urlscan.io logo urlscan.io
SecurityTrails logo

secure.winred.com Open in urlscan Pro
2606:4700::6813:d459  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://click.email.rondesantis.com/?qs=f9c60ecdf35d807c0172eb9ee9a5c35a8799cc1dc6245ebd392112acb59e2783a2f35a15bf8d222daba3402ae0ac...
Effective URL: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-...
Submission: On November 17 via api from CA — Scanned from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 26 IPs in 3 countries across 25 domains to perform 67 HTTP transactions. The main IP is 2606:4700::6813:d459, located in United States and belongs to CLOUDFLARENET, US. The main domain is secure.winred.com. The Cisco Umbrella rank of the primary domain is 87741.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on February 21st 2023. Valid for: a year.
This is the only time secure.winred.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 13.110.197.228 14340 (SALESFORCE)
1 11 2606:4700::68... 13335 (CLOUDFLAR...)
3 54.192.51.51 16509 (AMAZON-02)
4 2607:f8b0:400... 15169 (GOOGLE)
2 2600:9000:208... 16509 (AMAZON-02)
4 2607:f8b0:400... 15169 (GOOGLE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
3 54.187.159.182 16509 (AMAZON-02)
4 2607:f8b0:400... 15169 (GOOGLE)
2 151.101.192.176 54113 (FASTLY)
1 2606:4700::68... 13335 (CLOUDFLAR...)
3 142.251.163.155 15169 (GOOGLE)
1 146.75.36.157 54113 (FASTLY)
2 3.161.209.109 16509 (AMAZON-02)
2 2a03:2880:f07... 32934 (FACEBOOK)
1 34.117.162.98 396982 (GOOGLE-CL...)
2 2606:4700::68... 13335 (CLOUDFLAR...)
2 2607:f8b0:400... 15169 (GOOGLE)
2 34.111.186.1 396982 (GOOGLE-CL...)
3 3 2607:f8b0:400... 15169 (GOOGLE)
4 2607:f8b0:400... 15169 (GOOGLE)
1 44.239.50.123 16509 (AMAZON-02)
3 104.244.42.69 13414 (TWITTER)
3 104.244.42.3 13414 (TWITTER)
2 2001:4860:480... 15169 (GOOGLE)
1 2a03:2880:f17... 32934 (FACEBOOK)
1 4 35.71.131.137 16509 (AMAZON-02)
1 1 69.173.151.100 26667 (RUBICONPR...)
2 2 68.67.179.155 29990 (ASN-APPNEX)
3 3 3.225.218.10 14618 (AMAZON-AES)
1 2.21.23.195 20940 (AKAMAI-ASN1)
67 26
1    13.110.197.228 (United States)

ASN14340 (SALESFORCE, US)
PTR: click.email.rondesantis.com
click.email.rondesantis.com
11    2606:4700::6813:d459 (United States)

ASN13335 (CLOUDFLARENET, US)
secure.winred.com
app.revv.co
3    54.192.51.51 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-54-192-51-51.yul62.r.cloudfront.net
js.stripe.com
4    2607:f8b0:4004:c08::5f (Ashburn, United States)

ASN15169 (GOOGLE, US)
maps.googleapis.com
2    2600:9000:208f:de00:0:7d26:ee00:93a1 (United States)

ASN16509 (AMAZON-02, US)
d35ligi1n5bgzc.cloudfront.net
4    2607:f8b0:4004:c09::61 (Ashburn, United States)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    2606:4700::6810:3865 (United States)

ASN13335 (CLOUDFLARENET, US)
static.cloudflareinsights.com
3    54.187.159.182 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ip-54-187-159-182.stripe.com
q.stripe.com
4    2607:f8b0:4004:c17::64 (Washington, United States)

ASN15169 (GOOGLE, US)
www.google-analytics.com
2    151.101.192.176 (United States)

ASN54113 (FASTLY, US)
m.stripe.network
1    2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
3    142.251.163.155 (United States)

ASN15169 (GOOGLE, US)
PTR: wv-in-f155.1e100.net
www.googleadservices.com
1    146.75.36.157 (Reston, United States)

ASN54113 (FASTLY, US)
static.ads-twitter.com
2    3.161.209.109 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-3-161-209-109.yul62.r.cloudfront.net
js.adsrvr.org
2    2a03:2880:f07d:0:face:b00c:0:3 (Apodaca, Mexico)

ASN32934 (FACEBOOK, US)
connect.facebook.net
1    34.117.162.98 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 98.162.117.34.bc.googleusercontent.com
pixel.byspotify.com
2    2606:4700::6810:f945 (United States)

ASN13335 (CLOUDFLARENET, US)
gtm.winred.com
2    2607:f8b0:4004:c08::9c (Ashburn, United States)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
2    34.111.186.1 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 1.186.111.34.bc.googleusercontent.com
evnt.byspotify.com
3    2607:f8b0:4004:c17::9b (Washington, United States)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
4    2607:f8b0:4004:c08::69 (Ashburn, United States)

ASN15169 (GOOGLE, US)
www.google.com
1    44.239.50.123 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-44-239-50-123.us-west-2.compute.amazonaws.com
m.stripe.com
3    104.244.42.69 (United States)

ASN13414 (TWITTER, US)
t.co
3    104.244.42.3 (United States)

ASN13414 (TWITTER, US)
analytics.twitter.com
2    2001:4860:4802:36::181 (United States)

ASN15169 (GOOGLE, US)
analytics.google.com
1    2a03:2880:f171:81:face:b00c:0:25de (Apodaca, Mexico)

ASN32934 (FACEBOOK, US)
www.facebook.com
4    35.71.131.137 (United States)

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com
insight.adsrvr.org
match.adsrvr.org
1    69.173.151.100 (United States)

ASN26667 (RUBICONPROJECT, US)
pixel.rubiconproject.com
2    68.67.179.155 (North Bergen, United States)

ASN29990 (ASN-APPNEX, US)
PTR: 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
ib.adnxs.com
3    3.225.218.10 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-225-218-10.compute-1.amazonaws.com
ups.analytics.yahoo.com
1    2.21.23.195 (Paris, France)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-21-23-195.deploy.static.akamaitechnologies.com
hb.yahoo.net
Apex Domain
Subdomains		 Transfer
12 winred.com
secure.winred.com — Cisco Umbrella Rank: 87741
gtm.winred.com — Cisco Umbrella Rank: 177643
195 KB
7 stripe.com
js.stripe.com — Cisco Umbrella Rank: 1287
q.stripe.com — Cisco Umbrella Rank: 7148
m.stripe.com — Cisco Umbrella Rank: 1249
141 KB
6 google.com
www.google.com — Cisco Umbrella Rank: 2
analytics.google.com — Cisco Umbrella Rank: 157
1 KB
6 adsrvr.org
js.adsrvr.org — Cisco Umbrella Rank: 1610
insight.adsrvr.org — Cisco Umbrella Rank: 584
match.adsrvr.org — Cisco Umbrella Rank: 353
6 KB
5 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 78
googleads.g.doubleclick.net — Cisco Umbrella Rank: 33
4 KB
4 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 27
21 KB
4 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 35
363 KB
4 googleapis.com
maps.googleapis.com — Cisco Umbrella Rank: 393
175 KB
3 yahoo.com
ups.analytics.yahoo.com — Cisco Umbrella Rank: 327
877 B
3 twitter.com
analytics.twitter.com — Cisco Umbrella Rank: 747
2 KB
3 t.co
t.co — Cisco Umbrella Rank: 607
807 B
3 byspotify.com
pixel.byspotify.com — Cisco Umbrella Rank: 11884
evnt.byspotify.com — Cisco Umbrella Rank: 12020
7 KB
3 googleadservices.com
www.googleadservices.com — Cisco Umbrella Rank: 145
6 KB
2 adnxs.com
ib.adnxs.com — Cisco Umbrella Rank: 246
2 KB
2 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 174
90 KB
2 stripe.network
m.stripe.network — Cisco Umbrella Rank: 1354
16 KB
2 cloudfront.net
d35ligi1n5bgzc.cloudfront.net
432 KB
1 yahoo.net
hb.yahoo.net — Cisco Umbrella Rank: 938
657 B
1 rubiconproject.com
pixel.rubiconproject.com — Cisco Umbrella Rank: 376
915 B
1 facebook.com
www.facebook.com — Cisco Umbrella Rank: 110
185 B
1 ads-twitter.com
static.ads-twitter.com — Cisco Umbrella Rank: 713
15 KB
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 223
4 KB
1 revv.co
app.revv.co — Cisco Umbrella Rank: 360593
1 KB
1 cloudflareinsights.com
static.cloudflareinsights.com — Cisco Umbrella Rank: 899
7 KB
1 rondesantis.com
click.email.rondesantis.com
425 B
67 25
Domain Requested by
10 secure.winred.com 1 redirects secure.winred.com
static.cloudflareinsights.com
4 www.google.com secure.winred.com
4 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
secure.winred.com
4 www.googletagmanager.com secure.winred.com
www.googletagmanager.com
4 maps.googleapis.com secure.winred.com
maps.googleapis.com
3 ups.analytics.yahoo.com 3 redirects
3 match.adsrvr.org js.adsrvr.org
3 analytics.twitter.com secure.winred.com
3 t.co secure.winred.com
3 googleads.g.doubleclick.net 3 redirects
3 www.googleadservices.com www.googletagmanager.com
3 q.stripe.com secure.winred.com
3 js.stripe.com secure.winred.com
js.stripe.com
2 ib.adnxs.com 2 redirects
2 analytics.google.com www.googletagmanager.com
2 evnt.byspotify.com pixel.byspotify.com
2 stats.g.doubleclick.net www.google-analytics.com
www.googletagmanager.com
2 gtm.winred.com www.googletagmanager.com
2 connect.facebook.net secure.winred.com
connect.facebook.net
2 js.adsrvr.org www.googletagmanager.com
match.adsrvr.org
2 m.stripe.network js.stripe.com
m.stripe.network
2 d35ligi1n5bgzc.cloudfront.net secure.winred.com
1 hb.yahoo.net js.adsrvr.org
1 pixel.rubiconproject.com 1 redirects
1 insight.adsrvr.org 1 redirects
1 www.facebook.com secure.winred.com
1 m.stripe.com m.stripe.network
1 pixel.byspotify.com secure.winred.com
1 static.ads-twitter.com www.googletagmanager.com
1 cdnjs.cloudflare.com secure.winred.com
1 app.revv.co secure.winred.com
1 static.cloudflareinsights.com secure.winred.com
1 click.email.rondesantis.com 1 redirects
67 33

This site contains links to these domains. Also see Links.

Domain
winred.com
rondesantis.com
Subject Issuer Validity Valid
secure.winred.com
Cloudflare Inc ECC CA-3		 2023-02-21 -
2024-02-21		 a year crt.sh
a.stripecdn.com
DigiCert SHA2 Extended Validation Server CA		 2023-10-30 -
2024-01-25		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2023-10-23 -
2024-01-15		 3 months crt.sh
*.cloudfront.net
Amazon RSA 2048 M01		 2023-10-10 -
2024-09-19		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2023-10-23 -
2024-01-15		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-04-10 -
2024-04-09		 a year crt.sh
*.stripe.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2023-10-09 -
2024-01-18		 3 months crt.sh
www.googleadservices.com
GTS CA 1C3		 2023-10-23 -
2024-01-15		 3 months crt.sh
ads-twitter.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-07-21 -
2024-07-19		 a year crt.sh
*.adsrvr.org
GlobalSign GCC R3 DV TLS CA 2020		 2023-04-12 -
2024-05-13		 a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2023-08-26 -
2023-11-24		 3 months crt.sh
pixel.byspotify.com
GTS CA 1D4		 2023-11-06 -
2024-02-04		 3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2023-10-23 -
2024-01-15		 3 months crt.sh
prfx.byspotify.com
GTS CA 1D4		 2023-11-11 -
2024-02-09		 3 months crt.sh
m.stripe.com
DigiCert TLS RSA SHA256 2020 CA1		 2023-10-05 -
2024-01-18		 3 months crt.sh
t.co
DigiCert TLS RSA SHA256 2020 CA1		 2023-02-01 -
2024-02-01		 a year crt.sh
*.twitter.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-11-07 -
2024-11-05		 a year crt.sh
www.google.com
GTS CA 1C3		 2023-10-23 -
2024-01-15		 3 months crt.sh
*.google.com
GTS CA 1C3		 2023-10-23 -
2024-01-15		 3 months crt.sh
hb.yahoo.net
R3		 2023-10-09 -
2024-01-07		 3 months crt.sh

This page contains 8 frames:

Primary Page: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com
Frame ID: 7307C04305AEC0701899315D086863B3
Requests: 51 HTTP requests in this frame

Frame: https://secure.winred.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/main.js
Frame ID: 1AACDAF00582F4F7AB08FDC4FD2FCF96
Requests: 2 HTTP requests in this frame

Frame: https://js.stripe.com/v3/m-outer-27c67c0d52761104439bb051c7856ab1.html
Frame ID: FE389F8C4E388E858450CC81132D8B22
Requests: 4 HTTP requests in this frame

Frame: https://m.stripe.network/inner.html
Frame ID: DD0993149A4CC6601783426F920A8FED
Requests: 4 HTTP requests in this frame

Frame: https://match.adsrvr.org/track/upb/?adv=8gutl3m&ref=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com&upid=ssuhzkp&upv=1.1.0&td1=undefined&td2=undefined&td3=undefined&td4=undefined&td5=undefined&td6=undefined&td7=undefined&v=undefined
Frame ID: E0E8C4F9DA26E4B6F0F0D779737C43A9
Requests: 2 HTTP requests in this frame

Frame: https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
Frame ID: 4375F2C689D13F4A4B541D8F35E90BE3
Requests: 1 HTTP requests in this frame

Frame: https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=7797509905249140324&ttd_tdid=9fd8246a-def3-4204-b83e-bdc0a96e8912
Frame ID: 7B84BBF29A864727DAE11E5A5F698F2F
Requests: 1 HTTP requests in this frame

Frame: https://hb.yahoo.net/cksync?cs=63&axid_e=eS1mYUxjY3hORTJ1SElWTzg5NjdiSzMyWG1SNk5RaHJ2N35B&gdpr=0&ovsid=9fd8246a-def3-4204-b83e-bdc0a96e8912&dpid=55953
Frame ID: 148BD053E5ED19F8125AE140D4787CEB
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Ron DeSantis for President | Grassroots Team

Page URL History Show full URLs

  1. https://click.email.rondesantis.com/?qs=f9c60ecdf35d807c0172eb9ee9a5c35a8799cc1dc6245ebd392112acb59e2783a2f35a15... HTTP 302
    https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaig... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • //maps\.google(?:apis)?\.com/maps/api/js
Overall confidence: 100%
Detected patterns
  • js\.stripe\.com
Overall confidence: 100%
Detected patterns
  • static\.cloudflareinsights\.com/beacon(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/ns\.html[^>]+></iframe>
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js

Page Statistics

67
Requests

94 %
HTTPS

45 %
IPv6

25
Domains

33
Subdomains

26
IPs

3
Countries

1484 kB
Transfer

4211 kB
Size

38
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://click.email.rondesantis.com/?qs=f9c60ecdf35d807c0172eb9ee9a5c35a8799cc1dc6245ebd392112acb59e2783a2f35a15bf8d222daba3402ae0acc5d73caa9201ab6dd1f95dc2887ba013522d HTTP 302
    https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 13
  • https://secure.winred.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
  • https://secure.winred.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/main.js
Request Chain 41
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11188077750/?random=174871859&cv=11&fst=1700190609436&bg=ffffff&guid=ON&async=1&gtm=45He3b81v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com&label=tNBiCNPx_KIYELaJ8tYp&hn=www.googleadservices.com&frm=0&tiba=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&value=0&auid=754495540.1700190609&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&ocp_id=kdlWZcaCKZuwoPMPs_SLiAI&sscte=1&crd=&eitems=ChAIgJjXqgYQ9Jadse2ruoV8Eh0Al0MgLzbe4rK0iPA2JfHC6981F2YYuX8MH27GkQ&pscrd=EkxDaEFJZ0pqWHFnWVFrcWo2MHFQMW9JQTlFaVVBNEtDUC10Nk5rdjJKajhJVW40UU11SGpfSm5pNXpMTnJ0UExFX2taUThEd2RFZFFmGldDaEFJZ0pqWHFnWVFuNzdNaU11OGljTkVFaTBBOURJYkl3RFFUSzItd2F5c1M2aFF2QTFSZERTOVRPeHE2VVlLemZ6TDdfWm5ENGxkai04dWVZXzdoMHMiEwiGj9zKh8qCAxUbGGgIHTP6AiE HTTP 302
  • https://www.google.com/pagead/1p-conversion/11188077750/?random=174871859&cv=11&fst=1700190609436&bg=ffffff&guid=ON&async=1&gtm=45He3b81v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com&label=tNBiCNPx_KIYELaJ8tYp&hn=www.googleadservices.com&frm=0&tiba=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&value=0&auid=754495540.1700190609&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=EkxDaEFJZ0pqWHFnWVFrcWo2MHFQMW9JQTlFaVVBNEtDUC10Nk5rdjJKajhJVW40UU11SGpfSm5pNXpMTnJ0UExFX2taUThEd2RFZFFmGldDaEFJZ0pqWHFnWVFuNzdNaU11OGljTkVFaTBBOURJYkl3RFFUSzItd2F5c1M2aFF2QTFSZERTOVRPeHE2VVlLemZ6TDdfWm5ENGxkai04dWVZXzdoMHMiEwiGj9zKh8qCAxUbGGgIHTP6AiE&is_vtc=1&ocp_id=kdlWZcaCKZuwoPMPs_SLiAI&cid=CAQSGwDICaaNb9KoskBRciuH2D9UDtNKPTAWMUtn9Q&eitems=ChAIgJjXqgYQ9Jadse2ruoV8Eh0Al0MgL5taUErXpXCBqKUpYvReJjON35cKj49dRQ&random=3619681583
Request Chain 42
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11198202606/?random=1906704391&cv=11&fst=1700190609444&bg=ffffff&guid=ON&async=1&gtm=45He3b81v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com&label=M51RCOmQgKgYEO6F3Nsp&hn=www.googleadservices.com&frm=0&tiba=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&value=0&auid=754495540.1700190609&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&ocp_id=kdlWZc2GKfC0oPMPib-YEA&sscte=1&crd=&eitems=ChAIgJjXqgYQ9Jadse2ruoV8Eh0Al0MgL6efg9vXWmgchR14ddjsO5fP2EuOfxVHdg&pscrd=EkxDaEFJZ0pqWHFnWVFrcWo2MHFQMW9JQTlFaVVBNEtDUC10Nk5rdjJKajhJVW40UU11SGpfSm5pNXpMTnJ0UExFX2taUThEd2RFZFFmGldDaEFJZ0pqWHFnWVFuNzdNaU11OGljTkVFaTBBOURJYkkzeE42bkhSZldNczNPOTJDeE5waS03Yl9LeUJ0RHFQUkJfRjQwYXBibGxfa3JWWWJJM0x4cjAiEwiNk9zKh8qCAxVwGmgIHYkfBgI HTTP 302
  • https://www.google.com/pagead/1p-conversion/11198202606/?random=1906704391&cv=11&fst=1700190609444&bg=ffffff&guid=ON&async=1&gtm=45He3b81v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com&label=M51RCOmQgKgYEO6F3Nsp&hn=www.googleadservices.com&frm=0&tiba=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&value=0&auid=754495540.1700190609&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=EkxDaEFJZ0pqWHFnWVFrcWo2MHFQMW9JQTlFaVVBNEtDUC10Nk5rdjJKajhJVW40UU11SGpfSm5pNXpMTnJ0UExFX2taUThEd2RFZFFmGldDaEFJZ0pqWHFnWVFuNzdNaU11OGljTkVFaTBBOURJYkkzeE42bkhSZldNczNPOTJDeE5waS03Yl9LeUJ0RHFQUkJfRjQwYXBibGxfa3JWWWJJM0x4cjAiEwiNk9zKh8qCAxVwGmgIHYkfBgI&is_vtc=1&ocp_id=kdlWZc2GKfC0oPMPib-YEA&cid=CAQSGwDICaaNNcOjndRLTiEQoMbGCR9qiUpPBbliSg&eitems=ChAIgJjXqgYQ9Jadse2ruoV8Eh0Al0MgL5UKGduSAEicCVtnPpqGqgr8n9eXLj77Vw&random=3715121242
Request Chain 43
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11263458299/?random=1627416149&cv=11&fst=1700190609451&bg=ffffff&guid=ON&async=1&gtm=45He3b81v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com&label=e3Q7CJi9neAYEPv36vop&hn=www.googleadservices.com&frm=0&tiba=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&value=0&auid=754495540.1700190609&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&ocp_id=kdlWZfKkKaOqoPMPyfap6AQ&sscte=1&crd=&eitems=ChAIgJjXqgYQ9Jadse2ruoV8Eh0Al0MgL04AE5iXFNRHxoOURfmTaAJxVjNgfmQxbA&pscrd=EkxDaEFJZ0pqWHFnWVFrcWo2MHFQMW9JQTlFaVVBNEtDUC10Nk5rdjJKajhJVW40UU11SGpfSm5pNXpMTnJ0UExFX2taUThEd2RFZFFmGldDaEFJZ0pqWHFnWVFuNzdNaU11OGljTkVFaTBBOURJYkkybDB6WXZmREtGNnRWeHBvSDh5MkhHalo0alY4NVJhVmZfZzJUZHg1RjQyLXl5NkotZnNrQ0EiEwiysdzKh8qCAxUjFWgIHUl7Ck0 HTTP 302
  • https://www.google.com/pagead/1p-conversion/11263458299/?random=1627416149&cv=11&fst=1700190609451&bg=ffffff&guid=ON&async=1&gtm=45He3b81v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com&label=e3Q7CJi9neAYEPv36vop&hn=www.googleadservices.com&frm=0&tiba=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&value=0&auid=754495540.1700190609&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=EkxDaEFJZ0pqWHFnWVFrcWo2MHFQMW9JQTlFaVVBNEtDUC10Nk5rdjJKajhJVW40UU11SGpfSm5pNXpMTnJ0UExFX2taUThEd2RFZFFmGldDaEFJZ0pqWHFnWVFuNzdNaU11OGljTkVFaTBBOURJYkkybDB6WXZmREtGNnRWeHBvSDh5MkhHalo0alY4NVJhVmZfZzJUZHg1RjQyLXl5NkotZnNrQ0EiEwiysdzKh8qCAxUjFWgIHUl7Ck0&is_vtc=1&ocp_id=kdlWZfKkKaOqoPMPyfap6AQ&cid=CAQSGwDICaaNMXgyRNtFGZN-UH3ZeLaN_Nl7XJuwBg&eitems=ChAIgJjXqgYQ9Jadse2ruoV8Eh0Al0MgL09sVPFJ-9mWGtGSSdsOIofRilzcUPMkXQ&random=3060294209
Request Chain 59
  • https://insight.adsrvr.org/track/up?adv=8gutl3m&ref=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com&upid=ssuhzkp&upv=1.1.0&td1=undefined&td2=undefined&td3=undefined&td4=undefined&td5=undefined&td6=undefined&td7=undefined&v=undefined HTTP 302
  • https://match.adsrvr.org/track/upb/?adv=8gutl3m&ref=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com&upid=ssuhzkp&upv=1.1.0&td1=undefined&td2=undefined&td3=undefined&td4=undefined&td5=undefined&td6=undefined&td7=undefined&v=undefined
Request Chain 61
  • https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=9fd8246a-def3-4204-b83e-bdc0a96e8912&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon HTTP 302
  • https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
Request Chain 62
  • https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=9fd8246a-def3-4204-b83e-bdc0a96e8912 HTTP 307
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fmatch.adsrvr.org%252ftrack%252fcmf%252fappnexus%253fttd%253d1%2526anid%253d%2524UID%26ttd_tdid%3D9fd8246a-def3-4204-b83e-bdc0a96e8912 HTTP 302
  • https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=7797509905249140324&ttd_tdid=9fd8246a-def3-4204-b83e-bdc0a96e8912
Request Chain 63
  • https://ups.analytics.yahoo.com/ups/55953/sync?uid=9fd8246a-def3-4204-b83e-bdc0a96e8912&_origin=1&redir=true&gdpr=0&gdpr_consent=&redir=true HTTP 302
  • https://ups.analytics.yahoo.com/ups/55953/sync?uid=9fd8246a-def3-4204-b83e-bdc0a96e8912&_origin=1&redir=true&gdpr=0&gdpr_consent=&redir=true&verify=true HTTP 302
  • https://ups.analytics.yahoo.com/ups/58824/sync?_origin=0&dpid=55953&ovsid=9fd8246a-def3-4204-b83e-bdc0a96e8912&gdpr=0&redir=true HTTP 302
  • https://hb.yahoo.net/cksync?cs=63&axid_e=eS1mYUxjY3hORTJ1SElWTzg5NjdiSzMyWG1SNk5RaHJ2N35B&gdpr=0&ovsid=9fd8246a-def3-4204-b83e-bdc0a96e8912&dpid=55953

67 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request fewer-desantis-emails
secure.winred.com/desantis/
Redirect Chain
  • https://click.email.rondesantis.com/?qs=f9c60ecdf35d807c0172eb9ee9a5c35a8799cc1dc6245ebd392112acb59e2783a2f35a15bf8d222daba3402ae0acc5d73caa9201ab6dd1f95dc2887ba013522d
  • https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_nam...
29 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d459 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3b8ee7327179bc2b117d8c326f358f0e72b011a37912570cf19e80190220aa81
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate, private, max-age=0
cf-cache-status
DYNAMIC
cf-ray
8274c767e90d38e3-YYZ
content-encoding
br
content-type
text/html; charset=utf-8
date
Fri, 17 Nov 2023 03:10:08 GMT
server
cloudflare
strict-transport-security
max-age=0; includeSubDomains
vary
Accept-Encoding
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-rack-cors
miss; no-origin
x-request-id
bb870d02-18cd-4133-8f32-f48b67df7dbf
x-revv-cache
Hit from Revv
x-robots-tag
noindex, nofollow, noarchive
x-runtime
0.043652
x-xss-protection
1; mode=block

Redirect headers

Cache-Control
private
Connection
close
Content-Length
399
Content-Type
text/html; charset=utf-8
Date
Fri, 17 Nov 2023 03:10:08 GMT
Location
https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com
/
js.stripe.com/v3/ 		554 KB
136 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.stripe.com/v3/
Requested by
Host: secure.winred.com
URL: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.192.51.51 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-192-51-51.yul62.r.cloudfront.net
Software
Cloudfront /
Resource Hash
f27e9ca75db1b778e94c55ffb6a1f471a2fab0761034b9ce0a233bc0866e6cc2
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 03:09:35 GMT
content-encoding
br
via
1.1 47373525d370c4b58e8b2be88c66f646.cloudfront.net (CloudFront)
strict-transport-security
max-age=31556926; includeSubDomains; preload
x-content-type-options
nosniff
age
36
x-amz-cf-pop
YUL62-C2
x-cache
Hit from cloudfront
last-modified
Thu, 16 Nov 2023 22:23:16 GMT
server
Cloudfront
etag
W/"735677db1390373c37dfd0233c992727"
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=60
timing-allow-origin
*
x-amz-cf-id
jIORSCcUowz5qVWi7Mtz4WjK99nGMSMOPt5wL6lztsPB4c5_PYvv7g==
landing_page-b5085350195c50801834c19cd56b1cabc8b9ea2b81e3a74f8486f6b3e2ae2898.css
secure.winred.com/assets/ 		219 KB
34 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://secure.winred.com/assets/landing_page-b5085350195c50801834c19cd56b1cabc8b9ea2b81e3a74f8486f6b3e2ae2898.css
Requested by
Host: secure.winred.com
URL: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d459 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
961951e588ed2cbd0dadda321becf5c4d27451bb0896262f86e7d922da5794ca
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 03:10:08 GMT
strict-transport-security
max-age=0; includeSubDomains
x-content-type-options
nosniff
x-amz-version-id
AovNtHHE8r.B5j9dqDW1Mv8YglCEAdgs
cf-cache-status
HIT
x-amz-request-id
SQRRDRAVXMN0CGDP
age
5088
cf-polished
origSize=227667
content-encoding
br
alt-svc
h3=":443"; ma=86400
x-amz-id-2
ujT8qmh86ShaMCUnOhkPGEuXupQ+ypJG5biFZUo5/zIs1cMzT2eX1Jx95acA15AeFWQFa6XLad4=
cf-bgj
minify
last-modified
Fri, 27 Oct 2023 00:50:26 GMT
server
cloudflare
etag
W/"57df3b6cebff9962c43c29347b45123f"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
cf-ray
8274c768daed38e3-YYZ
expires
Fri, 17 Nov 2023 07:10:08 GMT
1693236734.css
secure.winred.com/stylesheets/rv_page_01h8mfbypgqb7dfk1mh2zg6nbb/ 		9 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://secure.winred.com/stylesheets/rv_page_01h8mfbypgqb7dfk1mh2zg6nbb/1693236734.css
Requested by
Host: secure.winred.com
URL: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d459 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d2a9df6a4cfce46a55fec3fbc9134896438d7a845e3ae841b0f9214f62988cf7
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-rack-cors
miss; no-origin
date
Fri, 17 Nov 2023 03:10:08 GMT
strict-transport-security
max-age=0; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
MISS
content-encoding
br
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
x-request-id
211fbc67-02b2-4812-a028-f334714895d0
x-runtime
0.054678
last-modified
Fri, 17 Nov 2023 03:10:08 GMT
server
cloudflare
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
cache-control
public, max-age=31556952
cf-ray
8274c768daef38e3-YYZ
expires
Sat, 16 Nov 2024 08:59:20 GMT
js
maps.googleapis.com/maps/api/ 		193 KB
65 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places
Requested by
Host: secure.winred.com
URL: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c08::5f Ashburn, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
scaffolding on HTTPServer2 /
Resource Hash
abbb946d3f9dbc094aee39d8bcaf2549aba489769aa9c27a37e8feef9dc1b3fa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 03:10:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
scaffolding on HTTPServer2
vary
Accept-Language, Origin, X-Origin, Referer
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1800
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
66384
x-xss-protection
0
application-landing-page-f2a5b42b4b21999654b53e07363d1a56587867548d00f9dd45c2af6c283da313.js
secure.winred.com/assets/ 		486 KB
136 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.winred.com/assets/application-landing-page-f2a5b42b4b21999654b53e07363d1a56587867548d00f9dd45c2af6c283da313.js
Requested by
Host: secure.winred.com
URL: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d459 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4b0ee40c236b43959682dbfb183f1e573d475a20c1a8831055731403679aaa69
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 03:10:08 GMT
strict-transport-security
max-age=0; includeSubDomains
x-content-type-options
nosniff
x-amz-version-id
978OI8i6QFarFjUvfriEb5EFtcqK3zb9
cf-cache-status
HIT
x-amz-request-id
SJF98NERQBWM9C58
age
5088
cf-polished
origSize=497438
content-encoding
br
alt-svc
h3=":443"; ma=86400
x-amz-id-2
KiEsSZj4gOevWIIx0mTkX4O6rLzu4rPWw+OMQyKpjkC6T35zL7Kt57AwwTeUW9oTTRGblcwKSiI=
cf-bgj
minify
last-modified
Tue, 07 Nov 2023 01:47:09 GMT
server
cloudflare
etag
W/"00507202ba7b3ee5cf79681b9afffc43"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=14400
cf-ray
8274c768daf038e3-YYZ
expires
Fri, 17 Nov 2023 07:10:08 GMT
DZ3LCQO_FORq64tSsknePYk4yVRiej_zqQGggKXmGAc.png
d35ligi1n5bgzc.cloudfront.net/logos/logo_assets/000/657/064/large/ 		14 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d35ligi1n5bgzc.cloudfront.net/logos/logo_assets/000/657/064/large/DZ3LCQO_FORq64tSsknePYk4yVRiej_zqQGggKXmGAc.png
Requested by
Host: secure.winred.com
URL: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:208f:de00:0:7d26:ee00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
b12d7b7e9f25c3b43fd866b5ca187f83b20b85e4da81adc57d951662bb001a5f

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 03:10:10 GMT
x-amz-version-id
HqacbrjTiuOEJ__Bhb__xt7pVUrABwED
via
1.1 8a5f92c3f2254c853b1d4d6f0bb340ac.cloudfront.net (CloudFront)
last-modified
Sat, 24 Jun 2023 14:31:38 GMT
server
AmazonS3
x-amz-cf-pop
IAD79-C3
etag
"12c257318c236589e1c52c90ddc85a06"
x-amz-server-side-encryption
AES256
x-cache
Miss from cloudfront
content-type
image/png
accept-ranges
bytes
alt-svc
h3=":443"; ma=86400
content-length
14268
x-amz-cf-id
TBTdH3czWNAibL0LpNDiwrvRfNrS9zJRNekr0cp5ZxzH-23RxOzUmw==
win-red-full-red-5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848.svg
secure.winred.com/assets/ 		19 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure.winred.com/assets/win-red-full-red-5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848.svg
Requested by
Host: secure.winred.com
URL: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d459 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 03:10:08 GMT
x-amz-version-id
yQRGZgalAwutcyvR8cZRohcw5vZDtH9y
x-content-type-options
nosniff
strict-transport-security
max-age=0; includeSubDomains
cf-cache-status
HIT
x-amz-request-id
NFH5A6V8WD1DA1XC
age
5311
content-encoding
br
alt-svc
h3=":443"; ma=86400
x-amz-id-2
3lhfgIhxvJuarbJQxDUdBxcwKpVaPhPnU1hn3TcL+oGxc66CCfgpbRel8Z+Pe+2EfeLWKwsV0Wo=
last-modified
Fri, 27 Oct 2023 00:50:28 GMT
server
cloudflare
etag
W/"d31530d4186af669daf4f47099614593"
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
public, max-age=14400
cf-ray
8274c768daf138e3-YYZ
expires
Fri, 17 Nov 2023 07:10:08 GMT
email-decode.min.js
secure.winred.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 		1 KB
849 B 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.winred.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: secure.winred.com
URL: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d459 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 03:10:08 GMT
strict-transport-security
max-age=0; includeSubDomains
x-content-type-options
nosniff
last-modified
Thu, 16 Nov 2023 21:55:48 GMT
server
cloudflare
content-encoding
gzip
etag
W/"65568fe4-4d7"
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/javascript
cache-control
max-age=172800, public
cf-ray
8274c7693b8d38e3-YYZ
expires
Sun, 19 Nov 2023 03:10:08 GMT
gtm.js
www.googletagmanager.com/ 		421 KB
97 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N
Requested by
Host: secure.winred.com
URL: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c09::61 Ashburn, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
a008eb4b9c1b4b1832cfe3afbc9f4f5899fe79e4727dc5e4df2cce3b6972370f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 03:10:09 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
99055
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Fri, 17 Nov 2023 03:10:09 GMT
gtm.js
www.googletagmanager.com/ 		267 KB
88 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-M4TW6TX
Requested by
Host: secure.winred.com
URL: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c09::61 Ashburn, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
dfb7d96a948d75cc26916279eefbf066212b4525856bcfff25b866cdfedfc42d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 03:10:09 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
90240
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Fri, 17 Nov 2023 03:10:09 GMT
v84a3a4012de94ce1a686ba8c167c359c1696973893317
static.cloudflareinsights.com/beacon.min.js/ 		20 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.cloudflareinsights.com/beacon.min.js/v84a3a4012de94ce1a686ba8c167c359c1696973893317
Requested by
Host: secure.winred.com
URL: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:3865 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101

Request headers

Referer
https://secure.winred.com/
Origin
https://secure.winred.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 03:10:09 GMT
content-encoding
gzip
last-modified
Tue, 10 Oct 2023 21:38:13 GMT
server
cloudflare
etag
W/"2023.10.0"
vary
Accept-Encoding
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
cf-ray
8274c76b4cb939f0-YYZ
WinRed_Background_%2813%29.png
d35ligi1n5bgzc.cloudfront.net/backgrounds/images/000/702/782/large/ 		417 KB
418 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d35ligi1n5bgzc.cloudfront.net/backgrounds/images/000/702/782/large/WinRed_Background_%2813%29.png
Requested by
Host: secure.winred.com
URL: https://secure.winred.com/stylesheets/rv_page_01h8mfbypgqb7dfk1mh2zg6nbb/1693236734.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:208f:de00:0:7d26:ee00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2f8a9cb94b4f434cd8efceb5a4b29a151180a3ca2e3f41278512b460387e815d

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Thu, 16 Nov 2023 05:42:10 GMT
x-amz-version-id
lvyWkSIXVxabEv.WOSgLlyYT7vA_.4Wo
via
1.1 8a5f92c3f2254c853b1d4d6f0bb340ac.cloudfront.net (CloudFront)
last-modified
Sun, 20 Aug 2023 18:23:41 GMT
server
AmazonS3
x-amz-cf-pop
IAD79-C3
age
77280
etag
"ac9f12cca25816d71631a89ea3e3d334"
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-type
image/png
accept-ranges
bytes
alt-svc
h3=":443"; ma=86400
content-length
426992
x-amz-cf-id
kUGfj7BB8GXVPXkOqDPaYGRVfIG1FmEU8ka3BmMW7Rb7tBqUvyW_dg==
current_with_info
app.revv.co/api/v3/users/ 		162 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://app.revv.co/api/v3/users/current_with_info?organization_token=rv_org_01h0fnp3d6597cwc8tt4vbst1j&redirect=https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com
Requested by
Host: secure.winred.com
URL: https://secure.winred.com/assets/application-landing-page-f2a5b42b4b21999654b53e07363d1a56587867548d00f9dd45c2af6c283da313.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:d459 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f708986d1226675751814adee7ad273ef74751adb3f17a6ad0ba0c8b6eb0773e
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://secure.winred.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-rack-cors-original-access-control-allow-origin
https://secure.winred.com
x-rack-cors
hit
date
Fri, 17 Nov 2023 03:10:09 GMT
x-rack-cors-original-access-control-max-age
0
x-rack-cors-original-access-control-allow-credentials
true
strict-transport-security
max-age=0; includeSubDomains
cf-cache-status
DYNAMIC
x-content-type-options
nosniff
content-encoding
br
x-rack-cors-original-access-control-allow-methods
GET, POST, OPTIONS
x-rack-cors-original-access-control-expose-headers
alt-svc
h3=":443"; ma=86400
x-request-id
9ce4d473-f8a0-408f-9880-b2ed6ff25897
x-runtime
0.009087
server
cloudflare
etag
W/"f708986d1226675751814adee7ad273e"
access-control-max-age
0
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/vnd.api+json
access-control-allow-origin
https://secure.winred.com
access-control-expose-headers
cache-control
max-age=0, private, must-revalidate
access-control-allow-credentials
true
vary
Origin
cf-ray
8274c76d2e9139c5-YYZ
main.js
secure.winred.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/ Frame 1AAC
Redirect Chain
  • https://secure.winred.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
  • https://secure.winred.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/main.js
7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.winred.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/main.js
Requested by
Host: secure.winred.com
URL: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com
Protocol
H3
Server
2606:4700::6813:d459 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c8492451ab7ce8b47c7fbb0bc1b71d6a5686953aa17ee5f9cd76aa41a0135a3c
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 03:10:09 GMT
strict-transport-security
max-age=0; includeSubDomains
x-content-type-options
nosniff
content-encoding
br
server
cloudflare
vary
accept-encoding
content-type
application/javascript; charset=UTF-8
cache-control
max-age=14400, public
cf-ray
8274c76c98eda241-YYZ
alt-svc
h3=":443"; ma=86400

Redirect headers

date
Fri, 17 Nov 2023 03:10:09 GMT
strict-transport-security
max-age=0; includeSubDomains
x-content-type-options
nosniff
server
cloudflare
vary
accept-encoding
access-control-allow-origin
*
location
/cdn-cgi/challenge-platform/h/g/scripts/jsd/9914b343/main.js
cache-control
max-age=300, public
cf-ray
8274c76c3869a241-YYZ
alt-svc
h3=":443"; ma=86400
m-outer-27c67c0d52761104439bb051c7856ab1.html
js.stripe.com/v3/ Frame FE38 		200 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://js.stripe.com/v3/m-outer-27c67c0d52761104439bb051c7856ab1.html
Requested by
Host: js.stripe.com
URL: https://js.stripe.com/v3/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.192.51.51 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-192-51-51.yul62.r.cloudfront.net
Software
Cloudfront /
Resource Hash
351ffc2bdf381352dcd801be49be5018361119588eae077650260f9e162fe7b9
Security Headers
Name Value
Content-Security-Policy base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security max-age=31556926; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://secure.winred.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
access-control-allow-origin
*
age
3018
cache-control
max-age=31536000
content-length
200
content-security-policy
base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://q.stripe.com/csp-report
content-security-policy-report-only
base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://q.stripe.com/csp-report
content-type
text/html; charset=utf-8
date
Fri, 17 Nov 2023 02:19:52 GMT
etag
"27c67c0d52761104439bb051c7856ab1"
last-modified
Fri, 03 Nov 2023 20:07:03 GMT
server
Cloudfront
strict-transport-security
max-age=31556926; includeSubDomains; preload
timing-allow-origin
*
vary
Accept-Encoding
via
1.1 47373525d370c4b58e8b2be88c66f646.cloudfront.net (CloudFront)
x-amz-cf-id
RMQQsdj-sBbG3KV55qtsF78d-QFyiLNlxgYoVxp9VE6ShU7LFqpuJA==
x-amz-cf-pop
YUL62-C2
x-cache
Hit from cloudfront
x-content-type-options
nosniff
gen_204
maps.googleapis.com/maps/api/mapsjs/ 		3 B
45 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true
Requested by
Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c08::5f Ashburn, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
scaffolding on HTTPServer2 /
Resource Hash
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 03:10:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
scaffolding on HTTPServer2
vary
Origin, X-Origin, Referer
x-frame-options
SAMEORIGIN
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://secure.winred.com
access-control-expose-headers
vary,vary,vary,content-encoding,date,server,content-length
cache-control
private
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
23
x-xss-protection
0
m-outer-6576085ca35ee42f2f484cda6763e4aa.js
js.stripe.com/v3/fingerprinted/js/ Frame FE38 		631 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.stripe.com/v3/fingerprinted/js/m-outer-6576085ca35ee42f2f484cda6763e4aa.js
Requested by
Host: js.stripe.com
URL: https://js.stripe.com/v3/m-outer-27c67c0d52761104439bb051c7856ab1.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.192.51.51 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-54-192-51-51.yul62.r.cloudfront.net
Software
Cloudfront /
Resource Hash
f0205495d259e89d99e6c4989147f8a65bef41513bfbe3e97251cd6fb6fa5947
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://js.stripe.com/v3/m-outer-27c67c0d52761104439bb051c7856ab1.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 02:45:38 GMT
via
1.1 47373525d370c4b58e8b2be88c66f646.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=31556926; includeSubDomains; preload
age
1472
x-amz-cf-pop
YUL62-C2
x-cache
Hit from cloudfront
content-length
631
last-modified
Tue, 31 Oct 2023 20:34:57 GMT
server
Cloudfront
etag
"70cacf09ae81711ac6dcbc5ee59750c4"
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
x-amz-cf-id
0davleq1HzUHp_aKpLRfLytQnfzjadyQTdFXYOla7yzyv1R4sIxWtA==
csp-report
q.stripe.com/ Frame FE38 		0
717 B 		Other
General
Check archive.org
Download Go to
Full URL
https://q.stripe.com/csp-report
Requested by
Host: secure.winred.com
URL: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ip-54-187-159-182.stripe.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://js.stripe.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type
application/csp-report

Response headers

date
Fri, 17 Nov 2023 03:10:09 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-content-type-options
nosniff
x-stripe-server-envoy-start-time-us
1700190609699806
x-envoy-upstream-service-time
3
content-length
0
x-stripe-bg-intended-route-color
green
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
server
nginx
cross-origin-opener-policy
same-origin
access-control-max-age
3600
access-control-allow-methods
GET, POST, OPTIONS
x-stripe-server-envoy-upstream-service-time-ms
1
access-control-allow-origin
https://js.stripe.com
x-stripe-client-envoy-start-time-us
1700190609699196
cache-control
max-age=0, no-cache, no-store, must-revalidate
access-control-expose-headers
Server, Range, Content-Type
x-robots-tag
none
access-control-allow-headers
Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires
0
csp-report
q.stripe.com/ Frame FE38 		0
718 B 		Other
General
Check archive.org
Download Go to
Full URL
https://q.stripe.com/csp-report
Requested by
Host: secure.winred.com
URL: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ip-54-187-159-182.stripe.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://js.stripe.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type
application/csp-report

Response headers

date
Fri, 17 Nov 2023 03:10:09 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-content-type-options
nosniff
x-stripe-server-envoy-start-time-us
1700190609699637
x-envoy-upstream-service-time
2
content-length
0
x-stripe-bg-intended-route-color
green
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
server
nginx
cross-origin-opener-policy
same-origin
access-control-max-age
3600
access-control-allow-methods
GET, POST, OPTIONS
x-stripe-server-envoy-upstream-service-time-ms
0
access-control-allow-origin
https://js.stripe.com
x-stripe-client-envoy-start-time-us
1700190609699178
cache-control
max-age=0, no-cache, no-store, must-revalidate
access-control-expose-headers
Server, Range, Content-Type
x-robots-tag
none
access-control-allow-headers
Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires
0
js
www.googletagmanager.com/gtag/ 		258 KB
87 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c09::61 Ashburn, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
294128b9b86498504102507289a9e355433ac0158d8fb24a7348e1f92be7612f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 03:10:09 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
89395
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Fri, 17 Nov 2023 03:10:09 GMT
analytics.js
www.google-analytics.com/ 		52 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c17::64 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Fri, 17 Nov 2023 02:22:21 GMT
last-modified
Mon, 12 Jun 2023 18:23:07 GMT
server
Golfe2
age
2868
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20994
expires
Fri, 17 Nov 2023 04:22:21 GMT
inner.html
m.stripe.network/ Frame DD09 		930 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://m.stripe.network/inner.html
Requested by
Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/m-outer-6576085ca35ee42f2f484cda6763e4aa.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.192.176 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Fastly /
Resource Hash
947ac0903521f5eceefc90637c066306a8ca67466ccc188bb0107fb7cfb532d1
Security Headers
Name Value
Content-Security-Policy base-uri 'none'; connect-src https://m.stripe.network https://m.stripe.com; default-src 'none'; font-src https://m.stripe.network https://fonts.gstatic.com; form-action 'none'; frame-src https://m.stripe.network https://js.stripe.com; img-src https://m.stripe.network https://m.stripe.com https://b.stripecdn.com; script-src https://m.stripe.network 'sha256-/5Guo2nzv5n/w6ukZpOBZOtTJBJPSkJ6mhHpnBgm3Ls='; style-src https://m.stripe.network; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security max-age=31556926; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://js.stripe.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
112
cache-control
max-age=300, public
content-encoding
br
content-length
540
content-security-policy
base-uri 'none'; connect-src https://m.stripe.network https://m.stripe.com; default-src 'none'; font-src https://m.stripe.network https://fonts.gstatic.com; form-action 'none'; frame-src https://m.stripe.network https://js.stripe.com; img-src https://m.stripe.network https://m.stripe.com https://b.stripecdn.com; script-src https://m.stripe.network 'sha256-/5Guo2nzv5n/w6ukZpOBZOtTJBJPSkJ6mhHpnBgm3Ls='; style-src https://m.stripe.network; report-uri https://q.stripe.com/csp-report
content-type
text/html; charset=utf-8
date
Fri, 17 Nov 2023 03:10:09 GMT
server
Fastly
strict-transport-security
max-age=31556926; includeSubDomains; preload
vary
Accept-Encoding, Origin
via
1.1 varnish
x-cache
HIT
x-cache-hits
62
x-content-type-options
nosniff
x-request-id
9b449480-e876-46f0-8a14-376a1c73c5b8
x-served-by
cache-yyz4522-YYZ
x-timer
S1700190610.603030,VS0,VE0
sha256.min.js
cdnjs.cloudflare.com/ajax/libs/js-sha256/0.9.0/ 		9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/js-sha256/0.9.0/sha256.min.js
Requested by
Host: secure.winred.com
URL: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7157511697db744d384a5a2a8646af23f3c90560abf93bb240fdd690b29a898a
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
https://secure.winred.com/
Origin
https://secure.winred.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 03:10:09 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
1364998
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
2977
last-modified
Mon, 04 May 2020 16:11:50 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03ec6-2339"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kjiFe4yMEaWX82OIWQHzl6koNHUQ%2BSQad6bGhKvB4Vcrg%2FxSp2DByMo5Y6fTkIg4xX8OTLrFjWAFpJJWSqkzfBW%2FB5Yr1GMaFduHEZnZyusL%2FNcYjSRlHGunB5R2zzRpOAmczscLFR290Fqmy00pZAS6"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
8274c76e1b9b53dd-YYZ
expires
Wed, 06 Nov 2024 03:10:09 GMT
js
www.googletagmanager.com/gtag/ 		273 KB
91 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-LDP16YY77N&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M4TW6TX
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c09::61 Ashburn, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
a7723f63151f99064a343f00b4fccc510fb55f3cfba7b13d88b383824a663486
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 03:10:09 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
92702
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Fri, 17 Nov 2023 03:10:09 GMT
/
www.googleadservices.com/pagead/conversion/11188077750/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/conversion/11188077750/?random=1700190609436&cv=11&fst=1700190609436&bg=ffffff&guid=ON&async=1&gtm=45He3b81v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com&label=tNBiCNPx_KIYELaJ8tYp&hn=www.googleadservices.com&frm=0&tiba=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&value=0&bttype=purchase&auid=754495540.1700190609&uamb=0&uaw=0&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M4TW6TX
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.163.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wv-in-f155.1e100.net
Software
cafe /
Resource Hash
ff74fdccb97f1ea6c0c6b90f5adb27111705e20ad98a6d787824638d29102592
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 17 Nov 2023 03:10:09 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1794
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.googleadservices.com/pagead/conversion/11198202606/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/conversion/11198202606/?random=1700190609444&cv=11&fst=1700190609444&bg=ffffff&guid=ON&async=1&gtm=45He3b81v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com&label=M51RCOmQgKgYEO6F3Nsp&hn=www.googleadservices.com&frm=0&tiba=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&value=0&bttype=purchase&auid=754495540.1700190609&uamb=0&uaw=0&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M4TW6TX
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.163.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wv-in-f155.1e100.net
Software
cafe /
Resource Hash
04ef8a83c9b2b24b80ff827b2abed08e1327f77f71165643ac5b9696fd6e2792
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 17 Nov 2023 03:10:09 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1789
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
uwt.js
static.ads-twitter.com/ 		56 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M4TW6TX
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
146.75.36.157 Reston, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 03:10:09 GMT
content-encoding
gzip
last-modified
Thu, 27 Oct 2022 15:55:14 GMT
etag
"32ad004436155ec972bc50e6238b5b67+gzip"
vary
Accept-Encoding,Host
x-cache
HIT
content-type
application/javascript; charset=utf-8
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn
FT
cache-control
no-cache
accept-ranges
bytes
content-length
15375
x-served-by
cache-iad-kcgs7200020-IAD
/
www.googleadservices.com/pagead/conversion/11263458299/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/conversion/11263458299/?random=1700190609451&cv=11&fst=1700190609451&bg=ffffff&guid=ON&async=1&gtm=45He3b81v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com&label=e3Q7CJi9neAYEPv36vop&hn=www.googleadservices.com&frm=0&tiba=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&value=0&bttype=purchase&auid=754495540.1700190609&uamb=0&uaw=0&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M4TW6TX
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.163.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wv-in-f155.1e100.net
Software
cafe /
Resource Hash
c17cd40d261ca044dba00d020f915f7c9663136dd927903422780f8d98328312
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 17 Nov 2023 03:10:09 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1797
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
up_loader.1.1.0.js
js.adsrvr.org/ 		5 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.adsrvr.org/up_loader.1.1.0.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M4TW6TX
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.161.209.109 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-161-209-109.yul62.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
899663bfeab6b11842c974c2417dc0ad88bd79bb7510b1e032384ccf2618dcc1

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date
Thu, 16 Nov 2023 21:54:27 GMT
Content-Encoding
gzip
Via
1.1 19298b403c16e472e8e1bf4122960db4.cloudfront.net (CloudFront)
Last-Modified
Tue, 01 Aug 2023 20:10:44 GMT
Server
AmazonS3
X-Amz-Cf-Pop
YUL62-P1
Age
18943
x-amz-server-side-encryption
AES256
ETag
W/"b7474eac210849250426a8f6a39d00f3"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
application/x-javascript
X-Cache
Hit from cloudfront
Connection
keep-alive
X-Amz-Cf-Id
eMHyb2gw7NAE9MpzIKnF3A1Ls25OWpo2GiAsMuaf2_1-grIJBgMGdQ==
fbevents.js
connect.facebook.net/en_US/ 		202 KB
54 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: secure.winred.com
URL: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f07d:0:face:b00c:0:3 Apodaca, Mexico, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
3e136e77083bfc6ef14ffc5abd19da89a82bf12fc0cda3c603e01582b93303c8
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Fri, 17 Nov 2023 03:10:09 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
54273
x-xss-protection
0
reporting-endpoints
pragma
public
x-fb-debug
xiO5RApCtq5k4A6MXmfNmyif40jwgGNS2zUtCnZey72VVQ7yhj4kFMzXsgwXaiq/QXiTuN92xL/BZsgObhmIFQ==
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin
*
expires
Sat, 01 Jan 2000 00:00:00 GMT
ping.min.js
pixel.byspotify.com/ 		32 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pixel.byspotify.com/ping.min.js
Requested by
Host: secure.winred.com
URL: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.117.162.98 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
98.162.117.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
20c0114a672ac0b5b31a1c0100543a2306bf389816ab20774b66e8f7b30fb60c

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 02:38:52 GMT
content-encoding
gzip
via
1.1 google
age
1877
x-guploader-uploadid
ABPtcPpdijWELIi9EB-3EluPXhNkxMq-ZBsCBS_PtcmHs34aEUxBJjdhDt1fOMtzEp2X4kstWMOLzUztdOjeIZj7L-1c7Q
x-goog-storage-class
STANDARD
x-goog-metageneration
2
x-goog-stored-content-encoding
gzip
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6158
last-modified
Wed, 11 Oct 2023 19:00:35 GMT
server
UploadServer
etag
"13069f74108a788c598831c3a4ff2cdf"
vary
Accept-Encoding
x-goog-generation
1697050835633914
x-goog-hash
crc32c=We0+rw==, md5=EwafdBCKeIxZiDHDpP8s3w==
content-type
application/javascript;
cache-control
public, max-age=3600
x-goog-stored-content-length
6158
accept-ranges
bytes
expires
Fri, 17 Nov 2023 03:38:52 GMT
8274c767e90d38e3
secure.winred.com/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame 1AAC 		0
297 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://secure.winred.com/cdn-cgi/challenge-platform/h/g/jsd/r/8274c767e90d38e3
Requested by
Host: secure.winred.com
URL: https://secure.winred.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6813:d459 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Referer
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type
application/json

Response headers

date
Fri, 17 Nov 2023 03:10:13 GMT
strict-transport-security
max-age=0; includeSubDomains
x-content-type-options
nosniff
content-encoding
br
server
cloudflare
content-type
text/plain; charset=UTF-8
cf-ray
8274c76e1b93a241-YYZ
alt-svc
h3=":443"; ma=86400
collect
gtm.winred.com/g/ 		468 B
605 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://gtm.winred.com/g/collect?v=2&tid=G-X6H0114PDF&gtm=45je3b81v867905447z872410129&_p=1700190608765&gcd=11l1l1l1l1&dma=0&cid=504583713.1700190610&ul=en-us&sr=1600x1200&_fplc=0&ur=US&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&sst.uc=US&sst.gse=1&sst.gcd=11l1l1l1l1&sst.tft=1700190608765&_s=1&sid=1700190609&sct=1&seg=0&dl=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com&dt=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&en=page_view&_fv=1&_nsi=1&_ss=1&ep.pagepath=%2Fdesantis%2Ffewer-desantis-emails&ep.pagehostname=secure.winred.com&ep.parsedurl=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails&epn.load_time_sec=-1700190608&epn.event_fire_time=1700190609367&ep.event_uuid=9b45a029-80b3-4039-beb6-0c8eb7e784ca&ep.isVideoPage=f&ep.referrer=&tfd=1580&richsstsse
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:f945 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2da27e9f80fb0c587704e60f412e21a58a651815555dec67442cad18911ad102
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 03:10:10 GMT
via
1.1 google
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
content-encoding
br
server
cloudflare
strict-transport-security
max-age=0; includeSubDomains
vary
Accept-Encoding
content-type
text/plain
access-control-allow-origin
https://secure.winred.com
cache-control
no-cache
access-control-allow-credentials
true
cf-ray
8274c771dd913a02-YYZ
alt-svc
h3=":443"; ma=86400
collect
www.google-analytics.com/g/ 		0
172 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/g/collect?v=2&tid=G-LDP16YY77N&gtm=45je3b81v9118533250z89118299598&_p=1700190608765&gcd=11l1l1l1l1&dma=0&cid=504583713.1700190610&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1700190609&sct=1&seg=0&dl=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com&dt=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&en=page_view&_fv=1&_ss=1&tfd=1624
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-LDP16YY77N&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c17::64 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 17 Nov 2023 03:10:09 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://secure.winred.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
csp-report
q.stripe.com/ Frame DD09 		0
489 B 		Other
General
Check archive.org
Download Go to
Full URL
https://q.stripe.com/csp-report
Requested by
Host: secure.winred.com
URL: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ip-54-187-159-182.stripe.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload, max-age=31556926; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://m.stripe.network/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type
application/csp-report

Response headers

date
Fri, 17 Nov 2023 03:10:09 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload, max-age=31556926; includeSubDomains; preload
x-content-type-options
nosniff
x-stripe-server-envoy-start-time-us
1700190609761024
x-envoy-upstream-service-time
2
content-length
0
x-stripe-bg-intended-route-color
green
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
server
nginx
cross-origin-opener-policy
same-origin
x-stripe-server-envoy-upstream-service-time-ms
0
x-stripe-client-envoy-start-time-us
1700190609760531
cache-control
max-age=0, no-cache, no-store, must-revalidate
x-robots-tag
none
expires
0
out-4.5.43.js
m.stripe.network/ Frame DD09 		87 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://m.stripe.network/out-4.5.43.js
Requested by
Host: m.stripe.network
URL: https://m.stripe.network/inner.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.192.176 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Fastly /
Resource Hash
e039e607c78306c7e029a7fd0ecdb14f86456f16e1a5ce65aa26b4fdf1d38a3c
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://m.stripe.network/inner.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=31556926; includeSubDomains; preload
date
Fri, 17 Nov 2023 03:10:09 GMT
x-content-type-options
nosniff
content-encoding
br
via
1.1 varnish
age
261
x-cache
HIT
content-length
15509
x-request-id
22e004f9-febc-4b60-ab4b-df0ad34253b7
x-served-by
cache-yyz4522-YYZ
server
Fastly
x-timer
S1700190610.709888,VS0,VE0
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=utf-8
cache-control
max-age=300, public
accept-ranges
bytes
x-cache-hits
144
collect
www.google-analytics.com/j/ 		3 B
93 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j101&a=107075907&t=pageview&_s=1&dl=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_%26first_name%3D%5BREDACTED%20NAME%5D%26last_name%3D%5BREDACTED%20NAME%5D%26state%3D%26city%3D%26zip%3D%26email%3Djed.w%5BREDACTED%20EMAIL%5Dien.com&ul=en-us&de=UTF-8&dt=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YCDAiEABBAAAACAEK~&jid=97866781&gjid=106698217&cid=504583713.1700190610&tid=UA-73658561-7&_gid=1177860662.1700190610&_slc=1&gtm=45He3b81n71NTQZ9Nv72410129&cd61=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_%26first_name%3D%5BREDACTED%20NAME%5D%26last_name%3D%5BREDACTED%20NAME%5D%26state%3D%26city%3D%26zip%3D%26email%3Djed.w%5BREDACTED%20EMAIL%5Dien.com&gcd=11l1l1l1l1&dma=0&z=69539589
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c17::64 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://secure.winred.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Fri, 17 Nov 2023 03:10:09 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://secure.winred.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
3
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/ 		2 B
348 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-73658561-7&cid=504583713.1700190610&jid=97866781&gjid=106698217&_gid=1177860662.1700190610&_u=YCDAiEABBAAAAGAEK~&z=1202270344
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c08::9c Ashburn, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6068f86ff5e6d3a3e100e95fd0ab03a5fb9ebfca9386b2c0ee131361a62526c2
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://secure.winred.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Fri, 17 Nov 2023 03:10:10 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://secure.winred.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/ 		35 B
112 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j101&a=107075907&t=event&ni=0&_s=1&dl=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com&ul=en-us&de=UTF-8&dt=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=petition%20landing%20page&ea=user%20session%20start&el=landing%20page%20settings&_u=YCDAiEABBAAAAGAEK~&jid=&gjid=&cid=504583713.1700190610&tid=UA-73658561-7&_gid=1177860662.1700190610&gtm=45He3b81n71NTQZ9Nv72410129&cd41=anonymous&cd58=t&cd61=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com&gcd=11l1l1l1l1&dma=0&z=1730142164
Requested by
Host: secure.winred.com
URL: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c17::64 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 17 Nov 2023 03:10:09 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
evnt.byspotify.com/ 		2 B
106 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://evnt.byspotify.com/
Requested by
Host: pixel.byspotify.com
URL: https://pixel.byspotify.com/ping.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.111.186.1 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
1.186.111.34.bc.googleusercontent.com
Software
/
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Accept
application/json
Referer
https://secure.winred.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type
application/json

Response headers

date
Fri, 17 Nov 2023 03:10:10 GMT
via
1.1 google
access-control-allow-methods
GET, POST
content-type
application/json
access-control-allow-origin
*
access-control-allow-credentials
false
access-control-allow-headers
Content-Type, Accept
content-length
2
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
/
evnt.byspotify.com/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://evnt.byspotify.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.111.186.1 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
1.186.111.34.bc.googleusercontent.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://secure.winred.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-credentials
false
access-control-allow-headers
content-type
access-control-allow-methods
POST
access-control-allow-origin
https://secure.winred.com
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
date
Fri, 17 Nov 2023 03:10:10 GMT
via
1.1 google
/
www.google.com/pagead/1p-conversion/11188077750/
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11188077750/?random=174871859&cv=11&fst=1700190609436&bg=ffffff&guid=ON&async=1&gtm=45He3b81v9118299598&gcd=11l1l1l1l1&dma=0&u_w=160...
  • https://www.google.com/pagead/1p-conversion/11188077750/?random=174871859&cv=11&fst=1700190609436&bg=ffffff&guid=ON&async=1&gtm=45He3b81v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%...
42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-conversion/11188077750/?random=174871859&cv=11&fst=1700190609436&bg=ffffff&guid=ON&async=1&gtm=45He3b81v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com&label=tNBiCNPx_KIYELaJ8tYp&hn=www.googleadservices.com&frm=0&tiba=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&value=0&auid=754495540.1700190609&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=EkxDaEFJZ0pqWHFnWVFrcWo2MHFQMW9JQTlFaVVBNEtDUC10Nk5rdjJKajhJVW40UU11SGpfSm5pNXpMTnJ0UExFX2taUThEd2RFZFFmGldDaEFJZ0pqWHFnWVFuNzdNaU11OGljTkVFaTBBOURJYkl3RFFUSzItd2F5c1M2aFF2QTFSZERTOVRPeHE2VVlLemZ6TDdfWm5ENGxkai04dWVZXzdoMHMiEwiGj9zKh8qCAxUbGGgIHTP6AiE&is_vtc=1&ocp_id=kdlWZcaCKZuwoPMPs_SLiAI&cid=CAQSGwDICaaNb9KoskBRciuH2D9UDtNKPTAWMUtn9Q&eitems=ChAIgJjXqgYQ9Jadse2ruoV8Eh0Al0MgL5taUErXpXCBqKUpYvReJjON35cKj49dRQ&random=3619681583
Requested by
Host: secure.winred.com
URL: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com
Protocol
H2
Server
2607:f8b0:4004:c08::69 Ashburn, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 17 Nov 2023 03:10:10 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 17 Nov 2023 03:10:10 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://www.google.com/pagead/1p-conversion/11188077750/?random=174871859&cv=11&fst=1700190609436&bg=ffffff&guid=ON&async=1&gtm=45He3b81v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com&label=tNBiCNPx_KIYELaJ8tYp&hn=www.googleadservices.com&frm=0&tiba=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&value=0&auid=754495540.1700190609&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=EkxDaEFJZ0pqWHFnWVFrcWo2MHFQMW9JQTlFaVVBNEtDUC10Nk5rdjJKajhJVW40UU11SGpfSm5pNXpMTnJ0UExFX2taUThEd2RFZFFmGldDaEFJZ0pqWHFnWVFuNzdNaU11OGljTkVFaTBBOURJYkl3RFFUSzItd2F5c1M2aFF2QTFSZERTOVRPeHE2VVlLemZ6TDdfWm5ENGxkai04dWVZXzdoMHMiEwiGj9zKh8qCAxUbGGgIHTP6AiE&is_vtc=1&ocp_id=kdlWZcaCKZuwoPMPs_SLiAI&cid=CAQSGwDICaaNb9KoskBRciuH2D9UDtNKPTAWMUtn9Q&eitems=ChAIgJjXqgYQ9Jadse2ruoV8Eh0Al0MgL5taUErXpXCBqKUpYvReJjON35cKj49dRQ&random=3619681583
content-type
image/gif
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-conversion/11198202606/
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11198202606/?random=1906704391&cv=11&fst=1700190609444&bg=ffffff&guid=ON&async=1&gtm=45He3b81v9118299598&gcd=11l1l1l1l1&dma=0&u_w=16...
  • https://www.google.com/pagead/1p-conversion/11198202606/?random=1906704391&cv=11&fst=1700190609444&bg=ffffff&guid=ON&async=1&gtm=45He3b81v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https...
42 B
455 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-conversion/11198202606/?random=1906704391&cv=11&fst=1700190609444&bg=ffffff&guid=ON&async=1&gtm=45He3b81v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com&label=M51RCOmQgKgYEO6F3Nsp&hn=www.googleadservices.com&frm=0&tiba=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&value=0&auid=754495540.1700190609&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=EkxDaEFJZ0pqWHFnWVFrcWo2MHFQMW9JQTlFaVVBNEtDUC10Nk5rdjJKajhJVW40UU11SGpfSm5pNXpMTnJ0UExFX2taUThEd2RFZFFmGldDaEFJZ0pqWHFnWVFuNzdNaU11OGljTkVFaTBBOURJYkkzeE42bkhSZldNczNPOTJDeE5waS03Yl9LeUJ0RHFQUkJfRjQwYXBibGxfa3JWWWJJM0x4cjAiEwiNk9zKh8qCAxVwGmgIHYkfBgI&is_vtc=1&ocp_id=kdlWZc2GKfC0oPMPib-YEA&cid=CAQSGwDICaaNNcOjndRLTiEQoMbGCR9qiUpPBbliSg&eitems=ChAIgJjXqgYQ9Jadse2ruoV8Eh0Al0MgL5UKGduSAEicCVtnPpqGqgr8n9eXLj77Vw&random=3715121242
Requested by
Host: secure.winred.com
URL: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com
Protocol
H2
Server
2607:f8b0:4004:c08::69 Ashburn, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 17 Nov 2023 03:10:10 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 17 Nov 2023 03:10:10 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://www.google.com/pagead/1p-conversion/11198202606/?random=1906704391&cv=11&fst=1700190609444&bg=ffffff&guid=ON&async=1&gtm=45He3b81v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com&label=M51RCOmQgKgYEO6F3Nsp&hn=www.googleadservices.com&frm=0&tiba=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&value=0&auid=754495540.1700190609&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=EkxDaEFJZ0pqWHFnWVFrcWo2MHFQMW9JQTlFaVVBNEtDUC10Nk5rdjJKajhJVW40UU11SGpfSm5pNXpMTnJ0UExFX2taUThEd2RFZFFmGldDaEFJZ0pqWHFnWVFuNzdNaU11OGljTkVFaTBBOURJYkkzeE42bkhSZldNczNPOTJDeE5waS03Yl9LeUJ0RHFQUkJfRjQwYXBibGxfa3JWWWJJM0x4cjAiEwiNk9zKh8qCAxVwGmgIHYkfBgI&is_vtc=1&ocp_id=kdlWZc2GKfC0oPMPib-YEA&cid=CAQSGwDICaaNNcOjndRLTiEQoMbGCR9qiUpPBbliSg&eitems=ChAIgJjXqgYQ9Jadse2ruoV8Eh0Al0MgL5UKGduSAEicCVtnPpqGqgr8n9eXLj77Vw&random=3715121242
content-type
image/gif
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-conversion/11263458299/
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11263458299/?random=1627416149&cv=11&fst=1700190609451&bg=ffffff&guid=ON&async=1&gtm=45He3b81v9118299598&gcd=11l1l1l1l1&dma=0&u_w=16...
  • https://www.google.com/pagead/1p-conversion/11263458299/?random=1627416149&cv=11&fst=1700190609451&bg=ffffff&guid=ON&async=1&gtm=45He3b81v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https...
42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-conversion/11263458299/?random=1627416149&cv=11&fst=1700190609451&bg=ffffff&guid=ON&async=1&gtm=45He3b81v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com&label=e3Q7CJi9neAYEPv36vop&hn=www.googleadservices.com&frm=0&tiba=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&value=0&auid=754495540.1700190609&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=EkxDaEFJZ0pqWHFnWVFrcWo2MHFQMW9JQTlFaVVBNEtDUC10Nk5rdjJKajhJVW40UU11SGpfSm5pNXpMTnJ0UExFX2taUThEd2RFZFFmGldDaEFJZ0pqWHFnWVFuNzdNaU11OGljTkVFaTBBOURJYkkybDB6WXZmREtGNnRWeHBvSDh5MkhHalo0alY4NVJhVmZfZzJUZHg1RjQyLXl5NkotZnNrQ0EiEwiysdzKh8qCAxUjFWgIHUl7Ck0&is_vtc=1&ocp_id=kdlWZfKkKaOqoPMPyfap6AQ&cid=CAQSGwDICaaNMXgyRNtFGZN-UH3ZeLaN_Nl7XJuwBg&eitems=ChAIgJjXqgYQ9Jadse2ruoV8Eh0Al0MgL09sVPFJ-9mWGtGSSdsOIofRilzcUPMkXQ&random=3060294209
Requested by
Host: secure.winred.com
URL: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com
Protocol
H2
Server
2607:f8b0:4004:c08::69 Ashburn, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 17 Nov 2023 03:10:10 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 17 Nov 2023 03:10:10 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://www.google.com/pagead/1p-conversion/11263458299/?random=1627416149&cv=11&fst=1700190609451&bg=ffffff&guid=ON&async=1&gtm=45He3b81v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com&label=e3Q7CJi9neAYEPv36vop&hn=www.googleadservices.com&frm=0&tiba=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&value=0&auid=754495540.1700190609&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=EkxDaEFJZ0pqWHFnWVFrcWo2MHFQMW9JQTlFaVVBNEtDUC10Nk5rdjJKajhJVW40UU11SGpfSm5pNXpMTnJ0UExFX2taUThEd2RFZFFmGldDaEFJZ0pqWHFnWVFuNzdNaU11OGljTkVFaTBBOURJYkkybDB6WXZmREtGNnRWeHBvSDh5MkhHalo0alY4NVJhVmZfZzJUZHg1RjQyLXl5NkotZnNrQ0EiEwiysdzKh8qCAxUjFWgIHUl7Ck0&is_vtc=1&ocp_id=kdlWZfKkKaOqoPMPyfap6AQ&cid=CAQSGwDICaaNMXgyRNtFGZN-UH3ZeLaN_Nl7XJuwBg&eitems=ChAIgJjXqgYQ9Jadse2ruoV8Eh0Al0MgL09sVPFJ-9mWGtGSSdsOIofRilzcUPMkXQ&random=3060294209
content-type
image/gif
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
6
m.stripe.com/ Frame DD09 		156 B
668 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://m.stripe.com/6
Requested by
Host: m.stripe.network
URL: https://m.stripe.network/out-4.5.43.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
44.239.50.123 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-44-239-50-123.us-west-2.compute.amazonaws.com
Software
nginx /
Resource Hash
2bfffa28b98700f1fca2433260a5b8c1ae2407a63a8811592ef633da5243a54b
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://m.stripe.network/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

x-stripe-bg-intended-route-color
green
date
Fri, 17 Nov 2023 03:10:10 GMT
strict-transport-security
max-age=31556926; includeSubDomains; preload
x-content-type-options
nosniff
x-stripe-server-envoy-start-time-us
1700190610516373
server
nginx
content-type
application/json;charset=utf-8
x-stripe-server-envoy-upstream-service-time-ms
2
access-control-allow-origin
https://m.stripe.network
x-stripe-client-envoy-start-time-us
1700190610516056
access-control-allow-credentials
true
access-control-allow-headers
Content-Type
content-length
156
collect
gtm.winred.com/g/ 		239 B
827 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://gtm.winred.com/g/collect?v=2&tid=G-X6H0114PDF&gtm=45je3b81v867905447z872410129&_p=1700190608765&gcd=11l1l1l1l1&dma=0&cid=504583713.1700190610&ul=en-us&sr=1600x1200&_fplc=0&ur=US&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&sst.uc=US&sst.gse=1&sst.gcd=11l1l1l1l1&sst.tft=1700190608765&_s=2&sid=1700190609&sct=1&seg=0&dl=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com&dt=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&en=user%20session%20start&ep.pagepath=%2Fdesantis%2Ffewer-desantis-emails&ep.pagehostname=secure.winred.com&ep.parsedurl=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails&epn.load_time_sec=-1700190608&epn.event_fire_time=1700190609393&ep.event_uuid=b4355eb1-c5e9-4cbf-96b6-d18f2cf79205&ep.isVideoPage=f&ep.referrer=&ep.category=petition%20landing%20page&ep.action=user%20session%20start&ep.label=landing%20page%20settings&ep.customCSS=t&ep.usercategory=anonymous&_et=4&tfd=2160&richsstsse
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:f945 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
29d690befadef53803fbba7e3bfe0b0233658d09d08b9263da7f90321d2e3124
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 03:10:10 GMT
via
1.1 google
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
content-encoding
br
server
cloudflare
strict-transport-security
max-age=0; includeSubDomains
vary
Accept-Encoding
content-type
text/plain
access-control-allow-origin
https://secure.winred.com
cache-control
no-cache
access-control-allow-credentials
true
cf-ray
8274c771fdd23a02-YYZ
alt-svc
h3=":443"; ma=86400
adsct
t.co/1/i/ 		43 B
376 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t.co/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=c39cc2f0-049c-4bc8-acc4-939dee132bd5&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=847a88da-8b6f-4f65-95c0-3ac676948bf5&tw_document_href=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com&tw_iframe_status=0&txn_id=of5mh&type=javascript&version=2.3.29
Requested by
Host: secure.winred.com
URL: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.69 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_b /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-response-time
6
date
Fri, 17 Nov 2023 03:10:10 GMT
strict-transport-security
max-age=0
server
tsa_b
content-type
image/gif;charset=utf-8
x-transaction-id
867a3f40ee42ce57
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
b23dedc2943ac1c7242d2dc01f7c04762da8ad597422bf289662a6fc6a0a04a7
content-length
43
adsct
analytics.twitter.com/1/i/ 		43 B
566 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://analytics.twitter.com/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=c39cc2f0-049c-4bc8-acc4-939dee132bd5&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=847a88da-8b6f-4f65-95c0-3ac676948bf5&tw_document_href=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com&tw_iframe_status=0&txn_id=of5mh&type=javascript&version=2.3.29
Requested by
Host: secure.winred.com
URL: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_b /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-response-time
75
date
Fri, 17 Nov 2023 03:10:10 GMT
strict-transport-security
max-age=631138519
server
tsa_b
content-type
image/gif;charset=utf-8
x-transaction-id
8d2984f6f3e92e0c
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
319b7a8403b200e02502a20285e594e0d3238ade06f67972e66d9fad88499cce
content-length
43
adsct
t.co/1/i/ 		43 B
227 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t.co/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=fc49f438-a079-42e0-8ce0-ca50b80f17bd&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=847a88da-8b6f-4f65-95c0-3ac676948bf5&tw_document_href=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com&tw_iframe_status=0&txn_id=ofi0u&type=javascript&version=2.3.29
Requested by
Host: secure.winred.com
URL: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.69 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_b /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-response-time
74
date
Fri, 17 Nov 2023 03:10:09 GMT
strict-transport-security
max-age=0
server
tsa_b
content-type
image/gif;charset=utf-8
x-transaction-id
b674f0abc9f96a78
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
b23dedc2943ac1c7242d2dc01f7c04762da8ad597422bf289662a6fc6a0a04a7
content-length
43
adsct
analytics.twitter.com/1/i/ 		43 B
722 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://analytics.twitter.com/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=fc49f438-a079-42e0-8ce0-ca50b80f17bd&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=847a88da-8b6f-4f65-95c0-3ac676948bf5&tw_document_href=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com&tw_iframe_status=0&txn_id=ofi0u&type=javascript&version=2.3.29
Requested by
Host: secure.winred.com
URL: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_b /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-response-time
70
date
Fri, 17 Nov 2023 03:10:09 GMT
strict-transport-security
max-age=631138519
server
tsa_b
content-type
image/gif;charset=utf-8
x-transaction-id
22035b15383bdbdc
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
319b7a8403b200e02502a20285e594e0d3238ade06f67972e66d9fad88499cce
content-length
43
adsct
t.co/1/i/ 		43 B
204 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t.co/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=4c6a1918-48e1-4ee5-8133-11a99785ecca&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=847a88da-8b6f-4f65-95c0-3ac676948bf5&tw_document_href=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com&tw_iframe_status=0&txn_id=ofi14&type=javascript&version=2.3.29
Requested by
Host: secure.winred.com
URL: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.69 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_b /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-response-time
69
date
Fri, 17 Nov 2023 03:10:10 GMT
strict-transport-security
max-age=0
server
tsa_b
content-type
image/gif;charset=utf-8
x-transaction-id
9d37d6283f3b36f5
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
b23dedc2943ac1c7242d2dc01f7c04762da8ad597422bf289662a6fc6a0a04a7
content-length
43
adsct
analytics.twitter.com/1/i/ 		43 B
545 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://analytics.twitter.com/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=4c6a1918-48e1-4ee5-8133-11a99785ecca&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=847a88da-8b6f-4f65-95c0-3ac676948bf5&tw_document_href=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com&tw_iframe_status=0&txn_id=ofi14&type=javascript&version=2.3.29
Requested by
Host: secure.winred.com
URL: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_b /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-response-time
87
date
Fri, 17 Nov 2023 03:10:10 GMT
strict-transport-security
max-age=631138519
server
tsa_b
content-type
image/gif;charset=utf-8
x-transaction-id
186dd8e978ef2b96
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
319b7a8403b200e02502a20285e594e0d3238ade06f67972e66d9fad88499cce
content-length
43
217670437796224
connect.facebook.net/signals/config/ 		139 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/217670437796224?v=2.9.138&r=stable&domain=secure.winred.com
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f07d:0:face:b00c:0:3 Apodaca, Mexico, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
197ad16a8f7de1f12a33e0afd28be37cd6976960045c21be3e58ebe45afe65f4
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Fri, 17 Nov 2023 03:10:10 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
x-xss-protection
0
reporting-endpoints
pragma
public
x-fb-debug
76PhWgYHiK0cQ5GPLvCopQpwNapsBOVCTKQO2RPfggBUbFUMtZm+W8B/+s1aQ6fuFxQ743YYAc/2OCV1cBbT/A==
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
origin-agent-cluster
?0
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin
*
expires
Sat, 01 Jan 2000 00:00:00 GMT
ga-audiences
www.google.com/ads/ 		42 B
107 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-73658561-7&cid=504583713.1700190610&jid=97866781&_u=YCDAiEABBAAAAGAEK~&z=1437772840
Requested by
Host: secure.winred.com
URL: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c08::69 Ashburn, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 17 Nov 2023 03:10:10 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
analytics.google.com/g/s/ 		0
255 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://analytics.google.com/g/s/collect?dma=0&gtm=45j91e3b81v867905447z872410129z9867900975&_gsid=X6H0114PDFCWpJc1szHUlkv0D3_Ys5_A
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:36::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 17 Nov 2023 03:10:10 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://secure.winred.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
analytics.google.com/g/s/ 		0
54 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://analytics.google.com/g/s/collect?dma=0&gtm=45j91e3b81v867905447z872410129z9867900975&_gsid=X6H0114PDF5tfSFbmwQfxa15mlDJ8mlQ
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:36::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 17 Nov 2023 03:10:10 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://secure.winred.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/g/ 		0
56 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&dma=0&tid=G-X6H0114PDF&cid=x8bTOkYgR%2FJHQDLwxJUUU%2BTLYN6eqIzPH2pSGqk4AJM%3D.1700190610&gtm=45j91e3b81v867905447z872410129z9867900975&aip=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c08::9c Ashburn, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 17 Nov 2023 03:10:10 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://secure.winred.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.facebook.com/tr/ 		0
185 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=217670437796224&ev=PageView&dl=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_%26first_name%3D_removed_%26last_name%3D_removed_%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%2540nutrien.com%26_filteredParams%3D%257B%2522unwantedParams%2522%253A%255B%2522first_name%2522%252C%2522last_name%2522%255D%252C%2522restrictedParams%2522%253A%255B%255D%257D&rl=&if=false&ts=1700190610556&sw=1600&sh=1200&v=2.9.138&r=stable&ec=0&o=4126&fbp=fb.1.1700190610553.499772943&cs_est=true&ler=empty&it=1700190610235&coo=false&rqm=GET
Requested by
Host: secure.winred.com
URL: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f171:81:face:b00c:0:25de Apodaca, Mexico, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Fri, 17 Nov 2023 03:10:10 GMT
server
proxygen-bolt
content-type
text/plain
access-control-allow-origin
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
0
rum
secure.winred.com/cdn-cgi/ 		0
142 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://secure.winred.com/cdn-cgi/rum?
Requested by
Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/v84a3a4012de94ce1a686ba8c167c359c1696973893317
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6813:d459 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type
application/json

Response headers

date
Fri, 17 Nov 2023 03:10:11 GMT
x-content-type-options
nosniff
server
cloudflare
vary
Origin
access-control-max-age
86400
access-control-allow-methods
POST,OPTIONS
access-control-allow-origin
https://secure.winred.com
x-frame-options
DENY
access-control-allow-credentials
true
cf-ray
8274c776f9cda241-YYZ
/
match.adsrvr.org/track/upb/ Frame E0E8
Redirect Chain
  • https://insight.adsrvr.org/track/up?adv=8gutl3m&ref=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-11-09_rds-we-w...
  • https://match.adsrvr.org/track/upb/?adv=8gutl3m&ref=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-11-09_rds-we-w...
874 B
924 B 		Document
General
Check archive.org
Download Go to
Full URL
https://match.adsrvr.org/track/upb/?adv=8gutl3m&ref=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com&upid=ssuhzkp&upv=1.1.0&td1=undefined&td2=undefined&td3=undefined&td4=undefined&td5=undefined&td6=undefined&td7=undefined&v=undefined
Requested by
Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
Kestrel /
Resource Hash
e2f0494edda67134e0cee5a5d0a239966dc362273b3330db4d55bd37d0c652a6

Request headers

Referer
https://secure.winred.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

content-encoding
gzip
content-type
text/html
date
Fri, 17 Nov 2023 03:10:11 GMT
server
Kestrel
vary
Accept-Encoding

Redirect headers

content-length
1017
date
Fri, 17 Nov 2023 03:10:11 GMT
location
https://match.adsrvr.org/track/upb/?adv=8gutl3m&ref=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com&upid=ssuhzkp&upv=1.1.0&td1=undefined&td2=undefined&td3=undefined&td4=undefined&td5=undefined&td6=undefined&td7=undefined&v=undefined
server
Kestrel
universal_pixel.1.1.0.js
js.adsrvr.org/ Frame E0E8 		488 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.adsrvr.org/universal_pixel.1.1.0.js
Requested by
Host: match.adsrvr.org
URL: https://match.adsrvr.org/track/upb/?adv=8gutl3m&ref=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_%26first_name%3DJed%26last_name%3DWeeks%26state%3D%26city%3D%26zip%3D%26email%3Djed.weeks%40nutrien.com&upid=ssuhzkp&upv=1.1.0&td1=undefined&td2=undefined&td3=undefined&td4=undefined&td5=undefined&td6=undefined&td7=undefined&v=undefined
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.161.209.109 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-161-209-109.yul62.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
484ef4268f1d679c1ae88c06fc2388d39afc441465732617e5e2cdc2e3d418e2

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://match.adsrvr.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date
Thu, 16 Nov 2023 21:03:59 GMT
Via
1.1 19298b403c16e472e8e1bf4122960db4.cloudfront.net (CloudFront)
Last-Modified
Tue, 01 Aug 2023 20:10:40 GMT
Server
AmazonS3
X-Amz-Cf-Pop
YUL62-P1
Age
21973
x-amz-server-side-encryption
AES256
ETag
"2775054c068b37509e0798448f7fd32c"
Vary
Accept-Encoding
X-Cache
Hit from cloudfront
Content-Type
application/x-javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
488
X-Amz-Cf-Id
D5cjcWLC4Qy3CTMgMdaYYCIp3EW0ZCpivkS4kW28nt9sGmkPKhXwXA==
rubicon
match.adsrvr.org/track/cmf/ Frame 4375
Redirect Chain
  • https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=9fd8246a-def3-4204-b83e-bdc0a96e8912&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon
  • https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
70 B
472 B 		Document
General
Check archive.org
Download Go to
Full URL
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
Requested by
Host: js.adsrvr.org
URL: https://js.adsrvr.org/universal_pixel.1.1.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
Kestrel /
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer
https://match.adsrvr.org/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

content-length
70
content-type
image/gif
date
Fri, 17 Nov 2023 03:10:12 GMT
server
Kestrel

Redirect headers

Cache-Control
no-cache,no-store,must-revalidate
Content-Type
text/html
Expires
0
Location
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Pragma
no-cache
X-RPHost
966e54b6201ecd300c4db0efc0f5781a
content-length
0
appnexus
match.adsrvr.org/track/cmf/ Frame 7B84
Redirect Chain
  • https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=9fd8246a-def3-4204-b83e-bdc0a96e8912
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fmatch.adsrvr.org%252ftrack%252fcmf%252fappnexus%253fttd%253d1%2526anid%253d%2524UID%26ttd_tdid%3D9fd8246a-def3-4204-b83e-bdc0a96e8912
  • https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=7797509905249140324&ttd_tdid=9fd8246a-def3-4204-b83e-bdc0a96e8912
70 B
472 B 		Document
General
Check archive.org
Download Go to
Full URL
https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=7797509905249140324&ttd_tdid=9fd8246a-def3-4204-b83e-bdc0a96e8912
Requested by
Host: js.adsrvr.org
URL: https://js.adsrvr.org/universal_pixel.1.1.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
Kestrel /
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer
https://match.adsrvr.org/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

content-length
70
content-type
image/gif
date
Fri, 17 Nov 2023 03:10:12 GMT
server
Kestrel

Redirect headers

accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials
true
access-control-allow-origin
*
an-x-request-uuid
4b589463-cb50-4803-98fb-2113a8bf7b8a
cache-control
no-store, no-cache, private
content-length
0
content-type
text/html; charset=utf-8
date
Fri, 17 Nov 2023 03:10:12 GMT
expires
Sat, 15 Nov 2008 16:00:00 GMT
location
https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=7797509905249140324&ttd_tdid=9fd8246a-def3-4204-b83e-bdc0a96e8912
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
pragma
no-cache
server
nginx/1.21.3
x-proxy-origin
70.25.255.186; 70.25.255.186; 579.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
x-xss-protection
0
cksync
hb.yahoo.net/ Frame 148B
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/55953/sync?uid=9fd8246a-def3-4204-b83e-bdc0a96e8912&_origin=1&redir=true&gdpr=0&gdpr_consent=&redir=true
  • https://ups.analytics.yahoo.com/ups/55953/sync?uid=9fd8246a-def3-4204-b83e-bdc0a96e8912&_origin=1&redir=true&gdpr=0&gdpr_consent=&redir=true&verify=true
  • https://ups.analytics.yahoo.com/ups/58824/sync?_origin=0&dpid=55953&ovsid=9fd8246a-def3-4204-b83e-bdc0a96e8912&gdpr=0&redir=true
  • https://hb.yahoo.net/cksync?cs=63&axid_e=eS1mYUxjY3hORTJ1SElWTzg5NjdiSzMyWG1SNk5RaHJ2N35B&gdpr=0&ovsid=9fd8246a-def3-4204-b83e-bdc0a96e8912&dpid=55953
53 B
657 B 		Document
General
Check archive.org
Download Go to
Full URL
https://hb.yahoo.net/cksync?cs=63&axid_e=eS1mYUxjY3hORTJ1SElWTzg5NjdiSzMyWG1SNk5RaHJ2N35B&gdpr=0&ovsid=9fd8246a-def3-4204-b83e-bdc0a96e8912&dpid=55953
Requested by
Host: js.adsrvr.org
URL: https://js.adsrvr.org/universal_pixel.1.1.0.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.21.23.195 Paris, France, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-21-23-195.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
9d96b2fe2d8d4a398a846ebee84e5e70ec37e0fc613b3e2a5aaa81b1bf2d8470
Security Headers
Name Value
Strict-Transport-Security max-age=86400 ; includeSubDomains max-age=604800

Request headers

Referer
https://match.adsrvr.org/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
max-age=0, no-cache, no-store
content-length
53
content-type
image/gif
date
Fri, 17 Nov 2023 03:10:13 GMT
expires
Fri, 17 Nov 2023 03:10:13 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA" CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
pragma
no-cache
server
Apache
strict-transport-security
max-age=86400 ; includeSubDomains max-age=604800
x-mnet-hl2
E

Redirect headers

age
0
content-length
0
date
Fri, 17 Nov 2023 03:10:12 GMT
location
https://hb.yahoo.net/cksync?cs=63&axid_e=eS1mYUxjY3hORTJ1SElWTzg5NjdiSzMyWG1SNk5RaHJ2N35B&gdpr=0&ovsid=9fd8246a-def3-4204-b83e-bdc0a96e8912&dpid=55953
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
server
ATS/9.1.10.87
strict-transport-security
max-age=31536000
common.js
maps.googleapis.com/maps-api-v3/api/js/55/1/ 		254 KB
56 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maps.googleapis.com/maps-api-v3/api/js/55/1/common.js
Requested by
Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c08::5f Ashburn, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e8ea928121a40d22f6739ed2ad8509c4b710104483bddae0d5021fcdebb76295
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 03:04:53 GMT
content-encoding
br
x-content-type-options
nosniff
age
321
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
56955
x-xss-protection
0
last-modified
Tue, 14 Nov 2023 19:21:59 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="maps-api-js"
vary
Accept-Encoding, Origin
report-to
{"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 16 Nov 2024 03:04:53 GMT
util.js
maps.googleapis.com/maps-api-v3/api/js/55/1/ 		173 KB
54 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maps.googleapis.com/maps-api-v3/api/js/55/1/util.js
Requested by
Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c08::5f Ashburn, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
740297dd144b71eedd45ab264a5a59e84096632d0870f0cf304d673e7bead73f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://secure.winred.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Fri, 17 Nov 2023 02:57:04 GMT
content-encoding
br
x-content-type-options
nosniff
age
790
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
55028
x-xss-protection
0
last-modified
Tue, 14 Nov 2023 19:21:59 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="maps-api-js"
vary
Accept-Encoding, Origin
report-to
{"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 16 Nov 2024 02:57:04 GMT

Verdicts & Comments Add Verdict or Comment

52 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| documentPictureInPicture object| dataLayer boolean| isWinRed string| app_platform function| $ function| jQuery object| jQuery112406309257395381669 function| Tether function| NestedFormEvents object| nestedFormEvents function| JQClass object| bioEp function| Cookies object| App object| picturefillCFG function| picturefill object| party function| UAParser function| gm_authFailure object| antiClickjack object| webpackChunkStripeJSouter function| noop function| Stripe object| __cfBeacon function| landingPageFormSubmitRecaptchaSuccess function| landingPageFormSubmitRecaptchaError object| google object| module$exports$mapsapi$geometry$spherical object| reactiveElementVersions object| module$contents$mapsapi$overlay$overlayView_OverlayView object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga object| GooglebQhCsO function| twq function| fbq function| _fbq function| spdt function| onYouTubeIframeAPIReady object| gaGlobal function| sha256 function| sha224 object| gaplugins object| gaData function| ttd_dom_ready function| TTDUniversalPixelApi object| regeneratorRuntime object| twttr

38 Cookies

Domain/Path Name / Value
app.revv.co/api/v3/users Name: rvid
Value: b104a142-28ca-41a1-99a7-c81822fa30b8
.winred.com/ Name: _revv_v3_session
Value: UjhOVGsxU2labGo0Q2htd28yRFlCNkV5T0RiU01zbVphdXRVZEsrS3hCZndHQUNwMWNYTzB0em5vTmRMSVhkYk1PcUttNUlYWE1ubmhFTnJEZzZqNGZOaE5WVFkxVWVMVDB0a28xcjVCYnl5V1k2OGdrTml3Y09McGJ1TGJUbjBqNjFSWGhjSHE0Vy8yOWVKRG1GSUxUb3BBRzIvNStjNVU3M2V2MjhZRnl0eUJMYm9KZUZZK0tsY0hnZ2hwN1J3MFJtNWNOZmMxS3hjVnZibzRsdUVibm1jdzJ5WmpCYUErK2tzR3dtUW02MkFYL3Rod2ppY3l0WVNsUmp0eWJnMUFWalkxVWR4N2pibHhrUTZsVCtiTWpNblVvQkVIY0prdlVFbVRMMXgrK1dLWjdCN0k3UnQ3bGlTU0NTREZLUFo1UWppOEZycnBBNUNKL2tHYnBVN3p2Lzc1bTZ1dEpYSG9CeTVQajRiZmlvPS0tZ2lVaUNtNFdRMHZEVFFRVGRGM1piQT09--5aa5aa7c0fc9a36ba3e08c98452c1c291f10f59c
.secure.winred.com/ Name: __cf_bm
Value: BPCnfAEgeWrakLo8stOEtvxX3daCOxJPwnpMtp51w.w-1700190608-0-AbG2S9SQr6ITYu2R+34jDXjBN1IfGOqKPS5fmPIDk7qjh7PW9DU8rq44e2qQZx2vDCgdyS9Qsxw7FYiZYTQFKWg=
secure.winred.com/ Name: origin_url
Value: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-11-09_rds-we-won-the-debate_ha_aud0469_em0912_lp1343_rds_175935_&first_name=Jed&last_name=Weeks&state=&city=&zip=&email=jed.weeks@nutrien.com
.winred.com/ Name: _gcl_au
Value: 1.1.754495540.1700190609
.revv.co/ Name: _revv_v3_session
Value: RFFuM1VNblROTWVJbkFYQmZUMlVWS2VZaThyczNnMUFLV0JKQldJYU9pckNKS0F5K1pJVEZGUGEwaDNBeGNZZTlzdTFGYUxYUVI2STUxZzNFQlo3QVE9PS0tam5jd0dsZzlqb09scTJDeDJSd0xPQT09--3ab26ebbd9a117e60f54c6630be5df7d1de22d08
.revv.co/ Name: __cf_bm
Value: lZJzMK5IJsVxyLryDAsV6iDZlNtmhOSEdhYKYVZ9B1A-1700190609-0-AaSII5gQMbXJiQ3Gd7CpdNcVZitna5L1vg/ox1fotDFTrycvrasoEUQyt9Z9jhlCwRCFZtxbkenHTqKhPweJ1lQ=
.winred.com/ Name: _ga_X6H0114PDF
Value: GS1.1.1700190609.1.0.1700190609.0.0.0
secure.winred.com/ Name: sso_tries
Value: 1
secure.winred.com/ Name: rvid
Value: b104a142-28ca-41a1-99a7-c81822fa30b8
.winred.com/ Name: _ga_LDP16YY77N
Value: GS1.1.1700190609.1.0.1700190609.0.0.0
secure.winred.com/ Name: __spdt
Value: 53f27b3ee50b46e8ae65970a7e87aee9
.winred.com/ Name: _ga
Value: GA1.2.504583713.1700190610
.winred.com/ Name: _gid
Value: GA1.2.1177860662.1700190610
.winred.com/ Name: _dc_gtm_UA-73658561-7
Value: 1
.doubleclick.net/ Name: test_cookie
Value: CheckForPermission
.winred.com/ Name: FPID
Value: FPID2.2.x8bTOkYgR%2FJHQDLwxJUUU%2BTLYN6eqIzPH2pSGqk4AJM%3D.1700190610
.winred.com/ Name: FPLC
Value: 6er2CiAhY2589GD9S3oZQ6w0ndfVIyQWOyr0O4LHskBMX4Q%2BaL1sN6uUb6nujp7L8lVZnc%2FaKGqbSWiRTW5VRLZxMCV4iZNfBQGB08DVlpfc0JsrXVn%2BDcd1mYa%2FsA%3D%3D
.winred.com/ Name: FPGSID
Value: 1.1700190610.1700190610.G-X6H0114PDF.5tfSFbmwQfxa15mlDJ8mlQ
.winred.com/ Name: _fbp
Value: fb.1.1700190610553.499772943
.t.co/ Name: muc_ads
Value: 492ccd3e-de8e-458d-879e-995f257416c5
m.stripe.com/ Name: m
Value: 384d091d-33a1-43b2-89bc-8a34b5aded9e349cc6
.secure.winred.com/ Name: __stripe_mid
Value: 1ad757cf-27d2-47b9-a767-2ef17212f089fde648
.secure.winred.com/ Name: __stripe_sid
Value: 202889e5-ae87-42a2-b6dc-dae95035e08133fedd
.twitter.com/ Name: guest_id_marketing
Value: v1%3A170019061045499358
.twitter.com/ Name: guest_id_ads
Value: v1%3A170019061045499358
.twitter.com/ Name: personalization_id
Value: "v1_3bfUnC2lRwEeBu0cKKHJrA=="
.twitter.com/ Name: guest_id
Value: v1%3A170019061045499358
.adsrvr.org/ Name: TDID
Value: 9fd8246a-def3-4204-b83e-bdc0a96e8912
.adnxs.com/ Name: uuid2
Value: 7797509905249140324
.yahoo.com/ Name: A3
Value: d=AQABBJTZVmUCEE07Gie4bS0uF6oZVML55foFEgEBAQErWGVgZSXcxyMA_eMAAA&S=AQAAAvarjvgs7CtqSlrcmsazw80
.rubiconproject.com/ Name: khaos
Value: LP21LCFR-F-7JG5
.rubiconproject.com/ Name: audit
Value: 1|Z/e3GTDxK2CsOlPBjk7GLo8X2cAmVQj8imA1tgwmIKMrwWHzGOfgzEjI/vHgHPwqvgfP2eZaIEqM1KxoLazIt9i2Wk5FrGos0XY24Ec+XLv3QFyYJL5LDD6Fu2cMpNAEGT4Lr9zx+BMgfriVSQD/rYXXJl9sJDrWvqAH+LZKodtbOz6AjJtUa8ZnH3r7x5VAdeodiyl5GGjkt77VmXBK7kiCfUmSYXqD+ohH/uuQN8oOr/S07bYDcYQkZmofZQkSVSwKu1RXSJT0/fhu8/pkBO4VeIulq+4M1TRwmTZWV3Xc6UO785F0Pw==
.adsrvr.org/ Name: TDCPM
Value: CAESFgoHcnViaWNvbhILCN6T_eWXybM8EAUSFwoIYXBwbmV4dXMSCwjogrnwl8mzPBAFEhkKCnJpZ2h0bWVkaWESCwj80f3ll8mzPBAFGAUgAigDMgsInvL_kq7JszwQBUIPIg0IARIJCgV0aWVyMhABWgc4Z3V0bDNtYAE.
.analytics.yahoo.com/ Name: IDSYNC
Value: "1769~2f3f:19e0~2f3f"
.hb.yahoo.net/ Name: visitor-id
Value: 3431922130898621000V10
.hb.yahoo.net/ Name: data-ttd
Value: 9fd8246a-def3-4204-b83e-bdc0a96e8912~~63
.secure.winred.com/ Name: cf_clearance
Value: v6rx8Yor1.gNkDjiSKZzgHNJdSMcKZ14nzZIf2yr7hs-1700190613-0-1-e351ec6.69079d90.2d28cbc7-0.2.1700190613

1 Console Messages

Source Level URL
Text
security error (Line 6)
Message:
[Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self'".

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=0; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

analytics.google.com
analytics.twitter.com
app.revv.co
cdnjs.cloudflare.com
click.email.rondesantis.com
connect.facebook.net
d35ligi1n5bgzc.cloudfront.net
evnt.byspotify.com
googleads.g.doubleclick.net
gtm.winred.com
hb.yahoo.net
ib.adnxs.com
insight.adsrvr.org
js.adsrvr.org
js.stripe.com
m.stripe.com
m.stripe.network
maps.googleapis.com
match.adsrvr.org
pixel.byspotify.com
pixel.rubiconproject.com
q.stripe.com
secure.winred.com
static.ads-twitter.com
static.cloudflareinsights.com
stats.g.doubleclick.net
t.co
ups.analytics.yahoo.com
www.facebook.com
www.google-analytics.com
www.google.com
www.googleadservices.com
www.googletagmanager.com
104.244.42.3
104.244.42.69
13.110.197.228
142.251.163.155
146.75.36.157
151.101.192.176
2.21.23.195
2001:4860:4802:36::181
2600:9000:208f:de00:0:7d26:ee00:93a1
2606:4700::6810:3865
2606:4700::6810:f945
2606:4700::6811:180e
2606:4700::6813:d459
2607:f8b0:4004:c08::5f
2607:f8b0:4004:c08::69
2607:f8b0:4004:c08::9c
2607:f8b0:4004:c09::61
2607:f8b0:4004:c17::64
2607:f8b0:4004:c17::9b
2a03:2880:f07d:0:face:b00c:0:3
2a03:2880:f171:81:face:b00c:0:25de
3.161.209.109
3.225.218.10
34.111.186.1
34.117.162.98
35.71.131.137
44.239.50.123
54.187.159.182
54.192.51.51
68.67.179.155
69.173.151.100
04ef8a83c9b2b24b80ff827b2abed08e1327f77f71165643ac5b9696fd6e2792
197ad16a8f7de1f12a33e0afd28be37cd6976960045c21be3e58ebe45afe65f4
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
20c0114a672ac0b5b31a1c0100543a2306bf389816ab20774b66e8f7b30fb60c
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
294128b9b86498504102507289a9e355433ac0158d8fb24a7348e1f92be7612f
29d690befadef53803fbba7e3bfe0b0233658d09d08b9263da7f90321d2e3124
2bfffa28b98700f1fca2433260a5b8c1ae2407a63a8811592ef633da5243a54b
2da27e9f80fb0c587704e60f412e21a58a651815555dec67442cad18911ad102
2f8a9cb94b4f434cd8efceb5a4b29a151180a3ca2e3f41278512b460387e815d
351ffc2bdf381352dcd801be49be5018361119588eae077650260f9e162fe7b9
3b8ee7327179bc2b117d8c326f358f0e72b011a37912570cf19e80190220aa81
3e136e77083bfc6ef14ffc5abd19da89a82bf12fc0cda3c603e01582b93303c8
484ef4268f1d679c1ae88c06fc2388d39afc441465732617e5e2cdc2e3d418e2
4b0ee40c236b43959682dbfb183f1e573d475a20c1a8831055731403679aaa69
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848
6068f86ff5e6d3a3e100e95fd0ab03a5fb9ebfca9386b2c0ee131361a62526c2
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101
7157511697db744d384a5a2a8646af23f3c90560abf93bb240fdd690b29a898a
740297dd144b71eedd45ab264a5a59e84096632d0870f0cf304d673e7bead73f
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
899663bfeab6b11842c974c2417dc0ad88bd79bb7510b1e032384ccf2618dcc1
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
947ac0903521f5eceefc90637c066306a8ca67466ccc188bb0107fb7cfb532d1
961951e588ed2cbd0dadda321becf5c4d27451bb0896262f86e7d922da5794ca
9d96b2fe2d8d4a398a846ebee84e5e70ec37e0fc613b3e2a5aaa81b1bf2d8470
a008eb4b9c1b4b1832cfe3afbc9f4f5899fe79e4727dc5e4df2cce3b6972370f
a7723f63151f99064a343f00b4fccc510fb55f3cfba7b13d88b383824a663486
abbb946d3f9dbc094aee39d8bcaf2549aba489769aa9c27a37e8feef9dc1b3fa
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
b12d7b7e9f25c3b43fd866b5ca187f83b20b85e4da81adc57d951662bb001a5f
c17cd40d261ca044dba00d020f915f7c9663136dd927903422780f8d98328312
c8492451ab7ce8b47c7fbb0bc1b71d6a5686953aa17ee5f9cd76aa41a0135a3c
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee
d2a9df6a4cfce46a55fec3fbc9134896438d7a845e3ae841b0f9214f62988cf7
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
dfb7d96a948d75cc26916279eefbf066212b4525856bcfff25b866cdfedfc42d
e039e607c78306c7e029a7fd0ecdb14f86456f16e1a5ce65aa26b4fdf1d38a3c
e2f0494edda67134e0cee5a5d0a239966dc362273b3330db4d55bd37d0c652a6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e8ea928121a40d22f6739ed2ad8509c4b710104483bddae0d5021fcdebb76295
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0205495d259e89d99e6c4989147f8a65bef41513bfbe3e97251cd6fb6fa5947
f27e9ca75db1b778e94c55ffb6a1f471a2fab0761034b9ce0a233bc0866e6cc2
f708986d1226675751814adee7ad273ef74751adb3f17a6ad0ba0c8b6eb0773e
ff74fdccb97f1ea6c0c6b90f5adb27111705e20ad98a6d787824638d29102592