preferences.oxfordclub.com Open in urlscan Pro
18.233.27.104 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://events-c.mb.libertythroughwealth.com/track?uid=909ebfd4-ed56-4e56-81c0-105a6d470eb1&txnid=915323c1-ee88-4a60-882c-d81c6626d4f8&bsft_a...
Effective URL:
https://preferences.oxfordclub.com/?type=standardunsub&list=LIBWEALT%2CLWDED&pk=1b2c3d4fe10d2627c537aea7e72a986e&utm_campaign=LW_Ed...
Submission: On June 18 via manual (June 18th 2024, 7:30:46 pm UTC) from CA — Scanned from CA

Summary HTTP 41 Redirects Behaviour Indicators

Summary

This website contacted 18 IPs in 2 countries across 15 domains to perform 41 HTTP transactions. The main IP is 18.233.27.104, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is preferences.oxfordclub.com.
TLS certificate: Issued by R3 on May 9th 2024. Valid for: 3 months.

This is the only time preferences.oxfordclub.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	104.17.30.85 104.17.30.85	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	18.233.27.104 18.233.27.104	14618 (AMAZON-AES) (AMAZON-AES)
1	18.160.37.92 18.160.37.92	16509 (AMAZON-02) (AMAZON-02)
1 1	185.93.1.244 185.93.1.244	60068 (CDN77 _) (CDN77 _)
1 3	151.101.65.229 151.101.65.229	54113 (FASTLY) (FASTLY)
1	151.101.66.137 151.101.66.137	54113 (FASTLY) (FASTLY)
2	104.17.25.14 104.17.25.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	54.231.199.25 54.231.199.25	16509 (AMAZON-02) (AMAZON-02)
7	104.26.2.22 104.26.2.22	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	18.154.227.63 18.154.227.63	16509 (AMAZON-02) (AMAZON-02)
3	142.251.16.97 142.251.16.97	15169 (GOOGLE) (GOOGLE)
1	16.182.32.225 16.182.32.225	16509 (AMAZON-02) (AMAZON-02)
1	151.101.65.44 151.101.65.44	54113 (FASTLY) (FASTLY)
6	13.32.151.71 13.32.151.71	16509 (AMAZON-02) (AMAZON-02)
3	13.107.21.237 13.107.21.237	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	52.217.112.136 52.217.112.136	16509 (AMAZON-02) (AMAZON-02)
1	172.67.73.236 172.67.73.236	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	209.85.144.100 209.85.144.100	15169 (GOOGLE) (GOOGLE)
1	173.194.205.207 173.194.205.207	15169 (GOOGLE) (GOOGLE)
1	52.32.152.61 52.32.152.61	16509 (AMAZON-02) (AMAZON-02)
41	18

1 104.17.30.85 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

events-c.mb.libertythroughwealth.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 18.233.27.104 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-233-27-104.compute-1.amazonaws.com

preferences.oxfordclub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
libertythroughwealth.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.160.37.92 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-160-37-92.iad55.r.cloudfront.net

dhbhdrzi4tiry.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.93.1.244 (Chicago, United States) 1 redirects

ASN60068 (CDN77 _, GB)
PTR: 185-93-1-244.bunnyinfra.net

cdn.materialdesignicons.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.65.229 (San Francisco, United States) 1 redirects

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.66.137 (San Francisco, United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.17.25.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.231.199.25 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1-w.amazonaws.com

portrait-tracker.s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 104.26.2.22 (None, )

ASN13335 (CLOUDFLARENET, US)

c.lytics.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.154.227.63 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-154-227-63.iad55.r.cloudfront.net

cdn.getblueshift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.251.16.97 (Farmingdale, United States)

ASN15169 (GOOGLE, US)
PTR: bl-in-f97.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 16.182.32.225 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1-w.amazonaws.com

portrait-tracker.s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.65.44 (San Francisco, United States)

ASN54113 (FASTLY, US)

trc.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 13.32.151.71 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-151-71.iad66.r.cloudfront.net

dnzkifeab6.execute-api.us-east-1.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 13.107.21.237 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.217.112.136 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1.amazonaws.com

s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.73.236 (United States)

ASN13335 (CLOUDFLARENET, US)

c.lytics.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 209.85.144.100 (Council Bluffs, United States)

ASN15169 (GOOGLE, US)
PTR: qv-in-f100.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 173.194.205.207 (United States)

ASN15169 (GOOGLE, US)
PTR: qm-in-f207.1e100.net

storage.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.32.152.61 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-32-152-61.us-west-2.compute.amazonaws.com

api.getblueshift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	amazonaws.com portrait-tracker.s3.amazonaws.com — Cisco Umbrella Rank: 800978 dnzkifeab6.execute-api.us-east-1.amazonaws.com — Cisco Umbrella Rank: 738546 s3.amazonaws.com	523 KB
8	lytics.io c.lytics.io — Cisco Umbrella Rank: 13419	75 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 68	21 KB
3	bing.com bat.bing.com — Cisco Umbrella Rank: 357	14 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 79	287 KB
3	jsdelivr.net 1 redirects cdn.jsdelivr.net — Cisco Umbrella Rank: 373	123 KB
3	oxfordclub.com preferences.oxfordclub.com	10 KB
2	getblueshift.com cdn.getblueshift.com — Cisco Umbrella Rank: 18625 api.getblueshift.com — Cisco Umbrella Rank: 14584	4 KB
2	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 265	4 KB
2	libertythroughwealth.com 1 redirects events-c.mb.libertythroughwealth.com libertythroughwealth.com	21 KB
1	googleapis.com storage.googleapis.com — Cisco Umbrella Rank: 394	1 KB
1	taboola.com trc.taboola.com — Cisco Umbrella Rank: 702	416 B
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 814	30 KB
1	materialdesignicons.com 1 redirects cdn.materialdesignicons.com — Cisco Umbrella Rank: 51681	708 B
1	cloudfront.net dhbhdrzi4tiry.cloudfront.net	49 KB
41	15

	Domain	Requested by
8	c.lytics.io	portrait-tracker.s3.amazonaws.com c.lytics.io preferences.oxfordclub.com
6	dnzkifeab6.execute-api.us-east-1.amazonaws.com	portrait-tracker.s3.amazonaws.com preferences.oxfordclub.com
3	www.google-analytics.com	www.googletagmanager.com preferences.oxfordclub.com
3	bat.bing.com	preferences.oxfordclub.com bat.bing.com
3	www.googletagmanager.com	portrait-tracker.s3.amazonaws.com preferences.oxfordclub.com www.googletagmanager.com
3	portrait-tracker.s3.amazonaws.com	preferences.oxfordclub.com portrait-tracker.s3.amazonaws.com
3	cdn.jsdelivr.net	1 redirects preferences.oxfordclub.com cdn.jsdelivr.net
3	preferences.oxfordclub.com	preferences.oxfordclub.com
2	cdnjs.cloudflare.com	preferences.oxfordclub.com
1	api.getblueshift.com	cdn.getblueshift.com
1	libertythroughwealth.com
1	storage.googleapis.com	c.lytics.io
1	s3.amazonaws.com	www.googletagmanager.com
1	trc.taboola.com	preferences.oxfordclub.com
1	cdn.getblueshift.com	portrait-tracker.s3.amazonaws.com
1	code.jquery.com	preferences.oxfordclub.com
1	cdn.materialdesignicons.com	1 redirects
1	dhbhdrzi4tiry.cloudfront.net	preferences.oxfordclub.com
1	events-c.mb.libertythroughwealth.com	1 redirects
41	19

This site contains no links.

Subject Issuer	Validity	Valid
preferences.oxfordclub.com R3	`2024-05-09` - `2024-08-07`	3 months	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2023-10-10` - `2024-09-19`	a year	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-11` - `2024-07-14`	a year	crt.sh
cdnjs.cloudflare.com E1	`2024-06-02` - `2024-08-31`	3 months	crt.sh
*.s3.amazonaws.com Amazon RSA 2048 M01	`2024-04-22` - `2025-04-07`	a year	crt.sh
lytics.io E1	`2024-05-14` - `2024-08-12`	3 months	crt.sh
*.getblueshift.com Amazon RSA 2048 M02	`2024-06-08` - `2025-07-06`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2024-05-27` - `2024-08-19`	3 months	crt.sh
*.taboola.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-10-23` - `2024-11-22`	a year	crt.sh
*.execute-api.us-east-1.amazonaws.com Amazon RSA 2048 M03	`2024-01-08` - `2025-02-04`	a year	crt.sh
www.bing.com Microsoft Azure TLS Issuing CA 02	`2024-05-01` - `2024-06-27`	2 months	crt.sh
s3.amazonaws.com Amazon RSA 2048 M01	`2024-05-25` - `2025-05-02`	a year	crt.sh
storage.googleapis.com GTS CA 1C3	`2024-05-27` - `2024-08-19`	3 months	crt.sh
libertythroughwealth.com R3	`2024-05-16` - `2024-08-14`	3 months	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2023 Q3	`2023-09-27` - `2024-10-28`	a year	crt.sh

This page contains 3 frames:

Primary Page: https://preferences.oxfordclub.com/?type=standardunsub&list=LIBWEALT%2CLWDED&pk=1b2c3d4fe10d2627c537aea7e72a986e&utm_campaign=LW_Editorial_Welcome_%28WIP%29&vid2=230bb62d688e1134df1075d438faeb10b28cae9bbe1cfae39f3a6f289f60c5bab28cd446edc1c401f2ec6461489691f8&utm_medium=email&utm_source=libwealt&bsft_clkid=5f83f764-6117-4c0b-a922-be87415e7865&bsft_uid=909ebfd4-ed56-4e56-81c0-105a6d470eb1&bsft_mid=479d1590-6040-46c0-8079-8dfd0388991a&bsft_eid=f6326b75-6ed5-dfd7-1c4f-290990c739c4&bsft_txnid=915323c1-ee88-4a60-882c-d81c6626d4f8&bsft_utid=909ebfd4-ed56-4e56-81c0-105a6d470eb1-LIBWEALT&bsft_mime_type=html&bsft_ek=2024-06-18T04%3A11%3A05Z&bsft_aaid=143cca17-1a3d-4d28-8ba4-eaf7031e47d7&bsft_lx=22&bsft_tv=27
Frame ID: 5B3BFCFC4F502BFE1CB60A280DF0DC24
Requests: 36 HTTP requests in this frame

Frame: https://portrait-tracker.s3.amazonaws.com/index.html
Frame ID: 4BC37AFD24877337EC6C726CF94D3418
Requests: 1 HTTP requests in this frame

Frame: https://c.lytics.io/c/9c32784e3cc4888a693a7988ad64c63d/portrait
Frame ID: 6625AD31FD4CD33438C5B329E97C06F6
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://events-c.mb.libertythroughwealth.com/track?uid=909ebfd4-ed56-4e56-81c0-105a6d470eb1&txnid=915323c1-ee88-4a60-882c... HTTP 307
https://preferences.oxfordclub.com/?type=standardunsub&list=LIBWEALT%2CLWDED&pk=1b2c3d4fe10d2627c537aea7e72a986... Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

ZURB Foundation (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]+foundation[^>"]+css
<div [^>]*class="[^"]*(?:small|medium|large)-\d{1,2} columns

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

googleapis\.com/.+webfont

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

41
Requests

98 %
HTTPS

0 %
IPv6

15
Domains

19
Subdomains

18
IPs

2
Countries

1161 kB
Transfer

2344 kB
Size

11
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://events-c.mb.libertythroughwealth.com/track?uid=909ebfd4-ed56-4e56-81c0-105a6d470eb1&txnid=915323c1-ee88-4a60-882c-d81c6626d4f8&bsft_aaid=143cca17-1a3d-4d28-8ba4-eaf7031e47d7&eid=f6326b75-6ed5-dfd7-1c4f-290990c739c4&mid=479d1590-6040-46c0-8079-8dfd0388991a&bsft_ek=2024-06-18T04%3A11%3A05Z&bsft_mime_type=html&bsft_tv=27&bsft_lx=22&utid=909ebfd4-ed56-4e56-81c0-105a6d470eb1-LIBWEALT&a=click&redir=https%3A%2F%2Fpreferences.oxfordclub.com%2F%3Ftype%3Dstandardunsub%26list%3DLIBWEALT%252CLWDED%26pk%3D1b2c3d4fe10d2627c537aea7e72a986e%26utm_campaign%3DLW_Editorial_Welcome_%2528WIP%2529%26vid2%3D230bb62d688e1134df1075d438faeb10b28cae9bbe1cfae39f3a6f289f60c5bab28cd446edc1c401f2ec6461489691f8%26utm_medium%3Demail%26utm_source%3Dlibwealt HTTP 307
https://preferences.oxfordclub.com/?type=standardunsub&list=LIBWEALT%2CLWDED&pk=1b2c3d4fe10d2627c537aea7e72a986e&utm_campaign=LW_Editorial_Welcome_%28WIP%29&vid2=230bb62d688e1134df1075d438faeb10b28cae9bbe1cfae39f3a6f289f60c5bab28cd446edc1c401f2ec6461489691f8&utm_medium=email&utm_source=libwealt&bsft_clkid=5f83f764-6117-4c0b-a922-be87415e7865&bsft_uid=909ebfd4-ed56-4e56-81c0-105a6d470eb1&bsft_mid=479d1590-6040-46c0-8079-8dfd0388991a&bsft_eid=f6326b75-6ed5-dfd7-1c4f-290990c739c4&bsft_txnid=915323c1-ee88-4a60-882c-d81c6626d4f8&bsft_utid=909ebfd4-ed56-4e56-81c0-105a6d470eb1-LIBWEALT&bsft_mime_type=html&bsft_ek=2024-06-18T04%3A11%3A05Z&bsft_aaid=143cca17-1a3d-4d28-8ba4-eaf7031e47d7&bsft_lx=22&bsft_tv=27 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

https://cdn.materialdesignicons.com/2.0.46/css/materialdesignicons.min.css HTTP 301
https://cdn.jsdelivr.net/mdi/2.0.46/css/materialdesignicons.min.css HTTP 301
https://cdn.jsdelivr.net/npm/@mdi/font@2.0.46/css/materialdesignicons.min.css

41 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
preferences.oxfordclub.com/
Redirect Chain

https://events-c.mb.libertythroughwealth.com/track?uid=909ebfd4-ed56-4e56-81c0-105a6d470eb1&txnid=915323c1-ee88-4a60-882c-d81c6626d4f8&bsft_aaid=143cca17-1a3d-4d28-8ba4-eaf7031e47d7&eid=f6326b75-6e...
https://preferences.oxfordclub.com/?type=standardunsub&list=LIBWEALT%2CLWDED&pk=1b2c3d4fe10d2627c537aea7e72a986e&utm_campaign=LW_Editorial_Welcome_%28WIP%29&vid2=230bb62d688e1134df1075d438faeb10b28...

5 KB
2 KB

137ms
42ms

Document
text/html

18.233.27.104
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://preferences.oxfordclub.com/?type=standardunsub&list=LIBWEALT%2CLWDED&pk=1b2c3d4fe10d2627c537aea7e72a986e&utm_campaign=LW_Editorial_Welcome_%28WIP%29&vid2=230bb62d688e1134df1075d438faeb10b28cae9bbe1cfae39f3a6f289f60c5bab28cd446edc1c401f2ec6461489691f8&utm_medium=email&utm_source=libwealt&bsft_clkid=5f83f764-6117-4c0b-a922-be87415e7865&bsft_uid=909ebfd4-ed56-4e56-81c0-105a6d470eb1&bsft_mid=479d1590-6040-46c0-8079-8dfd0388991a&bsft_eid=f6326b75-6ed5-dfd7-1c4f-290990c739c4&bsft_txnid=915323c1-ee88-4a60-882c-d81c6626d4f8&bsft_utid=909ebfd4-ed56-4e56-81c0-105a6d470eb1-LIBWEALT&bsft_mime_type=html&bsft_ek=2024-06-18T04%3A11%3A05Z&bsft_aaid=143cca17-1a3d-4d28-8ba4-eaf7031e47d7&bsft_lx=22&bsft_tv=27
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 18.233.27.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-233-27-104.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 13b0f68bd3d8bebfa3a0139811fdb61f62803b014f820e76a5b559ee5dc6136d

Request headers

Accept-Language: en-CA,en;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Connection: keep-alive
Content-Encoding: br
Content-Type: text/html
Date: Tue, 18 Jun 2024 19:30:40 GMT
ETag: W/"62e99941-15fe"
Last-Modified: Tue, 02 Aug 2022 21:38:09 GMT
Server: nginx
Transfer-Encoding: chunked

Redirect headers

access-control-allow-headers: Content-Type, X-Api-Key
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1728000
cache-control: no-cache, no-store
cf-cache-status: DYNAMIC
cf-ray: 895db1f6c81139f9-YYZ
content-type: text/html; charset=utf-8
date: Tue, 18 Jun 2024 19:30:40 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
location: https://preferences.oxfordclub.com/?type=standardunsub&list=LIBWEALT%2CLWDED&pk=1b2c3d4fe10d2627c537aea7e72a986e&utm_campaign=LW_Editorial_Welcome_%28WIP%29&vid2=230bb62d688e1134df1075d438faeb10b28cae9bbe1cfae39f3a6f289f60c5bab28cd446edc1c401f2ec6461489691f8&utm_medium=email&utm_source=libwealt&bsft_clkid=5f83f764-6117-4c0b-a922-be87415e7865&bsft_uid=909ebfd4-ed56-4e56-81c0-105a6d470eb1&bsft_mid=479d1590-6040-46c0-8079-8dfd0388991a&bsft_eid=f6326b75-6ed5-dfd7-1c4f-290990c739c4&bsft_txnid=915323c1-ee88-4a60-882c-d81c6626d4f8&bsft_utid=909ebfd4-ed56-4e56-81c0-105a6d470eb1-LIBWEALT&bsft_mime_type=html&bsft_ek=2024-06-18T04%3A11%3A05Z&bsft_aaid=143cca17-1a3d-4d28-8ba4-eaf7031e47d7&bsft_lx=22&bsft_tv=27
pragma: no-cache
server: cloudflare
strict-transport-security: max-age=315360000; includeSubdomains; preload
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-request-id: 77171cb9-b3e0-4ba7-92e0-6a44a1246c00
x-runtime: 0.021959
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK foundation.min.css
dhbhdrzi4tiry.cloudfront.net/cdn/sites/ 49 KB
49 KB 400ms
44ms Stylesheet
text/css 18.160.37.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dhbhdrzi4tiry.cloudfront.net/cdn/sites/foundation.min.css
Requested by: Host: preferences.oxfordclub.com
URL: https://preferences.oxfordclub.com/?type=standardunsub&list=LIBWEALT%2CLWDED&pk=1b2c3d4fe10d2627c537aea7e72a986e&utm_campaign=LW_Editorial_Welcome_%28WIP%29&vid2=230bb62d688e1134df1075d438faeb10b28cae9bbe1cfae39f3a6f289f60c5bab28cd446edc1c401f2ec6461489691f8&utm_medium=email&utm_source=libwealt&bsft_clkid=5f83f764-6117-4c0b-a922-be87415e7865&bsft_uid=909ebfd4-ed56-4e56-81c0-105a6d470eb1&bsft_mid=479d1590-6040-46c0-8079-8dfd0388991a&bsft_eid=f6326b75-6ed5-dfd7-1c4f-290990c739c4&bsft_txnid=915323c1-ee88-4a60-882c-d81c6626d4f8&bsft_utid=909ebfd4-ed56-4e56-81c0-105a6d470eb1-LIBWEALT&bsft_mime_type=html&bsft_ek=2024-06-18T04%3A11%3A05Z&bsft_aaid=143cca17-1a3d-4d28-8ba4-eaf7031e47d7&bsft_lx=22&bsft_tv=27
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.37.92 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-37-92.iad55.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 08e7d98e767f185bdbdc70bc962d784292f1ba7a6d9230d2cd9a7a841112fa19

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://preferences.oxfordclub.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 18 Jun 2024 05:49:10 GMT
Via: 1.1 3718533b4f5d67c52ce24dc2e8ef04b4.cloudfront.net (CloudFront)
Last-Modified: Thu, 19 Nov 2015 20:04:31 GMT
Server: AmazonS3
X-Amz-Cf-Pop: IAD55-P1
Age: 49291
ETag: "08f0ca148c519d8f574f3851cb745c5d"
X-Cache: Hit from cloudfront
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 49709
X-Amz-Cf-Id: RiFQ1wd-n1c2KHGbZk0ZmS1dFb4Qi0u7tCnLkDb2X5ZmBrDMKIlAwQ==

GET
H2

200

materialdesignicons.min.css
cdn.jsdelivr.net/npm/@mdi/font@2.0.46/css/
Redirect Chain

https://cdn.materialdesignicons.com/2.0.46/css/materialdesignicons.min.css
https://cdn.jsdelivr.net/mdi/2.0.46/css/materialdesignicons.min.css
https://cdn.jsdelivr.net/npm/@mdi/font@2.0.46/css/materialdesignicons.min.css

85 KB
16 KB

21ms
19ms

Stylesheet
text/css

151.101.65.229
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/@mdi/font@2.0.46/css/materialdesignicons.min.css

Requested by

Host: preferences.oxfordclub.com
URL: https://preferences.oxfordclub.com/?type=standardunsub&list=LIBWEALT%2CLWDED&pk=1b2c3d4fe10d2627c537aea7e72a986e&utm_campaign=LW_Editorial_Welcome_%28WIP%29&vid2=230bb62d688e1134df1075d438faeb10b28cae9bbe1cfae39f3a6f289f60c5bab28cd446edc1c401f2ec6461489691f8&utm_medium=email&utm_source=libwealt&bsft_clkid=5f83f764-6117-4c0b-a922-be87415e7865&bsft_uid=909ebfd4-ed56-4e56-81c0-105a6d470eb1&bsft_mid=479d1590-6040-46c0-8079-8dfd0388991a&bsft_eid=f6326b75-6ed5-dfd7-1c4f-290990c739c4&bsft_txnid=915323c1-ee88-4a60-882c-d81c6626d4f8&bsft_utid=909ebfd4-ed56-4e56-81c0-105a6d470eb1-LIBWEALT&bsft_mime_type=html&bsft_ek=2024-06-18T04%3A11%3A05Z&bsft_aaid=143cca17-1a3d-4d28-8ba4-eaf7031e47d7&bsft_lx=22&bsft_tv=27

Protocol

Server

151.101.65.229 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

9e0ba9b7b14aad4119d42336ac59c47758e24267decca899f7645558538d8ebc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9;q=0.9
Referer: https://preferences.oxfordclub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 18 Jun 2024 19:30:40 GMT
x-content-type-options: nosniff
content-encoding: br
age: 3671697
x-jsd-version: 2.0.46
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 16158
x-served-by: cache-fra-etou8220113-FRA, cache-yyz4571-YYZ
x-jsd-version-type: version
etag: W/"1536b-owF90foviTSYDZtW7lXw7JIor2c"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 18 Jun 2024 19:30:40 GMT
x-content-type-options: nosniff
age: 2475387
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 111
x-served-by: cache-fra-eddf8230119-FRA, cache-yyz4571-YYZ
vary: Accept-Encoding, Accept
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
location: https://cdn.jsdelivr.net/npm/@mdi/font@2.0.46/css/materialdesignicons.min.css
access-control-expose-headers: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 jquery-3.5.1.min.js Show response
code.jquery.com/ 87 KB
30 KB 374ms
20ms Script
application/javascript 151.101.66.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.5.1.min.js
Requested by: Host: preferences.oxfordclub.com
URL: https://preferences.oxfordclub.com/?type=standardunsub&list=LIBWEALT%2CLWDED&pk=1b2c3d4fe10d2627c537aea7e72a986e&utm_campaign=LW_Editorial_Welcome_%28WIP%29&vid2=230bb62d688e1134df1075d438faeb10b28cae9bbe1cfae39f3a6f289f60c5bab28cd446edc1c401f2ec6461489691f8&utm_medium=email&utm_source=libwealt&bsft_clkid=5f83f764-6117-4c0b-a922-be87415e7865&bsft_uid=909ebfd4-ed56-4e56-81c0-105a6d470eb1&bsft_mid=479d1590-6040-46c0-8079-8dfd0388991a&bsft_eid=f6326b75-6ed5-dfd7-1c4f-290990c739c4&bsft_txnid=915323c1-ee88-4a60-882c-d81c6626d4f8&bsft_utid=909ebfd4-ed56-4e56-81c0-105a6d470eb1-LIBWEALT&bsft_mime_type=html&bsft_ek=2024-06-18T04%3A11%3A05Z&bsft_aaid=143cca17-1a3d-4d28-8ba4-eaf7031e47d7&bsft_lx=22&bsft_tv=27
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.66.137 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://preferences.oxfordclub.com/
Origin: https://preferences.oxfordclub.com
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 18 Jun 2024 19:30:40 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 4595213
x-cache: HIT, HIT
content-length: 30879
x-served-by: cache-lga21981-LGA, cache-yyz4532-YYZ
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
x-timer: S1718739041.599580,VS0,VE0
etag: W/"28feccc0-15d84"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=604800
accept-ranges: bytes
x-cache-hits: 25, 252800

GET
H3 200 jquery.modal.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery-modal/0.9.1/ 5 KB
2 KB 384ms
32ms Script
application/javascript 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery-modal/0.9.1/jquery.modal.min.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a7e8ed2d7bbdbcaeeee81c3433f057d64a32c000112bbd09b5969fc658d0a655

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://preferences.oxfordclub.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 18 Jun 2024 19:30:40 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 431555
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1399
last-modified: Mon, 04 May 2020 16:11:46 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec2-1359"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YOVaylrztU0xP%2Fgz6ZW7qDkZVw%2B6xK%2FGkuXpezmEw57r%2Blv%2BqFVtmpEqO%2BUL5Ai%2BhFC8bZaXDVys87uZLp0lgd3Zwn%2FiHQQve2PPYMCKok6QC6lbzIqJ%2F7hhubp1dEFf4jes8G3E"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 895db1fbbde4ac28-YYZ
expires: Sun, 08 Jun 2025 19:30:40 GMT

GET
H3 200 jquery.modal.min.css
cdnjs.cloudflare.com/ajax/libs/jquery-modal/0.9.1/ 3 KB
2 KB 383ms
30ms Stylesheet
text/css 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery-modal/0.9.1/jquery.modal.min.css

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eaa593bcfe485f4b5a8ac997cf9936604f9fbef91652db94a8e22b75d612bfc1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://preferences.oxfordclub.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 18 Jun 2024 19:30:40 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 223938
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1541
last-modified: Mon, 04 May 2020 16:11:46 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec2-c81"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vHUxh7SxHxXXyBepQQ5lXyhgo3zCQkj6RdPUYnW9zxzHLvJi%2Bc%2FNR5y4C8AT450HTLQSpSEQaeZ4tYj8a52sZPNXSJNMm5OMM0LqHEOotqT5RHdI%2BLzSuQk7j6RYwp0AWuV5KYHF"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 895db1fbbde6ac28-YYZ
expires: Sun, 08 Jun 2025 19:30:40 GMT

GET
H/1.1 200
OK all.js Show response
portrait-tracker.s3.amazonaws.com/ 38 KB
38 KB 410ms
57ms Script
application/javascript 54.231.199.25
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://portrait-tracker.s3.amazonaws.com/all.js
Requested by: Host: preferences.oxfordclub.com
URL: https://preferences.oxfordclub.com/?type=standardunsub&list=LIBWEALT%2CLWDED&pk=1b2c3d4fe10d2627c537aea7e72a986e&utm_campaign=LW_Editorial_Welcome_%28WIP%29&vid2=230bb62d688e1134df1075d438faeb10b28cae9bbe1cfae39f3a6f289f60c5bab28cd446edc1c401f2ec6461489691f8&utm_medium=email&utm_source=libwealt&bsft_clkid=5f83f764-6117-4c0b-a922-be87415e7865&bsft_uid=909ebfd4-ed56-4e56-81c0-105a6d470eb1&bsft_mid=479d1590-6040-46c0-8079-8dfd0388991a&bsft_eid=f6326b75-6ed5-dfd7-1c4f-290990c739c4&bsft_txnid=915323c1-ee88-4a60-882c-d81c6626d4f8&bsft_utid=909ebfd4-ed56-4e56-81c0-105a6d470eb1-LIBWEALT&bsft_mime_type=html&bsft_ek=2024-06-18T04%3A11%3A05Z&bsft_aaid=143cca17-1a3d-4d28-8ba4-eaf7031e47d7&bsft_lx=22&bsft_tv=27
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.231.199.25 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 0d442120d2b60deb30df02e017358ba9e8057e57af2a52aadaceb08200dc5118

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://preferences.oxfordclub.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 18 Jun 2024 19:30:41 GMT
x-amz-version-id: DJTsKKAXZAjX88yytY8IZ9oo.cyFutLW
Last-Modified: Tue, 12 Mar 2024 18:03:33 GMT
Server: AmazonS3
x-amz-request-id: XSM76QB80MJKCBG5
ETag: "7a4866af82b3d9c4147211938ab5004d"
x-amz-server-side-encryption: AES256
Content-Type: application/javascript
Accept-Ranges: bytes
Content-Length: 38527
x-amz-id-2: tpk+vLCvEFGm4AbnzDgCVikHmWlpSaOubRFfnb0HpqWwm3rIcMkIiHpxIAamMnKuh48WB9YsrU4=

GET
H/1.1 200
OK all.js Show response
preferences.oxfordclub.com/dest/ 29 KB
8 KB 43ms
41ms Script
application/javascript 18.233.27.104
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://preferences.oxfordclub.com/dest/all.js
Requested by: Host: preferences.oxfordclub.com
URL: https://preferences.oxfordclub.com/?type=standardunsub&list=LIBWEALT%2CLWDED&pk=1b2c3d4fe10d2627c537aea7e72a986e&utm_campaign=LW_Editorial_Welcome_%28WIP%29&vid2=230bb62d688e1134df1075d438faeb10b28cae9bbe1cfae39f3a6f289f60c5bab28cd446edc1c401f2ec6461489691f8&utm_medium=email&utm_source=libwealt&bsft_clkid=5f83f764-6117-4c0b-a922-be87415e7865&bsft_uid=909ebfd4-ed56-4e56-81c0-105a6d470eb1&bsft_mid=479d1590-6040-46c0-8079-8dfd0388991a&bsft_eid=f6326b75-6ed5-dfd7-1c4f-290990c739c4&bsft_txnid=915323c1-ee88-4a60-882c-d81c6626d4f8&bsft_utid=909ebfd4-ed56-4e56-81c0-105a6d470eb1-LIBWEALT&bsft_mime_type=html&bsft_ek=2024-06-18T04%3A11%3A05Z&bsft_aaid=143cca17-1a3d-4d28-8ba4-eaf7031e47d7&bsft_lx=22&bsft_tv=27
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 18.233.27.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-233-27-104.compute-1.amazonaws.com
Software: nginx /
Resource Hash: f686cd944a0f51be36f8c8f9e4e228155057b4ebd3b141374a92e4e759efe1c7

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://preferences.oxfordclub.com/?type=standardunsub&list=LIBWEALT%2CLWDED&pk=1b2c3d4fe10d2627c537aea7e72a986e&utm_campaign=LW_Editorial_Welcome_%28WIP%29&vid2=230bb62d688e1134df1075d438faeb10b28cae9bbe1cfae39f3a6f289f60c5bab28cd446edc1c401f2ec6461489691f8&utm_medium=email&utm_source=libwealt&bsft_clkid=5f83f764-6117-4c0b-a922-be87415e7865&bsft_uid=909ebfd4-ed56-4e56-81c0-105a6d470eb1&bsft_mid=479d1590-6040-46c0-8079-8dfd0388991a&bsft_eid=f6326b75-6ed5-dfd7-1c4f-290990c739c4&bsft_txnid=915323c1-ee88-4a60-882c-d81c6626d4f8&bsft_utid=909ebfd4-ed56-4e56-81c0-105a6d470eb1-LIBWEALT&bsft_mime_type=html&bsft_ek=2024-06-18T04%3A11%3A05Z&bsft_aaid=143cca17-1a3d-4d28-8ba4-eaf7031e47d7&bsft_lx=22&bsft_tv=27
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 18 Jun 2024 19:30:40 GMT
Content-Encoding: br
Last-Modified: Tue, 30 May 2023 16:27:33 GMT
Server: nginx
ETag: W/"647623f5-72bc"
Transfer-Encoding: chunked
Content-Type: application/javascript
Connection: keep-alive

GET
H/1.1 200
OK ajax-loader.gif
portrait-tracker.s3.amazonaws.com/ 3 KB
4 KB 410ms
57ms Image
image/gif 54.231.199.25
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://portrait-tracker.s3.amazonaws.com/ajax-loader.gif
Requested by: Host: preferences.oxfordclub.com
URL: https://preferences.oxfordclub.com/?type=standardunsub&list=LIBWEALT%2CLWDED&pk=1b2c3d4fe10d2627c537aea7e72a986e&utm_campaign=LW_Editorial_Welcome_%28WIP%29&vid2=230bb62d688e1134df1075d438faeb10b28cae9bbe1cfae39f3a6f289f60c5bab28cd446edc1c401f2ec6461489691f8&utm_medium=email&utm_source=libwealt&bsft_clkid=5f83f764-6117-4c0b-a922-be87415e7865&bsft_uid=909ebfd4-ed56-4e56-81c0-105a6d470eb1&bsft_mid=479d1590-6040-46c0-8079-8dfd0388991a&bsft_eid=f6326b75-6ed5-dfd7-1c4f-290990c739c4&bsft_txnid=915323c1-ee88-4a60-882c-d81c6626d4f8&bsft_utid=909ebfd4-ed56-4e56-81c0-105a6d470eb1-LIBWEALT&bsft_mime_type=html&bsft_ek=2024-06-18T04%3A11%3A05Z&bsft_aaid=143cca17-1a3d-4d28-8ba4-eaf7031e47d7&bsft_lx=22&bsft_tv=27
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.231.199.25 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: aebc793d0064383ee6b1625bf3bb32532ec30a5c12bf9117066107d412119123

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://preferences.oxfordclub.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 18 Jun 2024 19:30:41 GMT
x-amz-version-id: null
Last-Modified: Tue, 29 Sep 2020 18:47:39 GMT
Server: AmazonS3
x-amz-request-id: XSMB9702CX8MNAF4
ETag: "a51c5608d01acf32df728f299767f82b"
Content-Type: image/gif
Accept-Ranges: bytes
Content-Length: 3208
x-amz-id-2: KvzCHbMXXgToD+/rjFJf6S5ZYCimtaSK/iiZnfOSJfG94Y0YkjHmXuMNQ3qPUkCzTG1sufm0jAI=

GET
H2 200 latest.min.js Show response
c.lytics.io/api/tag/9c32784e3cc4888a693a7988ad64c63d/ 68 KB
23 KB 85ms
33ms Script
application/javascript 104.26.2.22
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.lytics.io/api/tag/9c32784e3cc4888a693a7988ad64c63d/latest.min.js

Requested by

Host: portrait-tracker.s3.amazonaws.com
URL: https://portrait-tracker.s3.amazonaws.com/all.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.2.22 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

63c5498e6b566cbdce24d58c797661ae67e8dfb2d75f3d5592017a881f9b1762

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000;

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://preferences.oxfordclub.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 18 Jun 2024 19:30:40 GMT
content-encoding: gzip
via: 1.1 google
strict-transport-security: max-age=63072000;
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4479
last-modified: Tue, 18 Jun 2024 18:16:01 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Bm50x%2F%2FsjHXwStDPoLLbEWB6IAkbu3zr7kudoS0WFqLAxZL0f2WxOLcV%2Bmn7PD1DnnMkOAEzAJc2QjUUCpz%2BN%2B8n%2BpmscMSDY8bN63k%2FXjteydwBW6YbC8UV836f"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=7200
x-lytics-trace: 813edc2c2ac10f2d7433237f8653447c
cf-ray: 895db1fd1d493981-YYZ

GET
H/1.1 200
OK blueshift.js Show response
cdn.getblueshift.com/ 6 KB
3 KB 119ms
38ms Script
application/javascript 18.154.227.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.getblueshift.com/blueshift.js
Requested by: Host: portrait-tracker.s3.amazonaws.com
URL: https://portrait-tracker.s3.amazonaws.com/all.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.154.227.63 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-154-227-63.iad55.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a97c4e09767a155128f03c8a72efccc7d8e38e2e8e78daf14c8e5beaf72ff1a5

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://preferences.oxfordclub.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 18 Jun 2024 19:01:21 GMT
Content-Encoding: gzip
Via: 1.1 a170450d5cd56debfea916e005590e76.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: IAD55-P5
Age: 1760
x-amz-server-side-encryption: AES256
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 2826
Last-Modified: Wed, 24 Jan 2024 03:44:50 GMT
Server: AmazonS3
ETag: "bd39fba69cd2745738daf44e0e350f6e"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=3600
Accept-Ranges: bytes
X-Amz-Cf-Id: 6Osid8yn0Fq3Fa1xc5bYNbqzafRzmnxgsWJzSuxrKTChkbpJNph6uw==

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 364 KB
109 KB 148ms
68ms Script
application/javascript 142.251.16.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-KTM4C7C

Requested by

Host: portrait-tracker.s3.amazonaws.com
URL: https://portrait-tracker.s3.amazonaws.com/all.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.97 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

b6035e4b2947cca7ff4542789ac625a59054bc6d55a74a1a3a10a5fb2b004991

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://preferences.oxfordclub.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 18 Jun 2024 19:30:40 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 110776
x-xss-protection: 0
last-modified: Tue, 18 Jun 2024 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 18 Jun 2024 19:30:40 GMT

GET
H/1.1 200
OK index.html
portrait-tracker.s3.amazonaws.com/ Frame 4BC3 0
0 125ms
53ms Document
text/html 16.182.32.225
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://portrait-tracker.s3.amazonaws.com/index.html
Requested by: Host: portrait-tracker.s3.amazonaws.com
URL: https://portrait-tracker.s3.amazonaws.com/all.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 16.182.32.225 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash

Request headers

Accept-Language: en-CA,en;q=0.9;q=0.9
Referer: https://preferences.oxfordclub.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Accept-Ranges: bytes
Content-Length: 2371
Content-Type: text/html
Date: Tue, 18 Jun 2024 19:30:42 GMT
ETag: "c029f674b13b082e9a03b16217c3f576"
Last-Modified: Wed, 03 Nov 2021 21:10:09 GMT
Server: AmazonS3
x-amz-id-2: da5xkHPmueHWVWqI7ZfbrqcONRTJ6x4ovIVrgPZy3Qw/sonsr4iGamiM/y9oxrLylCvibfEzZDs=
x-amz-request-id: XPCQ8S7HZZ9QZ4PY
x-amz-version-id: X1zblgbOV1d.Qkc55AyQidmgNGbabuW5

GET
H2 200 d9c98aba-58bd-4d60-9ae0-4b46bfc96fee Show response
c.lytics.io/api/personalize/9c32784e3cc4888a693a7988ad64c63d/user/_uid/ 80 KB
13 KB 91ms
91ms Script
application/json 104.26.2.22
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.lytics.io/api/personalize/9c32784e3cc4888a693a7988ad64c63d/user/_uid/d9c98aba-58bd-4d60-9ae0-4b46bfc96fee?segments=true&mergestate=true&state=%7B%22_uid%22%3A%22d9c98aba-58bd-4d60-9ae0-4b46bfc96fee%22%2C%22utm_campaign%22%3A%22LW_Editorial_Welcome_(WIP)%22%2C%22utm_medium%22%3A%22email%22%2C%22utm_source%22%3A%22libwealt%22%2C%22_sesstart%22%3A%221%22%2C%22_tz%22%3A-7%2C%22_ul%22%3A%22en-CA%22%2C%22_sz%22%3A%221600x1200%22%2C%22_nmob%22%3A%22t%22%2C%22_device%22%3A%22desktop%22%2C%22url%22%3A%22preferences.oxfordclub.com%2F%3Ftype%3Dstandardunsub%26list%3DLIBWEALT%252CLWDED%26pk%3D1b2c3d4fe10d2627c537aea7e72a986e%26utm_campaign%3DLW_Editorial_Welcome_%2528WIP%2529%26vid2%3D230bb62d688e1134df1075d438faeb10b28cae9bbe1cfae39f3a6f289f60c5bab28cd446edc1c401f2ec6461489691f8%26utm_medium%3Demail%26utm_source%3Dlibwealt%26bsft_clkid%3D5f83f764-6117-4c0b-a922-be87415e7865%26bsft_uid%3D909ebfd4-ed56-4e56-81c0-105a6d470eb1%26bsft_mid%3D479d1590-6040-46c0-8079-8dfd0388991a%26bsft_eid%3Df6326b75-6ed5-dfd7-1c4f-290990c739c4%26bsft_txnid%3D915323c1-ee88-4a60-882c-d81c6626d4f8%26bsft_utid%3D909ebfd4-ed56-4e56-81c0-105a6d470eb1-LIBWEALT%26bsft_mime_type%3Dhtml%26bsft_ek%3D2024-06-18T04%253A11%253A05Z%26bsft_aaid%3D143cca17-1a3d-4d28-8ba4-eaf7031e47d7%26bsft_lx%3D22%26bsft_tv%3D27%22%2C%22_v%22%3A%223.0.35%22%7D&ts=1718739040999&callback=u_946094209362841100

Requested by

Host: c.lytics.io
URL: https://c.lytics.io/api/tag/9c32784e3cc4888a693a7988ad64c63d/latest.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.2.22 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5296fd658bf4b22e17ffc1858a69dde914152de65fff220d426edface77fa816

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000;

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://preferences.oxfordclub.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 18 Jun 2024 19:30:41 GMT
content-encoding: gzip
via: 1.1 google
strict-transport-security: max-age=63072000;
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I6uwkJDbakzic1jgUWbEP7OVicwSwXS7vWlwfo5XbJ6VEOvIxvdZzY0cdHfEP3nnzSW%2B2oAoWXgTB186nHHJEWXZKxxonrNgdcG%2F%2FKn6h0boYOGSODnhBS840hKN"}],"group":"cf-nel","max_age":604800}
x-lytics-trace: 98cc709b748f1c24248c723ae84a8b4c
cf-ray: 895db1fe4ea83981-YYZ
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Cookie, *

GET
H2 200 9c32784e3cc4888a693a7988ad64c63d
c.lytics.io/c/ 35 B
591 B 58ms
58ms Image
image/gif 104.26.2.22
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.lytics.io/c/9c32784e3cc4888a693a7988ad64c63d?_e=pv&utm_campaign=LW_Editorial_Welcome_(WIP)&utm_medium=email&utm_source=libwealt&_sesstart=1&_tz=-7&_ul=en-CA&_sz=1600x1200&_ts=1718739040994&_nmob=t&_device=desktop&url=preferences.oxfordclub.com%2F%3Ftype%3Dstandardunsub%26list%3DLIBWEALT%252CLWDED%26pk%3D1b2c3d4fe10d2627c537aea7e72a986e%26utm_campaign%3DLW_Editorial_Welcome_%2528WIP%2529%26vid2%3D230bb62d688e1134df1075d438faeb10b28cae9bbe1cfae39f3a6f289f60c5bab28cd446edc1c401f2ec6461489691f8%26utm_medium%3Demail%26utm_source%3Dlibwealt%26bsft_clkid%3D5f83f764-6117-4c0b-a922-be87415e7865%26bsft_uid%3D909ebfd4-ed56-4e56-81c0-105a6d470eb1%26bsft_mid%3D479d1590-6040-46c0-8079-8dfd0388991a%26bsft_eid%3Df6326b75-6ed5-dfd7-1c4f-290990c739c4%26bsft_txnid%3D915323c1-ee88-4a60-882c-d81c6626d4f8%26bsft_utid%3D909ebfd4-ed56-4e56-81c0-105a6d470eb1-LIBWEALT%26bsft_mime_type%3Dhtml%26bsft_ek%3D2024-06-18T04%253A11%253A05Z%26bsft_aaid%3D143cca17-1a3d-4d28-8ba4-eaf7031e47d7%26bsft_lx%3D22%26bsft_tv%3D27&_v=3.0.35&_uid=d9c98aba-58bd-4d60-9ae0-4b46bfc96fee&_getid=t

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.2.22 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000;

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://preferences.oxfordclub.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 18 Jun 2024 19:30:41 GMT
strict-transport-security: max-age=63072000;
via: 1.1 google
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length: 35
pragma: no-cache
server: cloudflare
access-control-allow-methods: GET, POST
content-type: image/gif
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v9UGMGlVwzgF9nWhn%2BGxnunts%2F%2BEC48lD4dOh4y41GnUSAKCQCpCR%2FroyDRDsmWunJ%2F5%2FRQm1y5hiOzk91t5fSyIx%2F%2BZZJB188OD9BZEwDdqTM6SWns9p355raJB"}],"group":"cf-nel","max_age":604800}
cache-control: no-cache, no-store, must-revalidate
x-lytics-trace: dad1a5297b11d4a9041a8a2181d5c4da
cf-ray: 895db1fe4eac3981-YYZ
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Cookie, *
expires: 0

GET
H2 200 cm
trc.taboola.com/sg/lytics/1/ 43 B
416 B 79ms
34ms Image
image/gif 151.101.65.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trc.taboola.com/sg/lytics/1/cm?redirect=https%3A%2F%2Fc.lytics.io%2Fc%2Fprovider%2Ftaboola%3Ftaboola_id%3D%3CTUID%3E%26_uid%3Dd9c98aba-58bd-4d60-9ae0-4b46bfc96fee%26account_id%3D9c32784e3cc4888a693a7988ad64c63d
Requested by: Host: preferences.oxfordclub.com
URL: https://preferences.oxfordclub.com/?type=standardunsub&list=LIBWEALT%2CLWDED&pk=1b2c3d4fe10d2627c537aea7e72a986e&utm_campaign=LW_Editorial_Welcome_%28WIP%29&vid2=230bb62d688e1134df1075d438faeb10b28cae9bbe1cfae39f3a6f289f60c5bab28cd446edc1c401f2ec6461489691f8&utm_medium=email&utm_source=libwealt&bsft_clkid=5f83f764-6117-4c0b-a922-be87415e7865&bsft_uid=909ebfd4-ed56-4e56-81c0-105a6d470eb1&bsft_mid=479d1590-6040-46c0-8079-8dfd0388991a&bsft_eid=f6326b75-6ed5-dfd7-1c4f-290990c739c4&bsft_txnid=915323c1-ee88-4a60-882c-d81c6626d4f8&bsft_utid=909ebfd4-ed56-4e56-81c0-105a6d470eb1-LIBWEALT&bsft_mime_type=html&bsft_ek=2024-06-18T04%3A11%3A05Z&bsft_aaid=143cca17-1a3d-4d28-8ba4-eaf7031e47d7&bsft_lx=22&bsft_tv=27
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.44 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 0d9762a1a60deef8aa093c473ad27c38eed77184d6940e7df06d89d77cbd3e94

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://preferences.oxfordclub.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-vcl-time-ms: 15
date: Tue, 18 Jun 2024 19:30:41 GMT
via: 1.1 varnish
x-fastly-to-nlb-rtt: 14219
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version: v2
x-served-by: cache-yyz4562-YYZ
pragma: no-cache
server: nginx
x-timer: S1718739041.154979,VS0,VE15
access-control-allow-origin: *
cache-control: no-cache, no-store
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 0

OPTIONS
H2 200 GetBlueshiftUserData
dnzkifeab6.execute-api.us-east-1.amazonaws.com/Prod/ Frame 0
0 122ms
41ms Preflight
application/json 13.32.151.71
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dnzkifeab6.execute-api.us-east-1.amazonaws.com/Prod/GetBlueshiftUserData
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.151.71 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-151-71.iad66.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://preferences.oxfordclub.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin: *
content-length: 3
content-type: application/json
date: Tue, 18 Jun 2024 19:30:41 GMT
via: 1.1 8a39851a9fdfa096ba6f1e618ed88f40.cloudfront.net (CloudFront)
x-amz-apigw-id: Zk__PEpUoAMEaGA=
x-amz-cf-id: dhcSBXRVK-CHV8HNNKXTPzyHZQUT1AU3yfHie72n4KwY7mCtt6l-iQ==
x-amz-cf-pop: IAD66-C2
x-amzn-requestid: 0aa4d9e4-1626-4393-aa24-fa925331de27
x-cache: Miss from cloudfront

POST
H2 200 GetBlueshiftUserData Show response
dnzkifeab6.execute-api.us-east-1.amazonaws.com/Prod/ 4 KB
4 KB 339ms
338ms XHR
application/json 13.32.151.71
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dnzkifeab6.execute-api.us-east-1.amazonaws.com/Prod/GetBlueshiftUserData
Requested by: Host: portrait-tracker.s3.amazonaws.com
URL: https://portrait-tracker.s3.amazonaws.com/all.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.151.71 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-151-71.iad66.r.cloudfront.net
Software: /
Resource Hash: 5f4cf2ff2ac16dea81372c0b9dc29c58e3c175be3db4b858efcf07640ce0512c

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform: "Win32"
Referer: https://preferences.oxfordclub.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 18 Jun 2024 19:30:41 GMT
via: 1.1 8a39851a9fdfa096ba6f1e618ed88f40.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD66-C2
x-amzn-requestid: 00375aa9-6d3b-4c75-bd1c-d74c205d5f61
x-amzn-trace-id: Root=1-6671e061-1ac7811f3985571b67e48057;Parent=3fe9f32c262a3acf;Sampled=0;lineage=1b8d1031:0
access-control-allow-methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
content-type: application/json
access-control-allow-origin: *
x-cache: Miss from cloudfront
x-amz-apigw-id: Zk__PHs6IAMEO_Q=
content-length: 3836
x-amz-cf-id: JtzaFV04lC-2GszvQL76lEN9qXGHr5WtqMfSnz2UZFdB09blQcF_Sw==
access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 218 KB
77 KB 71ms
69ms Script
application/javascript 142.251.16.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-56SG97N

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.97 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

66f7a7b214eaf711a8e440c1d0d39361f8b1d640738de3244d8b6e6176c6c0c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://preferences.oxfordclub.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 18 Jun 2024 19:30:41 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 79071
x-xss-protection: 0
last-modified: Tue, 18 Jun 2024 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 18 Jun 2024 19:30:41 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 45 KB
13 KB 159ms
50ms Script
application/javascript 13.107.21.237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

13.107.21.237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

335750c5de24e485b630b91393e74f41356a4f036496995742eebabc97a47165

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://preferences.oxfordclub.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Tue, 18 Jun 2024 19:30:40 GMT
last-modified: Thu, 29 Feb 2024 19:58:06 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: CD947AE610A54A58A388C6195245441C Ref B: YTO01EDGE0814 Ref C: 2024-06-18T19:30:41Z
etag: "01b4e9c496bda1:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 13261

GET
H/1.1 200
OK lytics-styles.css
s3.amazonaws.com/assets.oxfordclub.com/css/global/ 428 KB
428 KB 138ms
61ms Stylesheet
text/css 52.217.112.136
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s3.amazonaws.com/assets.oxfordclub.com/css/global/lytics-styles.css
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KTM4C7C
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.217.112.136 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: ba62454b7a38b38285bd20c66c0aaced3d625e10646a12c209d57ea5af186eb7

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://preferences.oxfordclub.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 18 Jun 2024 19:30:42 GMT
x-amz-version-id: Mp35HizUdlZ9h7c1SZhGZSqW44JxVkGA
Last-Modified: Mon, 17 Jun 2024 19:02:57 GMT
Server: AmazonS3
x-amz-request-id: XPCZ4PJBG5QJ105K
ETag: "0ca8bdd3121f11d99ad744be4ca54b01"
x-amz-server-side-encryption: AES256
Content-Type: text/css
Accept-Ranges: bytes
Content-Length: 438183
x-amz-id-2: Y2B7P4mTEFEzqXw08rwz8adLxUIabh85iNqR52RtQaOEQv+dmk2+pYthpOYbJVa2M5fa1cZijQg=

POST
H2 200 portrait
c.lytics.io/c/9c32784e3cc4888a693a7988ad64c63d/ Frame 6625 0
0 99ms
59ms Document
text/html 172.67.73.236
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.lytics.io/c/9c32784e3cc4888a693a7988ad64c63d/portrait

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.73.236 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000;

Request headers

Accept-Language: en-CA,en;q=0.9;q=0.9
Content-Type: application/x-www-form-urlencoded
Origin: https://preferences.oxfordclub.com
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Cookie, *
access-control-allow-methods: GET, POST
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 895db1ff7959ac5a-YYZ
content-encoding: br
content-type: text/html
date: Tue, 18 Jun 2024 19:30:41 GMT
expires: 0
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XOs2nUB8pmiyULOEmJw5Pf8xNpOSj50cQzaKKN%2B9OJqxSk3KFd8WzXMjFwH7407M%2Fx9kvLbE3xDePYmWJqmdMBK60z3DxuNC2AmGc2eYlaPZWJN4MDhBVZuzQLqQ"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=63072000;
via: 1.1 google
x-lytics-trace: c7f607d85a880c75f41a759498e4f45d

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 304 KB
101 KB 55ms
55ms Script
application/javascript 142.251.16.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-15LG7SDTRV&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-56SG97N

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.97 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

17017815c6b4b778260ac128c485fe3d63c4955a1835c65ee97055297a4cbb65

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://preferences.oxfordclub.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 18 Jun 2024 19:30:41 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 103619
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 18 Jun 2024 19:30:41 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 152ms
49ms Script
text/javascript 209.85.144.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-56SG97N

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

209.85.144.100 Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

qv-in-f100.1e100.net

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://preferences.oxfordclub.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 18 Jun 2024 18:40:22 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 3019
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Tue, 18 Jun 2024 20:40:22 GMT

GET
H2 204 15322609.js Show response
bat.bing.com/p/action/ 0
117 B 51ms
51ms Script
text/plain 13.107.21.237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/15322609.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

13.107.21.237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://preferences.oxfordclub.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
date: Tue, 18 Jun 2024 19:30:41 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: AC71FC079B734CAEA7401356204801E9 Ref B: YTO01EDGE0814 Ref C: 2024-06-18T19:30:41Z
x-cache: CONFIG_NOCACHE

GET
H2 204 0
bat.bing.com/action/ 0
360 B 106ms
105ms Image
text/plain 13.107.21.237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=15322609&Ver=2&mid=6337ce9f-5bdf-4a04-ab77-7e5176fc323d&sid=3faf5e202da911efbe27377f86b42a82&vid=3faf7f802da911ef97d72ffdfaa3a521&vids=1&msclkid=N&pi=918639831&lg=en-CA&sw=1600&sh=1200&sc=24&p=https%3A%2F%2Fpreferences.oxfordclub.com%2F%3Ftype%3Dstandardunsub%26list%3DLIBWEALT%252CLWDED%26pk%3D1b2c3d4fe10d2627c537aea7e72a986e%26utm_campaign%3DLW_Editorial_Welcome_%2528WIP%2529%26vid2%3D230bb62d688e1134df1075d438faeb10b28cae9bbe1cfae39f3a6f289f60c5bab28cd446edc1c401f2ec6461489691f8%26utm_medium%3Demail%26utm_source%3Dlibwealt%26bsft_clkid%3D5f83f764-6117-4c0b-a922-be87415e7865%26bsft_uid%3D909ebfd4-ed56-4e56-81c0-105a6d470eb1%26bsft_mid%3D479d1590-6040-46c0-8079-8dfd0388991a%26bsft_eid%3Df6326b75-6ed5-dfd7-1c4f-290990c739c4%26bsft_txnid%3D915323c1-ee88-4a60-882c-d81c6626d4f8%26bsft_utid%3D909ebfd4-ed56-4e56-81c0-105a6d470eb1-LIBWEALT%26bsft_mime_type%3Dhtml%26bsft_ek%3D2024-06-18T04%253A11%253A05Z%26bsft_aaid%3D143cca17-1a3d-4d28-8ba4-eaf7031e47d7%26bsft_lx%3D22%26bsft_tv%3D27&r=&lt=1044&evt=pageLoad&sv=1&rn=236414

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

13.107.21.237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://preferences.oxfordclub.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 18 Jun 2024 19:30:41 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: E63075CD80504FA186A4E74D29B86932 Ref B: YTO01EDGE0814 Ref C: 2024-06-18T19:30:41Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 51ms
50ms Fetch
text/plain 209.85.144.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-15LG7SDTRV&gtm=45je46c0h1v9126866096z8845913905za200zb845913905&_p=1718739040761&gcd=13l3l3l3l1&npa=0&dma=0&tag_exp=0&cid=132027949.1718739041&ul=en-ca&sr=1600x1200&uaa=x86&uab=64&uafvl=Not%252FA)Brand%3B8.0.0.0%7CChromium%3B126.0.6478.61%7CGoogle%2520Chrome%3B126.0.6478.61&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1718739041&sct=1&seg=0&dl=https%3A%2F%2Fpreferences.oxfordclub.com%2F%3Ftype%3Dstandardunsub%26list%3DLIBWEALT%252CLWDED%26pk%3D1b2c3d4fe10d2627c537aea7e72a986e%26utm_campaign%3DLW_Editorial_Welcome_%2528WIP%2529%26vid2%3D230bb62d688e1134df1075d438faeb10b28cae9bbe1cfae39f3a6f289f60c5bab28cd446edc1c401f2ec6461489691f8%26utm_medium%3Demail%26utm_source%3Dlibwealt%26bsft_clkid%3D5f83f764-6117-4c0b-a922-be87415e7865%26bsft_uid%3D909ebfd4-ed56-4e56-81c0-105a6d470eb1%26bsft_mid%3D479d1590-6040-46c0-8079-8dfd0388991a%26bsft_eid%3Df6326b75-6ed5-dfd7-1c4f-290990c739c4%26bsft_txnid%3D915323c1-ee88-4a60-882c-d81c6626d4f8%26bsft_utid%3D909ebfd4-ed56-4e56-81c0-105a6d470eb1-LIBWEALT%26bsft_mime_type%3Dhtml%26bsft_ek%3D2024-06-18T04%253A11%253A05Z%26bsft_aaid%3D143cca17-1a3d-4d28-8ba4-eaf7031e47d7%26bsft_lx%3D22%26bsft_tv%3D27&dt=&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=1678&_z=fetch
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-15LG7SDTRV&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 209.85.144.100 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: qv-in-f100.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://preferences.oxfordclub.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Tue, 18 Jun 2024 19:30:41 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://preferences.oxfordclub.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
155 B 50ms
49ms Image
image/gif 209.85.144.100
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1368253601&t=pageview&_s=1&dl=https%3A%2F%2Fpreferences.oxfordclub.com%2F%3Ftype%3Dstandardunsub%26list%3DLIBWEALT%252CLWDED%26pk%3D1b2c3d4fe10d2627c537aea7e72a986e%26utm_campaign%3DLW_Editorial_Welcome_%2528WIP%2529%26vid2%3D230bb62d688e1134df1075d438faeb10b28cae9bbe1cfae39f3a6f289f60c5bab28cd446edc1c401f2ec6461489691f8%26utm_medium%3Demail%26utm_source%3Dlibwealt%26bsft_clkid%3D5f83f764-6117-4c0b-a922-be87415e7865%26bsft_uid%3D909ebfd4-ed56-4e56-81c0-105a6d470eb1%26bsft_mid%3D479d1590-6040-46c0-8079-8dfd0388991a%26bsft_eid%3Df6326b75-6ed5-dfd7-1c4f-290990c739c4%26bsft_txnid%3D915323c1-ee88-4a60-882c-d81c6626d4f8%26bsft_utid%3D909ebfd4-ed56-4e56-81c0-105a6d470eb1-LIBWEALT%26bsft_mime_type%3Dhtml%26bsft_ek%3D2024-06-18T04%253A11%253A05Z%26bsft_aaid%3D143cca17-1a3d-4d28-8ba4-eaf7031e47d7%26bsft_lx%3D22%26bsft_tv%3D27&ul=en-ca&de=windows-1252&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YIAAAAABAAAAAAAAIE~&cid=97b14144-df7c-4427-8221-5bc7b6ea4d05&uid=97b14144-df7c-4427-8221-5bc7b6ea4d05&tid=UA-148998105-8&_gid=225235334.1718739041&gtm=45He46c0h1n8156SG97Nv845913905za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&z=831276828

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

209.85.144.100 Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

qv-in-f100.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://preferences.oxfordclub.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Tue, 18 Jun 2024 07:52:26 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 41895
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 404
Not Found favicon.ico
preferences.oxfordclub.com/ 209 B
355 B 41ms
41ms Other
text/html 18.233.27.104
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://preferences.oxfordclub.com/favicon.ico
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 18.233.27.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-233-27-104.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b6682cab65d3243b5b75efb7279dbf49491957484780f2ba0a87632cc0e25642

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://preferences.oxfordclub.com/?type=standardunsub&list=LIBWEALT%2CLWDED&pk=1b2c3d4fe10d2627c537aea7e72a986e&utm_campaign=LW_Editorial_Welcome_%28WIP%29&vid2=230bb62d688e1134df1075d438faeb10b28cae9bbe1cfae39f3a6f289f60c5bab28cd446edc1c401f2ec6461489691f8&utm_medium=email&utm_source=libwealt&bsft_clkid=5f83f764-6117-4c0b-a922-be87415e7865&bsft_uid=909ebfd4-ed56-4e56-81c0-105a6d470eb1&bsft_mid=479d1590-6040-46c0-8079-8dfd0388991a&bsft_eid=f6326b75-6ed5-dfd7-1c4f-290990c739c4&bsft_txnid=915323c1-ee88-4a60-882c-d81c6626d4f8&bsft_utid=909ebfd4-ed56-4e56-81c0-105a6d470eb1-LIBWEALT&bsft_mime_type=html&bsft_ek=2024-06-18T04%3A11%3A05Z&bsft_aaid=143cca17-1a3d-4d28-8ba4-eaf7031e47d7&bsft_lx=22&bsft_tv=27
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 18 Jun 2024 19:30:41 GMT
Content-Encoding: br
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=iso-8859-1

OPTIONS
H2 200 GetLyticsUserData
dnzkifeab6.execute-api.us-east-1.amazonaws.com/Prod/ Frame 0
0 40ms
40ms Preflight
application/json 13.32.151.71
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dnzkifeab6.execute-api.us-east-1.amazonaws.com/Prod/GetLyticsUserData
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.151.71 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-151-71.iad66.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://preferences.oxfordclub.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin: *
content-length: 3
content-type: application/json
date: Tue, 18 Jun 2024 19:30:41 GMT
via: 1.1 8a39851a9fdfa096ba6f1e618ed88f40.cloudfront.net (CloudFront)
x-amz-apigw-id: Zk__TFVkIAMEGdw=
x-amz-cf-id: nDRMQpV3OvKIzlApfW17qA6ZLRL0fhYrcLDV5_uwIc-rjm_MXx8BAQ==
x-amz-cf-pop: IAD66-C2
x-amzn-requestid: 9de089a5-9cf0-44c6-911b-5deca30bb7d5
x-cache: Miss from cloudfront

POST
H2 200 GetLyticsUserData Show response
dnzkifeab6.execute-api.us-east-1.amazonaws.com/Prod/ 46 KB
47 KB 200ms
199ms XHR
application/json 13.32.151.71
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dnzkifeab6.execute-api.us-east-1.amazonaws.com/Prod/GetLyticsUserData
Requested by: Host: portrait-tracker.s3.amazonaws.com
URL: https://portrait-tracker.s3.amazonaws.com/all.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.151.71 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-151-71.iad66.r.cloudfront.net
Software: /
Resource Hash: 93615f69f836a060d08c4b3edd035a06e3526fa06e93bd73a506974e65babf91

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform: "Win32"
Referer: https://preferences.oxfordclub.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 18 Jun 2024 19:30:41 GMT
via: 1.1 8a39851a9fdfa096ba6f1e618ed88f40.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD66-C2
x-amzn-requestid: 75b00b8a-ae0d-4bb2-9510-cd5ecc80ddb9
x-amzn-trace-id: Root=1-6671e061-7a8a04870b4a873d06a6c800;Parent=2fe837320ec36648;Sampled=0;lineage=17be0e8a:0
access-control-allow-methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
content-type: application/json
access-control-allow-origin: *
x-cache: Miss from cloudfront
x-amz-apigw-id: Zk__TF69IAMEcOQ=
content-length: 47544
x-amz-cf-id: 0tr7HsG7Mka6jTMVG1pNw0Mb75jioUiSMVB3KA7P6rQ0_a7RwnOgTA==
access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token

GET
H2 200 9c32784e3cc4888a693a7988ad64c63d
c.lytics.io/c/ 35 B
325 B 85ms
85ms Image
image/gif 104.26.2.22
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.lytics.io/c/9c32784e3cc4888a693a7988ad64c63d?email=ccowling%40firstwestcu.ca&_ts=1718739041581&_nmob=t&_device=desktop&url=preferences.oxfordclub.com%2F%3Ftype%3Dstandardunsub%26list%3DLIBWEALT%252CLWDED%26pk%3D1b2c3d4fe10d2627c537aea7e72a986e%26utm_campaign%3DLW_Editorial_Welcome_%2528WIP%2529%26vid2%3D230bb62d688e1134df1075d438faeb10b28cae9bbe1cfae39f3a6f289f60c5bab28cd446edc1c401f2ec6461489691f8%26utm_medium%3Demail%26utm_source%3Dlibwealt%26bsft_clkid%3D5f83f764-6117-4c0b-a922-be87415e7865%26bsft_uid%3D909ebfd4-ed56-4e56-81c0-105a6d470eb1%26bsft_mid%3D479d1590-6040-46c0-8079-8dfd0388991a%26bsft_eid%3Df6326b75-6ed5-dfd7-1c4f-290990c739c4%26bsft_txnid%3D915323c1-ee88-4a60-882c-d81c6626d4f8%26bsft_utid%3D909ebfd4-ed56-4e56-81c0-105a6d470eb1-LIBWEALT%26bsft_mime_type%3Dhtml%26bsft_ek%3D2024-06-18T04%253A11%253A05Z%26bsft_aaid%3D143cca17-1a3d-4d28-8ba4-eaf7031e47d7%26bsft_lx%3D22%26bsft_tv%3D27&_ga=GA1.1.132027949.1718739041&_uid=d9c98aba-58bd-4d60-9ae0-4b46bfc96fee&_v=3.0.35&_uido=d9c98aba-58bd-4d60-9ae0-4b46bfc96fee

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.2.22 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000;

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://preferences.oxfordclub.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 18 Jun 2024 19:30:41 GMT
strict-transport-security: max-age=63072000;
via: 1.1 google
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length: 35
pragma: no-cache
server: cloudflare
access-control-allow-methods: GET, POST
content-type: image/gif
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=awrORlNM1UGl9EivJLa%2BYc2CSaT6k%2BCvigvsRvI6neoOidnOjvvXoLLuoDd8dp%2FwqNmllHSge81KhBU4Z0Yvm8FyDVZ8bUYR3E83GBwKCSuDn1UFMyjSyY%2Bdavaq"}],"group":"cf-nel","max_age":604800}
cache-control: no-cache, no-store, must-revalidate
x-lytics-trace: 1bac78ee17135270b01de024c2bb87bb
cf-ray: 895db201fb233981-YYZ
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Cookie, *
expires: 0

OPTIONS
H2 200 GetListSignup
dnzkifeab6.execute-api.us-east-1.amazonaws.com/Prod/ Frame 0
0 42ms
42ms Preflight
application/json 13.32.151.71
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dnzkifeab6.execute-api.us-east-1.amazonaws.com/Prod/GetListSignup
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.151.71 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-151-71.iad66.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://preferences.oxfordclub.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin: *
content-length: 3
content-type: application/json
date: Tue, 18 Jun 2024 19:30:41 GMT
via: 1.1 8a39851a9fdfa096ba6f1e618ed88f40.cloudfront.net (CloudFront)
x-amz-apigw-id: Zk__TF66oAMENpQ=
x-amz-cf-id: pwY7gbZiVsLF4t6gxDqH2_y68OlKjaDDybft7SkXL3RZbGzG9Kxx4w==
x-amz-cf-pop: IAD66-C2
x-amzn-requestid: fbc36fe2-4d4e-4f9f-8998-34151da96083
x-cache: Miss from cloudfront

POST
H2 200 GetListSignup Show response
dnzkifeab6.execute-api.us-east-1.amazonaws.com/Prod/ 973 B
1 KB 130ms
129ms Fetch
application/json 13.32.151.71
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dnzkifeab6.execute-api.us-east-1.amazonaws.com/Prod/GetListSignup
Requested by: Host: preferences.oxfordclub.com
URL: https://preferences.oxfordclub.com/dest/all.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.151.71 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-151-71.iad66.r.cloudfront.net
Software: /
Resource Hash: 2ddc26d93bd5d53e41509224875dd39e538f3d9ad5713ca258499a7e420bb851

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform: "Win32"
Referer
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 18 Jun 2024 19:30:41 GMT
via: 1.1 8a39851a9fdfa096ba6f1e618ed88f40.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD66-C2
x-amzn-requestid: 0f6168d5-1c08-4d33-b01d-49c730c38226
x-amzn-trace-id: Root=1-6671e061-298ea0004b5a3e567b437305;Parent=2dfce9b20030feba;Sampled=0;lineage=9d887eda:0
access-control-allow-methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
content-type: application/json
access-control-allow-origin: *
x-cache: Miss from cloudfront
x-amz-apigw-id: Zk__THaTIAMEftQ=
content-length: 973
x-amz-cf-id: ifV0dcFbVkXimTjscFXsKfLoIrwx3_Ubo-DPfuy1LwWLiNgZ9jnGKw==
access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token

GET
H2 200 pathfora.min.js Show response
c.lytics.io/static/ 103 KB
22 KB 31ms
31ms Script
text/javascript 104.26.2.22
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.lytics.io/static/pathfora.min.js

Requested by

Host: c.lytics.io
URL: https://c.lytics.io/api/tag/9c32784e3cc4888a693a7988ad64c63d/latest.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.2.22 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1f6e70fc4337b6769a4c498cf721491cb1f31a14e342cb9c584ccea00fee9d1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000;

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://preferences.oxfordclub.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 18 Jun 2024 19:30:41 GMT
strict-transport-security: max-age=63072000;
via: 1.1 google
cf-cache-status: HIT
last-modified: Tue, 18 Jun 2024 18:23:19 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 4042
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Md%2Bi8uW%2BnBkXr670VhomyxaWXD9Vhyv5ERBREvmXfWDZOLdwmHPrnYFdsoGYG3a0MrsZSbdPY4cwDsmIVeBIPPa4MnyvxaQtxibRd7gBbnI8kDAF4XGXxjzaEtVx"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript; charset=utf-8
content-encoding: br
cache-control: max-age=7200
cf-ray: 895db2021b403981-YYZ

GET
H2 200 pathfora.min.css
c.lytics.io/static/ 20 KB
4 KB 35ms
34ms Stylesheet
text/css 104.26.2.22
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.lytics.io/static/pathfora.min.css

Requested by

Host: c.lytics.io
URL: https://c.lytics.io/static/pathfora.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.2.22 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

464ad5d70f6d5fe4adef4d3057e1ae91e4983b02ef4ec9db0b067dcad4e53685

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000;

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://preferences.oxfordclub.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 18 Jun 2024 19:30:41 GMT
strict-transport-security: max-age=63072000;
via: 1.1 google
cf-cache-status: HIT
last-modified: Tue, 18 Jun 2024 17:48:51 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 6110
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DYCEB%2F157IsKcAdTDvs7F1qKtHn0NwZMz3CM3TKshkwcc0pPsef4LRQ1t4lUJZsRRxSmgoS9wKgWO%2B37vjggehJKiOIxW0BjeZhCBFlgD8z8arWtdYZIYFaA3ICv"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
content-encoding: br
cache-control: max-age=7200
cf-ray: 895db2025b903981-YYZ

GET
H2 200 lytics_overrides.min.css
storage.googleapis.com/lioservices/2470-oxford-club/ 602 B
1 KB 204ms
100ms Stylesheet
text/css 173.194.205.207
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://storage.googleapis.com/lioservices/2470-oxford-club/lytics_overrides.min.css
Requested by: Host: c.lytics.io
URL: https://c.lytics.io/api/tag/9c32784e3cc4888a693a7988ad64c63d/latest.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 173.194.205.207 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: qm-in-f207.1e100.net
Software: UploadServer /
Resource Hash: 0efd1a0f2f52ed3d1bbd90257616b1f3f057163e50e3ed7d36af06ffa10b7b06

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://preferences.oxfordclub.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 18 Jun 2024 19:30:41 GMT
age: 0
x-guploader-uploadid: ACJd0NoYgGxrGmOjNypJTpEglva4520zSSE-kQXRCePteUYZ34CV5gHU_aP0b0YhjHqr0kXRQLw
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 602
last-modified: Thu, 04 Oct 2018 21:47:26 GMT
server: UploadServer
etag: "9df2d5ae6031369aa6e0f3685608cd8c"
x-goog-generation: 1538689646128559
x-goog-hash: crc32c=VZEimQ==, md5=nfLVrmAxNpqm4PNoVgjNjA==
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=3600
x-goog-stored-content-length: 602
accept-ranges: bytes
content-type: text/css
expires: Tue, 18 Jun 2024 20:30:41 GMT

GET
H/1.1 200
OK LTWlogo.svg
libertythroughwealth.com/wp-content/uploads/2019/08/ 20 KB
20 KB 142ms
56ms Image
image/svg+xml 18.233.27.104
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://libertythroughwealth.com/wp-content/uploads/2019/08/LTWlogo.svg
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 18.233.27.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-233-27-104.compute-1.amazonaws.com
Software: nginx /
Resource Hash: d539ac631b4c533e6d77a8ba96acb173159ca2645c85c40ea308e91b7be92c6d

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://preferences.oxfordclub.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 18 Jun 2024 19:30:41 GMT
Last-Modified: Fri, 30 Aug 2019 19:59:22 GMT
Server: nginx
ETag: "5d69801a-5075"
Content-Type: image/svg+xml
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 20597

GET
H3 200 materialdesignicons-webfont.woff2
cdn.jsdelivr.net/npm/@mdi/font@2.0.46/fonts/ 107 KB
107 KB 42ms
21ms Font
font/woff2 151.101.65.229
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/@mdi/font@2.0.46/fonts/materialdesignicons-webfont.woff2?v=2.0.46

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/@mdi/font@2.0.46/css/materialdesignicons.min.css

Protocol

Security

QUIC, , AES_256_GCM

Server

151.101.65.229 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

4d60cf558c0cab6cfdd40aab9f02cdd6ea571eb5919057473d970e9af55064a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://cdn.jsdelivr.net/npm/@mdi/font@2.0.46/css/materialdesignicons.min.css
Origin: https://preferences.oxfordclub.com
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 18 Jun 2024 19:30:41 GMT
x-content-type-options: nosniff
age: 1529088
x-jsd-version: 2.0.46
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 109248
x-served-by: cache-fra-eddf8230104-FRA, cache-yyz4542-YYZ
x-jsd-version-type: version
etag: W/"1aac0-e/75XHcWyi3g6UUaeu6//ZePq6k"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 config.js Show response
c.lytics.io/api/experience/candidate/9c32784e3cc4888a693a7988ad64c63d/ 173 KB
12 KB 29ms
29ms Script
application/javascript 104.26.2.22
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.lytics.io/api/experience/candidate/9c32784e3cc4888a693a7988ad64c63d/config.js

Requested by

Host: c.lytics.io
URL: https://c.lytics.io/api/tag/9c32784e3cc4888a693a7988ad64c63d/latest.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.2.22 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

57099ead8bd931f94afb4eda417c2c020068a5ecdbde64a5efd6885a92589fd0

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000;

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://preferences.oxfordclub.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 18 Jun 2024 19:30:41 GMT
content-encoding: gzip
via: 1.1 google
strict-transport-security: max-age=63072000;
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3812
last-modified: Tue, 18 Jun 2024 18:27:09 GMT
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iYofayFkI6DhPcf3%2F1d1OECY%2BF5ImhWInq8ydpm2Nvc6Yz6jp4x9orXGkSXlw%2B3pDAN7BFSpe4RqWcrRn2NhXHP7Tu%2BhEx%2BW5btd2%2FQVaPgbPmqTOD1Obv%2FqTg4s"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=7200
x-lytics-trace: abde374e6853807e74d4ff1569442d74
cf-ray: 895db203aceb3981-YYZ

GET
H2 200 unity.gif Show response
api.getblueshift.com/ 42 B
237 B 280ms
95ms XHR
image/gif 52.32.152.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.getblueshift.com/unity.gif?t=1718739042&e=pageload&r=&z=600788&x=5475fa15fca6698857e67e2705849cfa&k=34296505-5429-4ac9-8f8c-1f89663f23c5&u=https%3A%2F%2Fpreferences.oxfordclub.com%2F%3Ftype%3Dstandardunsub%26list%3DLIBWEALT%252CLWDED%26pk%3D1b2c3d4fe10d2627c537aea7e72a986e%26utm_campaign%3DLW_Editorial_Welcome_%2528WIP%2529%26vid2%3D230bb62d688e1134df1075d438faeb10b28cae9bbe1cfae39f3a6f289f60c5bab28cd446edc1c401f2ec6461489691f8%26utm_medium%3Demail%26utm_source%3Dlibwealt%26bsft_clkid%3D5f83f764-6117-4c0b-a922-be87415e7865%26bsft_uid%3D909ebfd4-ed56-4e56-81c0-105a6d470eb1%26bsft_mid%3D479d1590-6040-46c0-8079-8dfd0388991a%26bsft_eid%3Df6326b75-6ed5-dfd7-1c4f-290990c739c4%26bsft_txnid%3D915323c1-ee88-4a60-882c-d81c6626d4f8%26bsft_utid%3D909ebfd4-ed56-4e56-81c0-105a6d470eb1-LIBWEALT%26bsft_mime_type%3Dhtml%26bsft_ek%3D2024-06-18T04%253A11%253A05Z%26bsft_aaid%3D143cca17-1a3d-4d28-8ba4-eaf7031e47d7%26bsft_lx%3D22%26bsft_tv%3D27
Requested by: Host: cdn.getblueshift.com
URL: https://cdn.getblueshift.com/blueshift.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.32.152.61 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-32-152-61.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://preferences.oxfordclub.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

access-control-allow-origin: https://preferences.oxfordclub.com
date: Tue, 18 Jun 2024 19:30:42 GMT
access-control-expose-headers: etag
content-length: 42
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type: image/gif

Verdicts & Comments Add Verdict or Comment

47 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

11 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.events-c.mb.libertythroughwealth.com/	1970-01-20 21:25:40	Name: __cf_bm Value: HZzsH8J4JMPuh3xap6vsVaAyTCtAfRPnszgTlVu.bQM-1718739040-1.0.1.1-5FLhkHt_4L1gDNUPLhWCPjWPH7Nd5.Qw6RO03D.vA.rdaKSKdi_3SnPj54WVRJkbEtydE_3I.zpssi9_BbXAHA
.preferences.oxfordclub.com/	1970-01-20 21:25:40	Name: seerses Value: e
.preferences.oxfordclub.com/	1970-01-21 07:01:39	Name: seerid Value: d9c98aba-58bd-4d60-9ae0-4b46bfc96fee
.lytics.io/	1970-01-21 07:01:39	Name: seerid Value: d9c98aba-58bd-4d60-9ae0-4b46bfc96fee
.oxfordclub.com/	1970-01-20 21:27:05	Name: _uetsid Value: 3faf5e202da911efbe27377f86b42a82
.oxfordclub.com/	1970-01-21 06:47:15	Name: _uetvid Value: 3faf7f802da911ef97d72ffdfaa3a521
.oxfordclub.com/	1970-01-21 07:01:39	Name: _ga Value: GA1.1.132027949.1718739041
.bing.com/	1970-01-21 06:47:15	Name: MUID Value: 12C447A91FDB62642249530B1EF16341
.bat.bing.com/	1970-01-20 21:35:43	Name: MR Value: 0
.oxfordclub.com/	1970-01-21 07:01:39	Name: _ga_15LG7SDTRV Value: GS1.1.1718739041.1.0.1718739041.0.0.0
.preferences.oxfordclub.com/	1970-01-21 06:11:15	Name: _bs Value: 34296505-5429-4ac9-8f8c-1f89663f23c5

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://preferences.oxfordclub.com/favicon.ico Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.getblueshift.com
bat.bing.com
c.lytics.io
cdn.getblueshift.com
cdn.jsdelivr.net
cdn.materialdesignicons.com
cdnjs.cloudflare.com
code.jquery.com
dhbhdrzi4tiry.cloudfront.net
dnzkifeab6.execute-api.us-east-1.amazonaws.com
events-c.mb.libertythroughwealth.com
libertythroughwealth.com
portrait-tracker.s3.amazonaws.com
preferences.oxfordclub.com
s3.amazonaws.com
storage.googleapis.com
trc.taboola.com
www.google-analytics.com
www.googletagmanager.com
104.17.25.14
104.17.30.85
104.26.2.22
13.107.21.237
13.32.151.71
142.251.16.97
151.101.65.229
151.101.65.44
151.101.66.137
16.182.32.225
172.67.73.236
173.194.205.207
18.154.227.63
18.160.37.92
18.233.27.104
185.93.1.244
209.85.144.100
52.217.112.136
52.32.152.61
54.231.199.25
08e7d98e767f185bdbdc70bc962d784292f1ba7a6d9230d2cd9a7a841112fa19
0d442120d2b60deb30df02e017358ba9e8057e57af2a52aadaceb08200dc5118
0d9762a1a60deef8aa093c473ad27c38eed77184d6940e7df06d89d77cbd3e94
0efd1a0f2f52ed3d1bbd90257616b1f3f057163e50e3ed7d36af06ffa10b7b06
13b0f68bd3d8bebfa3a0139811fdb61f62803b014f820e76a5b559ee5dc6136d
17017815c6b4b778260ac128c485fe3d63c4955a1835c65ee97055297a4cbb65
1f6e70fc4337b6769a4c498cf721491cb1f31a14e342cb9c584ccea00fee9d1b
2ddc26d93bd5d53e41509224875dd39e538f3d9ad5713ca258499a7e420bb851
335750c5de24e485b630b91393e74f41356a4f036496995742eebabc97a47165
464ad5d70f6d5fe4adef4d3057e1ae91e4983b02ef4ec9db0b067dcad4e53685
4d60cf558c0cab6cfdd40aab9f02cdd6ea571eb5919057473d970e9af55064a6
5296fd658bf4b22e17ffc1858a69dde914152de65fff220d426edface77fa816
57099ead8bd931f94afb4eda417c2c020068a5ecdbde64a5efd6885a92589fd0
5f4cf2ff2ac16dea81372c0b9dc29c58e3c175be3db4b858efcf07640ce0512c
63c5498e6b566cbdce24d58c797661ae67e8dfb2d75f3d5592017a881f9b1762
66f7a7b214eaf711a8e440c1d0d39361f8b1d640738de3244d8b6e6176c6c0c7
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
93615f69f836a060d08c4b3edd035a06e3526fa06e93bd73a506974e65babf91
9e0ba9b7b14aad4119d42336ac59c47758e24267decca899f7645558538d8ebc
a7e8ed2d7bbdbcaeeee81c3433f057d64a32c000112bbd09b5969fc658d0a655
a97c4e09767a155128f03c8a72efccc7d8e38e2e8e78daf14c8e5beaf72ff1a5
aebc793d0064383ee6b1625bf3bb32532ec30a5c12bf9117066107d412119123
b6035e4b2947cca7ff4542789ac625a59054bc6d55a74a1a3a10a5fb2b004991
b6682cab65d3243b5b75efb7279dbf49491957484780f2ba0a87632cc0e25642
ba62454b7a38b38285bd20c66c0aaced3d625e10646a12c209d57ea5af186eb7
d539ac631b4c533e6d77a8ba96acb173159ca2645c85c40ea308e91b7be92c6d
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eaa593bcfe485f4b5a8ac997cf9936604f9fbef91652db94a8e22b75d612bfc1
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f686cd944a0f51be36f8c8f9e4e228155057b4ebd3b141374a92e4e759efe1c7
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

preferences.oxfordclub.com Open in urlscan Pro 18.233.27.104 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

41 Requests

98 %HTTPS

0 %IPv6

15 Domains

19 Subdomains

18 IPs

2 Countries

1161 kBTransfer

2344 kBSize

11 Cookies

0 Outgoing links

Page URL History

Redirected requests

41 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

preferences.oxfordclub.com Open in urlscan Pro
18.233.27.104 Public Scan

Screenshot
Live screenshot

Full Image

41
Requests

98 %
HTTPS

0 %
IPv6

15
Domains

19
Subdomains

18
IPs

2
Countries

1161 kB
Transfer

2344 kB
Size

11
Cookies

41 HTTP transactions
0 data transactions