fst=1703038200985&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=160...
https://www.google.com/pagead/1p-conversion/11198202606/?random=290248036&cv=11&fst=1703038200985&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%...
https://www.google.ca/pagead/1p-conversion/11198202606/?random=290248036&cv=11&fst=1703038200985&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3...

42 B
108 B

942ms
55ms

Image
image/gif

142.251.179.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-conversion/11198202606/?random=290248036&cv=11&fst=1703038200985&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Foctober-eom-dtc%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com%26amount%3D25&label=M51RCOmQgKgYEO6F3Nsp&hn=www.googleadservices.com&frm=0&tiba=Support%20Ron%20DeSantis!&value=0&auid=1525999704.1703038201&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek5DaEFJZ0p1RnJBWVFxczZHc04tS2g4dG9FaVlBaUQwSi1ldzl2MklHQ2owRVBlOU9mRXdteUI0dVFycWNrcC1mN2tiT3ZGTXBrc3NtN3caWkNoRUlnSnVGckFZUXpLRGJzNVdJeWZLdkFSSXVBUHBDa1M4YWtuR2cxSEJxYkZsbWVFZmFIbXNXa2JLZTF2TDJxLW1XcndLaUw2ajBBSkt4QUR5UTE2MF9EUSITCOOUj9j3nIMDFY4gaAgdAz4Ohw&is_vtc=1&ocp_id=-UyCZaO0BY7BoPMPg_y4uAg&cid=CAQSGwAvHhf_tLWyXaJ3vFxbHXczcsLESnexQuscpQ&eitems=ChEIgJuFrAYQsaWC8uL41eLTARIdAOBcHGdIZGR3WAd7IXDsi1XRsHUgkYwHQkROgqw&random=1341597385&ipr=y&ezwbk=AZuM4hAGF944gcyrUOZCfgcX229b82K1MLGfQ_cgPgX53FPVFGWw5HC6u3IAAWp8F-7LJyPXVtpBfAlOKD8nSPQr3XJK

Requested by

Protocol

Server

142.251.179.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

pd-in-f94.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Dec 2023 02:10:03 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 20 Dec 2023 02:10:02 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://www.google.ca/pagead/1p-conversion/11198202606/?random=290248036&cv=11&fst=1703038200985&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Foctober-eom-dtc%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com%26amount%3D25&label=M51RCOmQgKgYEO6F3Nsp&hn=www.googleadservices.com&frm=0&tiba=Support%20Ron%20DeSantis!&value=0&auid=1525999704.1703038201&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek5DaEFJZ0p1RnJBWVFxczZHc04tS2g4dG9FaVlBaUQwSi1ldzl2MklHQ2owRVBlOU9mRXdteUI0dVFycWNrcC1mN2tiT3ZGTXBrc3NtN3caWkNoRUlnSnVGckFZUXpLRGJzNVdJeWZLdkFSSXVBUHBDa1M4YWtuR2cxSEJxYkZsbWVFZmFIbXNXa2JLZTF2TDJxLW1XcndLaUw2ajBBSkt4QUR5UTE2MF9EUSITCOOUj9j3nIMDFY4gaAgdAz4Ohw&is_vtc=1&ocp_id=-UyCZaO0BY7BoPMPg_y4uAg&cid=CAQSGwAvHhf_tLWyXaJ3vFxbHXczcsLESnexQuscpQ&eitems=ChEIgJuFrAYQsaWC8uL41eLTARIdAOBcHGdIZGR3WAd7IXDsi1XRsHUgkYwHQkROgqw&random=1341597385&ipr=y&ezwbk=AZuM4hAGF944gcyrUOZCfgcX229b82K1MLGfQ_cgPgX53FPVFGWw5HC6u3IAAWp8F-7LJyPXVtpBfAlOKD8nSPQr3XJK
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adsct
t.co/1/i/ 43 B
203 B 3292ms
150ms Image
image/gif 104.244.42.197
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=5d2afeb9-fa44-4d80-9032-ffa52efb61c4&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=a5ceb3f7-c82a-46c8-b813-b97c785da2cc&tw_document_href=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Foctober-eom-dtc%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com%26amount%3D25&tw_iframe_status=0&txn_id=of5mh&type=javascript&version=2.3.29

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.197 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-response-time: 85
date: Wed, 20 Dec 2023 02:10:04 GMT
strict-transport-security: max-age=0
server: tsa_b
content-type: image/gif;charset=utf-8
x-transaction-id: 2cae013999d30ce2
cache-control: no-cache, no-store, max-age=0
perf: 7469935968
x-connection-hash: c1de942ecb8564f5557eaf48fc74fc319e326dcd880d0163c96977fd67e9c593
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/1/i/ 43 B
543 B 3345ms
142ms Image
image/gif 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=5d2afeb9-fa44-4d80-9032-ffa52efb61c4&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=a5ceb3f7-c82a-46c8-b813-b97c785da2cc&tw_document_href=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Foctober-eom-dtc%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com%26amount%3D25&tw_iframe_status=0&txn_id=of5mh&type=javascript&version=2.3.29

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-response-time: 75
date: Wed, 20 Dec 2023 02:10:04 GMT
strict-transport-security: max-age=631138519
server: tsa_b
content-type: image/gif;charset=utf-8
x-transaction-id: 6116b96393c7e46f
cache-control: no-cache, no-store, max-age=0
perf: 7469935968
x-connection-hash: d8098e18fba40844f74260b50d8349d78a0fb298c56bd0f9268a5067df32da99
content-length: 43

GET
H2 200 adsct
t.co/1/i/ 43 B
377 B 3216ms
75ms Image
image/gif 104.244.42.197
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=e541bcae-ddf5-4ed5-9896-b72a3c1ef8fb&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=a5ceb3f7-c82a-46c8-b813-b97c785da2cc&tw_document_href=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Foctober-eom-dtc%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com%26amount%3D25&tw_iframe_status=0&txn_id=ofi0u&type=javascript&version=2.3.29

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.197 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-response-time: 5
date: Wed, 20 Dec 2023 02:10:04 GMT
strict-transport-security: max-age=0
server: tsa_b
content-type: image/gif;charset=utf-8
x-transaction-id: 45b3079102817c95
cache-control: no-cache, no-store, max-age=0
perf: 7469935968
x-connection-hash: c1de942ecb8564f5557eaf48fc74fc319e326dcd880d0163c96977fd67e9c593
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/1/i/ 43 B
544 B 3274ms
71ms Image
image/gif 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=e541bcae-ddf5-4ed5-9896-b72a3c1ef8fb&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=a5ceb3f7-c82a-46c8-b813-b97c785da2cc&tw_document_href=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Foctober-eom-dtc%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com%26amount%3D25&tw_iframe_status=0&txn_id=ofi0u&type=javascript&version=2.3.29

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-response-time: 7
date: Wed, 20 Dec 2023 02:10:04 GMT
strict-transport-security: max-age=631138519
server: tsa_b
content-type: image/gif;charset=utf-8
x-transaction-id: 307a42f2fd1a4676
cache-control: no-cache, no-store, max-age=0
perf: 7469935968
x-connection-hash: d8098e18fba40844f74260b50d8349d78a0fb298c56bd0f9268a5067df32da99
content-length: 43

GET
H2 200 adsct
t.co/1/i/ 43 B
204 B 3285ms
143ms Image
image/gif 104.244.42.197
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=a715029d-9d47-4a19-b444-e93a660c8c1a&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=a5ceb3f7-c82a-46c8-b813-b97c785da2cc&tw_document_href=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Foctober-eom-dtc%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com%26amount%3D25&tw_iframe_status=0&txn_id=ofi14&type=javascript&version=2.3.29

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.197 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-response-time: 79
date: Wed, 20 Dec 2023 02:10:04 GMT
strict-transport-security: max-age=0
server: tsa_b
content-type: image/gif;charset=utf-8
x-transaction-id: c915fd9a7e142fc3
cache-control: no-cache, no-store, max-age=0
perf: 7469935968
x-connection-hash: c1de942ecb8564f5557eaf48fc74fc319e326dcd880d0163c96977fd67e9c593
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/1/i/ 43 B
723 B 3272ms
70ms Image
image/gif 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=a715029d-9d47-4a19-b444-e93a660c8c1a&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=a5ceb3f7-c82a-46c8-b813-b97c785da2cc&tw_document_href=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Foctober-eom-dtc%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com%26amount%3D25&tw_iframe_status=0&txn_id=ofi14&type=javascript&version=2.3.29

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-response-time: 5
date: Wed, 20 Dec 2023 02:10:04 GMT
strict-transport-security: max-age=631138519
server: tsa_b
content-type: image/gif;charset=utf-8
x-transaction-id: ad5fd72361451206
cache-control: no-cache, no-store, max-age=0
perf: 7469935968
x-connection-hash: d8098e18fba40844f74260b50d8349d78a0fb298c56bd0f9268a5067df32da99
content-length: 43

POST
H3 200 collect Show response
www.google-analytics.com/j/ 3 B
23 B 47ms
43ms XHR
text/plain 142.251.16.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=189882700&t=pageview&_s=1&dl=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Foctober-eom-dtc%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3D%5BREDACTED%20NAME%5D%26last_name%3D%5BREDACTED%20NAME%5D%26state%3D%26city%3D%26zip%3D%26email%3Djed.w%5BREDACTED%20EMAIL%5Dien.com%26amount%3D25&ul=en-us&de=UTF-8&dt=Support%20Ron%20DeSantis!&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YCDAiEABBAAAACAEK~&jid=788203592&gjid=119686930&cid=270181744.1703038201&tid=UA-73658561-7&_gid=1963660658.1703038201&_slc=1&gtm=45He3bt0n71NTQZ9Nv72410129&cd61=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Foctober-eom-dtc%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3D%5BREDACTED%20NAME%5D%26last_name%3D%5BREDACTED%20NAME%5D%26state%3D%26city%3D%26zip%3D%26email%3Djed.w%5BREDACTED%20EMAIL%5Dien.com%26amount%3D25&gcd=11l1l1l1l1&dma=0&z=1744798011

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f138.1e100.net

Software

Golfe2 /

Resource Hash

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 20 Dec 2023 02:10:01 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
151 B 2138ms
53ms XHR
text/plain 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-73658561-7&cid=270181744.1703038201&jid=788203592&gjid=119686930&_gid=1963660658.1703038201&_u=YCDAiEABBAAAAGAEK~&z=223441737

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f155.1e100.net

Software

Golfe2 /

Resource Hash

8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Wed, 20 Dec 2023 02:10:03 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 41ms
35ms Image
image/gif 142.251.16.138
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=189882700&t=event&ni=0&_s=1&dl=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Foctober-eom-dtc%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com%26amount%3D25&ul=en-us&de=UTF-8&dt=Support%20Ron%20DeSantis!&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=donation%20landing%20page&ea=user%20session%20start&el=landing%20page%20settings&_u=YCDAiEABBAAAAGAEK~&jid=&gjid=&cid=270181744.1703038201&tid=UA-73658561-7&_gid=1963660658.1703038201&gtm=45He3bt0n71NTQZ9Nv72410129&cd41=anonymous&cd58=t&cd61=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Foctober-eom-dtc%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com%26amount%3D25&gcd=11l1l1l1l1&dma=0&z=491543846

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f138.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Dec 2023 00:51:38 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 4703
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect Show response
gtm.winred.com/g/ 720 B
973 B 517ms
216ms XHR
text/plain 104.16.249.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gtm.winred.com/g/collect?v=2&tid=G-X6H0114PDF&gtm=45je3bt0v867905447z872410129&_p=1703038200651&gcd=11l1l1l1l1&dma=0&cid=270181744.1703038201&ul=en-us&sr=1600x1200&_fplc=0&ur=CA-ON&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&sst.uc=CA&sst.gse=1&sst.etld=google.ca&sst.gcd=11l1l1l1l1&sst.tft=1703038200651&_s=1&sid=1703038201&sct=1&seg=0&dl=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Foctober-eom-dtc%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com%26amount%3D25&dt=Support%20Ron%20DeSantis!&en=page_view&_fv=1&_ss=1&ep.pagepath=%2Fdesantis%2Foctober-eom-dtc&ep.pagehostname=secure.winred.com&ep.parsedurl=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Foctober-eom-dtc&epn.load_time_sec=-1703038200.3&epn.event_fire_time=1703038201010&ep.event_uuid=6ddeb15f-2b1e-4f4c-9305-02a4fcc24cd0&ep.isVideoPage=f&ep.referrer=&tfd=1226&richsstsse

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.249.69 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3d08db345a18b5c44a89b2828f4440918603b290faa587811a364859924d530a

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 02:10:01 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
server: cloudflare
strict-transport-security: max-age=0; includeSubDomains
vary: Accept-Encoding
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 838458b93fe836ab-YYZ
alt-svc: h3=":443"; ma=86400

POST
H2 200 / Show response
evnt.byspotify.com/ 2 B
97 B 65ms
54ms Fetch
application/json 34.111.186.1
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://evnt.byspotify.com/
Requested by: Host: pixel.byspotify.com
URL: https://pixel.byspotify.com/ping.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.186.1 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 1.186.111.34.bc.googleusercontent.com
Software: /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Accept: application/json
Referer: https://secure.winred.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 20 Dec 2023 02:10:01 GMT
via: 1.1 google
access-control-allow-methods: GET, POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: false
access-control-allow-headers: Content-Type, Accept
content-length: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

OPTIONS
H2 200 /
evnt.byspotify.com/ Frame 0
0 103ms
43ms Preflight 34.111.186.1
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://evnt.byspotify.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.186.1 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 1.186.111.34.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://secure.winred.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-credentials: false
access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: https://secure.winred.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Wed, 20 Dec 2023 02:10:01 GMT
via: 1.1 google

GET
H2 200 www-player.css
www.youtube.com/s/player/d23221b6/ Frame EC09 366 KB
47 KB 44ms
34ms Stylesheet
text/css 142.251.111.190
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/d23221b6/www-player.css

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&&loop=1&mute=1&playlist=jeD5dxpNSLo

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.111.190 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f190.1e100.net

Software

sffe /

Resource Hash

ee11928e9a31b92c22b88f0c49dae1f791043fe071dacf46b848efe85254c003

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&&loop=1&mute=1&playlist=jeD5dxpNSLo
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 01:32:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2266
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48218
x-xss-protection: 0
last-modified: Wed, 13 Dec 2023 02:47:51 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Thu, 19 Dec 2024 01:32:15 GMT

GET
H2 200 embed.js Show response
www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/ Frame EC09 52 KB
16 KB 80ms
70ms Script
text/javascript 142.251.111.190
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/embed.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&&loop=1&mute=1&playlist=jeD5dxpNSLo

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.111.190 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f190.1e100.net

Software

sffe /

Resource Hash

423e4d25aa44ebb87acf362a69dc084449650df8fd4f7d325d2f4a136075726c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&&loop=1&mute=1&playlist=jeD5dxpNSLo
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 00:37:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5529
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16627
x-xss-protection: 0
last-modified: Wed, 13 Dec 2023 02:47:51 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Thu, 19 Dec 2024 00:37:52 GMT

GET
H2 200 www-embed-player.js Show response
www.youtube.com/s/player/d23221b6/www-embed-player.vflset/ Frame EC09 322 KB
96 KB 53ms
43ms Script
text/javascript 142.251.111.190
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/d23221b6/www-embed-player.vflset/www-embed-player.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&&loop=1&mute=1&playlist=jeD5dxpNSLo

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.111.190 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f190.1e100.net

Software

sffe /

Resource Hash

0c71106628b235959659a80caca8df6f9e8dfc9eac825605e79d2738726f287d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&&loop=1&mute=1&playlist=jeD5dxpNSLo
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 00:53:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4575
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 98540
x-xss-protection: 0
last-modified: Wed, 13 Dec 2023 02:47:51 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Thu, 19 Dec 2024 00:53:46 GMT

GET
H2 200 base.js Show response
www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/ Frame EC09 2 MB
768 KB 72ms
62ms Script
text/javascript 142.251.111.190
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/base.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&&loop=1&mute=1&playlist=jeD5dxpNSLo

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.111.190 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f190.1e100.net

Software

sffe /

Resource Hash

7f19936a920a8171fd23d2e11b15228bf208b542066e72f8689afd2e2f2ce934

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&&loop=1&mute=1&playlist=jeD5dxpNSLo
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 01:00:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4174
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 786314
x-xss-protection: 0
last-modified: Wed, 13 Dec 2023 02:47:51 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Thu, 19 Dec 2024 01:00:27 GMT

GET
H2 200 inner.html Show response
m.stripe.network/ Frame 12E6 930 B
1 KB 1336ms
18ms Document
text/html 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.network/inner.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/m-outer-6576085ca35ee42f2f484cda6763e4aa.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

947ac0903521f5eceefc90637c066306a8ca67466ccc188bb0107fb7cfb532d1

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src https://m.stripe.network https://m.stripe.com; default-src 'none'; font-src https://m.stripe.network https://fonts.gstatic.com; form-action 'none'; frame-src https://m.stripe.network https://js.stripe.com; img-src https://m.stripe.network https://m.stripe.com https://b.stripecdn.com; script-src https://m.stripe.network 'sha256-/5Guo2nzv5n/w6ukZpOBZOtTJBJPSkJ6mhHpnBgm3Ls='; style-src https://m.stripe.network; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 70
cache-control: max-age=300, public
content-encoding: br
content-length: 540
content-security-policy: base-uri 'none'; connect-src https://m.stripe.network https://m.stripe.com; default-src 'none'; font-src https://m.stripe.network https://fonts.gstatic.com; form-action 'none'; frame-src https://m.stripe.network https://js.stripe.com; img-src https://m.stripe.network https://m.stripe.com https://b.stripecdn.com; script-src https://m.stripe.network 'sha256-/5Guo2nzv5n/w6ukZpOBZOtTJBJPSkJ6mhHpnBgm3Ls='; style-src https://m.stripe.network; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Wed, 20 Dec 2023 02:10:02 GMT
server: Fastly
strict-transport-security: max-age=31556926; includeSubDomains; preload
vary: Accept-Encoding, Origin
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 42
x-content-type-options: nosniff
x-request-id: 2d7691da-f2dd-4c55-9449-b63f2f87fff7
x-served-by: cache-yyz4541-YYZ
x-timer: S1703038203.844075,VS0,VE0

GET
H2 200 www-player.css
www.youtube.com/s/player/d23221b6/ Frame F1D8 366 KB
47 KB 101ms
99ms Stylesheet
text/css 142.251.111.190
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/d23221b6/www-player.css

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&autoplay=1&loop=1&mute=1&playlist=jeD5dxpNSLo

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.111.190 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f190.1e100.net

Software

sffe /

Resource Hash

ee11928e9a31b92c22b88f0c49dae1f791043fe071dacf46b848efe85254c003

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&autoplay=1&loop=1&mute=1&playlist=jeD5dxpNSLo
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 01:32:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2266
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48218
x-xss-protection: 0
last-modified: Wed, 13 Dec 2023 02:47:51 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Thu, 19 Dec 2024 01:32:15 GMT

GET
H2 200 www-embed-player.js Show response
www.youtube.com/s/player/d23221b6/www-embed-player.vflset/ Frame F1D8 322 KB
96 KB 104ms
102ms Script
text/javascript 142.251.111.190
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/d23221b6/www-embed-player.vflset/www-embed-player.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&autoplay=1&loop=1&mute=1&playlist=jeD5dxpNSLo

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.111.190 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f190.1e100.net

Software

sffe /

Resource Hash

0c71106628b235959659a80caca8df6f9e8dfc9eac825605e79d2738726f287d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&autoplay=1&loop=1&mute=1&playlist=jeD5dxpNSLo
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 00:53:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4575
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 98540
x-xss-protection: 0
last-modified: Wed, 13 Dec 2023 02:47:51 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Thu, 19 Dec 2024 00:53:46 GMT

GET
H2 200 base.js Show response
www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/ Frame F1D8 2 MB
768 KB 110ms
109ms Script
text/javascript 142.251.111.190
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/base.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&autoplay=1&loop=1&mute=1&playlist=jeD5dxpNSLo

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.111.190 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f190.1e100.net

Software

sffe /

Resource Hash

7f19936a920a8171fd23d2e11b15228bf208b542066e72f8689afd2e2f2ce934

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&autoplay=1&loop=1&mute=1&playlist=jeD5dxpNSLo
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 01:00:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4174
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 786314
x-xss-protection: 0
last-modified: Wed, 13 Dec 2023 02:47:51 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Thu, 19 Dec 2024 01:00:27 GMT

GET
H2 200 217670437796224 Show response
connect.facebook.net/signals/config/ 139 KB
36 KB 236ms
214ms Script
application/x-javascript 157.240.244.1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/217670437796224?v=2.9.138&r=stable&domain=secure.winred.com

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.244.1 Apodaca, Mexico, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-mty2.fbcdn.net

Software

Resource Hash

8073a0bcd589f248e2324d7ab4b35550c064976fab988e132bf34ff9ee264fc3

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), gamepad=(), keyboard-map=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 20 Dec 2023 02:10:01 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints
pragma: public
x-fb-debug: HzYekOsS1SJho5E6BhF53Nh6CaNt7KSXXY6whTn6a0r11mbVKm0gbWDUCDe5aWk4ivAnbWb/JWWQaN2mCeYYiQ==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame EC09 15 KB
15 KB 169ms
67ms Font
font/woff2 142.251.16.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&&loop=1&mute=1&playlist=jeD5dxpNSLo

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f94.1e100.net

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
Origin: https://www.youtube.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sat, 16 Dec 2023 04:49:46 GMT
x-content-type-options: nosniff
age: 336015
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 15 Dec 2024 04:49:46 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame EC09 15 KB
15 KB 152ms
51ms Font
font/woff2 142.251.16.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&&loop=1&mute=1&playlist=jeD5dxpNSLo

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f94.1e100.net

Software

sffe /

Resource Hash

5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
Origin: https://www.youtube.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sat, 16 Dec 2023 00:38:53 GMT
x-content-type-options: nosniff
age: 351068
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15552
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:33:02 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 15 Dec 2024 00:38:53 GMT

GET
H2 200 .deploy_status_henson.json Show response
js.stripe.com/v3/ Frame 4553 474 B
865 B 472ms
75ms Fetch
application/json 52.85.151.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.stripe.com/v3/.deploy_status_henson.json
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.151.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-151-117.iad89.r.cloudfront.net
Software: Cloudfront /
Resource Hash: e20df4d423b37ce34fb8c17da7216ba9f70a05cc93ad807eb3cf454dfe56c411

Request headers

Accept: application/json
Referer: https://js.stripe.com/v3/controller-b22056080a36e4a3571fab5c1e67752d.html
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Wed, 20 Dec 2023 02:09:05 GMT
via: 1.1 c35f767218cbd1125d801b52fa785c8c.cloudfront.net (CloudFront)
last-modified: Tue, 19 Dec 2023 22:04:23 GMT
server: Cloudfront
age: 58
x-amz-cf-pop: IAD89-C3
etag: "98b2edf5e48fde7507e0a9757d567aea"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=60
accept-ranges: bytes
content-length: 474
x-amz-cf-id: v_wSQm3aArI9IXwmAdMD5ka2sqiEzo2qaCqAZFLTLA0GkMOwSSqWcw==

GET
H2 200 .deploy_status_henson.json Show response
js.stripe.com/v3/ Frame 4553 474 B
867 B 428ms
50ms Fetch
application/json 52.85.151.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.stripe.com/v3/.deploy_status_henson.json
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.151.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-151-117.iad89.r.cloudfront.net
Software: Cloudfront /
Resource Hash: e20df4d423b37ce34fb8c17da7216ba9f70a05cc93ad807eb3cf454dfe56c411

Request headers

Accept: application/json
Referer: https://js.stripe.com/v3/controller-b22056080a36e4a3571fab5c1e67752d.html
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Wed, 20 Dec 2023 02:09:05 GMT
via: 1.1 c35f767218cbd1125d801b52fa785c8c.cloudfront.net (CloudFront)
last-modified: Tue, 19 Dec 2023 22:04:23 GMT
server: Cloudfront
age: 58
x-amz-cf-pop: IAD89-C3
etag: "98b2edf5e48fde7507e0a9757d567aea"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=60
accept-ranges: bytes
content-length: 474
x-amz-cf-id: uq4yjTHaRdSSfYtc1LIYS6X2hlIFGSrngspNUBS6GQoHJQNNBVQvoQ==

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame F1D8 15 KB
15 KB 79ms
59ms Font
font/woff2 142.251.16.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&autoplay=1&loop=1&mute=1&playlist=jeD5dxpNSLo

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f94.1e100.net

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
Origin: https://www.youtube.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sat, 16 Dec 2023 04:49:46 GMT
x-content-type-options: nosniff
age: 336015
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 15 Dec 2024 04:49:46 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame F1D8 15 KB
16 KB 56ms
35ms Font
font/woff2 142.251.16.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&autoplay=1&loop=1&mute=1&playlist=jeD5dxpNSLo

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f94.1e100.net

Software

sffe /

Resource Hash

5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
Origin: https://www.youtube.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sat, 16 Dec 2023 00:38:53 GMT
x-content-type-options: nosniff
age: 351068
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15552
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:33:02 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 15 Dec 2024 00:38:53 GMT

GET
H2 200 .deploy_status_henson.json Show response
js.stripe.com/v3/ Frame 1EFB 474 B
865 B 392ms
51ms Fetch
application/json 52.85.151.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.stripe.com/v3/.deploy_status_henson.json
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.151.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-151-117.iad89.r.cloudfront.net
Software: Cloudfront /
Resource Hash: e20df4d423b37ce34fb8c17da7216ba9f70a05cc93ad807eb3cf454dfe56c411

Request headers

Accept: application/json
Referer: https://js.stripe.com/v3/controller-b22056080a36e4a3571fab5c1e67752d.html
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Wed, 20 Dec 2023 02:09:05 GMT
via: 1.1 c35f767218cbd1125d801b52fa785c8c.cloudfront.net (CloudFront)
last-modified: Tue, 19 Dec 2023 22:04:23 GMT
server: Cloudfront
age: 58
x-amz-cf-pop: IAD89-C3
etag: "98b2edf5e48fde7507e0a9757d567aea"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=60
accept-ranges: bytes
content-length: 474
x-amz-cf-id: b2LFEGPSASD3MUTwsOFqncFE1oC42R5C1HfBjPZHNdel3X2KUYDr1A==

GET
H2 200 .deploy_status_henson.json Show response
js.stripe.com/v3/ Frame 1EFB 474 B
863 B 410ms
74ms Fetch
application/json 52.85.151.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.stripe.com/v3/.deploy_status_henson.json
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.151.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-151-117.iad89.r.cloudfront.net
Software: Cloudfront /
Resource Hash: e20df4d423b37ce34fb8c17da7216ba9f70a05cc93ad807eb3cf454dfe56c411

Request headers

Accept: application/json
Referer: https://js.stripe.com/v3/controller-b22056080a36e4a3571fab5c1e67752d.html
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Wed, 20 Dec 2023 02:09:05 GMT
via: 1.1 c35f767218cbd1125d801b52fa785c8c.cloudfront.net (CloudFront)
last-modified: Tue, 19 Dec 2023 22:04:23 GMT
server: Cloudfront
age: 58
x-amz-cf-pop: IAD89-C3
etag: "98b2edf5e48fde7507e0a9757d567aea"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=60
accept-ranges: bytes
content-length: 474
x-amz-cf-id: 2a-2zcjI1li22JNlcisH-ZMtW0e4R3-MU8HIvaUyyvh2Vo5pMOQ7dQ==

GET
H2 200 .deploy_status_henson.json Show response
js.stripe.com/v3/ Frame 0B15 474 B
865 B 369ms
52ms Fetch
application/json 52.85.151.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.stripe.com/v3/.deploy_status_henson.json
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.151.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-151-117.iad89.r.cloudfront.net
Software: Cloudfront /
Resource Hash: e20df4d423b37ce34fb8c17da7216ba9f70a05cc93ad807eb3cf454dfe56c411

Request headers

Accept: application/json
Referer: https://js.stripe.com/v3/elements-inner-card-4f22a78d7e8a5e7d999d864bb3c9d998.html
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Wed, 20 Dec 2023 02:09:05 GMT
via: 1.1 c35f767218cbd1125d801b52fa785c8c.cloudfront.net (CloudFront)
last-modified: Tue, 19 Dec 2023 22:04:23 GMT
server: Cloudfront
age: 58
x-amz-cf-pop: IAD89-C3
etag: "98b2edf5e48fde7507e0a9757d567aea"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=60
accept-ranges: bytes
content-length: 474
x-amz-cf-id: lDRmwJNEb4sAcJt0Mik457Pe9jSTqbHMDfTmOR_NBY8z1ZaPluX2Tg==

GET
H2 200 countryRanges-9ffc15b92962ca316164b9a5ff4c1917.json Show response
js.stripe.com/v3/fingerprinted/data/ Frame 0B15 145 KB
36 KB 356ms
66ms Fetch
application/json 52.85.151.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/data/countryRanges-9ffc15b92962ca316164b9a5ff4c1917.json

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-117.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

007b4be1404b0f21a158fa83a2ae9375393b2d932a17e9745aa392fcadc7cf2f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://js.stripe.com/v3/elements-inner-card-4f22a78d7e8a5e7d999d864bb3c9d998.html
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Wed, 20 Dec 2023 01:49:51 GMT
content-encoding: gzip
via: 1.1 c35f767218cbd1125d801b52fa785c8c.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 1256
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Sat, 16 Dec 2023 02:01:23 GMT
server: Cloudfront
etag: W/"9ffc15b92962ca316164b9a5ff4c1917"
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: MtHIiw3rX6aEshFmNEtciXMkL21GXI-wIzO9JNI_zkX_DMrvpBVHWQ==

POST
H3 200 838458b11cb53972 Show response
secure.winred.com/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame EEDA 0
298 B 105ms
104ms XHR
text/plain 104.19.212.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/cdn-cgi/challenge-platform/h/g/jsd/r/838458b11cb53972

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/cdn-cgi/challenge-platform/scripts/jsd/main.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.212.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 20 Dec 2023 02:10:01 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
content-encoding: br
server: cloudflare
content-type: text/plain; charset=UTF-8
cf-ray: 838458b9ca9e36fb-YYZ
alt-svc: h3=":443"; ma=86400

POST
H2 200 wallet-config Show response
merchant-ui-api.stripe.com/elements/ Frame 1EFB 2 KB
3 KB 284ms
194ms Fetch
application/json 198.202.176.141
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://merchant-ui-api.stripe.com/elements/wallet-config

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

198.202.176.141 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

0ae3ccaa6252886c58e0ba33eddf63a9116d0ff60bf310c290890f6a41f30b96

Security Headers

Name	Value
Content-Security-Policy	report-uri https://q.stripe.com/csp-report?p=elements%2Fwallet-config; block-all-mixed-content; default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; img-src 'self'; script-src 'self' 'report-sample'; style-src 'self'
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Wed, 20 Dec 2023 02:10:02 GMT
content-security-policy: report-uri https://q.stripe.com/csp-report?p=elements%2Fwallet-config; block-all-mixed-content; default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; img-src 'self'; script-src 'self' 'report-sample'; style-src 'self'
strict-transport-security: max-age=63072000; includeSubDomains; preload
cross-origin-resource-policy: same-site
content-length: 2457
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
access-control-max-age: 300
access-control-allow-methods: GET, POST
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://js.stripe.com
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
vary: Origin
access-control-allow-headers: x-stripe-csrf-token
cross-origin-opener-policy-report-only: same-origin; report-to=https://q.stripe.com/coop-report
expires: 0

POST
H2 204 collect
analytics.google.com/g/s/ 0
246 B 166ms
89ms Ping
text/plain 172.253.122.113
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/s/collect?dma=0&gtm=45j91e3b82v867905447z872410129z9867900975&_gsid=X6H0114PDFnfL_10pLywZU6IZT1n8VOQ
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.253.122.113 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bh-in-f113.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Dec 2023 02:10:02 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
255 B 132ms
51ms Ping
text/plain 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&dma=0&tid=G-X6H0114PDF&cid=muKnnv%2FZPhc1BGOM86kg0rmmKW2FhxsobKdfaSGfX9Q%3D.1703038201&gtm=45j91e3b82v867905447z872410129z9867900975&aip=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bh-in-f155.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Dec 2023 02:10:03 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.ca/ads/ 42 B
408 B 1136ms
48ms Image
image/gif 142.251.179.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&dma=0&tid=G-X6H0114PDF&cid=muKnnv%2FZPhc1BGOM86kg0rmmKW2FhxsobKdfaSGfX9Q%3D.1703038201&gtm=45j91e3b82v867905447z872410129z9867900975&aip=1&z=408931212

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.179.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

pd-in-f94.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Dec 2023 02:10:03 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect Show response
gtm.winred.com/g/ 320 B
493 B 158ms
157ms XHR
text/plain 104.16.249.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gtm.winred.com/g/collect?v=2&tid=G-X6H0114PDF&gtm=45je3bt0v867905447z872410129&_p=1703038200651&gcd=11l1l1l1l1&dma=0&cid=270181744.1703038201&ul=en-us&sr=1600x1200&_fplc=0&ur=CA-ON&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&sst.uc=CA&sst.gse=1&sst.etld=google.ca&sst.gcd=11l1l1l1l1&sst.tft=1703038200651&_s=2&sid=1703038201&sct=1&seg=0&dl=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Foctober-eom-dtc%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com%26amount%3D25&dt=Support%20Ron%20DeSantis!&en=user%20session%20start&ep.pagepath=%2Fdesantis%2Foctober-eom-dtc&ep.pagehostname=secure.winred.com&ep.parsedurl=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Foctober-eom-dtc&epn.load_time_sec=-1703038200.3&epn.event_fire_time=1703038201146&ep.event_uuid=f640db47-0665-4382-9e54-6e07fc54675e&ep.isVideoPage=f&ep.referrer=&ep.category=donation%20landing%20page&ep.action=user%20session%20start&ep.label=landing%20page%20settings&ep.customCSS=t&ep.usercategory=anonymous&_et=4&tfd=1870&richsstsse

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.249.69 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4f0386322ee24279b4280f6b37c2c0a571b5d8b0c474efd7beaf2e88f9baa499

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 02:10:02 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
server: cloudflare
strict-transport-security: max-age=0; includeSubDomains
vary: Accept-Encoding
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 838458bb6bee36ab-YYZ
alt-svc: h3=":443"; ma=86400

GET
H2 200 payframe Show response
pay.google.com/gp/p/ui/ Frame FF00 19 KB
8 KB 84ms
83ms Document
text/html 142.251.16.92
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pay.google.com/gp/p/ui/payframe?origin=https%3A%2F%2Fjs.stripe.com&mid=

Requested by

Host: pay.google.com
URL: https://pay.google.com/gp/p/js/pay.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.92 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f92.1e100.net

Software

ESF /

Resource Hash

104383e8a8abda3872004efefe2132dbffb3f299779822a9d2c207ea42152b62

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport script-src 'report-sample' 'nonce-DNzVxFVDYDGgzbMZxgEy3A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport;worker-src 'self' script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport/allowlist
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://js.stripe.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=3600
content-encoding: gzip
content-security-policy: require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport script-src 'report-sample' 'nonce-DNzVxFVDYDGgzbMZxgEy3A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport;worker-src 'self' script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport/allowlist
content-type: text/html; charset=utf-8
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-site
date: Wed, 20 Dec 2023 02:10:02 GMT
expires: Wed, 20 Dec 2023 02:10:02 GMT
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
server: ESF
strict-transport-security: max-age=31536000
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-content-type-options: nosniff
x-ua-compatible: IE=edge
x-xss-protection: 0

GET
H3

200

id Show response
googleads.g.doubleclick.net/pagead/ Frame EC09
Redirect Chain

https://googleads.g.doubleclick.net/pagead/id
https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

100 B
146 B

44ms
43ms

XHR
application/json

172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&&loop=1&mute=1&playlist=jeD5dxpNSLo

Protocol

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f155.1e100.net

Software

cafe /

Resource Hash

020467532cf7603763adb79036b05ecebd75a8a989da15d96d4aa3836a7e5ccd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 02:10:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 120
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.youtube.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 20 Dec 2023 02:10:02 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
access-control-allow-origin: https://www.youtube.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ad_status.js Show response
static.doubleclick.net/instream/ Frame EC09 29 B
495 B 124ms
36ms Script
text/javascript 172.253.115.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.doubleclick.net/instream/ad_status.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/d23221b6/www-embed-player.vflset/www-embed-player.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f148.1e100.net

Software

sffe /

Resource Hash

eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 02:06:04 GMT
x-content-type-options: nosniff
age: 238
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29
x-xss-protection: 0
last-modified: Thu, 12 Dec 2013 23:40:16 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 20 Dec 2023 02:21:04 GMT

POST
H2 200 wallet-config Show response
merchant-ui-api.stripe.com/elements/ Frame 4553 2 KB
3 KB 194ms
185ms Fetch
application/json 198.202.176.141
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://merchant-ui-api.stripe.com/elements/wallet-config

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

198.202.176.141 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

400672572bf199e07f53440d576be04c58beaec83fa03f27b5875aaae67745a8

Security Headers

Name	Value
Content-Security-Policy	report-uri https://q.stripe.com/csp-report?p=elements%2Fwallet-config; block-all-mixed-content; default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; img-src 'self'; script-src 'self' 'report-sample'; style-src 'self'
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Wed, 20 Dec 2023 02:10:02 GMT
content-security-policy: report-uri https://q.stripe.com/csp-report?p=elements%2Fwallet-config; block-all-mixed-content; default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; img-src 'self'; script-src 'self' 'report-sample'; style-src 'self'
strict-transport-security: max-age=63072000; includeSubDomains; preload
cross-origin-resource-policy: same-site
content-length: 2457
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
access-control-max-age: 300
access-control-allow-methods: GET, POST
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://js.stripe.com
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
vary: Origin
access-control-allow-headers: x-stripe-csrf-token
cross-origin-opener-policy-report-only: same-origin; report-to=https://q.stripe.com/coop-report
expires: 0

GET
H3

200

id Show response
googleads.g.doubleclick.net/pagead/ Frame F1D8
Redirect Chain

https://googleads.g.doubleclick.net/pagead/id
https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

100 B
146 B

46ms
45ms

XHR
application/json

172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&autoplay=1&loop=1&mute=1&playlist=jeD5dxpNSLo

Protocol

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f155.1e100.net

Software

cafe /

Resource Hash

170a50153dff5a497bb2f1b9fa77c0d0849428fc1765d3940a47314ae972ca2d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 02:10:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 120
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.youtube.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 20 Dec 2023 02:10:02 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
access-control-allow-origin: https://www.youtube.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ad_status.js Show response
static.doubleclick.net/instream/ Frame F1D8 29 B
89 B 84ms
37ms Script
text/javascript 172.253.115.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.doubleclick.net/instream/ad_status.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/d23221b6/www-embed-player.vflset/www-embed-player.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f148.1e100.net

Software

sffe /

Resource Hash

eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 02:06:04 GMT
x-content-type-options: nosniff
age: 238
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29
x-xss-protection: 0
last-modified: Thu, 12 Dec 2013 23:40:16 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 20 Dec 2023 02:21:04 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 3170ms
50ms Image
text/plain 157.240.229.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=217670437796224&ev=PageView&dl=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Foctober-eom-dtc%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3D_removed_%26last_name%3D_removed_%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%2540nutrien.com%26amount%3D25%26_filteredParams%3D%257B%2522unwantedParams%2522%253A%255B%2522first_name%2522%252C%2522last_name%2522%255D%252C%2522restrictedParams%2522%253A%255B%255D%257D&rl=&if=false&ts=1703038202272&sw=1600&sh=1200&v=2.9.138&r=stable&ec=0&o=4126&fbp=fb.1.1703038202269.476351254&cs_est=true&ler=empty&it=1703038201569&coo=false&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.229.35 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-02-iad3.facebook.com

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 20 Dec 2023 02:10:06 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

OPTIONS
H2 200 Create
jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame 0
0 229ms
38ms Preflight
text/html 142.251.16.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f95.1e100.net

Software

ESF /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-goog-api-key,x-user-agent
Access-Control-Request-Method: POST
Origin: https://www.youtube.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type,x-goog-api-key,x-user-agent
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin: https://www.youtube.com
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html
date: Wed, 20 Dec 2023 02:10:02 GMT
server: ESF
vary: origin referer x-origin
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 0

POST
H3 200 Create Show response
jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame EC09 87 KB
40 KB 69ms
68ms XHR
application/json+protobuf 142.251.163.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f95.1e100.net

Software

ESF /

Resource Hash

81299fe01b2318e658f9bbaa7c47ff29348095dc905f54a6b002c45a92ecdac4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

X-User-Agent: grpc-web-javascript/0.1
Referer: https://www.youtube.com/
X-Goog-Api-Key: AIzaSyDyT5W0Jh49F30Pqqtyfdf7pDLFKLJoAnw
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/json+protobuf

Response headers

date: Wed, 20 Dec 2023 02:10:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json+protobuf; charset=UTF-8
access-control-allow-origin: https://www.youtube.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41108
x-xss-protection: 0

GET
H3 200 remote.js Show response
www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/ Frame EC09 116 KB
33 KB 37ms
36ms Script
text/javascript 142.251.111.190
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/remote.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.190 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f190.1e100.net

Software

sffe /

Resource Hash

d065099ccf0a0a61ade77c45457a9064ce7566f1bd58306608e3caad1ba15c9e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&&loop=1&mute=1&playlist=jeD5dxpNSLo
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 23:20:23 GMT
content-encoding: br
x-content-type-options: nosniff
age: 10179
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33540
x-xss-protection: 0
last-modified: Wed, 13 Dec 2023 02:47:51 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Wed, 18 Dec 2024 23:20:23 GMT

GET
H2 200 q3ybFvLVurjIRsyeRT4FtV2O7nz4ZH1nHhTn1-npVcU.js Show response
www.google.com/js/th/ Frame EC09 51 KB
20 KB 112ms
39ms Script
text/javascript 172.253.62.105
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/js/th/q3ybFvLVurjIRsyeRT4FtV2O7nz4ZH1nHhTn1-npVcU.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/base.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.105 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f105.1e100.net

Software

sffe /

Resource Hash

ab7c9b16f2d5bab8c846cc9e453e05b55d8eee7cf8647d671e14e7d7e9e955c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 12:04:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 50747
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19841
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:30:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 18 Dec 2024 12:04:15 GMT

GET
H2 200 default.webp
i.ytimg.com/vi_webp/jeD5dxpNSLo/ Frame EC09 2 KB
2 KB 1120ms
40ms Image
image/webp 172.253.62.119
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.ytimg.com/vi_webp/jeD5dxpNSLo/default.webp

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&&loop=1&mute=1&playlist=jeD5dxpNSLo

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.119 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f119.1e100.net

Software

sffe /

Resource Hash

d1bff4c024cb504c5d458cbeac53f0509fb2fcb9b0c6e37ca249fed31ce66791

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 02:10:03 GMT
x-content-type-options: nosniff
server: sffe
etag: "1697637063"
vary: Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: image/webp
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2064
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Wed, 20 Dec 2023 04:10:03 GMT

GET
H2 200 .deploy_status_henson.json Show response
js.stripe.com/v3/ Frame 0B15 474 B
866 B 48ms
48ms Fetch
application/json 52.85.151.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.stripe.com/v3/.deploy_status_henson.json
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.151.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-151-117.iad89.r.cloudfront.net
Software: Cloudfront /
Resource Hash: e20df4d423b37ce34fb8c17da7216ba9f70a05cc93ad807eb3cf454dfe56c411

Request headers

Accept: application/json
Referer: https://js.stripe.com/v3/elements-inner-card-4f22a78d7e8a5e7d999d864bb3c9d998.html
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Wed, 20 Dec 2023 02:09:05 GMT
via: 1.1 c35f767218cbd1125d801b52fa785c8c.cloudfront.net (CloudFront)
last-modified: Tue, 19 Dec 2023 22:04:23 GMT
server: Cloudfront
age: 58
x-amz-cf-pop: IAD89-C3
etag: "98b2edf5e48fde7507e0a9757d567aea"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=60
accept-ranges: bytes
content-length: 474
x-amz-cf-id: 4TbO2CgXgPJYx7uNKd-7LAbUCZs7hwXPm4AJxz-l4_kX4uqpZ9XOgw==

POST
H2 200 b Show response
r.stripe.com/ Frame 1EFB 0
273 B 93ms
91ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Wed, 20 Dec 2023 02:10:02 GMT
x-stripe-server-envoy-start-time-us: 1703038202433358
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 3
x-stripe-client-envoy-start-time-us: 1703038202432788
access-control-allow-credentials: true
content-length: 0

POST
H2 200 b Show response
r.stripe.com/ Frame 1EFB 0
272 B 95ms
94ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Wed, 20 Dec 2023 02:10:02 GMT
x-stripe-server-envoy-start-time-us: 1703038202436955
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 2
x-stripe-client-envoy-start-time-us: 1703038202436800
access-control-allow-credentials: true
content-length: 0

POST
H2 200 b Show response
r.stripe.com/ Frame 1EFB 0
271 B 99ms
98ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Wed, 20 Dec 2023 02:10:02 GMT
x-stripe-server-envoy-start-time-us: 1703038202440982
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 3
x-stripe-client-envoy-start-time-us: 1703038202440671
access-control-allow-credentials: true
content-length: 0

POST
H2 200 b Show response
r.stripe.com/ Frame 1EFB 0
272 B 108ms
107ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Wed, 20 Dec 2023 02:10:02 GMT
x-stripe-server-envoy-start-time-us: 1703038202450020
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 3
x-stripe-client-envoy-start-time-us: 1703038202449379
access-control-allow-credentials: true
content-length: 0

POST
H2 200 b Show response
r.stripe.com/ Frame 1EFB 0
272 B 106ms
106ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Wed, 20 Dec 2023 02:10:02 GMT
x-stripe-server-envoy-start-time-us: 1703038202450180
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 3
x-stripe-client-envoy-start-time-us: 1703038202449437
access-control-allow-credentials: true
content-length: 0

POST
H2 200 b Show response
r.stripe.com/ Frame 1EFB 0
272 B 112ms
112ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Wed, 20 Dec 2023 02:10:02 GMT
x-stripe-server-envoy-start-time-us: 1703038202453922
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 3
x-stripe-client-envoy-start-time-us: 1703038202453279
access-control-allow-credentials: true
content-length: 0

POST
H2 200 b Show response
r.stripe.com/ Frame 1EFB 0
271 B 112ms
112ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Wed, 20 Dec 2023 02:10:02 GMT
x-stripe-server-envoy-start-time-us: 1703038202457412
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 2
x-stripe-client-envoy-start-time-us: 1703038202457205
access-control-allow-credentials: true
content-length: 0

OPTIONS
H2 200 Create
jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame 0
0 110ms
37ms Preflight
text/html 142.251.16.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f95.1e100.net

Software

ESF /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-goog-api-key,x-user-agent
Access-Control-Request-Method: POST
Origin: https://www.youtube.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type,x-goog-api-key,x-user-agent
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin: https://www.youtube.com
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html
date: Wed, 20 Dec 2023 02:10:02 GMT
server: ESF
vary: origin referer x-origin
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 0

POST
H3 200 Create Show response
jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame F1D8 87 KB
40 KB 49ms
47ms XHR
application/json+protobuf 142.251.163.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f95.1e100.net

Software

ESF /

Resource Hash

a3a8ccd62952cba5e79d5fe88026b484bb1900217c3fc14d9987b270fde01e00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

X-User-Agent: grpc-web-javascript/0.1
Referer: https://www.youtube.com/
X-Goog-Api-Key: AIzaSyDyT5W0Jh49F30Pqqtyfdf7pDLFKLJoAnw
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/json+protobuf

Response headers

date: Wed, 20 Dec 2023 02:10:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json+protobuf; charset=UTF-8
access-control-allow-origin: https://www.youtube.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41163
x-xss-protection: 0

POST
H3 200 player Show response
www.youtube.com/youtubei/v1/ Frame F1D8 74 KB
30 KB 126ms
125ms XHR
application/json 142.251.111.190
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/youtubei/v1/player?key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8&prettyPrint=false

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.190 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f190.1e100.net

Software

scaffolding on HTTPServer2 /

Resource Hash

440b6213329ddea7fb3618e7a28fe9868c859454726d39e114e694b8313cd9dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

X-Youtube-Bootstrap-Logged-In: false
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/json
Referer: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&autoplay=1&loop=1&mute=1&playlist=jeD5dxpNSLo
X-Youtube-Client-Name: 56
X-Youtube-Client-Version: 1.20231212.01.00
X-Goog-Visitor-Id: Cgt6aVh6RG9XMldIRSj5mYmsBjIKCgJDQRIEGgAgLA%3D%3D

Response headers

date: Wed, 20 Dec 2023 02:10:02 GMT
content-encoding: br
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
x-frame-options: SAMEORIGIN
vary: Origin, X-Origin, Referer
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30584
x-xss-protection: 0

GET
H2 200 q3ybFvLVurjIRsyeRT4FtV2O7nz4ZH1nHhTn1-npVcU.js Show response
www.google.com/js/th/ Frame F1D8 51 KB
19 KB 37ms
36ms Script
text/javascript 172.253.62.105
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/js/th/q3ybFvLVurjIRsyeRT4FtV2O7nz4ZH1nHhTn1-npVcU.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/base.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.105 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f105.1e100.net

Software

sffe /

Resource Hash

ab7c9b16f2d5bab8c846cc9e453e05b55d8eee7cf8647d671e14e7d7e9e955c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 12:04:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 50747
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19841
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:30:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 18 Dec 2024 12:04:15 GMT

GET
H3 200 embed.js Show response
www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/ Frame F1D8 52 KB
16 KB 37ms
37ms Script
text/javascript 142.251.111.190
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/embed.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.190 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f190.1e100.net

Software

sffe /

Resource Hash

423e4d25aa44ebb87acf362a69dc084449650df8fd4f7d325d2f4a136075726c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&autoplay=1&loop=1&mute=1&playlist=jeD5dxpNSLo
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 00:37:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5530
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16627
x-xss-protection: 0
last-modified: Wed, 13 Dec 2023 02:47:51 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Thu, 19 Dec 2024 00:37:52 GMT

GET
DATA 200
OK truncated
/ Frame F1D8 175 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 hr-7CPrFgoHm5xMRhcxGNHdKkw7B2X2uKsnRlY6bUxhhZSZdIUafumHAHWowdRRBZ8G69ShtPQ=s68-c-k-c0x00ffffff-no-rj
yt3.ggpht.com/ Frame F1D8 3 KB
3 KB 778ms
88ms Image
image/jpeg 142.251.163.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://yt3.ggpht.com/hr-7CPrFgoHm5xMRhcxGNHdKkw7B2X2uKsnRlY6bUxhhZSZdIUafumHAHWowdRRBZ8G69ShtPQ=s68-c-k-c0x00ffffff-no-rj

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&autoplay=1&loop=1&mute=1&playlist=jeD5dxpNSLo

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f132.1e100.net

Software

fife /

Resource Hash

220f25f6cbb3f22ce75fbee30ef17f56be6d76cced97c0634406b55430a76bdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 01:41:55 GMT
x-content-type-options: nosniff
age: 1688
content-disposition: inline;filename="channels4_profile.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3077
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 21 Dec 2023 01:41:55 GMT

GET
DATA 200
OK truncated
/ Frame F1D8 296 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8e83bcf0315f708e646d547688191140b0fbf240f230225e7e4cc136d8133fe3

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 m=_b,_tp Show response
www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.YdcqkS5vMbo.es5.O/am=gEEY/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/ujg=1/rs=AMi... Frame FF00 159 KB
57 KB 766ms
36ms Script
text/javascript 172.253.115.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.YdcqkS5vMbo.es5.O/am=gEEY/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/ujg=1/rs=AMitfrggnGfTFx3XyHaDNbms4pfQ_DmHyg/m=_b,_tp

Requested by

Host: pay.google.com
URL: https://pay.google.com/gp/p/ui/payframe?origin=https%3A%2F%2Fjs.stripe.com&mid=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f94.1e100.net

Software

sffe /

Resource Hash

51bf499751a19c673124ea1e650359f15dd39f753aa223d2b7e2b68a65dcbd36

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sun, 17 Dec 2023 16:42:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 206824
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/payments-consumer-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57332
x-xss-protection: 0
last-modified: Tue, 12 Dec 2023 13:07:52 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="boq-infra/payments-consumer-boq-js-css-signers"
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/payments-consumer-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/payments-consumer-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Mon, 16 Dec 2024 16:42:59 GMT

POST
H2 200 b Show response
r.stripe.com/ Frame 4553 0
273 B 92ms
92ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Wed, 20 Dec 2023 02:10:02 GMT
x-stripe-server-envoy-start-time-us: 1703038202563843
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 2
x-stripe-client-envoy-start-time-us: 1703038202563462
access-control-allow-credentials: true
content-length: 0

POST
H2 200 b Show response
r.stripe.com/ Frame 4553 0
273 B 96ms
96ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Wed, 20 Dec 2023 02:10:02 GMT
x-stripe-server-envoy-start-time-us: 1703038202563858
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 3
x-stripe-client-envoy-start-time-us: 1703038202563583
access-control-allow-credentials: true
content-length: 0

POST
H2 200 b Show response
r.stripe.com/ Frame 4553 0
273 B 96ms
96ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Wed, 20 Dec 2023 02:10:02 GMT
x-stripe-server-envoy-start-time-us: 1703038202567757
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 2
x-stripe-client-envoy-start-time-us: 1703038202567361
access-control-allow-credentials: true
content-length: 0

POST
H2 200 b Show response
r.stripe.com/ Frame 4553 0
271 B 98ms
98ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Wed, 20 Dec 2023 02:10:02 GMT
x-stripe-server-envoy-start-time-us: 1703038202571723
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 2
x-stripe-client-envoy-start-time-us: 1703038202571312
access-control-allow-credentials: true
content-length: 0

POST
H2 200 b Show response
r.stripe.com/ Frame 4553 0
273 B 101ms
100ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Wed, 20 Dec 2023 02:10:02 GMT
x-stripe-server-envoy-start-time-us: 1703038202575460
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 2
x-stripe-client-envoy-start-time-us: 1703038202575277
access-control-allow-credentials: true
content-length: 0

POST
H2 200 b Show response
r.stripe.com/ Frame 4553 0
272 B 105ms
105ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Wed, 20 Dec 2023 02:10:02 GMT
x-stripe-server-envoy-start-time-us: 1703038202579818
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 3
x-stripe-client-envoy-start-time-us: 1703038202579191
access-control-allow-credentials: true
content-length: 0

GET
H2 200 ga-audiences
www.google.ca/ads/ 42 B
107 B 51ms
51ms Image
image/gif 142.251.179.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.179.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

pd-in-f94.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Dec 2023 02:10:03 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 b Show response
r.stripe.com/ Frame 4553 0
271 B 95ms
92ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Wed, 20 Dec 2023 02:10:02 GMT
x-stripe-server-envoy-start-time-us: 1703038202579512
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 3
x-stripe-client-envoy-start-time-us: 1703038202579230
access-control-allow-credentials: true
content-length: 0

POST
H3 404 cspreport
pay.google.com/_/InstantbuyFrontendBuyflowPayframeUi/ Frame FF00 2 KB
2 KB 140ms
140ms Other
text/html 142.251.16.92
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://pay.google.com/_/InstantbuyFrontendBuyflowPayframeUi/cspreport
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/desantis/october-eom-dtc?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com&amount=25
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.16.92 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bl-in-f92.1e100.net
Software: /
Resource Hash: d6ff339ddb4525268c21fa26ded66b0703f177e742281dc9bcd558288f8e1101

Request headers

Referer: https://pay.google.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Wed, 20 Dec 2023 02:10:02 GMT
referrer-policy: no-referrer
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1608
content-type: text/html; charset=UTF-8

POST
H3 200 log_event Show response
www.youtube.com/youtubei/v1/ Frame F1D8 28 B
50 B 53ms
50ms XHR
application/json 142.251.111.190
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.190 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f190.1e100.net

Software

scaffolding on HTTPServer2 /

Resource Hash

d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
X-Goog-Request-Time: 1703038202564
Content-Type: application/json
X-YouTube-Utc-Offset: -480
X-YouTube-Client-Name: 56
Referer: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&autoplay=1&loop=1&mute=1&playlist=jeD5dxpNSLo
X-YouTube-Client-Version: 1.20231212.01.00
X-YouTube-Time-Zone: America/Vancouver
X-Goog-Visitor-Id: Cgt6aVh6RG9XMldIRSj5mYmsBjIKCgJDQRIEGgAgLA%3D%3D
X-YouTube-Ad-Signals: dt=1703038202191&flash=0&frm=2&u_tz=-480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C344%2C315&vis=1&wgl=true&ca_type=image

Response headers

date: Wed, 20 Dec 2023 02:10:02 GMT
content-encoding: br
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
x-frame-options: SAMEORIGIN
vary: Origin, X-Origin, Referer
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31
x-xss-protection: 0

POST
H2 200 b Show response
r.stripe.com/ Frame 1EFB 0
272 B 102ms
102ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Wed, 20 Dec 2023 02:10:02 GMT
x-stripe-server-envoy-start-time-us: 1703038202627695
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 3
x-stripe-client-envoy-start-time-us: 1703038202627407
access-control-allow-credentials: true
content-length: 0

POST
H2 200 b Show response
r.stripe.com/ Frame 4553 0
272 B 101ms
99ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Wed, 20 Dec 2023 02:10:02 GMT
x-stripe-server-envoy-start-time-us: 1703038202634119
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 3
x-stripe-client-envoy-start-time-us: 1703038202633959
access-control-allow-credentials: true
content-length: 0

POST
H2 200 b Show response
r.stripe.com/ Frame 0B15 0
272 B 105ms
105ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Wed, 20 Dec 2023 02:10:02 GMT
x-stripe-server-envoy-start-time-us: 1703038202638022
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 3
x-stripe-client-envoy-start-time-us: 1703038202637846
access-control-allow-credentials: true
content-length: 0

GET
H2 200 cast_sender.js Show response
www.gstatic.com/cv/js/sender/v1/ Frame EC09 4 KB
2 KB 691ms
69ms Script
text/javascript 172.253.115.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/cv/js/sender/v1/cast_sender.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/base.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f94.1e100.net

Software

sffe /

Resource Hash

ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 02:10:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cloudview
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2007
x-xss-protection: 0
last-modified: Tue, 16 Feb 2021 23:57:06 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="cloudview"
vary: Accept-Encoding
report-to: {"group":"cloudview","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cloudview"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 20 Dec 2023 02:10:03 GMT

POST
H3 204 qoe Show response
www.youtube.com/api/stats/ Frame F1D8 0
19 B 49ms
49ms XHR
text/html 142.251.111.190
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/api/stats/qoe?fmt=243&cpn=svC5CK6PJaZKeXrQ&el=embedded&ns=yt&fexp=v1%2C23983296%2C21348%2C2602%2C73492%2C54572%2C73455%2C176963%2C53633%2C84737%2C25688%2C9541%2C1089%2C5877%2C394%2C26439494%2C4054%2C1930%2C5181%2C9369%2C1556%2C1141%2C5877%2C2251%2C859%2C1094%2C4012%2C5501%2C4683%2C2339%2C7615%2C2008%2C3943%2C609%2C5786%2C1160%2C1332%2C1701%2C723%2C5951&cl=590345707&seq=1&docid=jeD5dxpNSLo&ei=-kyCZcL-HI-M_9EPxceAqAk&event=streamingstats&plid=AAYM53sZdYXu3aOz&referrer=https%3A%2F%2Fwww.youtube.com%2Fembed%2FjeD5dxpNSLo%3Fsi%3DH_xx5wVJV6ZHDuQp%26autoplay%3D1%26loop%3D1%26mute%3D1%26playlist%3DjeD5dxpNSLo&qclc=ChBzdkM1Q0s2UEphWktlWHJREAE&embargoed=0&cbr=Chrome&cbrver=120.0.6099.109&c=WEB_EMBEDDED_PLAYER&cver=1.20231212.01.00&cplayer=UNIPLAYER&cos=Windows&cosver=10.0&cplatform=DESKTOP&vps=0.000:N,0.011:B,0.197:B,0.197:B&cat=streaming&cmt=0.011:0.000,0.197:0.000&vfs=0.197:243:243::r&view=0.197:344:315&bwe=0.197:130000&bat=0.197:1:1&vis=0.197:0&bh=0.197:0.000

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.190 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f190.1e100.net

Software

Video Stats Server /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded
X-YouTube-Utc-Offset: -480
X-YouTube-Client-Name: 56
Referer: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&autoplay=1&loop=1&mute=1&playlist=jeD5dxpNSLo
X-YouTube-Client-Version: 1.20231212.01.00
X-YouTube-Time-Zone: America/Vancouver
X-Goog-Visitor-Id: Cgt6aVh6RG9XMldIRSj5mYmsBjIKCgJDQRIEGgAgLA%3D%3D
X-YouTube-Ad-Signals: dt=1703038202191&flash=0&frm=2&u_tz=-480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C344%2C315&vis=1&wgl=true&ca_type=image

Response headers

pragma: no-cache
date: Wed, 20 Dec 2023 02:10:02 GMT
x-content-type-options: nosniff
server: Video Stats Server
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://www.youtube.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK videoplayback Show response
rr4---sn-tt1elnel.googlevideo.com/ Frame F1D8 1 KB
2 KB 78ms
19ms Fetch
application/vnd.yt-ump 74.125.0.9
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://rr4---sn-tt1elnel.googlevideo.com/videoplayback?expire=1703059802&ei=-kyCZcL-HI-M_9EPxceAqAk&ip=86.48.14.70&id=o-AHGdhAyob_R27BGbppNXHXkamOQ3b8tHnNy4FNHkRtwg&itag=243&aitags=133%2C134%2C135%2C136%2C137%2C160%2C242%2C243%2C244%2C247%2C248%2C278&source=youtube&requiressl=yes&xpc=EgVo2aDSNQ%3D%3D&mh=tR&mm=31%2C29&mn=sn-tt1elnel%2Csn-tt1e7nls&ms=au%2Crdu&mv=m&mvi=4&pl=24&initcwndbps=3286250&spc=UWF9fwaXQ252oIuVCX2tKQAW0gtmcdrN1_OZvqR0zg&vprv=1&svpuc=1&mime=video%2Fwebm&ns=HtKlFwrpwSD4C58rXDchClwQ&gir=yes&clen=379533&dur=19.633&lmt=1698030525033392&mt=1703037889&fvip=4&keepalive=yes&fexp=24007246&c=WEB_EMBEDDED_PLAYER&txp=531F224&n=bByQU2ruxwjB4g&sparams=expire%2Cei%2Cip%2Cid%2Caitags%2Csource%2Crequiressl%2Cxpc%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Cgir%2Cclen%2Cdur%2Clmt&sig=AJfQdSswRAIgItfkXVnCjOXNUOsZ2SE13aYi7aNScMjR1QCFrLlMmHgCIFb2od_yHFgBgwYxQ6PvrkASXObUguXydmIFD7gXhgF1&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=AAO5W4owRAIgL5Db7ckYyPhQEQDVXsgesEwVvr3r3_Pd-IlpW0ecfiYCIHRooiMlSy1jY_DPsByQ45T9k02BJaQ9MKaEZYYM_Ehu&alr=yes&cpn=svC5CK6PJaZKeXrQ&cver=1.20231212.01.00&range=0-65820&rn=1&rbuf=0&pot=IjgSfxJ8d_1ehVEYZklzKXpJQDgrJ18TdjZALHhKfyZ_DFAVWzRRGFg7Qy1bOlUYUxhePjdMVlohOw==&ump=1&srfvp=1

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/base.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

74.125.0.9 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yyz12s12-in-f9.1e100.net

Software

gvs 1.0 /

Resource Hash

eda6f4bcaf303909d18ac66d645a98a475a59fd4496ef2f5cf0b47a68dc7cea7

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Wed, 20 Dec 2023 02:10:02 GMT
X-Restrict-Formats-Hint: None
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46"
Last-Modified: Wed, 02 May 2007 10:26:10 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: application/vnd.yt-ump
Access-Control-Allow-Origin: https://www.youtube.com
Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
Cache-Control: private, max-age=21300
Access-Control-Allow-Credentials: true
Timing-Allow-Origin: https://www.youtube.com
Expires: Wed, 20 Dec 2023 02:10:02 GMT

POST
H/1.1 200
OK videoplayback Show response
rr4---sn-tt1elnel.googlevideo.com/ Frame F1D8 1 KB
2 KB 97ms
19ms Fetch
application/vnd.yt-ump 74.125.0.9
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://rr4---sn-tt1elnel.googlevideo.com/videoplayback?expire=1703059802&ei=-kyCZcL-HI-M_9EPxceAqAk&ip=86.48.14.70&id=o-AHGdhAyob_R27BGbppNXHXkamOQ3b8tHnNy4FNHkRtwg&itag=251&source=youtube&requiressl=yes&xpc=EgVo2aDSNQ%3D%3D&mh=tR&mm=31%2C29&mn=sn-tt1elnel%2Csn-tt1e7nls&ms=au%2Crdu&mv=m&mvi=4&pl=24&initcwndbps=3286250&spc=UWF9fwaXQ252oIuVCX2tKQAW0gtmcdrN1_OZvqR0zg&vprv=1&svpuc=1&mime=audio%2Fwebm&ns=HtKlFwrpwSD4C58rXDchClwQ&gir=yes&clen=273227&dur=19.681&lmt=1698030522265040&mt=1703037889&fvip=4&keepalive=yes&fexp=24007246&c=WEB_EMBEDDED_PLAYER&txp=5318224&n=bByQU2ruxwjB4g&sparams=expire%2Cei%2Cip%2Cid%2Citag%2Csource%2Crequiressl%2Cxpc%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Cgir%2Cclen%2Cdur%2Clmt&sig=AJfQdSswRQIgWEZGEcuyUgoFJHeOpXBc0ZJFAfAHlDcKDYYEK4jyN5kCIQCa_lB36WHqTesEg4iI_G81jf73LkvCKhdJNR77_dyHjw%3D%3D&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=AAO5W4owRAIgL5Db7ckYyPhQEQDVXsgesEwVvr3r3_Pd-IlpW0ecfiYCIHRooiMlSy1jY_DPsByQ45T9k02BJaQ9MKaEZYYM_Ehu&alr=yes&cpn=svC5CK6PJaZKeXrQ&cver=1.20231212.01.00&range=0-65835&rn=2&rbuf=0&pot=IjhGBUYGI4cK_wViMjMnUy4zFEJ_XQtpIkwUViwwK1wrdgRvD04FYgxBF1cPQAFiB2IKRGM2AiB1QQ==&ump=1&srfvp=1

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/base.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

74.125.0.9 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yyz12s12-in-f9.1e100.net

Software

gvs 1.0 /

Resource Hash

6f1537d4647aeb8b175928510ad87d87abc459892704caa2e1b5a338c0eb3dbe

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Wed, 20 Dec 2023 02:10:02 GMT
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46"
Last-Modified: Wed, 02 May 2007 10:26:10 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: application/vnd.yt-ump
Access-Control-Allow-Origin: https://www.youtube.com
Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
Cache-Control: private, max-age=21300
Access-Control-Allow-Credentials: true
Timing-Allow-Origin: https://www.youtube.com
Expires: Wed, 20 Dec 2023 02:10:02 GMT

GET
H3 200 remote.js Show response
www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/ Frame F1D8 116 KB
33 KB 48ms
46ms Script
text/javascript 142.251.111.190
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/remote.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.190 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f190.1e100.net

Software

sffe /

Resource Hash

d065099ccf0a0a61ade77c45457a9064ce7566f1bd58306608e3caad1ba15c9e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&autoplay=1&loop=1&mute=1&playlist=jeD5dxpNSLo
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 23:20:23 GMT
content-encoding: br
x-content-type-options: nosniff
age: 10179
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33540
x-xss-protection: 0
last-modified: Wed, 13 Dec 2023 02:47:51 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Wed, 18 Dec 2024 23:20:23 GMT

GET
H3 200 captions.js Show response
www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/ Frame F1D8 71 KB
24 KB 38ms
36ms Script
text/javascript 142.251.111.190
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/captions.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.190 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f190.1e100.net

Software

sffe /

Resource Hash

1140fb791063b962016a3480d12ede4f6bdbb688b486365448cf9d92b7d8cc5f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&autoplay=1&loop=1&mute=1&playlist=jeD5dxpNSLo
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Sat, 16 Dec 2023 00:35:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 351297
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24447
x-xss-protection: 0
last-modified: Wed, 13 Dec 2023 02:47:51 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Sun, 15 Dec 2024 00:35:05 GMT

GET
H3 200 endscreen.js Show response
www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/ Frame F1D8 33 KB
8 KB 56ms
55ms Script
text/javascript 142.251.111.190
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/endscreen.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.190 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f190.1e100.net

Software

sffe /

Resource Hash

420a7e24ced9f033898a0dd3c0164df4dbb5d97b7b48728610ab130510fa70dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&autoplay=1&loop=1&mute=1&playlist=jeD5dxpNSLo
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 15:57:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 36728
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8346
x-xss-protection: 0
last-modified: Wed, 13 Dec 2023 02:47:51 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Wed, 18 Dec 2024 15:57:54 GMT

POST
H3 200 next Show response
www.youtube.com/youtubei/v1/ Frame F1D8 34 KB
6 KB 308ms
307ms XHR
application/json 142.251.111.190
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/youtubei/v1/next?key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8&prettyPrint=false

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.190 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f190.1e100.net

Software

scaffolding on HTTPServer2 /

Resource Hash

4fc89691fc775c314491f28a5cee759d2e5a0acd64fc6ac35c1ae9536b4fb2c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

X-Youtube-Bootstrap-Logged-In: false
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/json
Referer: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&autoplay=1&loop=1&mute=1&playlist=jeD5dxpNSLo
X-Youtube-Client-Name: 56
X-Youtube-Client-Version: 1.20231212.01.00
X-Goog-Visitor-Id: Cgt6aVh6RG9XMldIRSj5mYmsBjIKCgJDQRIEGgAgLA%3D%3D

Response headers

date: Wed, 20 Dec 2023 02:10:02 GMT
content-encoding: br
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
x-frame-options: SAMEORIGIN
vary: Origin, X-Origin, Referer
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6298
x-xss-protection: 0

OPTIONS
H3 200 GenerateIT
jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame 0
0 37ms
37ms Preflight
text/html 142.251.163.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f95.1e100.net

Software

ESF /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-goog-api-key,x-user-agent
Access-Control-Request-Method: POST
Origin: https://www.youtube.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type,x-goog-api-key,x-user-agent
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin: https://www.youtube.com
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html
date: Wed, 20 Dec 2023 02:10:02 GMT
server: ESF
vary: origin referer x-origin
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 0

POST
H3 200 GenerateIT Show response
jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame F1D8 90 B
134 B 45ms
44ms XHR
application/json+protobuf 142.251.163.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f95.1e100.net

Software

ESF /

Resource Hash

8929ebffacc482aa03b66684a0db17bff046f146377bd163af84d66709d90a55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

X-User-Agent: grpc-web-javascript/0.1
Referer: https://www.youtube.com/
X-Goog-Api-Key: AIzaSyDyT5W0Jh49F30Pqqtyfdf7pDLFKLJoAnw
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/json+protobuf

Response headers

date: Wed, 20 Dec 2023 02:10:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json+protobuf; charset=UTF-8
access-control-allow-origin: https://www.youtube.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 110
x-xss-protection: 0

GET
H3 204 generate_204
www.youtube.com/ Frame EC09 0
10 B 36ms
36ms Image
text/plain 142.251.111.190
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.youtube.com/generate_204?lNoJrg
Requested by: Host: www.youtube.com
URL: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&&loop=1&mute=1&playlist=jeD5dxpNSLo
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.111.190 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bk-in-f190.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&&loop=1&mute=1&playlist=jeD5dxpNSLo
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 02:10:02 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 204 generate_204
www.youtube.com/ Frame F1D8 0
10 B 37ms
36ms Image
text/plain 142.251.111.190
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.youtube.com/generate_204?mQ_TFw
Requested by: Host: www.youtube.com
URL: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&autoplay=1&loop=1&mute=1&playlist=jeD5dxpNSLo
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.111.190 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bk-in-f190.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&autoplay=1&loop=1&mute=1&playlist=jeD5dxpNSLo
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 02:10:02 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

OPTIONS
H3 200 GenerateIT
jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame 0
0 41ms
40ms Preflight
text/html 142.251.163.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f95.1e100.net

Software

ESF /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-goog-api-key,x-user-agent
Access-Control-Request-Method: POST
Origin: https://www.youtube.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type,x-goog-api-key,x-user-agent
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin: https://www.youtube.com
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html
date: Wed, 20 Dec 2023 02:10:03 GMT
server: ESF
vary: origin referer x-origin
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 0

POST
H3 200 GenerateIT Show response
jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame EC09 90 B
134 B 42ms
42ms XHR
application/json+protobuf 142.251.163.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f95.1e100.net

Software

ESF /

Resource Hash

3302e6acf99a22281a8a1d4b419877ba6b82dad46f9216fdf04fac42636b2a74

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

X-User-Agent: grpc-web-javascript/0.1
Referer: https://www.youtube.com/
X-Goog-Api-Key: AIzaSyDyT5W0Jh49F30Pqqtyfdf7pDLFKLJoAnw
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/json+protobuf

Response headers

date: Wed, 20 Dec 2023 02:10:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json+protobuf; charset=UTF-8
access-control-allow-origin: https://www.youtube.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 110
x-xss-protection: 0

POST
H2 200 b Show response
r.stripe.com/ Frame 1EFB 0
271 B 93ms
92ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Wed, 20 Dec 2023 02:10:03 GMT
x-stripe-server-envoy-start-time-us: 1703038203125139
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 3
x-stripe-client-envoy-start-time-us: 1703038203124991
access-control-allow-credentials: true
content-length: 0

GET
H2 200 hr-7CPrFgoHm5xMRhcxGNHdKkw7B2X2uKsnRlY6bUxhhZSZdIUafumHAHWowdRRBZ8G69ShtPQ=s88-c-k-c0x00ffffff-no-rj
yt3.ggpht.com/ Frame F1D8 4 KB
4 KB 145ms
54ms Image
image/jpeg 142.251.163.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://yt3.ggpht.com/hr-7CPrFgoHm5xMRhcxGNHdKkw7B2X2uKsnRlY6bUxhhZSZdIUafumHAHWowdRRBZ8G69ShtPQ=s88-c-k-c0x00ffffff-no-rj

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&autoplay=1&loop=1&mute=1&playlist=jeD5dxpNSLo

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f132.1e100.net

Software

fife /

Resource Hash

f82ebc761788c79b3635fec5c5276321e2bdfc84a5913044417609adef8b5303

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 02:10:03 GMT
x-content-type-options: nosniff
age: 0
content-disposition: inline;filename="channels4_profile.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4031
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 21 Dec 2023 02:10:03 GMT

POST
H2 200 csp-report
q.stripe.com/ Frame 12E6 0
490 B 88ms
88ms Other
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://m.stripe.network/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Wed, 20 Dec 2023 02:10:03 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1703038203150055
x-envoy-upstream-service-time: 1
content-length: 0
x-stripe-bg-intended-route-color: green
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
cross-origin-opener-policy: same-origin
x-stripe-server-envoy-upstream-service-time-ms: 0
x-stripe-client-envoy-start-time-us: 1703038203149719
cache-control: max-age=0, no-cache, no-store, must-revalidate
x-robots-tag: none
expires: 0

GET
H2 200 out-4.5.43.js Show response
m.stripe.network/ Frame 12E6 87 KB
15 KB 18ms
17ms Script
text/javascript 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.network/out-4.5.43.js

Requested by

Host: m.stripe.network
URL: https://m.stripe.network/inner.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

e039e607c78306c7e029a7fd0ecdb14f86456f16e1a5ce65aa26b4fdf1d38a3c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://m.stripe.network/inner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
date: Wed, 20 Dec 2023 02:10:03 GMT
x-content-type-options: nosniff
content-encoding: br
via: 1.1 varnish
age: 109
x-cache: HIT
content-length: 15509
x-request-id: ce0627fa-c57a-49a6-938b-12fc0db77a5a
x-served-by: cache-yyz4541-YYZ
server: Fastly
x-timer: S1703038203.108355,VS0,VE0
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=utf-8
cache-control: max-age=300, public
accept-ranges: bytes
x-cache-hits: 58

POST
H3 200 videoplayback Show response
rr5---sn-vgqsrne6.googlevideo.com/ Frame F1D8 64 KB
64 KB 114ms
65ms Fetch
application/vnd.yt-ump 209.85.164.234
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://rr5---sn-vgqsrne6.googlevideo.com/videoplayback?expire=1703059802&ei=-kyCZcL-HI-M_9EPxceAqAk&ip=86.48.14.70&id=o-AHGdhAyob_R27BGbppNXHXkamOQ3b8tHnNy4FNHkRtwg&itag=243&aitags=133%2C134%2C135%2C136%2C137%2C160%2C242%2C243%2C244%2C247%2C248%2C278&source=youtube&requiressl=yes&xpc=EgVo2aDSNQ%3D%3D&spc=UWF9fwaXQ252oIuVCX2tKQAW0gtmcdrN1_OZvqR0zg&vprv=1&svpuc=1&mime=video%2Fwebm&ns=HtKlFwrpwSD4C58rXDchClwQ&gir=yes&clen=379533&dur=19.633&lmt=1698030525033392&keepalive=yes&fexp=24007246,24350138,24350146,24350147&c=WEB_EMBEDDED_PLAYER&txp=531F224&n=bByQU2ruxwjB4g&sparams=expire%2Cei%2Cip%2Cid%2Caitags%2Csource%2Crequiressl%2Cxpc%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Cgir%2Cclen%2Cdur%2Clmt&sig=AJfQdSswRAIgItfkXVnCjOXNUOsZ2SE13aYi7aNScMjR1QCFrLlMmHgCIFb2od_yHFgBgwYxQ6PvrkASXObUguXydmIFD7gXhgF1&alr=yes&cpn=svC5CK6PJaZKeXrQ&cver=1.20231212.01.00&redirect_counter=1&cm2rm=sn-tt1lk7z&cms_redirect=yes&cmsv=e&mh=tR&mm=34&mn=sn-vgqsrne6&ms=ltu&mt=1703037868&mv=m&mvi=5&pl=24&lsparams=mh,mm,mn,ms,mv,mvi,pl&lsig=AAO5W4owRAIgUBouXJrezcAP3Q9Xnha0yJwKVwj8z1EU5c0Ul3WQIrYCIBBYqQfgky6KZeWtjZj1NOL1ZgxTQWG-EwwuYBSsiB5F&range=0-65820&rn=3&rbuf=0&pot=MnRMl0cAAq2XV0yv-nMUIiBSWyMAoMStsQilNIRXu98daR6JQTnHDsZ1BPC134WvIvLDPFh-21IiP1nxYvCPHVZkkHWnKX9E7mYr1qlsmrkBopyEFa86MNPdY495V6sa8jisK8FEHtzq04Jo7_UupwJtxj6NYQ==&ump=1&srfvp=1&altitags=242%2C278

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

209.85.164.234 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ord38s15-in-f10.1e100.net

Software

gvs 1.0 /

Resource Hash

80bde6b2c6ef0d7b78fe29b97269a27c1ac96fb46a9ef8f57e2f2b7d4e4f7b3a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Wed, 20 Dec 2023 02:10:03 GMT
date: Wed, 20 Dec 2023 02:10:03 GMT
x-restrict-formats-hint: None
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46"
last-modified: Mon, 23 Oct 2023 03:08:45 GMT
server: gvs 1.0
vary: Origin
content-type: application/vnd.yt-ump
access-control-allow-origin: https://www.youtube.com
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: private, max-age=21299
access-control-allow-credentials: true
timing-allow-origin: https://www.youtube.com
client-protocol: quic

POST
H3 200 videoplayback Show response
rr5---sn-vgqsrne6.googlevideo.com/ Frame F1D8 64 KB
64 KB 119ms
72ms Fetch
application/vnd.yt-ump 209.85.164.234
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://rr5---sn-vgqsrne6.googlevideo.com/videoplayback?expire=1703059802&ei=-kyCZcL-HI-M_9EPxceAqAk&ip=86.48.14.70&id=o-AHGdhAyob_R27BGbppNXHXkamOQ3b8tHnNy4FNHkRtwg&itag=251&source=youtube&requiressl=yes&xpc=EgVo2aDSNQ%3D%3D&spc=UWF9fwaXQ252oIuVCX2tKQAW0gtmcdrN1_OZvqR0zg&vprv=1&svpuc=1&mime=audio%2Fwebm&ns=HtKlFwrpwSD4C58rXDchClwQ&gir=yes&clen=273227&dur=19.681&lmt=1698030522265040&keepalive=yes&fexp=24007246,24350138,24350146,24350147&c=WEB_EMBEDDED_PLAYER&txp=5318224&n=bByQU2ruxwjB4g&sparams=expire%2Cei%2Cip%2Cid%2Citag%2Csource%2Crequiressl%2Cxpc%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Cgir%2Cclen%2Cdur%2Clmt&sig=AJfQdSswRQIgWEZGEcuyUgoFJHeOpXBc0ZJFAfAHlDcKDYYEK4jyN5kCIQCa_lB36WHqTesEg4iI_G81jf73LkvCKhdJNR77_dyHjw%3D%3D&alr=yes&cpn=svC5CK6PJaZKeXrQ&cver=1.20231212.01.00&redirect_counter=1&cm2rm=sn-tt1lk7z&cms_redirect=yes&cmsv=e&mh=tR&mm=34&mn=sn-vgqsrne6&ms=ltu&mt=1703037868&mv=m&mvi=5&pl=24&lsparams=mh,mm,mn,ms,mv,mvi,pl&lsig=AAO5W4owRAIgD3Kx3aS6ss5X_eu5QK4xk0XEGnJzy7n0d5tCbGltPQgCIGlnEl7RYvM-okRQdLc743bRSd9BHrjfOOUe9CG1_JFw&range=0-65835&rn=4&rbuf=0&pot=MnRMl0cAAq2XV0yv-nMUIiBSWyMAoMStsQilNIRXu98daR6JQTnHDsZ1BPC134WvIvLDPFh-21IiP1nxYvCPHVZkkHWnKX9E7mYr1qlsmrkBopyEFa86MNPdY495V6sa8jisK8FEHtzq04Jo7_UupwJtxj6NYQ==&ump=1&srfvp=1

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

209.85.164.234 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ord38s15-in-f10.1e100.net

Software

gvs 1.0 /

Resource Hash

fc69ee1a63302d4fd29f1370a9f34817d861d02f76ffe05ce4da9ed5c76b36ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

client-protocol: quic
date: Wed, 20 Dec 2023 02:10:03 GMT
x-content-type-options: nosniff
last-modified: Mon, 23 Oct 2023 03:08:42 GMT
server: gvs 1.0
vary: Origin
content-type: application/vnd.yt-ump
access-control-allow-origin: https://www.youtube.com
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: private, max-age=21299
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: https://www.youtube.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46"
expires: Wed, 20 Dec 2023 02:10:03 GMT

GET
H2 200 hcaptcha-invisible-21d0f7b9caac917a250454733d386bfa.html Show response
js.stripe.com/v3/ Frame EF29 70 KB
24 KB 43ms
43ms Document
text/html 52.85.151.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/hcaptcha-invisible-21d0f7b9caac917a250454733d386bfa.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-117.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

06f560685ca3c65e18a4eb8b834ac16b54c48598385557f7fc4d3dfb3719a667

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://errors.stripe.com https://r.stripe.com; default-src 'self'; form-action 'none'; frame-src 'self' https://b.stripecdn.com; img-src 'self' https://q.stripe.com; script-src 'self' 'sha256-AZpRkJC32EgboMU2+9b/oDkboZoRvavsDhAJb4OxDe0='; style-src 'self'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-origin: *
age: 47
cache-control: max-age=60
content-encoding: gzip
content-security-policy: base-uri 'none'; connect-src 'self' https://errors.stripe.com https://r.stripe.com; default-src 'self'; form-action 'none'; frame-src 'self' https://b.stripecdn.com; img-src 'self' https://q.stripe.com; script-src 'self' 'sha256-AZpRkJC32EgboMU2+9b/oDkboZoRvavsDhAJb4OxDe0='; style-src 'self'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Wed, 20 Dec 2023 02:09:20 GMT
etag: W/"21d0f7b9caac917a250454733d386bfa"
last-modified: Tue, 19 Dec 2023 21:32:15 GMT
server: Cloudfront
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 2f66aa06710fece8ed203ab0ea81eb56.cloudfront.net (CloudFront)
x-amz-cf-id: ZDp_GYqYo3m8tvLP9ReKXEl8hf1p4ra4PG4keebu_gjYpMZzztUcYw==
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
x-content-type-options: nosniff

POST
H2 200 b Show response
r.stripe.com/ Frame 4553 0
272 B 90ms
89ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Wed, 20 Dec 2023 02:10:03 GMT
x-stripe-server-envoy-start-time-us: 1703038203180494
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 2
x-stripe-client-envoy-start-time-us: 1703038203180341
access-control-allow-credentials: true
content-length: 0

POST
H2 200 b Show response
r.stripe.com/ Frame 4553 0
272 B 92ms
91ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Wed, 20 Dec 2023 02:10:03 GMT
x-stripe-server-envoy-start-time-us: 1703038203182040
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 3
x-stripe-client-envoy-start-time-us: 1703038203181746
access-control-allow-credentials: true
content-length: 0

GET
H2 200 phone-numbers-lib-7c5affd44f7be899b2e4e0b567629e7e.js Show response
js.stripe.com/v3/fingerprinted/js/ 148 KB
36 KB 41ms
40ms Script
text/javascript 52.85.151.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/phone-numbers-lib-7c5affd44f7be899b2e4e0b567629e7e.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-117.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

7fca7fbee6f960ca0c929ed86e99e6078981b2000629fad83c2fb36530dbcbcc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 02:08:59 GMT
content-encoding: gzip
via: 1.1 2f66aa06710fece8ed203ab0ea81eb56.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 67
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Mon, 18 Dec 2023 21:17:09 GMT
server: Cloudfront
etag: W/"a4e8e6cecb07513a8c3637f2fb95c7b9"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: 5fzosdBDgES9zm5_Ss5vg0Fq7dH8K-JlHm0qlBvx2a6CFe7muo8atQ==

GET
H2 200 elements-inner-link-button-for-card-0e45e2a27e4f7a57fe49a1f7c9e465be.html Show response
js.stripe.com/v3/ Frame 41C1 73 KB
16 KB 39ms
39ms Document
text/html 52.85.151.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/elements-inner-link-button-for-card-0e45e2a27e4f7a57fe49a1f7c9e465be.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-117.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

ce05d09a5e7ee53c24528bb1c936cdc34470bcebd1b6da22585d1effffbac26b

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://ppm.stripe.com; default-src 'self'; font-src data: https:; form-action 'none'; frame-src 'self' https://www.affirm.com https://checkout.link.com https://b.stripecdn.com; img-src 'self' https://q.stripe.com https://b.stripecdn.com https://js.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-origin: *
age: 2103
cache-control: max-age=31536000
content-encoding: br
content-security-policy: base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://ppm.stripe.com; default-src 'self'; font-src data: https:; form-action 'none'; frame-src 'self' https://www.affirm.com https://checkout.link.com https://b.stripecdn.com; img-src 'self' https://q.stripe.com https://b.stripecdn.com https://js.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; report-uri https://q.stripe.com/csp-report
content-security-policy-report-only: base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://ppm.stripe.com; default-src 'self'; font-src data: https:; form-action 'none'; frame-src 'self' https://www.affirm.com https://checkout.link.com https://b.stripecdn.com; img-src 'self' https://q.stripe.com https://b.stripecdn.com https://js.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Wed, 20 Dec 2023 01:35:23 GMT
etag: W/"0e45e2a27e4f7a57fe49a1f7c9e465be"
last-modified: Tue, 19 Dec 2023 21:32:01 GMT
server: Cloudfront
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 2f66aa06710fece8ed203ab0ea81eb56.cloudfront.net (CloudFront)
x-amz-cf-id: 8ttSOCCP_b5cA3VW_YZXTHn_9e7ZZtygeBiZbcLlE8M5B_kem92HnQ==
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
x-content-type-options: nosniff

GET
H2 200 cast_sender.js Show response
www.gstatic.com/cv/js/sender/v1/ Frame F1D8 4 KB
2 KB 140ms
68ms Script
text/javascript 172.253.115.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/cv/js/sender/v1/cast_sender.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/base.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f94.1e100.net

Software

sffe /

Resource Hash

ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 02:10:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cloudview
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2007
x-xss-protection: 0
last-modified: Tue, 16 Feb 2021 23:57:06 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="cloudview"
vary: Accept-Encoding
report-to: {"group":"cloudview","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cloudview"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 20 Dec 2023 02:10:03 GMT

POST
H2 200 csp-report
q.stripe.com/ Frame EF29 0
717 B 95ms
87ms Other
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Wed, 20 Dec 2023 02:10:03 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1703038203277663
x-envoy-upstream-service-time: 1
content-length: 0
x-stripe-bg-intended-route-color: green
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
cross-origin-opener-policy: same-origin
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
x-stripe-server-envoy-upstream-service-time-ms: 0
access-control-allow-origin: https://js.stripe.com
x-stripe-client-envoy-start-time-us: 1703038203277345
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-expose-headers: Server, Range, Content-Type
x-robots-tag: none
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires: 0

GET
H2 200 shared-f5b29667107ca8f92f2c8276457cfdff.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 41C1 547 KB
120 KB 40ms
38ms Script
text/javascript 52.85.151.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-link-button-for-card-0e45e2a27e4f7a57fe49a1f7c9e465be.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-117.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

8bac8b4fe50c6203069c3386d71372ae668bb603f67bdcaa707f87c90ba45739

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-link-button-for-card-0e45e2a27e4f7a57fe49a1f7c9e465be.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 01:34:45 GMT
content-encoding: br
via: 1.1 2f66aa06710fece8ed203ab0ea81eb56.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 2119
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Tue, 19 Dec 2023 21:32:14 GMT
server: Cloudfront
etag: W/"50ac79781b0db4dc8141ff8720f49193"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: P5WyqtA6IZbMtBDcKS9OylSsCx7xtmR9y7IpZJwcqTuDTvUa6sFx7Q==

GET
H2 200 elements-inner-link-button-for-card-99e1053df8b3cdd6264998124c613e28.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 41C1 25 KB
9 KB 43ms
40ms Script
text/javascript 52.85.151.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/elements-inner-link-button-for-card-99e1053df8b3cdd6264998124c613e28.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-link-button-for-card-0e45e2a27e4f7a57fe49a1f7c9e465be.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-117.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

2f930a05ca463582b325c1e317bfec295d6f644951b4d44be5724d71c2777cfa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-link-button-for-card-0e45e2a27e4f7a57fe49a1f7c9e465be.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 01:42:17 GMT
content-encoding: br
via: 1.1 2f66aa06710fece8ed203ab0ea81eb56.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 1708
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Mon, 18 Dec 2023 21:17:07 GMT
server: Cloudfront
etag: W/"9a76aaf8c2784316e53afd7947d046fa"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: Tjj2ZEUsMkgh1MnlGuh0TMKYZCTclKF0lUFkNW_qUdn4-WM1y8m9lg==

GET
H2 200 elements-inner-link-button-for-card-42a4ee70245e79dcd6b946f237887fcd.css
js.stripe.com/v3/fingerprinted/css/ Frame 41C1 25 KB
4 KB 39ms
37ms Stylesheet
text/css 52.85.151.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/css/elements-inner-link-button-for-card-42a4ee70245e79dcd6b946f237887fcd.css

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-link-button-for-card-0e45e2a27e4f7a57fe49a1f7c9e465be.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-117.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

88c3d4d5beaaf259f1a4d85ec5c6b14e74ea9d0a6ce99751fa218f57757785c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-link-button-for-card-0e45e2a27e4f7a57fe49a1f7c9e465be.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 01:54:27 GMT
content-encoding: gzip
via: 1.1 2f66aa06710fece8ed203ab0ea81eb56.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 956
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Sat, 16 Dec 2023 02:01:22 GMT
server: Cloudfront
etag: W/"08aa13fc3d627e7cc58096e8a319c2c8"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: z0657QOCUOujjU1DYV7OAFFzppfBzvExEOSqp8ICOJk0ZE4xeNA6HQ==

GET
H2 200 .deploy_status_henson.json Show response
js.stripe.com/v3/ Frame EF29 474 B
865 B 41ms
40ms Fetch
application/json 52.85.151.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.stripe.com/v3/.deploy_status_henson.json
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/hcaptcha-invisible-21d0f7b9caac917a250454733d386bfa.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.151.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-151-117.iad89.r.cloudfront.net
Software: Cloudfront /
Resource Hash: e20df4d423b37ce34fb8c17da7216ba9f70a05cc93ad807eb3cf454dfe56c411

Request headers

Accept: application/json
Referer: https://js.stripe.com/v3/hcaptcha-invisible-21d0f7b9caac917a250454733d386bfa.html
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Wed, 20 Dec 2023 02:09:05 GMT
via: 1.1 c35f767218cbd1125d801b52fa785c8c.cloudfront.net (CloudFront)
last-modified: Tue, 19 Dec 2023 22:04:23 GMT
server: Cloudfront
age: 59
x-amz-cf-pop: IAD89-C3
etag: "98b2edf5e48fde7507e0a9757d567aea"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=60
accept-ranges: bytes
content-length: 474
x-amz-cf-id: SwmHrw1boUZZoDqsH0XNgKjZ6INctVXrOh6nNqBq_011vCdtqGJfnw==

GET
H2 200 HCaptchaInvisible.html Show response
b.stripecdn.com/stripethirdparty-srv/assets/v19.2/ Frame 28F7 419 B
721 B 448ms
431ms Document
text/html 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://b.stripecdn.com/stripethirdparty-srv/assets/v19.2/HCaptchaInvisible.html?id=446e0bb5-4863-43c8-a36e-f7fa521f28fe&origin=https%3A%2F%2Fjs.stripe.com

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/hcaptcha-invisible-21d0f7b9caac917a250454733d386bfa.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

812091a91a8e2a825050fb688375d19996b235d7cbe8b0ae9d526cba0fb7288d

Security Headers

Name	Value
Content-Security-Policy	base-uri 'self'; connect-src 'self' https://hcaptcha.com https://.hcaptcha.com https://errors.stripe.com; default-src 'self'; form-action 'none'; frame-src https://hcaptcha.com https://.hcaptcha.com; img-src 'self'; script-src 'self' https://hcaptcha.com https://.hcaptcha.com; style-src 'self' https://hcaptcha.com https://.hcaptcha.com; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 0
cache-control: max-age=60
content-encoding: br
content-length: 283
content-security-policy: base-uri 'self'; connect-src 'self' https://hcaptcha.com https://*.hcaptcha.com https://errors.stripe.com; default-src 'self'; form-action 'none'; frame-src https://hcaptcha.com https://*.hcaptcha.com; img-src 'self'; script-src 'self' https://hcaptcha.com https://*.hcaptcha.com; style-src 'self' https://hcaptcha.com https://*.hcaptcha.com; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Wed, 20 Dec 2023 02:10:03 GMT
server: Fastly
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding, Origin
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-content-type-options: nosniff
x-request-id: 87b07525-c92e-4789-bf20-573a047d2f90
x-served-by: cache-yyz4541-YYZ
x-timer: S1703038203.280224,VS0,VE414

POST
H2 200 6 Show response
m.stripe.com/ Frame 12E6 156 B
669 B 274ms
92ms XHR
application/json 44.233.104.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.com/6

Requested by

Host: m.stripe.network
URL: https://m.stripe.network/out-4.5.43.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.233.104.20 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-44-233-104-20.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

8d1181160c5a70a5bfe59701c0fc83930aa85d8a08baf2988417a20bc5f5e709

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://m.stripe.network/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-stripe-bg-intended-route-color: green
date: Wed, 20 Dec 2023 02:10:03 GMT
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1703038203494218
server: nginx
content-type: application/json;charset=utf-8
x-stripe-server-envoy-upstream-service-time-ms: 2
access-control-allow-origin: https://m.stripe.network
x-stripe-client-envoy-start-time-us: 1703038203493904
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 156

POST
H2 200 csp-report
q.stripe.com/ Frame 41C1 0
717 B 90ms
89ms Other
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Wed, 20 Dec 2023 02:10:03 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1703038203314284
x-envoy-upstream-service-time: 2
content-length: 0
x-stripe-bg-intended-route-color: green
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
cross-origin-opener-policy: same-origin
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
x-stripe-server-envoy-upstream-service-time-ms: 0
access-control-allow-origin: https://js.stripe.com
x-stripe-client-envoy-start-time-us: 1703038203313876
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-expose-headers: Server, Range, Content-Type
x-robots-tag: none
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires: 0

POST
H2 200 csp-report
q.stripe.com/ Frame 41C1 0
717 B 89ms
88ms Other
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Wed, 20 Dec 2023 02:10:03 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1703038203314279
x-envoy-upstream-service-time: 1
content-length: 0
x-stripe-bg-intended-route-color: green
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
cross-origin-opener-policy: same-origin
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
x-stripe-server-envoy-upstream-service-time-ms: 0
access-control-allow-origin: https://js.stripe.com
x-stripe-client-envoy-start-time-us: 1703038203313843
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-expose-headers: Server, Range, Content-Type
x-robots-tag: none
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires: 0

POST
H3 200 videoplayback Show response
rr5---sn-vgqsrne6.googlevideo.com/ Frame F1D8 64 KB
64 KB 31ms
30ms Fetch
application/vnd.yt-ump 209.85.164.234
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://rr5---sn-vgqsrne6.googlevideo.com/videoplayback?expire=1703059802&ei=-kyCZcL-HI-M_9EPxceAqAk&ip=86.48.14.70&id=o-AHGdhAyob_R27BGbppNXHXkamOQ3b8tHnNy4FNHkRtwg&itag=243&aitags=133%2C134%2C135%2C136%2C137%2C160%2C242%2C243%2C244%2C247%2C248%2C278&source=youtube&requiressl=yes&xpc=EgVo2aDSNQ%3D%3D&spc=UWF9fwaXQ252oIuVCX2tKQAW0gtmcdrN1_OZvqR0zg&vprv=1&svpuc=1&mime=video%2Fwebm&ns=HtKlFwrpwSD4C58rXDchClwQ&gir=yes&clen=379533&dur=19.633&lmt=1698030525033392&keepalive=yes&fexp=24007246,24350138,24350146,24350147&c=WEB_EMBEDDED_PLAYER&txp=531F224&n=bByQU2ruxwjB4g&sparams=expire%2Cei%2Cip%2Cid%2Caitags%2Csource%2Crequiressl%2Cxpc%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Cgir%2Cclen%2Cdur%2Clmt&sig=AJfQdSswRAIgItfkXVnCjOXNUOsZ2SE13aYi7aNScMjR1QCFrLlMmHgCIFb2od_yHFgBgwYxQ6PvrkASXObUguXydmIFD7gXhgF1&alr=yes&cpn=svC5CK6PJaZKeXrQ&cver=1.20231212.01.00&redirect_counter=1&cm2rm=sn-tt1lk7z&cms_redirect=yes&cmsv=e&mh=tR&mm=34&mn=sn-vgqsrne6&ms=ltu&mt=1703037868&mv=m&mvi=5&pl=24&lsparams=mh,mm,mn,ms,mv,mvi,pl&lsig=AAO5W4owRAIgUBouXJrezcAP3Q9Xnha0yJwKVwj8z1EU5c0Ul3WQIrYCIBBYqQfgky6KZeWtjZj1NOL1ZgxTQWG-EwwuYBSsiB5F&range=65821-131356&rn=5&rbuf=3389&pot=MnRMl0cAAq2XV0yv-nMUIiBSWyMAoMStsQilNIRXu98daR6JQTnHDsZ1BPC134WvIvLDPFh-21IiP1nxYvCPHVZkkHWnKX9E7mYr1qlsmrkBopyEFa86MNPdY495V6sa8jisK8FEHtzq04Jo7_UupwJtxj6NYQ==&ump=1&srfvp=1

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

209.85.164.234 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ord38s15-in-f10.1e100.net

Software

gvs 1.0 /

Resource Hash

192cfad4a0b19d97e0814b118efff433497c92220c08bc5fff6b0bda164b7891

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Wed, 20 Dec 2023 02:10:03 GMT
date: Wed, 20 Dec 2023 02:10:03 GMT
x-restrict-formats-hint: None
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46"
last-modified: Mon, 23 Oct 2023 03:08:45 GMT
server: gvs 1.0
vary: Origin
content-type: application/vnd.yt-ump
access-control-allow-origin: https://www.youtube.com
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: private, max-age=21299
access-control-allow-credentials: true
timing-allow-origin: https://www.youtube.com
client-protocol: quic

GET
H2 200 cast_sender.js Show response
www.gstatic.com/eureka/clank/120/ Frame F1D8 50 KB
15 KB 37ms
36ms Script
text/javascript 172.253.115.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/eureka/clank/120/cast_sender.js

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/cv/js/sender/v1/cast_sender.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f94.1e100.net

Software

sffe /

Resource Hash

f4d5deb4709cebcb8d869180a1db81fab7c54f99dc2e72dab8b3db15eb76e660

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 02:34:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 84952
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cloudview-release
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14705
x-xss-protection: 0
last-modified: Mon, 23 Oct 2023 15:04:43 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="cloudview-release"
vary: Accept-Encoding
report-to: {"group":"cloudview-release","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cloudview-release"}]}
content-type: text/javascript
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Wed, 20 Dec 2023 02:34:11 GMT

GET
H2 200 cast_sender.js Show response
www.gstatic.com/eureka/clank/120/ Frame EC09 50 KB
14 KB 39ms
37ms Script
text/javascript 172.253.115.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/eureka/clank/120/cast_sender.js

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/cv/js/sender/v1/cast_sender.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f94.1e100.net

Software

sffe /

Resource Hash

f4d5deb4709cebcb8d869180a1db81fab7c54f99dc2e72dab8b3db15eb76e660

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 02:34:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 84952
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cloudview-release
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14705
x-xss-protection: 0
last-modified: Mon, 23 Oct 2023 15:04:43 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="cloudview-release"
vary: Accept-Encoding
report-to: {"group":"cloudview-release","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cloudview-release"}]}
content-type: text/javascript
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Wed, 20 Dec 2023 02:34:11 GMT

GET
H2 200 m=Das5Le Show response
www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.YdcqkS5vMbo.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.BIA... Frame FF00 73 KB
27 KB 36ms
36ms Script
text/javascript 172.253.115.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.YdcqkS5vMbo.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.BIAwI5M4WSM.L.B1.O/am=gEEY/d=1/exm=_b,_tp/excm=_b,_tp,payframeview/ed=1/wt=2/ujg=1/rs=AMitfrgA0Ag7BGPPJwYUBV79paovzI37tQ/ee=EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SNUn3:ZwDk9d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;oGtAuc:sOXFj;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;wR5FRb:siKnQd;yEQyxe:p8L0ob;yxTchf:KUM7Z/m=Das5Le

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.YdcqkS5vMbo.es5.O/am=gEEY/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/ujg=1/rs=AMitfrggnGfTFx3XyHaDNbms4pfQ_DmHyg/m=_b,_tp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f94.1e100.net

Software

sffe /

Resource Hash

aeb652b78321c44ec942fe266f5a17cf8df9b3ac211575a05a59ceb2e9b7d146

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 14 Dec 2023 03:19:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 514259
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/payments-consumer-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27246
x-xss-protection: 0
last-modified: Tue, 12 Dec 2023 05:55:31 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="boq-infra/payments-consumer-boq-js-css-signers"
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/payments-consumer-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/payments-consumer-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Fri, 13 Dec 2024 03:19:04 GMT

POST
H3 200 videoplayback Show response
rr5---sn-vgqsrne6.googlevideo.com/ Frame F1D8 64 KB
64 KB 36ms
36ms Fetch
application/vnd.yt-ump 209.85.164.234
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://rr5---sn-vgqsrne6.googlevideo.com/videoplayback?expire=1703059802&ei=-kyCZcL-HI-M_9EPxceAqAk&ip=86.48.14.70&id=o-AHGdhAyob_R27BGbppNXHXkamOQ3b8tHnNy4FNHkRtwg&itag=251&source=youtube&requiressl=yes&xpc=EgVo2aDSNQ%3D%3D&spc=UWF9fwaXQ252oIuVCX2tKQAW0gtmcdrN1_OZvqR0zg&vprv=1&svpuc=1&mime=audio%2Fwebm&ns=HtKlFwrpwSD4C58rXDchClwQ&gir=yes&clen=273227&dur=19.681&lmt=1698030522265040&keepalive=yes&fexp=24007246,24350138,24350146,24350147&c=WEB_EMBEDDED_PLAYER&txp=5318224&n=bByQU2ruxwjB4g&sparams=expire%2Cei%2Cip%2Cid%2Citag%2Csource%2Crequiressl%2Cxpc%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Cgir%2Cclen%2Cdur%2Clmt&sig=AJfQdSswRQIgWEZGEcuyUgoFJHeOpXBc0ZJFAfAHlDcKDYYEK4jyN5kCIQCa_lB36WHqTesEg4iI_G81jf73LkvCKhdJNR77_dyHjw%3D%3D&alr=yes&cpn=svC5CK6PJaZKeXrQ&cver=1.20231212.01.00&redirect_counter=1&cm2rm=sn-tt1lk7z&cms_redirect=yes&cmsv=e&mh=tR&mm=34&mn=sn-vgqsrne6&ms=ltu&mt=1703037868&mv=m&mvi=5&pl=24&lsparams=mh,mm,mn,ms,mv,mvi,pl&lsig=AAO5W4owRAIgD3Kx3aS6ss5X_eu5QK4xk0XEGnJzy7n0d5tCbGltPQgCIGlnEl7RYvM-okRQdLc743bRSd9BHrjfOOUe9CG1_JFw&range=65836-131496&rn=6&rbuf=4163&pot=MnRMl0cAAq2XV0yv-nMUIiBSWyMAoMStsQilNIRXu98daR6JQTnHDsZ1BPC134WvIvLDPFh-21IiP1nxYvCPHVZkkHWnKX9E7mYr1qlsmrkBopyEFa86MNPdY495V6sa8jisK8FEHtzq04Jo7_UupwJtxj6NYQ==&ump=1&srfvp=1

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

209.85.164.234 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ord38s15-in-f10.1e100.net

Software

gvs 1.0 /

Resource Hash

254c7c3d65cfcc1a282323430a2f49560b55fafacccda77111bfc89edd3d3f71

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

client-protocol: quic
date: Wed, 20 Dec 2023 02:10:03 GMT
x-content-type-options: nosniff
last-modified: Mon, 23 Oct 2023 03:08:42 GMT
server: gvs 1.0
vary: Origin
content-type: application/vnd.yt-ump
access-control-allow-origin: https://www.youtube.com
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: private, max-age=21299
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: https://www.youtube.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46"
expires: Wed, 20 Dec 2023 02:10:03 GMT

GET
H3 200 pay Show response
pay.google.com/gp/p/ui/ Frame FF00 1 MB
376 KB 102ms
102ms XHR
text/html 142.251.16.92
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pay.google.com/gp/p/ui/pay

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.92 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f92.1e100.net

Software

ESF /

Resource Hash

53a5b2b0368e18c799c647cbacaff57dcd7829e53a26e63bcab72c9c96853631

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport, script-src 'report-sample' 'nonce-6k4HnC3WhiKhOv8i8HzV3g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com https://sandbox.google.com https://payments.google.com https://payments.sandbox.google.com https://pay.google.com https://pay.sandbox.google.com;report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport/allowlist
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 02:10:03 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
content-security-policy: require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport, script-src 'report-sample' 'nonce-6k4HnC3WhiKhOv8i8HzV3g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com https://sandbox.google.com https://payments.google.com https://payments.sandbox.google.com https://pay.google.com https://pay.sandbox.google.com;report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport/allowlist
x-content-type-options: nosniff
cross-origin-resource-policy: same-site
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
x-ua-compatible: IE=edge
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: unsafe-none
server: ESF
x-frame-options: DENY
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
cache-control: private, max-age=3600
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Wed, 20 Dec 2023 02:10:03 GMT

POST
H3 200 videoplayback Show response
rr5---sn-vgqsrne6.googlevideo.com/ Frame F1D8 134 KB
134 KB 33ms
32ms Fetch
application/vnd.yt-ump 209.85.164.234
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://rr5---sn-vgqsrne6.googlevideo.com/videoplayback?expire=1703059802&ei=-kyCZcL-HI-M_9EPxceAqAk&ip=86.48.14.70&id=o-AHGdhAyob_R27BGbppNXHXkamOQ3b8tHnNy4FNHkRtwg&itag=243&aitags=133%2C134%2C135%2C136%2C137%2C160%2C242%2C243%2C244%2C247%2C248%2C278&source=youtube&requiressl=yes&xpc=EgVo2aDSNQ%3D%3D&spc=UWF9fwaXQ252oIuVCX2tKQAW0gtmcdrN1_OZvqR0zg&vprv=1&svpuc=1&mime=video%2Fwebm&ns=HtKlFwrpwSD4C58rXDchClwQ&gir=yes&clen=379533&dur=19.633&lmt=1698030525033392&keepalive=yes&fexp=24007246,24350138,24350146,24350147&c=WEB_EMBEDDED_PLAYER&txp=531F224&n=bByQU2ruxwjB4g&sparams=expire%2Cei%2Cip%2Cid%2Caitags%2Csource%2Crequiressl%2Cxpc%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Cgir%2Cclen%2Cdur%2Clmt&sig=AJfQdSswRAIgItfkXVnCjOXNUOsZ2SE13aYi7aNScMjR1QCFrLlMmHgCIFb2od_yHFgBgwYxQ6PvrkASXObUguXydmIFD7gXhgF1&alr=yes&cpn=svC5CK6PJaZKeXrQ&cver=1.20231212.01.00&redirect_counter=1&cm2rm=sn-tt1lk7z&cms_redirect=yes&cmsv=e&mh=tR&mm=34&mn=sn-vgqsrne6&ms=ltu&mt=1703037868&mv=m&mvi=5&pl=24&lsparams=mh,mm,mn,ms,mv,mvi,pl&lsig=AAO5W4owRAIgUBouXJrezcAP3Q9Xnha0yJwKVwj8z1EU5c0Ul3WQIrYCIBBYqQfgky6KZeWtjZj1NOL1ZgxTQWG-EwwuYBSsiB5F&range=131357-268680&rn=7&rbuf=6842&pot=MnRMl0cAAq2XV0yv-nMUIiBSWyMAoMStsQilNIRXu98daR6JQTnHDsZ1BPC134WvIvLDPFh-21IiP1nxYvCPHVZkkHWnKX9E7mYr1qlsmrkBopyEFa86MNPdY495V6sa8jisK8FEHtzq04Jo7_UupwJtxj6NYQ==&ump=1&srfvp=1

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

209.85.164.234 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ord38s15-in-f10.1e100.net

Software

gvs 1.0 /

Resource Hash

b873e17f56a05aba705a3056cf0e3ef6c8687ab63ecd0a8f11537b685d8c76e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Wed, 20 Dec 2023 02:10:03 GMT
date: Wed, 20 Dec 2023 02:10:03 GMT
x-restrict-formats-hint: None
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46"
last-modified: Mon, 23 Oct 2023 03:08:45 GMT
server: gvs 1.0
vary: Origin
content-type: application/vnd.yt-ump
access-control-allow-origin: https://www.youtube.com
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: private, max-age=21299
access-control-allow-credentials: true
timing-allow-origin: https://www.youtube.com
client-protocol: quic

GET
H3 200 m=Wt6vjf,hhhU8,FCpbqb,WhJNk Show response
www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.YdcqkS5vMbo.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.BIA... Frame FF00 9 KB
4 KB 37ms
36ms Script
text/javascript 172.253.115.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.YdcqkS5vMbo.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.BIAwI5M4WSM.L.B1.O/am=gEEY/d=1/exm=Das5Le,_b,_tp/excm=_b,_tp,payframeview/ed=1/wt=2/ujg=1/rs=AMitfrgA0Ag7BGPPJwYUBV79paovzI37tQ/ee=EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SNUn3:ZwDk9d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;oGtAuc:sOXFj;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;wR5FRb:siKnQd;yEQyxe:p8L0ob;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f94.1e100.net

Software

sffe /

Resource Hash

321ece339bc501c3ccf8e6efae0f0ceba66b87667ea5dbbd3a44a795f21cf44b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 02:12:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 86237
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/payments-consumer-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3735
x-xss-protection: 0
last-modified: Tue, 12 Dec 2023 05:55:31 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="boq-infra/payments-consumer-boq-js-css-signers"
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/payments-consumer-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/payments-consumer-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Wed, 18 Dec 2024 02:12:46 GMT

GET
H3 200 m=byfTOb,lsjVmc,LEikZe,lwddkf,EFQ78c Show response
www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.YdcqkS5vMbo.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.BIA... Frame FF00 37 KB
14 KB 38ms
38ms Script
text/javascript 172.253.115.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.YdcqkS5vMbo.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.BIAwI5M4WSM.L.B1.O/am=gEEY/d=1/exm=Das5Le,FCpbqb,WhJNk,Wt6vjf,_b,_tp,hhhU8/excm=_b,_tp,payframeview/ed=1/wt=2/ujg=1/rs=AMitfrgA0Ag7BGPPJwYUBV79paovzI37tQ/ee=EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SNUn3:ZwDk9d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;oGtAuc:sOXFj;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;wR5FRb:siKnQd;yEQyxe:p8L0ob;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe,lwddkf,EFQ78c

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f94.1e100.net

Software

sffe /

Resource Hash

8479e373905a24b0dc0efb290d9de9d2e2ed2ccadf74826b4ab6c2cc2ff56099

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 14 Dec 2023 02:57:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 515530
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/payments-consumer-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14274
x-xss-protection: 0
last-modified: Tue, 12 Dec 2023 05:55:31 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="boq-infra/payments-consumer-boq-js-css-signers"
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/payments-consumer-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/payments-consumer-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Fri, 13 Dec 2024 02:57:53 GMT

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 181ms
50ms Preflight
text/plain 142.251.167.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f100.1e100.net

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: x-goog-authuser
Access-Control-Request-Method: POST
Origin: https://pay.google.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://pay.google.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/plain; charset=UTF-8
date: Wed, 20 Dec 2023 02:10:03 GMT
server: Playlog
x-frame-options: SAMEORIGIN
x-xss-protection: 0

POST
H3 200 log Show response
play.google.com/ Frame FF00 131 B
152 B 149ms
76ms XHR
text/plain 142.251.167.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f100.1e100.net

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://pay.google.com/
X-Goog-AuthUser: 0
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Wed, 20 Dec 2023 02:10:03 GMT
content-encoding: gzip
server: Playlog
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: X-Playlog-Web
content-length: 131
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

POST
H3 200 log Show response
play.google.com/ Frame FF00 131 B
152 B 145ms
76ms XHR
text/plain 142.251.167.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f100.1e100.net

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://pay.google.com/
X-Goog-AuthUser: 0
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Wed, 20 Dec 2023 02:10:03 GMT
content-encoding: gzip
server: Playlog
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: X-Playlog-Web
content-length: 131
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 178ms
52ms Preflight
text/plain 142.251.167.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f100.1e100.net

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: x-goog-authuser
Access-Control-Request-Method: POST
Origin: https://pay.google.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://pay.google.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/plain; charset=UTF-8
date: Wed, 20 Dec 2023 02:10:03 GMT
server: Playlog
x-frame-options: SAMEORIGIN
x-xss-protection: 0

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 173ms
51ms Preflight
text/plain 142.251.167.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f100.1e100.net

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: x-goog-authuser
Access-Control-Request-Method: POST
Origin: https://pay.google.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://pay.google.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/plain; charset=UTF-8
date: Wed, 20 Dec 2023 02:10:03 GMT
server: Playlog
x-frame-options: SAMEORIGIN
x-xss-protection: 0

POST
H3 200 log Show response
play.google.com/ Frame FF00 131 B
152 B 145ms
74ms XHR
text/plain 142.251.167.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f100.1e100.net

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://pay.google.com/
X-Goog-AuthUser: 0
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Wed, 20 Dec 2023 02:10:03 GMT
content-encoding: gzip
server: Playlog
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: X-Playlog-Web
content-length: 131
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

POST
H3 200 log Show response
play.google.com/ Frame FF00 131 B
152 B 149ms
77ms XHR
text/plain 142.251.167.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f100.1e100.net

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://pay.google.com/
X-Goog-AuthUser: 0
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Wed, 20 Dec 2023 02:10:03 GMT
content-encoding: gzip
server: Playlog
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: X-Playlog-Web
content-length: 131
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 169ms
50ms Preflight
text/plain 142.251.167.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f100.1e100.net

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: x-goog-authuser
Access-Control-Request-Method: POST
Origin: https://pay.google.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://pay.google.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/plain; charset=UTF-8
date: Wed, 20 Dec 2023 02:10:03 GMT
server: Playlog
x-frame-options: SAMEORIGIN
x-xss-protection: 0

POST
H3 200 log Show response
play.google.com/ Frame FF00 131 B
152 B 152ms
81ms XHR
text/plain 142.251.167.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f100.1e100.net

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://pay.google.com/
X-Goog-AuthUser: 0
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Wed, 20 Dec 2023 02:10:03 GMT
content-encoding: gzip
server: Playlog
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: X-Playlog-Web
content-length: 131
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 168ms
51ms Preflight
text/plain 142.251.167.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f100.1e100.net

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: x-goog-authuser
Access-Control-Request-Method: POST
Origin: https://pay.google.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://pay.google.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/plain; charset=UTF-8
date: Wed, 20 Dec 2023 02:10:03 GMT
server: Playlog
x-frame-options: SAMEORIGIN
x-xss-protection: 0

GET
H3 204 playback Show response
www.youtube.com/api/stats/ Frame F1D8 0
17 B 52ms
51ms XHR
text/html 142.251.111.190
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/api/stats/playback?ns=yt&el=embedded&cpn=svC5CK6PJaZKeXrQ&ver=2&cmt=0.051&fmt=243&fs=0&rt=1.014&euri=https%3A%2F%2Fsecure.winred.com%2F&lact=1055&cl=590345707&mos=1&volume=100&cbr=Chrome&cbrver=120.0.6099.109&c=WEB_EMBEDDED_PLAYER&cver=1.20231212.01.00&cplayer=UNIPLAYER&cos=Windows&cosver=10.0&cplatform=DESKTOP&autoplay=1&epm=1&delay=4&hl=en_US&cr=CA&len=19.681&fexp=v1%2C23983296%2C21348%2C2602%2C73492%2C54572%2C73455%2C176963%2C53633%2C84737%2C25688%2C9541%2C1089%2C5877%2C394%2C26439494%2C4054%2C1930%2C5181%2C9369%2C1556%2C1141%2C5877%2C2251%2C859%2C1094%2C4012%2C5501%2C4683%2C2339%2C7615%2C2008%2C3943%2C609%2C5786%2C1160%2C1332%2C1701%2C723%2C5951&rtn=4&afmt=251&size=344%3A315&inview=1&muted=1&docid=jeD5dxpNSLo&ei=-kyCZcL-HI-M_9EPxceAqAk&plid=AAYM53sZdYXu3aOz&referrer=https%3A%2F%2Fwww.youtube.com%2Fembed%2FjeD5dxpNSLo%3Fsi%3DH_xx5wVJV6ZHDuQp%26autoplay%3D1%26loop%3D1%26mute%3D1%26playlist%3DjeD5dxpNSLo&list=TLGGgcf5X4YlXhsyMDEyMjAyMw&of=2dVkz7e1rF9t_XNU6wGWIw&vm=CAEQABgEOjJBSHFpSlRMb1VoOTY4T0REMmNFWk1ER0dZeTV3X3hzdHNaZ3U2T0IwRE1lZXoxbEpid2JwQVBta0tESXNuOVJQUndtRU1YMFBUZ2ZqSzQ4ZElKTzJmYVQ0VFV2V1ZPSm9oMjAwRHFzSEpYOXF6UFpWOHJzdWRyVThXM0duWEVCM01RNmN2enlGcjZxUld1OFBPS2tKbTBJazFuUHB1bVgzeDZMTmgC

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.190 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f190.1e100.net

Software

Video Stats Server /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
X-YouTube-Utc-Offset: -480
X-YouTube-Client-Name: 56
Referer: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&autoplay=1&loop=1&mute=1&playlist=jeD5dxpNSLo
X-YouTube-Client-Version: 1.20231212.01.00
X-YouTube-Time-Zone: America/Vancouver
X-Goog-Visitor-Id: Cgt6aVh6RG9XMldIRSj5mYmsBjIKCgJDQRIEGgAgLA%3D%3D
X-YouTube-Ad-Signals: dt=1703038202191&flash=0&frm=2&u_tz=-480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C344%2C315&vis=1&wgl=true&ca_type=image

Response headers

pragma: no-cache
date: Wed, 20 Dec 2023 02:10:03 GMT
x-content-type-options: nosniff
server: Video Stats Server
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 ptracking Show response
www.youtube.com/ Frame F1D8 0
17 B 53ms
51ms XHR
text/html 142.251.111.190
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/ptracking?html5=1&video_id=jeD5dxpNSLo&cpn=svC5CK6PJaZKeXrQ&ei=-kyCZcL-HI-M_9EPxceAqAk&ptk=youtube_none&pltype=contentugc

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.190 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f190.1e100.net

Software

Video Stats Server /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
X-YouTube-Utc-Offset: -480
X-YouTube-Client-Name: 56
Referer: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&autoplay=1&loop=1&mute=1&playlist=jeD5dxpNSLo
X-YouTube-Client-Version: 1.20231212.01.00
X-YouTube-Time-Zone: America/Vancouver
X-Goog-Visitor-Id: Cgt6aVh6RG9XMldIRSj5mYmsBjIKCgJDQRIEGgAgLA%3D%3D
X-YouTube-Ad-Signals: dt=1703038202191&flash=0&frm=2&u_tz=-480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C344%2C315&vis=1&wgl=true&ca_type=image

Response headers

pragma: no-cache
date: Wed, 20 Dec 2023 02:10:03 GMT
x-content-type-options: nosniff
server: Video Stats Server
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 144ms
49ms Preflight
text/plain 142.251.167.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f100.1e100.net

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: x-goog-authuser
Access-Control-Request-Method: POST
Origin: https://pay.google.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://pay.google.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/plain; charset=UTF-8
date: Wed, 20 Dec 2023 02:10:03 GMT
server: Playlog
x-frame-options: SAMEORIGIN
x-xss-protection: 0

POST
H3 200 log Show response
play.google.com/ Frame FF00 131 B
152 B 149ms
76ms XHR
text/plain 142.251.167.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f100.1e100.net

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://pay.google.com/
X-Goog-AuthUser: 0
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Wed, 20 Dec 2023 02:10:03 GMT
content-encoding: gzip
server: Playlog
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: X-Playlog-Web
content-length: 131
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

POST
H2 200 b Show response
r.stripe.com/ Frame 1EFB 0
273 B 92ms
91ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Wed, 20 Dec 2023 02:10:03 GMT
x-stripe-server-envoy-start-time-us: 1703038203520977
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 3
x-stripe-client-envoy-start-time-us: 1703038203520654
access-control-allow-credentials: true
content-length: 0

POST
H2 200 b Show response
r.stripe.com/ Frame 1EFB 0
273 B 96ms
95ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Wed, 20 Dec 2023 02:10:03 GMT
x-stripe-server-envoy-start-time-us: 1703038203537385
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 3
x-stripe-client-envoy-start-time-us: 1703038203537018
access-control-allow-credentials: true
content-length: 0

GET
H2 200 elements-inner-payment-request-de6d778d5bab030655df68532a0212a5.html Show response
js.stripe.com/v3/ Frame B0ED 820 B
2 KB 40ms
39ms Document
text/html 52.85.151.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/elements-inner-payment-request-de6d778d5bab030655df68532a0212a5.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-117.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

c197a39aa31efe8624534c6907ddb1607d286e12d7d64c5e4eca703f7ba46d41

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://ppm.stripe.com; default-src 'self'; font-src data: https:; form-action 'none'; frame-src 'self' https://www.affirm.com https://checkout.link.com https://b.stripecdn.com; img-src 'self' https://q.stripe.com https://b.stripecdn.com https://js.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 1108
cache-control: max-age=31536000
content-length: 820
content-security-policy: base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://ppm.stripe.com; default-src 'self'; font-src data: https:; form-action 'none'; frame-src 'self' https://www.affirm.com https://checkout.link.com https://b.stripecdn.com; img-src 'self' https://q.stripe.com https://b.stripecdn.com https://js.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; report-uri https://q.stripe.com/csp-report
content-security-policy-report-only: base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://ppm.stripe.com; default-src 'self'; font-src data: https:; form-action 'none'; frame-src 'self' https://www.affirm.com https://checkout.link.com https://b.stripecdn.com; img-src 'self' https://q.stripe.com https://b.stripecdn.com https://js.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Wed, 20 Dec 2023 01:51:36 GMT
etag: "de6d778d5bab030655df68532a0212a5"
last-modified: Tue, 19 Dec 2023 21:32:01 GMT
server: Cloudfront
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 2f66aa06710fece8ed203ab0ea81eb56.cloudfront.net (CloudFront)
x-amz-cf-id: fjGPYSCpEWNZqcJZYOUcMYg4AHNFsTP8RzSrYcxH8qPReruI6ZA5gg==
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
x-content-type-options: nosniff

POST
H2 200 b Show response
r.stripe.com/ Frame 1EFB 0
273 B 97ms
85ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Wed, 20 Dec 2023 02:10:03 GMT
x-stripe-server-envoy-start-time-us: 1703038203557492
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 3
x-stripe-client-envoy-start-time-us: 1703038203557335
access-control-allow-credentials: true
content-length: 0

POST
H3 200 videoplayback Show response
rr5---sn-vgqsrne6.googlevideo.com/ Frame F1D8 128 KB
128 KB 46ms
45ms Fetch
application/vnd.yt-ump 209.85.164.234
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://rr5---sn-vgqsrne6.googlevideo.com/videoplayback?expire=1703059802&ei=-kyCZcL-HI-M_9EPxceAqAk&ip=86.48.14.70&id=o-AHGdhAyob_R27BGbppNXHXkamOQ3b8tHnNy4FNHkRtwg&itag=251&source=youtube&requiressl=yes&xpc=EgVo2aDSNQ%3D%3D&spc=UWF9fwaXQ252oIuVCX2tKQAW0gtmcdrN1_OZvqR0zg&vprv=1&svpuc=1&mime=audio%2Fwebm&ns=HtKlFwrpwSD4C58rXDchClwQ&gir=yes&clen=273227&dur=19.681&lmt=1698030522265040&keepalive=yes&fexp=24007246,24350138,24350146,24350147&c=WEB_EMBEDDED_PLAYER&txp=5318224&n=bByQU2ruxwjB4g&sparams=expire%2Cei%2Cip%2Cid%2Citag%2Csource%2Crequiressl%2Cxpc%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Cgir%2Cclen%2Cdur%2Clmt&sig=AJfQdSswRQIgWEZGEcuyUgoFJHeOpXBc0ZJFAfAHlDcKDYYEK4jyN5kCIQCa_lB36WHqTesEg4iI_G81jf73LkvCKhdJNR77_dyHjw%3D%3D&alr=yes&cpn=svC5CK6PJaZKeXrQ&cver=1.20231212.01.00&redirect_counter=1&cm2rm=sn-tt1lk7z&cms_redirect=yes&cmsv=e&mh=tR&mm=34&mn=sn-vgqsrne6&ms=ltu&mt=1703037868&mv=m&mvi=5&pl=24&lsparams=mh,mm,mn,ms,mv,mvi,pl&lsig=AAO5W4owRAIgD3Kx3aS6ss5X_eu5QK4xk0XEGnJzy7n0d5tCbGltPQgCIGlnEl7RYvM-okRQdLc743bRSd9BHrjfOOUe9CG1_JFw&range=131497-262689&rn=8&rbuf=8318&pot=MnRMl0cAAq2XV0yv-nMUIiBSWyMAoMStsQilNIRXu98daR6JQTnHDsZ1BPC134WvIvLDPFh-21IiP1nxYvCPHVZkkHWnKX9E7mYr1qlsmrkBopyEFa86MNPdY495V6sa8jisK8FEHtzq04Jo7_UupwJtxj6NYQ==&ump=1&srfvp=1

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

209.85.164.234 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ord38s15-in-f10.1e100.net

Software

gvs 1.0 /

Resource Hash

8eb58a2c5cf133d4bb268da959dfa5e6dc660f4ea61a6539e43627e6acb3c2e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

client-protocol: quic
date: Wed, 20 Dec 2023 02:10:03 GMT
x-content-type-options: nosniff
last-modified: Mon, 23 Oct 2023 03:08:42 GMT
server: gvs 1.0
vary: Origin
content-type: application/vnd.yt-ump
access-control-allow-origin: https://www.youtube.com
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: private, max-age=21299
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: https://www.youtube.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46"
expires: Wed, 20 Dec 2023 02:10:03 GMT

POST
H2 200 b Show response
r.stripe.com/ Frame 1EFB 0
272 B 101ms
99ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Wed, 20 Dec 2023 02:10:03 GMT
x-stripe-server-envoy-start-time-us: 1703038203571266
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 3
x-stripe-client-envoy-start-time-us: 1703038203570720
access-control-allow-credentials: true
content-length: 0

POST
H2 200 b Show response
r.stripe.com/ Frame 1EFB 0
272 B 101ms
91ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Wed, 20 Dec 2023 02:10:03 GMT
x-stripe-server-envoy-start-time-us: 1703038203611986
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 4
x-stripe-client-envoy-start-time-us: 1703038203611819
access-control-allow-credentials: true
content-length: 0

GET
H2 200 shared-f5b29667107ca8f92f2c8276457cfdff.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame B0ED 547 KB
120 KB 89ms
82ms Script
text/javascript 52.85.151.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-payment-request-de6d778d5bab030655df68532a0212a5.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-117.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

8bac8b4fe50c6203069c3386d71372ae668bb603f67bdcaa707f87c90ba45739

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-payment-request-de6d778d5bab030655df68532a0212a5.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 01:34:45 GMT
content-encoding: br
via: 1.1 2f66aa06710fece8ed203ab0ea81eb56.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 2119
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Tue, 19 Dec 2023 21:32:14 GMT
server: Cloudfront
etag: W/"50ac79781b0db4dc8141ff8720f49193"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: YZBkf9cr3NdXeEyruT6KGqmPf-tQRKh16Osv4bNX03uqUZXfmCjZug==

GET
H2 200 ui-shared-b9c34d762c7dbd21b5b339f15f5f8aaa.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame B0ED 390 KB
108 KB 49ms
43ms Script
text/javascript 52.85.151.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/ui-shared-b9c34d762c7dbd21b5b339f15f5f8aaa.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-payment-request-de6d778d5bab030655df68532a0212a5.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-117.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

fe3fd5bf597db84d64ede28fec7e1787f6cc2b23108969cf42ca92e5df10b26f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-payment-request-de6d778d5bab030655df68532a0212a5.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 01:35:22 GMT
content-encoding: gzip
via: 1.1 2f66aa06710fece8ed203ab0ea81eb56.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 2109
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Tue, 19 Dec 2023 21:32:15 GMT
server: Cloudfront
etag: W/"cc9fc2eeeed137b041213a9d8d973f4e"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: xU4i7Mn7fkGnLllNi8EeBo0syGE13JnsGsoWCUwwdn2_2lquYE8qYA==

GET
H2 200 elements-inner-payment-request-1816b9a5560d3e376ed3340e07bc5d6e.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame B0ED 72 KB
24 KB 312ms
312ms Script
text/javascript 52.85.151.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/elements-inner-payment-request-1816b9a5560d3e376ed3340e07bc5d6e.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-payment-request-de6d778d5bab030655df68532a0212a5.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-117.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

88fa2a27bf6937522af2a1fe69fd5f14f468c4b6a4d90603bab66eb7f7563127

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-payment-request-de6d778d5bab030655df68532a0212a5.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 02:07:04 GMT
content-encoding: br
via: 1.1 2f66aa06710fece8ed203ab0ea81eb56.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 181
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Tue, 19 Dec 2023 18:03:41 GMT
server: Cloudfront
etag: W/"f9e0364b56ab9a524f358ac5d2d44a1b"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: s3SAB0iv_mY3ZVVfGbKIighSxXt2qZs47iqWe04FA7Ydgi4Cn-imow==

GET
H2 200 ui-shared-1d27f4e2b314637ba4bb9d7ff79c23c7.css
js.stripe.com/v3/fingerprinted/css/ Frame B0ED 20 KB
3 KB 47ms
42ms Stylesheet
text/css 52.85.151.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/css/ui-shared-1d27f4e2b314637ba4bb9d7ff79c23c7.css

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-payment-request-de6d778d5bab030655df68532a0212a5.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-117.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

394724ca0118829643c12fb5a033cb66680e51327ba157677d18dec209278a3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-payment-request-de6d778d5bab030655df68532a0212a5.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 02:02:46 GMT
content-encoding: br
via: 1.1 2f66aa06710fece8ed203ab0ea81eb56.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 442
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Sat, 16 Dec 2023 02:01:23 GMT
server: Cloudfront
etag: W/"b361d7109e9925ca18e32c9da528520f"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: dYxRs7ubHmC6hCK4s2JWJfc1uwJDVANI4zrztBqlvqla-lbaTRWQPg==

GET
H2 200 elements-inner-payment-request-6851fb638395ab2ad12082441235bcfa.css
js.stripe.com/v3/fingerprinted/css/ Frame B0ED 11 KB
3 KB 106ms
101ms Stylesheet
text/css 52.85.151.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/css/elements-inner-payment-request-6851fb638395ab2ad12082441235bcfa.css

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-payment-request-de6d778d5bab030655df68532a0212a5.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-117.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

5033e337e474e5d2818fee21b093eaef81d5f545fd49b5f635b3e1160fa83abe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-payment-request-de6d778d5bab030655df68532a0212a5.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 01:51:36 GMT
content-encoding: br
via: 1.1 2f66aa06710fece8ed203ab0ea81eb56.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 1150
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Sat, 16 Dec 2023 02:01:22 GMT
server: Cloudfront
etag: W/"828ee6578d45b518446bf74a1cc39038"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: 7yTLtcegPPCgF_V3d_VPo7VGtYEPqzNF0HFTQ21c-IwdjcU1jb2U3A==

POST
H2 200 csp-report
q.stripe.com/ Frame B0ED 0
716 B 91ms
90ms Other
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Wed, 20 Dec 2023 02:10:03 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1703038203615160
x-envoy-upstream-service-time: 1
content-length: 0
x-stripe-bg-intended-route-color: green
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
cross-origin-opener-policy: same-origin
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
x-stripe-server-envoy-upstream-service-time-ms: 0
access-control-allow-origin: https://js.stripe.com
x-stripe-client-envoy-start-time-us: 1703038203614733
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-expose-headers: Server, Range, Content-Type
x-robots-tag: none
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires: 0

POST
H2 200 csp-report
q.stripe.com/ Frame B0ED 0
717 B 91ms
91ms Other
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Wed, 20 Dec 2023 02:10:03 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1703038203615534
x-envoy-upstream-service-time: 1
content-length: 0
x-stripe-bg-intended-route-color: green
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
cross-origin-opener-policy: same-origin
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
x-stripe-server-envoy-upstream-service-time-ms: 0
access-control-allow-origin: https://js.stripe.com
x-stripe-client-envoy-start-time-us: 1703038203614755
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-expose-headers: Server, Range, Content-Type
x-robots-tag: none
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires: 0

GET
H3 200 ga-audiences
www.google.com/ads/ 42 B
63 B 58ms
57ms Image
image/gif 172.253.62.105
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-73658561-7&cid=270181744.1703038201&jid=788203592&_u=YCDAiEABBAAAAGAEK~&z=1795581122

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.62.105 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f105.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Dec 2023 02:10:03 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.ca/ads/ 42 B
63 B 50ms
50ms Image
image/gif 142.251.179.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-73658561-7&cid=270181744.1703038201&jid=788203592&_u=YCDAiEABBAAAAGAEK~&z=1795581122

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.179.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

pd-in-f94.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Dec 2023 02:10:03 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 6 Show response
m.stripe.com/ Frame 12E6 156 B
668 B 94ms
93ms XHR
application/json 44.233.104.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.com/6

Requested by

Host: m.stripe.network
URL: https://m.stripe.network/out-4.5.43.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.233.104.20 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-44-233-104-20.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

8d1181160c5a70a5bfe59701c0fc83930aa85d8a08baf2988417a20bc5f5e709

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://m.stripe.network/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-stripe-bg-intended-route-color: green
date: Wed, 20 Dec 2023 02:10:03 GMT
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1703038203643621
server: nginx
content-type: application/json;charset=utf-8
x-stripe-server-envoy-upstream-service-time-ms: 2
access-control-allow-origin: https://m.stripe.network
x-stripe-client-envoy-start-time-us: 1703038203643436
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 156

POST
H2 200 6 Show response
m.stripe.com/ Frame 12E6 156 B
668 B 139ms
139ms XHR
application/json 44.233.104.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.com/6

Requested by

Host: m.stripe.network
URL: https://m.stripe.network/out-4.5.43.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.233.104.20 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-44-233-104-20.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

8d1181160c5a70a5bfe59701c0fc83930aa85d8a08baf2988417a20bc5f5e709

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://m.stripe.network/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-stripe-bg-intended-route-color: green
date: Wed, 20 Dec 2023 02:10:03 GMT
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1703038203691356
server: nginx
content-type: application/json;charset=utf-8
x-stripe-server-envoy-upstream-service-time-ms: 1
access-control-allow-origin: https://m.stripe.network
x-stripe-client-envoy-start-time-us: 1703038203691188
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 156

POST
H2 200 b Show response
r.stripe.com/ Frame 0B15 0
273 B 92ms
92ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Wed, 20 Dec 2023 02:10:03 GMT
x-stripe-server-envoy-start-time-us: 1703038203647995
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 3
x-stripe-client-envoy-start-time-us: 1703038203647840
access-control-allow-credentials: true
content-length: 0

GET
H2 200 api.js Show response
hcaptcha.com/1/ Frame 28F7 326 KB
92 KB 77ms
35ms Script
application/javascript 104.19.218.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hcaptcha.com/1/api.js?onload=captchaLoad&render=explicit

Requested by

Host: b.stripecdn.com
URL: https://b.stripecdn.com/stripethirdparty-srv/assets/v19.2/HCaptchaInvisible.html?id=446e0bb5-4863-43c8-a36e-f7fa521f28fe&origin=https%3A%2F%2Fjs.stripe.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.218.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9f57e1e7f7381ec0e4eb185ca491323450dd0742b19a6097995bac78487a1835

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b.stripecdn.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 02:10:03 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 0df778cadb5eaa000de4f1d7838b16e0.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-content-type-options: nosniff
x-amz-version-id: o2o2WA3L7Ll5QYn5daiC77yP7vRQJRVn
age: 0
x-amz-cf-pop: YUL62-C2
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 14 Dec 2023 21:28:53 GMT
server: cloudflare
etag: W/"b0204ba9adc9845b676113f41ae6d9c6"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=300
cf-ray: 838458c59f693a03-YYZ
x-amz-cf-id: VcEVNcHemcQ_cM54Vsz2r0zpBJc3wobTQpfmeIc_5wFwc34fHeTLYA==

GET
H2 200 vendors~AddressAutocomplete~AffirmInContext~AmazonPayButton~AuthMap~DemoPayButton~DynamicMap~GoogleA~0a54ab41.c7ae46076ac46d9976f0.bundle.js Show response
b.stripecdn.com/stripethirdparty-srv/assets/v19.2/ Frame 28F7 114 KB
37 KB 18ms
16ms Script
text/javascript 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://b.stripecdn.com/stripethirdparty-srv/assets/v19.2/vendors~AddressAutocomplete~AffirmInContext~AmazonPayButton~AuthMap~DemoPayButton~DynamicMap~GoogleA~0a54ab41.c7ae46076ac46d9976f0.bundle.js

Requested by

Host: b.stripecdn.com
URL: https://b.stripecdn.com/stripethirdparty-srv/assets/v19.2/HCaptchaInvisible.html?id=446e0bb5-4863-43c8-a36e-f7fa521f28fe&origin=https%3A%2F%2Fjs.stripe.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

67d2a36b1cd1a04f4d83f6236578a94f7e92d42e4d6b8ca92cc5907cd7141dcf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b.stripecdn.com/stripethirdparty-srv/assets/v19.2/HCaptchaInvisible.html?id=446e0bb5-4863-43c8-a36e-f7fa521f28fe&origin=https%3A%2F%2Fjs.stripe.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
date: Wed, 20 Dec 2023 02:10:03 GMT
x-content-type-options: nosniff
content-encoding: br
via: 1.1 varnish
age: 3555642
x-cache: HIT
content-length: 38077
x-request-id: 2963c61b-6a7b-458e-ab80-0033c2a9b8c0
x-served-by: cache-yyz4541-YYZ
server: Fastly
x-timer: S1703038204.728249,VS0,VE0
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=utf-8
cache-control: max-age=31536000, public
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 9428

GET
H2 200 HCaptchaInvisible.37d68ac55a3b552626ea.bundle.js Show response
b.stripecdn.com/stripethirdparty-srv/assets/v19.2/ Frame 28F7 17 KB
7 KB 37ms
35ms Script
text/javascript 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://b.stripecdn.com/stripethirdparty-srv/assets/v19.2/HCaptchaInvisible.37d68ac55a3b552626ea.bundle.js

Requested by

Host: b.stripecdn.com
URL: https://b.stripecdn.com/stripethirdparty-srv/assets/v19.2/HCaptchaInvisible.html?id=446e0bb5-4863-43c8-a36e-f7fa521f28fe&origin=https%3A%2F%2Fjs.stripe.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

27dff3dc6aeb4be2eff2b8127b1515b17032fb228af7c6cd274ebc4b17a6ee26

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b.stripecdn.com/stripethirdparty-srv/assets/v19.2/HCaptchaInvisible.html?id=446e0bb5-4863-43c8-a36e-f7fa521f28fe&origin=https%3A%2F%2Fjs.stripe.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
date: Wed, 20 Dec 2023 02:10:03 GMT
x-content-type-options: nosniff
content-encoding: br
via: 1.1 varnish
age: 1105666
x-cache: HIT
content-length: 7160
x-request-id: 7333b960-9546-44b8-8569-c1c7c8743fbf
x-served-by: cache-yyz4541-YYZ
server: Fastly
x-timer: S1703038204.728453,VS0,VE0
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=utf-8
cache-control: max-age=31536000, public
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 9255

POST
H2 200 csp-report
q.stripe.com/ Frame 28F7 0
491 B 90ms
89ms Other
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://b.stripecdn.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Wed, 20 Dec 2023 02:10:03 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1703038203771085
x-envoy-upstream-service-time: 1
content-length: 0
x-stripe-bg-intended-route-color: green
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
cross-origin-opener-policy: same-origin
x-stripe-server-envoy-upstream-service-time-ms: 0
x-stripe-client-envoy-start-time-us: 1703038203770768
cache-control: max-age=0, no-cache, no-store, must-revalidate
x-robots-tag: none
expires: 0

GET
H2 200 hcaptcha.html Show response
newassets.hcaptcha.com/captcha/v1/1bcdbdd/static/ Frame F212 2 KB
1 KB 38ms
28ms Document
text/html 104.19.218.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newassets.hcaptcha.com/captcha/v1/1bcdbdd/static/hcaptcha.html?_v=8qvmi0v77xk

Requested by

Host: hcaptcha.com
URL: https://hcaptcha.com/1/api.js?onload=captchaLoad&render=explicit

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.218.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a16c2a8d2e2d6ef0612038c3f318755a2e5da18e3183405705207860107d3858

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://b.stripecdn.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-origin: *
age: 408180
alt-svc: h3=":443"; ma=86400
cache-control: max-age=1209600
cf-cache-status: HIT
cf-ray: 838458c648c33a03-YYZ
content-encoding: br
content-type: text/html
cross-origin-embedder-policy: credentialless
cross-origin-resource-policy: cross-origin
date: Wed, 20 Dec 2023 02:10:03 GMT
last-modified: Thu, 14 Dec 2023 21:28:53 GMT
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
via: 1.1 bc9d715161855640c4738aa7390d934e.cloudfront.net (CloudFront)
x-amz-cf-id: 3yMBUkPRD8PQ_78EuZzZrw8bW6I5r2Y-DHNarKzh_0yRB8oUqJfjfQ==
x-amz-cf-pop: YTO50-P2
x-amz-server-side-encryption: AES256
x-amz-version-id: sfBs_KpP21ISqEty0JtaAonCMuRUeTuB
x-cache: Hit from cloudfront
x-content-type-options: nosniff

POST
H2 200 b Show response
r.stripe.com/ Frame 4553 0
273 B 93ms
92ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Wed, 20 Dec 2023 02:10:03 GMT
x-stripe-server-envoy-start-time-us: 1703038203930518
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 2
x-stripe-client-envoy-start-time-us: 1703038203929868
access-control-allow-credentials: true
content-length: 0

GET
H2 200 .deploy_status_henson.json Show response
js.stripe.com/v3/ Frame B0ED 474 B
865 B 39ms
38ms Fetch
application/json 52.85.151.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.stripe.com/v3/.deploy_status_henson.json
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.151.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-151-117.iad89.r.cloudfront.net
Software: Cloudfront /
Resource Hash: e20df4d423b37ce34fb8c17da7216ba9f70a05cc93ad807eb3cf454dfe56c411

Request headers

Accept: application/json
Referer: https://js.stripe.com/v3/elements-inner-payment-request-de6d778d5bab030655df68532a0212a5.html
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Wed, 20 Dec 2023 02:09:05 GMT
via: 1.1 c35f767218cbd1125d801b52fa785c8c.cloudfront.net (CloudFront)
last-modified: Tue, 19 Dec 2023 22:04:23 GMT
server: Cloudfront
age: 59
x-amz-cf-pop: IAD89-C3
etag: "98b2edf5e48fde7507e0a9757d567aea"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=60
accept-ranges: bytes
content-length: 474
x-amz-cf-id: MBYwV3tCACfQd2UOn_VPba0cNtX0Fq0ACea-LCrsPd_ES1FX33xlYw==

POST
H2 200 b Show response
r.stripe.com/ Frame 1EFB 0
273 B 92ms
91ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Wed, 20 Dec 2023 02:10:03 GMT
x-stripe-server-envoy-start-time-us: 1703038203972163
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 3
x-stripe-client-envoy-start-time-us: 1703038203971549
access-control-allow-credentials: true
content-length: 0

GET
H2 200 hcaptcha.js Show response
newassets.hcaptcha.com/captcha/v1/1bcdbdd/ Frame F212 326 KB
92 KB 32ms
30ms Script
application/javascript 104.19.218.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newassets.hcaptcha.com/captcha/v1/1bcdbdd/hcaptcha.js

Requested by

Host: newassets.hcaptcha.com
URL: https://newassets.hcaptcha.com/captcha/v1/1bcdbdd/static/hcaptcha.html?_v=8qvmi0v77xk

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.218.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9f57e1e7f7381ec0e4eb185ca491323450dd0742b19a6097995bac78487a1835

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://newassets.hcaptcha.com/captcha/v1/1bcdbdd/static/hcaptcha.html?_v=8qvmi0v77xk
Origin: https://newassets.hcaptcha.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 02:10:03 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 0df778cadb5eaa000de4f1d7838b16e0.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-content-type-options: nosniff
x-amz-version-id: o2o2WA3L7Ll5QYn5daiC77yP7vRQJRVn
age: 165590
x-amz-cf-pop: YUL62-C2
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 14 Dec 2023 21:28:53 GMT
server: cloudflare
etag: W/"b0204ba9adc9845b676113f41ae6d9c6"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=1209600
cf-ray: 838458c699553a03-YYZ
x-amz-cf-id: VcEVNcHemcQ_cM54Vsz2r0zpBJc3wobTQpfmeIc_5wFwc34fHeTLYA==

POST
H2 200 checksiteconfig Show response
api.hcaptcha.com/ Frame F212 719 B
907 B 59ms
58ms XHR
application/json 104.19.218.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.hcaptcha.com/checksiteconfig?v=1bcdbdd&host=b.stripecdn.com&sitekey=463b917e-e264-403f-ad34-34af0ee10294&sc=1&swa=1&spst=1

Requested by

Host: newassets.hcaptcha.com
URL: https://newassets.hcaptcha.com/captcha/v1/1bcdbdd/hcaptcha.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.218.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ada3db835dd04fd7974691e145b6321d03daef7745b5ed831cb586703265b108

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://newassets.hcaptcha.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 20 Dec 2023 02:10:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
content-encoding: br
server: cloudflare
vary: Origin, Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://newassets.hcaptcha.com
access-control-allow-credentials: true
cf-ray: 838458c72a5d3a03-YYZ
access-control-allow-headers: Cache-Control, Content-Type, DNT, Referer, User-Agent, challenge-bypass-token, cf-chl-bypass, challenge-bypass-token, challenge-bypass-host, challenge-bypass-path
alt-svc: h3=":443"; ma=86400

GET
H3 200 hsw.js Show response
newassets.hcaptcha.com/c/2458d9b/ Frame F212 499 KB
217 KB 30ms
30ms Script
application/javascript 104.19.219.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newassets.hcaptcha.com/c/2458d9b/hsw.js

Requested by

Host: newassets.hcaptcha.com
URL: https://newassets.hcaptcha.com/captcha/v1/1bcdbdd/hcaptcha.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.219.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c0c067d3512326ee1d73cce9dccbb1bb59c24b279df3ea650ddf80578182bda6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://newassets.hcaptcha.com/captcha/v1/1bcdbdd/static/hcaptcha.html?_v=8qvmi0v77xk
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 02:10:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 e0170582752f8bcacf802243afe5509c.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-content-type-options: nosniff
x-amz-version-id: 1JhSB37kavMYpA6c5WxU_Q.zUc_dI7mQ
age: 80607
x-amz-cf-pop: YUL62-C2
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 14 Dec 2023 16:59:11 GMT
server: cloudflare
etag: W/"9d671418ff661c7370b4e3530ac92335"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3024000
cf-ray: 838458c7985ba1ed-YYZ
x-amz-cf-id: 54S7S_yKF4C6FI3v_WhlTclLFdfqszF48MDs_wd-4QvPGtl0cGV7PA==

POST
H3 200 log_event Show response
www.youtube.com/youtubei/v1/ Frame EC09 28 B
50 B 154ms
110ms XHR
application/json 142.251.111.190
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/d23221b6/www-embed-player.vflset/www-embed-player.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.190 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f190.1e100.net

Software

scaffolding on HTTPServer2 /

Resource Hash

d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
X-Goog-Request-Time: 1703038204378
Content-Type: application/json
X-YouTube-Utc-Offset: -480
X-YouTube-Client-Name: 56
Referer: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&&loop=1&mute=1&playlist=jeD5dxpNSLo
X-YouTube-Client-Version: 1.20231212.01.00
X-YouTube-Time-Zone: America/Vancouver
X-Goog-Visitor-Id: CgtkZV9FMVAtcl9Gdyj5mYmsBjIKCgJDQRIEGgAgSw%3D%3D
X-YouTube-Ad-Signals: dt=1703038202114&flash=0&frm=2&u_tz=-480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C0%2C0&vis=1&wgl=true&ca_type=image

Response headers

date: Wed, 20 Dec 2023 02:10:04 GMT
content-encoding: br
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
x-frame-options: SAMEORIGIN
vary: Origin, X-Origin, Referer
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31
x-xss-protection: 0

POST
H3 200 463b917e-e264-403f-ad34-34af0ee10294 Show response
api.hcaptcha.com/getcaptcha/ Frame F212 3 KB
3 KB 277ms
267ms XHR
application/json 104.19.219.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.hcaptcha.com/getcaptcha/463b917e-e264-403f-ad34-34af0ee10294

Requested by

Host: newassets.hcaptcha.com
URL: https://newassets.hcaptcha.com/captcha/v1/1bcdbdd/hcaptcha.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.219.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d33e7d4d836f346ccdbadc87b97f8cca274c5d84ddfef99ebb819855e6b67869

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://newassets.hcaptcha.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Wed, 20 Dec 2023 02:10:05 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
server: cloudflare
vary: Origin, Accept-Encoding
content-type: application/json
access-control-allow-origin: https://newassets.hcaptcha.com
access-control-allow-credentials: true
cf-ray: 838458cbba33a1ed-YYZ
alt-svc: h3=":443"; ma=86400

POST
H2 200 b Show response
r.stripe.com/ Frame 1EFB 0
273 B 92ms
91ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Wed, 20 Dec 2023 02:10:04 GMT
x-stripe-server-envoy-start-time-us: 1703038204979932
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 3
x-stripe-client-envoy-start-time-us: 1703038204979277
access-control-allow-credentials: true
content-length: 0

POST
H3 200 videoplayback Show response
rr5---sn-vgqsrne6.googlevideo.com/ Frame F1D8 108 KB
108 KB 33ms
31ms Fetch
application/vnd.yt-ump 209.85.164.234
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://rr5---sn-vgqsrne6.googlevideo.com/videoplayback?expire=1703059802&ei=-kyCZcL-HI-M_9EPxceAqAk&ip=86.48.14.70&id=o-AHGdhAyob_R27BGbppNXHXkamOQ3b8tHnNy4FNHkRtwg&itag=243&aitags=133%2C134%2C135%2C136%2C137%2C160%2C242%2C243%2C244%2C247%2C248%2C278&source=youtube&requiressl=yes&xpc=EgVo2aDSNQ%3D%3D&spc=UWF9fwaXQ252oIuVCX2tKQAW0gtmcdrN1_OZvqR0zg&vprv=1&svpuc=1&mime=video%2Fwebm&ns=HtKlFwrpwSD4C58rXDchClwQ&gir=yes&clen=379533&dur=19.633&lmt=1698030525033392&keepalive=yes&fexp=24007246,24350138,24350146,24350147&c=WEB_EMBEDDED_PLAYER&txp=531F224&n=bByQU2ruxwjB4g&sparams=expire%2Cei%2Cip%2Cid%2Caitags%2Csource%2Crequiressl%2Cxpc%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Cgir%2Cclen%2Cdur%2Clmt&sig=AJfQdSswRAIgItfkXVnCjOXNUOsZ2SE13aYi7aNScMjR1QCFrLlMmHgCIFb2od_yHFgBgwYxQ6PvrkASXObUguXydmIFD7gXhgF1&alr=yes&cpn=svC5CK6PJaZKeXrQ&cver=1.20231212.01.00&redirect_counter=1&cm2rm=sn-tt1lk7z&cms_redirect=yes&cmsv=e&mh=tR&mm=34&mn=sn-vgqsrne6&ms=ltu&mt=1703037868&mv=m&mvi=5&pl=24&lsparams=mh,mm,mn,ms,mv,mvi,pl&lsig=AAO5W4owRAIgUBouXJrezcAP3Q9Xnha0yJwKVwj8z1EU5c0Ul3WQIrYCIBBYqQfgky6KZeWtjZj1NOL1ZgxTQWG-EwwuYBSsiB5F&range=268681-379532&rn=9&rbuf=12177&pot=MnRMl0cAAq2XV0yv-nMUIiBSWyMAoMStsQilNIRXu98daR6JQTnHDsZ1BPC134WvIvLDPFh-21IiP1nxYvCPHVZkkHWnKX9E7mYr1qlsmrkBopyEFa86MNPdY495V6sa8jisK8FEHtzq04Jo7_UupwJtxj6NYQ==&ump=1&srfvp=1

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

209.85.164.234 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ord38s15-in-f10.1e100.net

Software

gvs 1.0 /

Resource Hash

63a3c24fd75d7487cf7a1459b7fe5637c48781823dc569892c33c9e5d0aeb0de

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Wed, 20 Dec 2023 02:10:05 GMT
date: Wed, 20 Dec 2023 02:10:05 GMT
x-restrict-formats-hint: None
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46"
last-modified: Mon, 23 Oct 2023 03:08:45 GMT
server: gvs 1.0
vary: Origin
content-type: application/vnd.yt-ump
access-control-allow-origin: https://www.youtube.com
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: private, max-age=21297
access-control-allow-credentials: true
timing-allow-origin: https://www.youtube.com
client-protocol: quic

POST
H3 200 log_event Show response
www.youtube.com/youtubei/v1/ Frame F1D8 28 B
50 B 53ms
51ms XHR
application/json 142.251.111.190
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/d23221b6/www-embed-player.vflset/www-embed-player.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.190 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f190.1e100.net

Software

scaffolding on HTTPServer2 /

Resource Hash

d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
X-Goog-Request-Time: 1703038205416
Content-Type: application/json
X-YouTube-Utc-Offset: -480
X-YouTube-Client-Name: 56
Referer: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&autoplay=1&loop=1&mute=1&playlist=jeD5dxpNSLo
X-YouTube-Client-Version: 1.20231212.01.00
X-YouTube-Time-Zone: America/Vancouver
X-Goog-Visitor-Id: Cgt6aVh6RG9XMldIRSj5mYmsBjIKCgJDQRIEGgAgLA%3D%3D
X-YouTube-Ad-Signals: dt=1703038202182&flash=0&frm=2&u_tz=-480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C344%2C315&vis=1&wgl=true&ca_type=image

Response headers

date: Wed, 20 Dec 2023 02:10:05 GMT
content-encoding: br
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
x-frame-options: SAMEORIGIN
vary: Origin, X-Origin, Referer
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31
x-xss-protection: 0

POST
H2 200 b Show response
r.stripe.com/ Frame 4553 0
272 B 95ms
88ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Wed, 20 Dec 2023 02:10:06 GMT
x-stripe-server-envoy-start-time-us: 1703038206081127
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 2
x-stripe-client-envoy-start-time-us: 1703038206080858
access-control-allow-credentials: true
content-length: 0

GET
H2 200 common.js Show response
maps.googleapis.com/maps-api-v3/api/js/55/4/ 256 KB
57 KB 37ms
35ms Script
text/javascript 142.251.163.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps-api-v3/api/js/55/4/common.js

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f95.1e100.net

Software

sffe /

Resource Hash

969dace001ef24f99f38bd00c5578b85ba9368e77a5667cfcaeaa29d2f57657b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 01:25:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2682
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57512
x-xss-protection: 0
last-modified: Mon, 04 Dec 2023 22:55:43 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="maps-api-js"
vary: Accept-Encoding, Origin
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 19 Dec 2024 01:25:24 GMT

GET
H2 200 util.js Show response
maps.googleapis.com/maps-api-v3/api/js/55/4/ 173 KB
54 KB 49ms
49ms Script
text/javascript 142.251.163.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps-api-v3/api/js/55/4/util.js

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f95.1e100.net

Software

sffe /

Resource Hash

e759dc710ec6d9f9438d5a77f834b247254512fb90cf520764ab591db32cf5cb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 01:42:04 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1682
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 55175
x-xss-protection: 0
last-modified: Mon, 04 Dec 2023 22:55:43 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="maps-api-js"
vary: Accept-Encoding, Origin
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 19 Dec 2024 01:42:04 GMT

GET
H3 204 watchtime Show response
www.youtube.com/api/stats/ Frame F1D8 0
17 B 49ms
47ms XHR
text/html 142.251.111.190
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/api/stats/watchtime?ns=yt&el=embedded&cpn=svC5CK6PJaZKeXrQ&ver=2&cmt=3.039&fmt=243&fs=0&rt=4.001&euri=https%3A%2F%2Fsecure.winred.com%2F&lact=4042&cl=590345707&state=playing&volume=100&cbr=Chrome&cbrver=120.0.6099.109&c=WEB_EMBEDDED_PLAYER&cver=1.20231212.01.00&cplayer=UNIPLAYER&cos=Windows&cosver=10.0&cplatform=DESKTOP&autoplay=1&delay=4&hl=en_US&cr=CA&len=19.681&rtn=14&afmt=251&idpj=-8&ldpj=0&rti=4&size=344%3A315&inview=1&st=0&et=3.039&muted=1&docid=jeD5dxpNSLo&ei=-kyCZcL-HI-M_9EPxceAqAk&plid=AAYM53sZdYXu3aOz&referrer=https%3A%2F%2Fwww.youtube.com%2Fembed%2FjeD5dxpNSLo%3Fsi%3DH_xx5wVJV6ZHDuQp%26autoplay%3D1%26loop%3D1%26mute%3D1%26playlist%3DjeD5dxpNSLo&list=TLGGgcf5X4YlXhsyMDEyMjAyMw&of=2dVkz7e1rF9t_XNU6wGWIw&vm=CAEQABgEOjJBSHFpSlRMb1VoOTY4T0REMmNFWk1ER0dZeTV3X3hzdHNaZ3U2T0IwRE1lZXoxbEpid2JwQVBta0tESXNuOVJQUndtRU1YMFBUZ2ZqSzQ4ZElKTzJmYVQ0VFV2V1ZPSm9oMjAwRHFzSEpYOXF6UFpWOHJzdWRyVThXM0duWEVCM01RNmN2enlGcjZxUld1OFBPS2tKbTBJazFuUHB1bVgzeDZMTmgC

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.190 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f190.1e100.net

Software

Video Stats Server /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
X-YouTube-Utc-Offset: -480
X-YouTube-Client-Name: 56
Referer: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&autoplay=1&loop=1&mute=1&playlist=jeD5dxpNSLo
X-YouTube-Client-Version: 1.20231212.01.00
X-YouTube-Time-Zone: America/Vancouver
X-Goog-Visitor-Id: Cgt6aVh6RG9XMldIRSj5mYmsBjIKCgJDQRIEGgAgLA%3D%3D
X-YouTube-Ad-Signals: dt=1703038202191&flash=0&frm=2&u_tz=-480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C344%2C315&vis=1&wgl=true&ca_type=image

Response headers

pragma: no-cache
date: Wed, 20 Dec 2023 02:10:06 GMT
x-content-type-options: nosniff
server: Video Stats Server
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 rum Show response
secure.winred.com/cdn-cgi/ 0
143 B 27ms
20ms XHR
text/plain 104.19.212.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/v84a3a4012de94ce1a686ba8c167c359c1696973893317

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.212.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://secure.winred.com/desantis/october-eom-dtc?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com&amount=25
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
content-type: application/json

Response headers

date: Wed, 20 Dec 2023 02:10:06 GMT
x-content-type-options: nosniff
server: cloudflare
vary: Origin
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://secure.winred.com
x-frame-options: DENY
access-control-allow-credentials: true
cf-ray: 838458d768dd36fb-YYZ

GET
H2

200

/ Show response
match.adsrvr.org/track/upb/ Frame CCA8
Redirect Chain

https://insight.adsrvr.org/track/up?adv=8gutl3m&ref=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Foctober-eom-dtc%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-d...
https://match.adsrvr.org/track/upb/?adv=8gutl3m&ref=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Foctober-eom-dtc%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-d...

874 B
921 B

53ms
52ms

Document
text/html

15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/upb/?adv=8gutl3m&ref=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Foctober-eom-dtc%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com%26amount%3D25&upid=ssuhzkp&upv=1.1.0&td1=undefined&td2=undefined&td3=undefined&td4=undefined&td5=undefined&td6=undefined&td7=undefined&v=undefined
Requested by: Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: ad7c09d6e7e7eeea87bbf0edc10eaea21f4bd19c93c9cd8f4290d96161051f31

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

content-encoding: gzip
content-type: text/html
date: Wed, 20 Dec 2023 02:10:07 GMT
server: Kestrel
vary: Accept-Encoding

Redirect headers

content-length: 1031
date: Wed, 20 Dec 2023 02:10:07 GMT
location: https://match.adsrvr.org/track/upb/?adv=8gutl3m&ref=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Foctober-eom-dtc%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com%26amount%3D25&upid=ssuhzkp&upv=1.1.0&td1=undefined&td2=undefined&td3=undefined&td4=undefined&td5=undefined&td6=undefined&td7=undefined&v=undefined
server: Kestrel

POST
H3 200 videoplayback Show response
rr5---sn-vgqsrne6.googlevideo.com/ Frame F1D8 10 KB
10 KB 31ms
30ms Fetch
application/vnd.yt-ump 209.85.164.234
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://rr5---sn-vgqsrne6.googlevideo.com/videoplayback?expire=1703059802&ei=-kyCZcL-HI-M_9EPxceAqAk&ip=86.48.14.70&id=o-AHGdhAyob_R27BGbppNXHXkamOQ3b8tHnNy4FNHkRtwg&itag=251&source=youtube&requiressl=yes&xpc=EgVo2aDSNQ%3D%3D&spc=UWF9fwaXQ252oIuVCX2tKQAW0gtmcdrN1_OZvqR0zg&vprv=1&svpuc=1&mime=audio%2Fwebm&ns=HtKlFwrpwSD4C58rXDchClwQ&gir=yes&clen=273227&dur=19.681&lmt=1698030522265040&keepalive=yes&fexp=24007246,24350138,24350146,24350147&c=WEB_EMBEDDED_PLAYER&txp=5318224&n=bByQU2ruxwjB4g&sparams=expire%2Cei%2Cip%2Cid%2Citag%2Csource%2Crequiressl%2Cxpc%2Cspc%2Cvprv%2Csvpuc%2Cmime%2Cns%2Cgir%2Cclen%2Cdur%2Clmt&sig=AJfQdSswRQIgWEZGEcuyUgoFJHeOpXBc0ZJFAfAHlDcKDYYEK4jyN5kCIQCa_lB36WHqTesEg4iI_G81jf73LkvCKhdJNR77_dyHjw%3D%3D&alr=yes&cpn=svC5CK6PJaZKeXrQ&cver=1.20231212.01.00&redirect_counter=1&cm2rm=sn-tt1lk7z&cms_redirect=yes&cmsv=e&mh=tR&mm=34&mn=sn-vgqsrne6&ms=ltu&mt=1703037868&mv=m&mvi=5&pl=24&lsparams=mh,mm,mn,ms,mv,mvi,pl&lsig=AAO5W4owRAIgD3Kx3aS6ss5X_eu5QK4xk0XEGnJzy7n0d5tCbGltPQgCIGlnEl7RYvM-okRQdLc743bRSd9BHrjfOOUe9CG1_JFw&range=262690-273226&rn=10&rbuf=14818&pot=MnRMl0cAAq2XV0yv-nMUIiBSWyMAoMStsQilNIRXu98daR6JQTnHDsZ1BPC134WvIvLDPFh-21IiP1nxYvCPHVZkkHWnKX9E7mYr1qlsmrkBopyEFa86MNPdY495V6sa8jisK8FEHtzq04Jo7_UupwJtxj6NYQ==&ump=1&srfvp=1

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

209.85.164.234 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ord38s15-in-f10.1e100.net

Software

gvs 1.0 /

Resource Hash

9b4677b15d0a370e6e30ba3bdbbd09d25cddb1a680f3ccede72e2a418db8ed3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

client-protocol: quic
date: Wed, 20 Dec 2023 02:10:07 GMT
x-content-type-options: nosniff
last-modified: Mon, 23 Oct 2023 03:08:42 GMT
server: gvs 1.0
vary: Origin
content-type: application/vnd.yt-ump
access-control-allow-origin: https://www.youtube.com
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: private, max-age=21295
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: https://www.youtube.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46"
expires: Wed, 20 Dec 2023 02:10:07 GMT

POST
H2 200 b Show response
r.stripe.com/ Frame 4553 0
273 B 94ms
93ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5b29667107ca8f92f2c8276457cfdff.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Wed, 20 Dec 2023 02:10:07 GMT
x-stripe-server-envoy-start-time-us: 1703038207684026
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 2
x-stripe-client-envoy-start-time-us: 1703038207683871
access-control-allow-credentials: true
content-length: 0

GET
H/1.1 200
OK universal_pixel.1.1.0.js Show response
js.adsrvr.org/ Frame CCA8 488 B
1 KB 36ms
35ms Script
application/x-javascript 13.32.206.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adsrvr.org/universal_pixel.1.1.0.js
Requested by: Host: match.adsrvr.org
URL: https://match.adsrvr.org/track/upb/?adv=8gutl3m&ref=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Foctober-eom-dtc%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com%26amount%3D25&upid=ssuhzkp&upv=1.1.0&td1=undefined&td2=undefined&td3=undefined&td4=undefined&td5=undefined&td6=undefined&td7=undefined&v=undefined
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.206.122 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-206-122.iad66.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 484ef4268f1d679c1ae88c06fc2388d39afc441465732617e5e2cdc2e3d418e2

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://match.adsrvr.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Tue, 19 Dec 2023 21:16:03 GMT
Via: 1.1 e58f499d9cd10c42a7ba13215f40c914.cloudfront.net (CloudFront)
Last-Modified: Thu, 30 Nov 2023 03:37:22 GMT
Server: AmazonS3
X-Amz-Cf-Pop: IAD66-C1
Age: 17645
x-amz-server-side-encryption: AES256
ETag: "2775054c068b37509e0798448f7fd32c"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: application/x-javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 488
X-Amz-Cf-Id: 1e0xQxR9GGwSfu7GC7ekjEWqAQomJdYPLBEOErKPRUMQ-ebzx7VsdA==

GET tap.php
pixel.rubiconproject.com/ Frame A1B8 0
0

GET sync
ups.analytics.yahoo.com/ups/55953/ Frame 18C9 0
0

GET
H2

200

appnexus Show response
match.adsrvr.org/track/cmf/ Frame 70BF
Redirect Chain

https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=196be6b4-00cb-48b9-92e6-e2d883ace57c
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fmatch.adsrvr.org%252ftrack%252fcmf%252fappnexus%253fttd%253d1%2526anid%253d%2524UID%26ttd_tdid%3D196be6b4-00cb-48b9-92e6-e2d883ace57c
https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=5949987524205005609&ttd_tdid=196be6b4-00cb-48b9-92e6-e2d883ace57c

70 B
470 B

38ms
38ms

Document
image/gif

15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=5949987524205005609&ttd_tdid=196be6b4-00cb-48b9-92e6-e2d883ace57c
Requested by: Host: js.adsrvr.org
URL: https://js.adsrvr.org/universal_pixel.1.1.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://match.adsrvr.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

content-length: 70
content-type: image/gif
date: Wed, 20 Dec 2023 02:10:09 GMT
server: Kestrel

Redirect headers

accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
access-control-allow-origin: *
an-x-request-uuid: 78abb48d-540c-4764-bfc7-bf2262ecfcbe
cache-control: no-store, no-cache, private
content-length: 0
content-type: text/html; charset=utf-8
date: Wed, 20 Dec 2023 02:10:09 GMT
expires: Sat, 15 Nov 2008 16:00:00 GMT
location: https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=5949987524205005609&ttd_tdid=196be6b4-00cb-48b9-92e6-e2d883ace57c
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
pragma: no-cache
server: nginx/1.21.3
x-proxy-origin: 86.48.14.70; 86.48.14.70; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
x-xss-protection: 0

POST
H3 204 atr Show response
www.youtube.com/api/stats/ Frame F1D8 0
19 B 62ms
62ms XHR
text/html 142.251.111.190
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/api/stats/atr?ns=yt&el=embedded&cpn=svC5CK6PJaZKeXrQ&ver=2&cmt=4.593&fmt=243&fs=0&rt=5.554&euri=https%3A%2F%2Fsecure.winred.com%2F&lact=5595&cl=590345707&mos=1&volume=100&cbr=Chrome&cbrver=120.0.6099.109&c=WEB_EMBEDDED_PLAYER&cver=1.20231212.01.00&cplayer=UNIPLAYER&cos=Windows&cosver=10.0&cplatform=DESKTOP&autoplay=1&epm=1&delay=4&hl=en_US&cr=CA&len=19.681&fexp=v1%2C23983296%2C21348%2C2602%2C73492%2C54572%2C73455%2C176963%2C53633%2C84737%2C25688%2C9541%2C1089%2C5877%2C394%2C26439494%2C4054%2C1930%2C5181%2C9369%2C1556%2C1141%2C5877%2C2251%2C859%2C1094%2C4012%2C5501%2C4683%2C2339%2C7615%2C2008%2C3943%2C609%2C5786%2C1160%2C1332%2C1701%2C723%2C5951&afmt=251&muted=1&docid=jeD5dxpNSLo&ei=-kyCZcL-HI-M_9EPxceAqAk&plid=AAYM53sZdYXu3aOz&referrer=https%3A%2F%2Fwww.youtube.com%2Fembed%2FjeD5dxpNSLo%3Fsi%3DH_xx5wVJV6ZHDuQp%26autoplay%3D1%26loop%3D1%26mute%3D1%26playlist%3DjeD5dxpNSLo&list=TLGGgcf5X4YlXhsyMDEyMjAyMw&of=2dVkz7e1rF9t_XNU6wGWIw&vm=CAEQABgEOjJBSHFpSlRMb1VoOTY4T0REMmNFWk1ER0dZeTV3X3hzdHNaZ3U2T0IwRE1lZXoxbEpid2JwQVBta0tESXNuOVJQUndtRU1YMFBUZ2ZqSzQ4ZElKTzJmYVQ0VFV2V1ZPSm9oMjAwRHFzSEpYOXF6UFpWOHJzdWRyVThXM0duWEVCM01RNmN2enlGcjZxUld1OFBPS2tKbTBJazFuUHB1bVgzeDZMTmgC

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/d23221b6/player_ias.vflset/en_US/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.190 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f190.1e100.net

Software

Video Stats Server /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/x-www-form-urlencoded
X-YouTube-Utc-Offset: -480
X-YouTube-Client-Name: 56
Referer: https://www.youtube.com/embed/jeD5dxpNSLo?si=H_xx5wVJV6ZHDuQp&autoplay=1&loop=1&mute=1&playlist=jeD5dxpNSLo
X-YouTube-Client-Version: 1.20231212.01.00
X-YouTube-Time-Zone: America/Vancouver
X-Goog-Visitor-Id: Cgt6aVh6RG9XMldIRSj5mYmsBjIKCgJDQRIEGgAgLA%3D%3D
X-YouTube-Ad-Signals: dt=1703038202191&flash=0&frm=2&u_tz=-480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C344%2C315&vis=1&wgl=true&ca_type=image

Response headers

pragma: no-cache
date: Wed, 20 Dec 2023 02:10:08 GMT
x-content-type-options: nosniff
server: Video Stats Server
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://www.youtube.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: pixel.rubiconproject.com
URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=196be6b4-00cb-48b9-92e6-e2d883ace57c&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon

Domain: ups.analytics.yahoo.com
URL: https://ups.analytics.yahoo.com/ups/55953/sync?uid=196be6b4-00cb-48b9-92e6-e2d883ace57c&_origin=1&redir=true&gdpr=0&gdpr_consent=&redir=true

Verdicts & Comments Add Verdict or Comment

62 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

35 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
app.revv.co/api/v3/users	1970-01-21 02:39:58	Name: rvid Value: 2b379ee8-4cfe-4af9-a37b-915db50303de
.secure.winred.com/	1970-01-20 17:04:00	Name: __cf_bm Value: RYiSedmzYdPl.98dA3N7xuN2iCjlnay_SU1iEAtR0Bk-1703038200-1-AWU65lgtu3n/G5EKvPg3EuJaAOcKXSNZPiaaNEewC/bz983s0c6Rnox10DOZ9Tt5cUn3534E0Y00MJXhv5Js4Xs=
.winred.com/	1970-01-20 19:13:34	Name: _gcl_au Value: 1.1.1525999704.1703038201
secure.winred.com/	1969-12-31 23:59:59	Name: origin_url Value: https://secure.winred.com/desantis/october-eom-dtc?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com&amount=25
.winred.com/	1969-12-31 23:59:59	Name: _revv_v3_session Value: ZExucjZCSUNDc3NzT2tBTTJUaHBsZ1JXUTRuVmRLZk5nQVE2TW9seitoSlY1aXpQandTcTl6SU9ZaWJ6UmRlM01iczVDY04wbSt1N1NtaHFpREQxbkZIRWlvUXlvb3ppQ2JGbTdYcnljcXpuakxJUTlGVEN5T052Q3FOMTBRVnE4OFB2VUVzQVhVdTh1OVVMK3VscExlNit3cU9rcGk2bUR0eldlMVJhSjRmT2ZjUWNta3VkRys5aG4rWHVpM2VTdXR5ak9ROXJLMytGU3NKR0JSL0s5bEI4b1lmQ2tUNktSenFkamhEbTlqSW5uYThNRlF2Z1pZKzlESzZLV3BMdDhYSE9qWFZaY3hPSFladVFYanlMR2pVUFlBYnhuUXNPOVdLU3BWNzZMK2JlRDdoR1didFJDUWRLNTNoQW9CVmRSYjJ6NUtGeEFuOXNpRk9SbC9FaXY4TnFxcGZYdTQ1VG5RcDVSVGpqMXRRPS0tZ0o5RkhjNHNtT0hWVC9wYXp4YVFzdz09--36fc157851d3a87c0be24096bdc21cdfd44fe959
.revv.co/	1969-12-31 23:59:59	Name: _revv_v3_session Value: RUljcEpHVG93WWpQSEVoNUozZzRONkh0UEJ5azJ2L0ViSHlGUWdZYkhEd1ArZkkrOEVBU1NNY3ByZGlWNVcvcDhvSXhOSUlwb1ZxQXlzTm9SdXdmWHc9PS0tZy92SlU4WDlpeVVnYnhkZFN1U3ordz09--fa2f0cc5abeda25c593ab679eae8ddf5f3d15bcf
.revv.co/	1970-01-20 17:04:00	Name: __cf_bm Value: wAGW2xmwFyjho4rA84B4EewPfep9Y9QgMxkAB2XkCj0-1703038201-1-AdNfs6QQvxYgn5O6gQNSL9V5WjcMoOmg4TWG53YES6nwztNUTc+GGdGeZMv/XlZfLQkyEIGlEbPKp3w1NyHghNY=
.winred.com/	1970-01-21 02:39:58	Name: _ga_LDP16YY77N Value: GS1.1.1703038201.1.0.1703038201.0.0.0
secure.winred.com/	1970-01-21 01:49:34	Name: __spdt Value: 9253fb2bd8324611a1a3eff2f4b42f31
secure.winred.com/	1969-12-31 23:59:59	Name: sso_tries Value: 1
secure.winred.com/	1970-01-21 02:39:58	Name: rvid Value: 2b379ee8-4cfe-4af9-a37b-915db50303de
.winred.com/	1970-01-20 17:05:24	Name: _gid Value: GA1.2.1963660658.1703038201
.winred.com/	1970-01-20 17:03:58	Name: _dc_gtm_UA-73658561-7 Value: 1
.youtube.com/	1969-12-31 23:59:59	Name: YSC Value: aTAJ9QAcTQE
.youtube.com/	1970-01-20 21:23:10	Name: VISITOR_INFO1_LIVE Value: ziXzDoW2WHE
.winred.com/	1970-01-21 02:39:58	Name: _ga Value: GA1.1.270181744.1703038201
.winred.com/	1970-01-21 02:39:58	Name: _ga_X6H0114PDF Value: GS1.1.1703038201.1.0.1703038201.0.0.0
.google.com/	1970-01-20 21:27:29	Name: NID Value: 511=u-LezVhpivBm18pl5r8HR5FGVsDPFak9OdsRXBeOo_gVRD9sgHHnnijZiA3WaNXk0-HzGubz5l5nOppjpOqYWf6K-ki-MlpHchf2KbryI1VK15lPxKTUqfvbsApfsOIdVjEeuccq26WXY1k7lltJsx9NuwccepIocKXOctmkEgQ
.doubleclick.net/	1970-01-20 17:03:59	Name: test_cookie Value: CheckForPermission
.secure.winred.com/	1970-01-21 01:49:34	Name: cf_clearance Value: Xl_MYoEgAnfs231nHWuw48Ra3Y9eTHTTviuCLU3Fc2c-1703038201-0-1-4c8a72e0.bb48a701.ff67f156-0.2.1703038201
.winred.com/	1970-01-21 02:39:58	Name: FPID Value: FPID2.2.muKnnv%2FZPhc1BGOM86kg0rmmKW2FhxsobKdfaSGfX9Q%3D.1703038201
.winred.com/	1970-01-20 17:04:00	Name: FPGSID Value: 1.1703038201.1703038201.G-X6H0114PDF.nfL_10pLywZU6IZT1n8VOQ
.winred.com/	1970-01-20 19:13:34	Name: _fbp Value: fb.1.1703038202269.476351254
.winred.com/	1970-01-20 17:05:10	Name: FPLC Value: 4h3RW3BJWRXTL266K35f%2F5Bf7BnN728NFjOB38HpXZ96FySuSvN7tcKeBjqs6BM3LiRF3mBnj02Ohvvc63LiMmbtgzDaszNC7Taiha7z%2FnLUxKJ%2FhNmLInmPs5Zviw%3D%3D
m.stripe.com/	1970-01-21 02:39:58	Name: m Value: 29f33e06-2836-4dbd-8418-1c05438a5ec29ceeb9
.secure.winred.com/	1970-01-21 01:49:34	Name: __stripe_mid Value: 209d23c0-681b-4294-a424-69144fcac8726997c3
.secure.winred.com/	1970-01-20 17:04:00	Name: __stripe_sid Value: f653140f-5c0f-4341-aa0a-fb3bd3a183480ab3db
.t.co/	1970-01-21 02:39:58	Name: muc_ads Value: d96813b9-f5d3-4744-858c-544111b11873
.twitter.com/	1970-01-21 02:39:58	Name: guest_id_marketing Value: v1%3A170303820466413881
.twitter.com/	1970-01-21 02:39:58	Name: guest_id_ads Value: v1%3A170303820466413881
.twitter.com/	1970-01-21 02:39:58	Name: personalization_id Value: "v1_G72YTJ77NX05EgpAmlP5yg=="
.twitter.com/	1970-01-21 02:39:58	Name: guest_id Value: v1%3A170303820466413881
api.hcaptcha.com/	1970-01-20 17:47:10	Name: hmt_id Value: 56306826-e57d-4cdd-bd14-d75051c12bea
.adsrvr.org/	1970-01-21 01:51:00	Name: TDID Value: 196be6b4-00cb-48b9-92e6-e2d883ace57c
.adsrvr.org/	1970-01-21 01:51:00	Name: TDCPM Value: CAESFgoHcnViaWNvbhILCNKFiaLawsA8EAUSGQoKcmlnaHRtZWRpYRILCNyiiaLawsA8EAUSFwoIYXBwbmV4dXMSCwiYv4mi2sLAPBAFGAUoAzILCPbki8_wwsA8EAVCDyINCAESCQoFdGllcjIQAVoHOGd1dGwzbWAB

9 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://secure.winred.com/desantis/october-eom-dtc?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com&amount=25(Line 98) Message: Unrecognized feature: 'web-share'.
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self'".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self'".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' https://pay.google.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self'".
security	error	(Line 6) Message: This document requires 'TrustedScript' assignment.
network	error	URL: https://pay.google.com/_/InstantbuyFrontendBuyflowPayframeUi/cspreport Message: Failed to load resource: the server responded with a status of 404 ()
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self'".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self'".

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

analytics.google.com
analytics.twitter.com
api.hcaptcha.com
app.revv.co
b.stripecdn.com
cdnjs.cloudflare.com
click.email.rondesantis.com
connect.facebook.net
d35ligi1n5bgzc.cloudfront.net
evnt.byspotify.com
fonts.gstatic.com
googleads.g.doubleclick.net
gtm.winred.com
hcaptcha.com
i.ytimg.com
ib.adnxs.com
insight.adsrvr.org
jnn-pa.googleapis.com
js.adsrvr.org
js.stripe.com
m.stripe.com
m.stripe.network
maps.googleapis.com
match.adsrvr.org
merchant-ui-api.stripe.com
newassets.hcaptcha.com
pay.google.com
pixel.byspotify.com
pixel.rubiconproject.com
play.google.com
q.stripe.com
r.stripe.com
rr4---sn-tt1elnel.googlevideo.com
rr5---sn-vgqsrne6.googlevideo.com
secure.winred.com
static.ads-twitter.com
static.cloudflareinsights.com
static.doubleclick.net
stats.g.doubleclick.net
t.co
ups.analytics.yahoo.com
www.facebook.com
www.google-analytics.com
www.google.ca
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.gstatic.com
www.youtube.com
yt3.ggpht.com
pixel.rubiconproject.com
ups.analytics.yahoo.com
104.16.249.69
104.16.57.101
104.17.25.14
104.19.211.89
104.19.212.89
104.19.218.90
104.19.219.90
104.244.42.131
104.244.42.197
13.110.197.228
13.32.206.122
142.251.111.155
142.251.111.190
142.251.16.138
142.251.16.92
142.251.16.94
142.251.16.95
142.251.163.132
142.251.163.95
142.251.167.100
142.251.179.94
146.75.28.157
15.197.193.217
151.101.0.176
157.240.229.35
157.240.244.1
172.253.115.148
172.253.115.94
172.253.122.113
172.253.122.155
172.253.62.105
172.253.62.119
172.253.63.155
172.253.63.97
198.202.176.141
209.85.164.234
34.111.186.1
34.117.162.98
44.233.104.20
52.85.151.117
54.186.23.98
68.67.160.132
74.125.0.9
99.86.229.15
007b4be1404b0f21a158fa83a2ae9375393b2d932a17e9745aa392fcadc7cf2f
020467532cf7603763adb79036b05ecebd75a8a989da15d96d4aa3836a7e5ccd
06f560685ca3c65e18a4eb8b834ac16b54c48598385557f7fc4d3dfb3719a667
0ae3ccaa6252886c58e0ba33eddf63a9116d0ff60bf310c290890f6a41f30b96
0c71106628b235959659a80caca8df6f9e8dfc9eac825605e79d2738726f287d
0d25c4a331e29f9f58c7ce60ab833ddf50b811453f867a608ddb2f8e6209c735
104383e8a8abda3872004efefe2132dbffb3f299779822a9d2c207ea42152b62
1140fb791063b962016a3480d12ede4f6bdbb688b486365448cf9d92b7d8cc5f
170a50153dff5a497bb2f1b9fa77c0d0849428fc1765d3940a47314ae972ca2d
192cfad4a0b19d97e0814b118efff433497c92220c08bc5fff6b0bda164b7891
1a993839c8a46fd6c9d5804b83e402301a48ce6da4875c1f91ef5a649e111bd0
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
20c0114a672ac0b5b31a1c0100543a2306bf389816ab20774b66e8f7b30fb60c
220f25f6cbb3f22ce75fbee30ef17f56be6d76cced97c0634406b55430a76bdf
225d1680fd98dfb76eedb90b8ca678b1ea9daf5efb2a1b3289d3cc4c8ea6f5b5
254c7c3d65cfcc1a282323430a2f49560b55fafacccda77111bfc89edd3d3f71
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
27dff3dc6aeb4be2eff2b8127b1515b17032fb228af7c6cd274ebc4b17a6ee26
2f184c04ccf0a6350f145813b790f108b9f8a639414537e34fa805f19b645d63
2f930a05ca463582b325c1e317bfec295d6f644951b4d44be5724d71c2777cfa
3100edb838a335dc077854e521ca7a3db25782cfbcd1a5f7245e71e1a268f4f8
321ece339bc501c3ccf8e6efae0f0ceba66b87667ea5dbbd3a44a795f21cf44b
3302e6acf99a22281a8a1d4b419877ba6b82dad46f9216fdf04fac42636b2a74
33111c5d00b2e2e4e89f17402709ba30a1563e8c4d2fa93cf5756b44c7d1ee97
351ffc2bdf381352dcd801be49be5018361119588eae077650260f9e162fe7b9
394724ca0118829643c12fb5a033cb66680e51327ba157677d18dec209278a3d
3d08db345a18b5c44a89b2828f4440918603b290faa587811a364859924d530a
3e136e77083bfc6ef14ffc5abd19da89a82bf12fc0cda3c603e01582b93303c8
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
400672572bf199e07f53440d576be04c58beaec83fa03f27b5875aaae67745a8
40e0c53b489189c78e3627ed75b55f4907f8a79bce8810e5a26949570436afbe
420a7e24ced9f033898a0dd3c0164df4dbb5d97b7b48728610ab130510fa70dd
423e4d25aa44ebb87acf362a69dc084449650df8fd4f7d325d2f4a136075726c
440b6213329ddea7fb3618e7a28fe9868c859454726d39e114e694b8313cd9dd
4491ac8726434020a36b04e7815addf9341d5f8c19d3b9a9ba7d6b2bf7e3feaa
484ef4268f1d679c1ae88c06fc2388d39afc441465732617e5e2cdc2e3d418e2
489b773ac98678bb44e4df929d85ec9f947d7c106f61c5cd2c399eea5e9ad532
49bf463494cee8a6ce2cabefb62752db4089458d562533f9dfef404562f46159
4f0386322ee24279b4280f6b37c2c0a571b5d8b0c474efd7beaf2e88f9baa499
4fc89691fc775c314491f28a5cee759d2e5a0acd64fc6ac35c1ae9536b4fb2c0
502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358
5033e337e474e5d2818fee21b093eaef81d5f545fd49b5f635b3e1160fa83abe
51bf499751a19c673124ea1e650359f15dd39f753aa223d2b7e2b68a65dcbd36
52f33e9ac679336b5d8f6ce2dee339772a1b6f628346a6a09f20d3f4031db342
53a5b2b0368e18c799c647cbacaff57dcd7829e53a26e63bcab72c9c96853631
5506f280f34e259d4b40ccca649ca9d716d869ce6bfde09865ff4b4d982c717f
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101
63a3c24fd75d7487cf7a1459b7fe5637c48781823dc569892c33c9e5d0aeb0de
67d2a36b1cd1a04f4d83f6236578a94f7e92d42e4d6b8ca92cc5907cd7141dcf
67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2
6b63b6eea6c3175e453b0960009d25681013318ea7c565f2081a5e8bd1df6fe2
6f1537d4647aeb8b175928510ad87d87abc459892704caa2e1b5a338c0eb3dbe
7157511697db744d384a5a2a8646af23f3c90560abf93bb240fdd690b29a898a
7f19936a920a8171fd23d2e11b15228bf208b542066e72f8689afd2e2f2ce934
7fca7fbee6f960ca0c929ed86e99e6078981b2000629fad83c2fb36530dbcbcc
8073a0bcd589f248e2324d7ab4b35550c064976fab988e132bf34ff9ee264fc3
80bde6b2c6ef0d7b78fe29b97269a27c1ac96fb46a9ef8f57e2f2b7d4e4f7b3a
812091a91a8e2a825050fb688375d19996b235d7cbe8b0ae9d526cba0fb7288d
81299fe01b2318e658f9bbaa7c47ff29348095dc905f54a6b002c45a92ecdac4
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8479e373905a24b0dc0efb290d9de9d2e2ed2ccadf74826b4ab6c2cc2ff56099
8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50
88c3d4d5beaaf259f1a4d85ec5c6b14e74ea9d0a6ce99751fa218f57757785c3
88fa2a27bf6937522af2a1fe69fd5f14f468c4b6a4d90603bab66eb7f7563127
8929ebffacc482aa03b66684a0db17bff046f146377bd163af84d66709d90a55
899663bfeab6b11842c974c2417dc0ad88bd79bb7510b1e032384ccf2618dcc1
8bac8b4fe50c6203069c3386d71372ae668bb603f67bdcaa707f87c90ba45739
8d1181160c5a70a5bfe59701c0fc83930aa85d8a08baf2988417a20bc5f5e709
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8e51e1f02a3f6e08c6f9416d35f3d9d819844df7003128842d8ab0a86c6fa591
8e83bcf0315f708e646d547688191140b0fbf240f230225e7e4cc136d8133fe3
8eb58a2c5cf133d4bb268da959dfa5e6dc660f4ea61a6539e43627e6acb3c2e7
947ac0903521f5eceefc90637c066306a8ca67466ccc188bb0107fb7cfb532d1
94813a1029ba0435792d5e565dd27fbfde8a18f03e46082b44b7a77b679142a0
961951e588ed2cbd0dadda321becf5c4d27451bb0896262f86e7d922da5794ca
969dace001ef24f99f38bd00c5578b85ba9368e77a5667cfcaeaa29d2f57657b
9946c0ccba03ce2826e25d6e0588f95f202437f25d171747200bae7189f1a461
9b4677b15d0a370e6e30ba3bdbbd09d25cddb1a680f3ccede72e2a418db8ed3f
9f57e1e7f7381ec0e4eb185ca491323450dd0742b19a6097995bac78487a1835
a16c2a8d2e2d6ef0612038c3f318755a2e5da18e3183405705207860107d3858
a3a8ccd62952cba5e79d5fe88026b484bb1900217c3fc14d9987b270fde01e00
a66c306af34cd3884a07a3c67d4ce9cf1fa7b044b493b2ceec049ad9c275b3e5
ab7c9b16f2d5bab8c846cc9e453e05b55d8eee7cf8647d671e14e7d7e9e955c5
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ad7c09d6e7e7eeea87bbf0edc10eaea21f4bd19c93c9cd8f4290d96161051f31
ada3db835dd04fd7974691e145b6321d03daef7745b5ed831cb586703265b108
aeb652b78321c44ec942fe266f5a17cf8df9b3ac211575a05a59ceb2e9b7d146
af2d7d51d77af73d6e33519c8565b3e9c33f628d0bf148f045911c18c809c426
af8e10cdb4b569a5390d0a327e1bee275bc43980adf821d4ea5e5276b70de92e
b7c8d7e0552d05dbe386dab179f440d96422b129647e15c56866806643a06ecc
b873e17f56a05aba705a3056cf0e3ef6c8687ab63ecd0a8f11537b685d8c76e8
be680e4067f8c29773b5c545eb53e75dfea28aceeba5c2e3d5f624f9c04e0686
be9f065a43d459c32530d9b8b1f0e2ec2af9cc052e1a2086a043bab1227fcb8b
bf15413499b81555136c08dd340efaf4b00a8eb7ac1067d558e70bf6fbbfb07f
c0c067d3512326ee1d73cce9dccbb1bb59c24b279df3ea650ddf80578182bda6
c197a39aa31efe8624534c6907ddb1607d286e12d7d64c5e4eca703f7ba46d41
c3ca1558fd0f68bef4efd1c1b60c881c884ba6448251a0f66b9e133442bc4417
c9f1eaf5de0ea164f979b66dd4e737943c3fbaa4038abe597d599d93afc5aba1
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
ce05d09a5e7ee53c24528bb1c936cdc34470bcebd1b6da22585d1effffbac26b
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee
d065099ccf0a0a61ade77c45457a9064ce7566f1bd58306608e3caad1ba15c9e
d1bff4c024cb504c5d458cbeac53f0509fb2fcb9b0c6e37ca249fed31ce66791
d33e7d4d836f346ccdbadc87b97f8cca274c5d84ddfef99ebb819855e6b67869
d6ff339ddb4525268c21fa26ded66b0703f177e742281dc9bcd558288f8e1101
d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336
dcd19bf9d6bcb13c2ad6dec70c6ef1c1b7140844841861386e9bda8ab01354d0
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e039e607c78306c7e029a7fd0ecdb14f86456f16e1a5ce65aa26b4fdf1d38a3c
e14a21b6d0246e94147b907252730fae0af6ff98a7df478b1d632723e9f43127
e20df4d423b37ce34fb8c17da7216ba9f70a05cc93ad807eb3cf454dfe56c411
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e759dc710ec6d9f9438d5a77f834b247254512fb90cf520764ab591db32cf5cb
eda6f4bcaf303909d18ac66d645a98a475a59fd4496ef2f5cf0b47a68dc7cea7
ee11928e9a31b92c22b88f0c49dae1f791043fe071dacf46b848efe85254c003
ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f
eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef57d7f7ebe5a199ba8451468d80f03eb0da671c8820cba15bf6ec90e26d668a
f0205495d259e89d99e6c4989147f8a65bef41513bfbe3e97251cd6fb6fa5947
f0e8e07da0f7e8df81ad353aaf53faceea8164f905e39b4987f78e2cb9885142
f182d6ddf4c696841c5d8c992043ef548264832e3984c9d6b1e65461ede39df5
f29af0f45d2483d7b111bf75d2962e7d0a14ef3214068e7d334c09c4620379d3
f4d5deb4709cebcb8d869180a1db81fab7c54f99dc2e72dab8b3db15eb76e660
f82ebc761788c79b3635fec5c5276321e2bdfc84a5913044417609adef8b5303
fc69ee1a63302d4fd29f1370a9f34817d861d02f76ffe05ce4da9ed5c76b36ec
fe3fd5bf597db84d64ede28fec7e1787f6cc2b23108969cf42ca92e5df10b26f

secure.winred.com Open in urlscan Pro 104.19.212.89 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

250 Requests

97 %HTTPS

0 %IPv6

32 Domains

50 Subdomains

43 IPs

3 Countries

6673 kBTransfer

21606 kBSize

35 Cookies

10 Outgoing links

Page URL History

Redirected requests

250 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

secure.winred.com Open in urlscan Pro
104.19.212.89 Public Scan

Screenshot
Live screenshot

Full Image

250
Requests

97 %
HTTPS

0 %
IPv6

32
Domains

50
Subdomains

43
IPs

3
Countries

6673 kB
Transfer

21606 kB
Size

35
Cookies

250 HTTP transactions
2 data transactions