secure.winred.com Open in urlscan Pro
104.19.211.89 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://trk.cpro20.com/click/gmj1-8xjnk-c4u6e-ds22v97
Effective URL:
https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24
Submission: On March 05 via manual (March 5th 2024, 1:22:40 am UTC) from US — Scanned from CA

Summary HTTP 162 Redirects Links 9 Behaviour Indicators

Summary

This website contacted 31 IPs in 4 countries across 22 domains to perform 162 HTTP transactions. The main IP is 104.19.211.89, located in and belongs to CLOUDFLARENET, US. The main domain is secure.winred.com. The Cisco Umbrella rank of the primary domain is 78857.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on January 22nd 2024. Valid for: a year.

This is the only time secure.winred.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	3.97.124.126 3.97.124.126	16509 (AMAZON-02) (AMAZON-02)
1 14	104.19.211.89 104.19.211.89	13335 (CLOUDFLAR...) (CLOUDFLARENET)
43	52.85.151.31 52.85.151.31	16509 (AMAZON-02) (AMAZON-02)
4	172.253.62.95 172.253.62.95	15169 (GOOGLE) (GOOGLE)
4	3.161.213.13 3.161.213.13	16509 (AMAZON-02) (AMAZON-02)
2	172.253.122.132 172.253.122.132	15169 (GOOGLE) (GOOGLE)
7	142.251.16.97 142.251.16.97	15169 (GOOGLE) (GOOGLE)
1	104.16.56.101 104.16.56.101	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	172.253.62.139 172.253.62.139	15169 (GOOGLE) (GOOGLE)
1	104.19.212.89 104.19.212.89	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	172.253.115.92 172.253.115.92	15169 (GOOGLE) (GOOGLE)
1	146.75.28.157 146.75.28.157	54113 (FASTLY) (FASTLY)
2	31.13.66.19 31.13.66.19	32934 (FACEBOOK) (FACEBOOK)
1	172.98.56.41 172.98.56.41	399647 (RUMBLE) (RUMBLE)
3	104.16.250.69 104.16.250.69	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	172.253.122.155 172.253.122.155	15169 (GOOGLE) (GOOGLE)
2	54.192.51.79 54.192.51.79	16509 (AMAZON-02) (AMAZON-02)
4	172.253.122.99 172.253.122.99	15169 (GOOGLE) (GOOGLE)
8	142.251.16.94 142.251.16.94	15169 (GOOGLE) (GOOGLE)
8	142.251.163.102 142.251.163.102	15169 (GOOGLE) (GOOGLE)
1	104.244.42.5 104.244.42.5	13414 (TWITTER) (TWITTER)
1	104.244.42.195 104.244.42.195	13414 (TWITTER) (TWITTER)
1 2	172.253.63.149 172.253.63.149	15169 (GOOGLE) (GOOGLE)
3	142.251.163.155 142.251.163.155	15169 (GOOGLE) (GOOGLE)
2	198.137.150.81 198.137.150.81	16509 (AMAZON-02) (AMAZON-02)
15	54.186.23.98 54.186.23.98	16509 (AMAZON-02) (AMAZON-02)
1	163.70.128.35 163.70.128.35	32934 (FACEBOOK) (FACEBOOK)
4	172.253.115.94 172.253.115.94	15169 (GOOGLE) (GOOGLE)
3	44.237.70.166 44.237.70.166	16509 (AMAZON-02) (AMAZON-02)
6	142.251.163.100 142.251.163.100	15169 (GOOGLE) (GOOGLE)
3	3.161.213.60 3.161.213.60	16509 (AMAZON-02) (AMAZON-02)
6	104.19.219.90 104.19.219.90	13335 (CLOUDFLAR...) (CLOUDFLARENET)
162	31

1 3.97.124.126 (Montreal, Canada) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-97-124-126.ca-central-1.compute.amazonaws.com

trk.cpro20.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 104.19.211.89 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

secure.winred.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

43 52.85.151.31 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-151-31.iad89.r.cloudfront.net

js.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.253.62.95 (United States)

ASN15169 (GOOGLE, US)
PTR: bc-in-f95.1e100.net

maps.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 3.161.213.13 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-3-161-213-13.yul62.r.cloudfront.net

d35ligi1n5bgzc.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.253.122.132 (United States)

ASN15169 (GOOGLE, US)
PTR: bh-in-f132.1e100.net

lh7-us.googleusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 142.251.16.97 (Queens, United States)

ASN15169 (GOOGLE, US)
PTR: bl-in-f97.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.56.101 (None, )

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 172.253.62.139 (United States)

ASN15169 (GOOGLE, US)
PTR: bc-in-f139.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.19.212.89 (None, )

ASN13335 (CLOUDFLARENET, US)

app.winred.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.253.115.92 (United States)

ASN15169 (GOOGLE, US)
PTR: bg-in-f92.1e100.net

pay.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.75.28.157 (Ashburn, United States)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 31.13.66.19 (Ashburn, United States)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-01-iad3.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.98.56.41 (Canada)

ASN399647 (RUMBLE, CA)

a.ads.rmbl.ws	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.16.250.69 (None, )

ASN13335 (CLOUDFLARENET, US)

gtm.winred.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.253.122.155 (United States)

ASN15169 (GOOGLE, US)
PTR: bh-in-f155.1e100.net

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.192.51.79 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-54-192-51-79.yul62.r.cloudfront.net

m.stripe.network	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.253.122.99 (United States)

ASN15169 (GOOGLE, US)
PTR: bh-in-f99.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 142.251.16.94 (Queens, United States)

ASN15169 (GOOGLE, US)
PTR: bl-in-f94.1e100.net

www.google.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 142.251.163.102 (Farmingdale, United States)

ASN15169 (GOOGLE, US)
PTR: wv-in-f102.1e100.net

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
play.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.5 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.195 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.253.63.149 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: bi-in-f149.1e100.net

9381094.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.251.163.155 (Farmingdale, United States)

ASN15169 (GOOGLE, US)
PTR: wv-in-f155.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 198.137.150.81 (United States)

ASN16509 (AMAZON-02, US)

merchant-ui-api.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 54.186.23.98 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ip-54-186-23-98.stripe.com

r.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 163.70.128.35 (Saint-Denis, France)

ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-03-cdg4.facebook.com

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.253.115.94 (United States)

ASN15169 (GOOGLE, US)
PTR: bg-in-f94.1e100.net

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 44.237.70.166 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-44-237-70-166.us-west-2.compute.amazonaws.com

m.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.251.163.100 (Farmingdale, United States)

ASN15169 (GOOGLE, US)
PTR: wv-in-f100.1e100.net

play.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 3.161.213.60 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-3-161-213-60.yul62.r.cloudfront.net

b.stripecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 104.19.219.90 (None, )

ASN13335 (CLOUDFLARENET, US)

hcaptcha.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
newassets.hcaptcha.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
api2.hcaptcha.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
api.hcaptcha.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
63	stripe.com js.stripe.com — Cisco Umbrella Rank: 1155 merchant-ui-api.stripe.com — Cisco Umbrella Rank: 5082 r.stripe.com — Cisco Umbrella Rank: 2301 m.stripe.com — Cisco Umbrella Rank: 1134	2 MB
22	google.com pay.google.com — Cisco Umbrella Rank: 2753 www.google.com — Cisco Umbrella Rank: 2 analytics.google.com — Cisco Umbrella Rank: 148 adservice.google.com — Cisco Umbrella Rank: 92 play.google.com — Cisco Umbrella Rank: 33	423 KB
18	winred.com 1 redirects secure.winred.com — Cisco Umbrella Rank: 78857 app.winred.com — Cisco Umbrella Rank: 141672 gtm.winred.com — Cisco Umbrella Rank: 127398	217 KB
8	google.ca www.google.ca — Cisco Umbrella Rank: 9781	1 KB
8	doubleclick.net 1 redirects stats.g.doubleclick.net — Cisco Umbrella Rank: 84 9381094.fls.doubleclick.net — Cisco Umbrella Rank: 284883 googleads.g.doubleclick.net — Cisco Umbrella Rank: 35	5 KB
7	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 40	645 KB
6	hcaptcha.com hcaptcha.com — Cisco Umbrella Rank: 5514 newassets.hcaptcha.com — Cisco Umbrella Rank: 6729 api2.hcaptcha.com — Cisco Umbrella Rank: 14471 api.hcaptcha.com — Cisco Umbrella Rank: 6866	439 KB
5	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 29	21 KB
4	gstatic.com www.gstatic.com	102 KB
4	cloudfront.net d35ligi1n5bgzc.cloudfront.net	2 MB
4	googleapis.com maps.googleapis.com — Cisco Umbrella Rank: 374	187 KB
3	stripecdn.com b.stripecdn.com — Cisco Umbrella Rank: 11596	43 KB
2	stripe.network m.stripe.network — Cisco Umbrella Rank: 1243	16 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 180	71 KB
2	googleusercontent.com lh7-us.googleusercontent.com — Cisco Umbrella Rank: 608	201 KB
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 100	185 B
1	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 822	723 B
1	t.co t.co — Cisco Umbrella Rank: 674	377 B
1	rmbl.ws a.ads.rmbl.ws — Cisco Umbrella Rank: 51999	2 KB
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 775	15 KB
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 788	7 KB
1	cpro20.com 1 redirects trk.cpro20.com — Cisco Umbrella Rank: 390669	264 B
162	22

	Domain	Requested by
43	js.stripe.com	secure.winred.com js.stripe.com
15	r.stripe.com	js.stripe.com
14	secure.winred.com	1 redirects secure.winred.com static.cloudflareinsights.com
12	play.google.com	www.gstatic.com
8	www.google.ca	secure.winred.com
7	www.googletagmanager.com	secure.winred.com www.googletagmanager.com www.google-analytics.com
5	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com secure.winred.com
4	www.gstatic.com	pay.google.com www.gstatic.com
4	www.google.com	secure.winred.com
4	stats.g.doubleclick.net	www.google-analytics.com www.googletagmanager.com
4	d35ligi1n5bgzc.cloudfront.net	secure.winred.com
4	maps.googleapis.com	secure.winred.com maps.googleapis.com
3	newassets.hcaptcha.com	hcaptcha.com newassets.hcaptcha.com
3	b.stripecdn.com	js.stripe.com b.stripecdn.com
3	m.stripe.com	m.stripe.network
3	gtm.winred.com	www.googletagmanager.com
3	pay.google.com	js.stripe.com pay.google.com www.gstatic.com
2	merchant-ui-api.stripe.com	js.stripe.com
2	googleads.g.doubleclick.net	www.googletagmanager.com
2	9381094.fls.doubleclick.net	1 redirects www.googletagmanager.com
2	analytics.google.com	www.googletagmanager.com
2	m.stripe.network	js.stripe.com m.stripe.network
2	connect.facebook.net	secure.winred.com connect.facebook.net
2	lh7-us.googleusercontent.com	secure.winred.com
1	api.hcaptcha.com	newassets.hcaptcha.com
1	api2.hcaptcha.com	newassets.hcaptcha.com
1	hcaptcha.com	b.stripecdn.com
1	adservice.google.com	9381094.fls.doubleclick.net
1	www.facebook.com	secure.winred.com
1	analytics.twitter.com	secure.winred.com
1	t.co	secure.winred.com
1	a.ads.rmbl.ws	www.googletagmanager.com
1	static.ads-twitter.com	www.googletagmanager.com
1	app.winred.com	secure.winred.com
1	static.cloudflareinsights.com	secure.winred.com
1	trk.cpro20.com	1 redirects
162	36

This site contains links to these domains. Also see Links.

Domain
txtterms.co
winred.com
www.donaldjtrump.com
cdn.donaldjtrump.com
donaldjtrump.com

Subject Issuer	Validity	Valid
secure.winred.com Cloudflare Inc ECC CA-3	`2024-01-22` - `2024-12-31`	a year	crt.sh
a.stripecdn.com DigiCert SHA2 Extended Validation Server CA	`2024-02-07` - `2024-05-09`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2023-10-10` - `2024-09-19`	a year	crt.sh
*.googleusercontent.com GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-04-10` - `2024-04-09`	a year	crt.sh
*.google.com GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
ads-twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-21` - `2024-07-19`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-12-13` - `2024-03-12`	3 months	crt.sh
a.ads.rmbl.ws R3	`2024-02-14` - `2024-05-14`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
www.google.com GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
*.google.ca GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
t.co DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-01-04` - `2025-01-02`	a year	crt.sh
*.twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-11-07` - `2024-11-05`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
*.stripe.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2024-02-26` - `2024-05-23`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
m.stripe.com DigiCert TLS RSA SHA256 2020 CA1	`2024-02-26` - `2024-05-23`	3 months	crt.sh

This page contains 16 frames:

Primary Page: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24
Frame ID: F56FDEAB4E3316F9414984188D72EFDD
Requests: 68 HTTP requests in this frame

Frame: https://js.stripe.com/v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html
Frame ID: B3BA857EACF5EFC1E6BEAC1AD2CDA3A8
Requests: 2 HTTP requests in this frame

Frame: https://js.stripe.com/v3/controller-1b517d3dc8887d756b42ce62fc15d620.html
Frame ID: D6F4D56BD2360F5A19BE966787FE4303
Requests: 13 HTTP requests in this frame

Frame: https://js.stripe.com/v3/elements-inner-card-441445cbb512a63599ab0df61abfb641.html
Frame ID: BF6D91F41900B7FC0B6A446C2AAB133F
Requests: 10 HTTP requests in this frame

Frame: https://js.stripe.com/v3/controller-1b517d3dc8887d756b42ce62fc15d620.html
Frame ID: B0D7A520D484C20A47832BFCD11EA0FB
Requests: 13 HTTP requests in this frame

Frame: https://js.stripe.com/v3/payment-request-inner-google-pay-0ad4ab4836fd48b704f9836c381309d4.html
Frame ID: 35D735AACD0D8C47CDDB312E6B9EAC9C
Requests: 4 HTTP requests in this frame

Frame: https://js.stripe.com/v3/payment-request-inner-browser-bd09705d396c9abb97489a362b8310e0.html
Frame ID: FA3C142BE6B3614DEDD9C44B4011EE1B
Requests: 3 HTTP requests in this frame

Frame: https://secure.winred.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/a0d8959cb7d0/main.js
Frame ID: BD000A02010BD4707001DA66F44EFC41
Requests: 2 HTTP requests in this frame

Frame: https://m.stripe.network/inner.html
Frame ID: 0E4AC96944338C038C7A8FE3D97B049C
Requests: 5 HTTP requests in this frame

Frame: https://9381094.fls.doubleclick.net/activityi;dc_pre=CJGYjer624QDFfwX-QAdS7oJ0A;src=9381094;type=pagev0;cat=djt_p0;ord=7769649750614;npa=0;auiddc=1106069799.1709601753;pscdl=noapi;gtm=45fe42t1z872350723za201;gcd=13l3l3l3l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm%3Futm_term%3Dsv24
Frame ID: 74506074020BB6946E30F1A239969652
Requests: 2 HTTP requests in this frame

Frame: https://pay.google.com/gp/p/ui/payframe?origin=https%3A%2F%2Fjs.stripe.com&mid=
Frame ID: 0DCD8979C24F6260A940CBF3315784D6
Requests: 12 HTTP requests in this frame

Frame: https://js.stripe.com/v3/hcaptcha-invisible-1f6c59c3982eff179fc5d02d754852d5.html
Frame ID: 84FD9B87AA272B223EA079625A6FE887
Requests: 2 HTTP requests in this frame

Frame: https://js.stripe.com/v3/elements-inner-link-button-for-card-e4e1e1f3d4edcbb031e52c60566fe4f4.html
Frame ID: 1B0C2977B94D4E3A7A35A64183AF6E98
Requests: 4 HTTP requests in this frame

Frame: https://b.stripecdn.com/stripethirdparty-srv/assets/v20.20/HCaptchaInvisible.html?id=e9a85cc3-a52b-4f0b-b825-423d8233d94d&origin=https%3A%2F%2Fjs.stripe.com
Frame ID: D69846A21AAD6C5D83CA2499625BA12B
Requests: 4 HTTP requests in this frame

Frame: https://js.stripe.com/v3/elements-inner-payment-request-7cdcfcabc14b295d272b2a3834c63c39.html
Frame ID: 04F8ED60A7E502D848D317E1F4745A83
Requests: 7 HTTP requests in this frame

Frame: https://newassets.hcaptcha.com/captcha/v1/fadb9c6/static/hcaptcha.html?_v=4l6uwpy4knb
Frame ID: 8ED87B5C5D0772212BEBC15303303A3D
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

MAGA

Page URL History Show full URLs

https://trk.cpro20.com/click/gmj1-8xjnk-c4u6e-ds22v97 HTTP 302
https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Page URL

Detected technologies

Google Maps (Maps) Expand

Overall confidence: 100%
Detected patterns

//maps\.google(?:apis)?\.com/maps/api/js

Google Pay (Payment processors) Expand

Overall confidence: 100%
Detected patterns

pay\.google\.com/([a-z/]+)/pay\.js

Stripe (Payment Processors) Expand

Overall confidence: 100%
Detected patterns

js\.stripe\.com

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/ns\.html[^>]+></iframe>
googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

hCaptcha (Security) Expand

Overall confidence: 100%
Detected patterns

https://hcaptcha.com/([\d]+?)/api.js

Page Statistics

162
Requests

99 %
HTTPS

0 %
IPv6

22
Domains

36
Subdomains

31
IPs

4
Countries

6390 kB
Transfer

16840 kB
Size

33
Cookies

9 Outgoing links

These are links going to different origins than the main page.

URL: https://txtterms.co/88022-2/
Title: txtterms.co/88022

Search URL Search Domain Scan URL

URL: https://winred.com/terms/donor-terms/
Title: terms of use

Search URL Search Domain Scan URL

URL: https://winred.com/privacy
Title: privacy policy

Search URL Search Domain Scan URL

URL: https://www.donaldjtrump.com/join
Title: Interested in volunteering? Click here to sign up today.

Search URL Search Domain Scan URL

URL: https://cdn.donaldjtrump.com/djtweb24/general/TSA_JFC_Contributor_Form_230217.pdf
Title: Want to donate by mail? Click here to print out a donation form that you can send to our address.

Search URL Search Domain Scan URL

URL: http://donaldjtrump.com/
Title: donaldjtrump.com

Search URL Search Domain Scan URL

URL: https://winred.com/
Title: Powered by

Search URL Search Domain Scan URL

URL: https://winred.com/about-our-ads/
Title: About Our Ads

Search URL Search Domain Scan URL

URL: https://winred.com/support/
Title: Questions about your charge? Go to our Support Center

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://trk.cpro20.com/click/gmj1-8xjnk-c4u6e-ds22v97 HTTP 302
https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 30

https://secure.winred.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
https://secure.winred.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/a0d8959cb7d0/main.js

Request Chain 73

https://9381094.fls.doubleclick.net/activityi;src=9381094;type=pagev0;cat=djt_p0;ord=7769649750614;npa=0;auiddc=1106069799.1709601753;pscdl=noapi;gtm=45fe42t1z872350723za201;gcd=13l3l3l3l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm%3Futm_term%3Dsv24 HTTP 302
https://9381094.fls.doubleclick.net/activityi;dc_pre=CJGYjer624QDFfwX-QAdS7oJ0A;src=9381094;type=pagev0;cat=djt_p0;ord=7769649750614;npa=0;auiddc=1106069799.1709601753;pscdl=noapi;gtm=45fe42t1z872350723za201;gcd=13l3l3l3l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm%3Futm_term%3Dsv24

162 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request lp-email-quit-tuesday-bm Show response
secure.winred.com/save-america-joint-fundraising-committee/
Redirect Chain

https://trk.cpro20.com/click/gmj1-8xjnk-c4u6e-ds22v97
https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24

70 KB
17 KB

192ms
138ms

Document
text/html

104.19.211.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.211.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3637616b969f382f9b9533caba50ca0359df5a357d13a6c501d871badb1fa869

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache, no-store
cf-cache-status: DYNAMIC
cf-ray: 85f64ba9ccee53e9-YYZ
content-encoding: br
content-security-policy-report-only: script-src 'none'; connect-src 'none'; report-uri https://csp-reporting.cloudflare.com/cdn-cgi/script_monitor/report?m=SrWrs76FmExGrNZCbiBfpD_aH6gnuy6S51eqle9ImyY-1709601752-1.0.1.1-w_IpW7DNP5kKu3rYS1mYDbeed0hN_xXobHvtQ2z2YDl4ZZJdI9xuoOI7w2iWmMvIOTOk0Pn5nIk5lcYylF.FQo63htjWq7EvZlZTZTXF61z3KjXA69fHmYhP.EO1LK8Zk5E7SzffLA.lVpGJIrYtNSNJ7_q2Wie3LSXFGrLwwMI; report-to cf-csp-endpoint
content-type: text/html; charset=utf-8
date: Tue, 05 Mar 2024 01:22:32 GMT
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/csp-reporting.cloudflare.com\/cdn-cgi\/script_monitor\/report?m=SrWrs76FmExGrNZCbiBfpD_aH6gnuy6S51eqle9ImyY-1709601752-1.0.1.1-w_IpW7DNP5kKu3rYS1mYDbeed0hN_xXobHvtQ2z2YDl4ZZJdI9xuoOI7w2iWmMvIOTOk0Pn5nIk5lcYylF.FQo63htjWq7EvZlZTZTXF61z3KjXA69fHmYhP.EO1LK8Zk5E7SzffLA.lVpGJIrYtNSNJ7_q2Wie3LSXFGrLwwMI"}],"group":"cf-csp-endpoint","max_age":86400}
server: cloudflare
strict-transport-security: max-age=0; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-rack-cors: miss; no-origin
x-request-id: 238615e3-ce0d-4aa3-9c18-3fbad494e23a
x-revv-cache: Hit from Revv
x-runtime: 0.043523
x-xss-protection: 1; mode=block

Redirect headers

cache-control: private
content-length: 222
content-type: text/html; charset=utf-8
date: Tue, 05 Mar 2024 01:22:32 GMT
location: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24
refresh: 0; URL=https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24
server: cmp-trk-s1-01

GET
H2 200 / Show response
js.stripe.com/v3/ 603 KB
148 KB 183ms
49ms Script
text/javascript 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

0030f5a99c7993b12e2fabfd97fc80fca835db69e270cb872bfa8e8821af3d82

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:21:55 GMT
content-encoding: br
via: 1.1 47c0295005ec7d8570406951491004c2.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 40
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Mon, 04 Mar 2024 21:47:21 GMT
server: Cloudfront
etag: W/"68bcc669e847f4536a08e4ba24b5a206"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
timing-allow-origin: *
x-amz-cf-id: BkOhCJHgJRYBfnkhmFRB-YGYOTftuIf91P6HN0L1WJMIe9gakCOPFw==

GET
H2 200 landing_page-b5085350195c50801834c19cd56b1cabc8b9ea2b81e3a74f8486f6b3e2ae2898.css
secure.winred.com/assets/ 219 KB
34 KB 48ms
46ms Stylesheet
text/css 104.19.211.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/assets/landing_page-b5085350195c50801834c19cd56b1cabc8b9ea2b81e3a74f8486f6b3e2ae2898.css

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.211.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

961951e588ed2cbd0dadda321becf5c4d27451bb0896262f86e7d922da5794ca

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:22:32 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
x-amz-version-id: VXwylmd67a2TVXI0SDz2TzW_HEfq_T6n
cf-cache-status: HIT
x-amz-request-id: 9SMAHFM0XYKS7EKT
age: 6071
cf-polished: origSize=227667
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-amz-id-2: A8RCwZ9RopAV2jJaPC/LNAbdCTCV0rfiNTUpxQndC6w2xSBTZNHLo8lpVk19QOFx1u5q47vHftk=
cf-bgj: minify
last-modified: Fri, 23 Feb 2024 02:52:51 GMT
server: cloudflare
etag: W/"57df3b6cebff9962c43c29347b45123f"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
cf-ray: 85f64baacf1553e9-YYZ
expires: Tue, 05 Mar 2024 05:22:32 GMT

GET
H2 200 1709531012.css
secure.winred.com/stylesheets/rv_page_01hr3zrzm75ssesdfsbybbd0zh/ 8 KB
2 KB 131ms
129ms Stylesheet
text/css 104.19.211.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/stylesheets/rv_page_01hr3zrzm75ssesdfsbybbd0zh/1709531012.css

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.211.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4ff20e86436e2a88288ec278caab0ad0d32b279426bed6c101e5a97b8d9349e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

x-rack-cors: miss; no-origin
date: Tue, 05 Mar 2024 01:22:32 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: MISS
content-encoding: br
x-permitted-cross-domain-policies: none
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
x-request-id: f5dec828-09da-4a03-868a-62c92c902f07
x-runtime: 0.049416
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 05 Mar 2024 01:22:32 GMT
server: cloudflare
x-download-options: noopen
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
cache-control: public, max-age=31556952
cf-ray: 85f64baacf1853e9-YYZ
expires: Wed, 05 Mar 2025 07:11:44 GMT

GET
H2 200 js Show response
maps.googleapis.com/maps/api/ 231 KB
76 KB 139ms
65ms Script
text/javascript 172.253.62.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f95.1e100.net

Software

scaffolding on HTTPServer2 /

Resource Hash

a5caff2ac88482537395bf5cb6f74a309086645d160f73b5dad867f44c2d782c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:22:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Accept-Language, Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77015
x-xss-protection: 0

GET
H2 200 application-landing-page-e23d78f5dae749bd70067ba6d3bdf2e924c8866792d4dc2d5570569787a0c676.js Show response
secure.winred.com/assets/ 488 KB
137 KB 63ms
61ms Script
application/javascript 104.19.211.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/assets/application-landing-page-e23d78f5dae749bd70067ba6d3bdf2e924c8866792d4dc2d5570569787a0c676.js

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.211.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ff3bcb4b6ff50975328f38e8553353ce3c0a5bf93a578f9c4d6affc81870c349

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:22:32 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
x-amz-version-id: 3bK8BvucZTRAbTuPs1lO1vzovxv1fn3N
cf-cache-status: HIT
x-amz-request-id: YMFAHSWDSFHBEHHG
age: 3159
cf-polished: origSize=499824
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 3PM26+YUbgsbTWDM4K5i7hPWt6AqE0atmk1pRxXxwE3NVzPItCv6KvVe+TmEQ93lrKBkinKIf/c=
cf-bgj: minify
last-modified: Tue, 05 Mar 2024 00:21:32 GMT
server: cloudflare
etag: W/"9aa57484c8a794fd69956b30a12bc89c"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 85f64baacf1b53e9-YYZ
expires: Tue, 05 Mar 2024 05:22:32 GMT

GET
H2 200 TRUMP_LOGO_-_WHITE_BOX_%281%29.png
d35ligi1n5bgzc.cloudfront.net/logos/logo_assets/000/826/035/large/ 165 KB
165 KB 101ms
29ms Image
image/png 3.161.213.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d35ligi1n5bgzc.cloudfront.net/logos/logo_assets/000/826/035/large/TRUMP_LOGO_-_WHITE_BOX_%281%29.png
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.213.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-213-13.yul62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c3c2125ebaeb07268bbc110c5f11486686b0d1b756115142dfbfc855cf82ba43

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 18:19:08 GMT
x-amz-version-id: yfwN.ggIOaUC6AxHonrapfZVYuxzZd13
via: 1.1 95a3dd023df73736e8ea01cca5036ec0.cloudfront.net (CloudFront)
last-modified: Wed, 10 Jan 2024 18:25:23 GMT
server: AmazonS3
x-amz-cf-pop: YUL62-P1
age: 25405
etag: "75ce68862b7b84a971e6026ca747a8ba"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 168824
x-amz-cf-id: WYI0XQyCoMK8xwE9n0L9b83iVXqJMDmDj35H5p7qH3gKJAUHFXvVPA==

GET
H2 200 bEVmiBAlrMNHqy8pYp6es3R_SGCX0rOh-5MJKw3B6i_L2qlob_wNs8XJaFAhpwwow-ZcPq_qlxb3kEhHRc7wAE1HvyVsoEbb_cj0vm5_mmxCKnsijw0yeSIk30aoo1k6PLKAXCZRaO4oYjE4luuo8qE
lh7-us.googleusercontent.com/ 5 KB
5 KB 113ms
36ms Image
image/png 172.253.122.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh7-us.googleusercontent.com/bEVmiBAlrMNHqy8pYp6es3R_SGCX0rOh-5MJKw3B6i_L2qlob_wNs8XJaFAhpwwow-ZcPq_qlxb3kEhHRc7wAE1HvyVsoEbb_cj0vm5_mmxCKnsijw0yeSIk30aoo1k6PLKAXCZRaO4oYjE4luuo8qE

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f132.1e100.net

Software

fife /

Resource Hash

ce483bd57a7d0576c16db84df9cf92b4d94a2c8472f3254dbd2a759704d0fbfd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 23:40:36 GMT
x-content-type-options: nosniff
age: 6116
content-disposition: inline;filename="_QW1zW-kTCSjbaqIOpuRy5VMvh61fpZv212Q1YCWeOexOYKps9CRhiAxX9Kvvq-lIdKhd_eQcyu6vBuNlCq3u2RFxweb4FxaKIYDq3EaTHdLU2IPQQ2fCV-KVJygrIgkrOcUZ9htsl6GD76yV3Xaut4.png"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5209
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Tue, 05 Mar 2024 23:40:36 GMT

GET
H2 200 XNEQX8J3Hn1Tc1Cekdz69bCfdrh2IUfxO-n_jmYRPw8m0XbfQ8U6r2gs40xCYHpHYIOjHO8UXt1tM0880iBH-lhkpJf_WnI6GRQGSpgV6uggayE25ukLzK4C9WilKq3YZYdrC00FjrewTGXWDIAtoEo
lh7-us.googleusercontent.com/ 195 KB
195 KB 37ms
36ms Image
image/png 172.253.122.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh7-us.googleusercontent.com/XNEQX8J3Hn1Tc1Cekdz69bCfdrh2IUfxO-n_jmYRPw8m0XbfQ8U6r2gs40xCYHpHYIOjHO8UXt1tM0880iBH-lhkpJf_WnI6GRQGSpgV6uggayE25ukLzK4C9WilKq3YZYdrC00FjrewTGXWDIAtoEo

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f132.1e100.net

Software

fife /

Resource Hash

b94b05ccc912f4deadb7dffd20326ce301931340c02efcb1e2a80fb55c59c6c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 23:40:36 GMT
x-content-type-options: nosniff
age: 6116
content-disposition: inline;filename="DJT_YourRetribution_MMS.png"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 199926
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Tue, 05 Mar 2024 23:40:36 GMT

GET
H2 200 potus_headshot.png
d35ligi1n5bgzc.cloudfront.net/profiles/images/000/068/512/square/ 22 KB
22 KB 25ms
24ms Image
image/png 3.161.213.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d35ligi1n5bgzc.cloudfront.net/profiles/images/000/068/512/square/potus_headshot.png
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.213.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-213-13.yul62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4ec0827f796bdadb833f52dd7ea841e12158d9f488554ecb73479cc2ea6f6d8e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 12:44:25 GMT
x-amz-version-id: 6HYtNhcBxi6F_uJ2AY87Rc_xOq3TeHoz
via: 1.1 95a3dd023df73736e8ea01cca5036ec0.cloudfront.net (CloudFront)
last-modified: Sat, 17 Jul 2021 20:11:51 GMT
server: AmazonS3
x-amz-cf-pop: YUL62-P1
age: 45488
etag: "e595f679c10699fedef3c779e864cdd9"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 22449
x-amz-cf-id: lTjbiSR4x2JfeazRgZ3yPYpJ42G87Qv8T-vRJPRjIcm7pLfjf4r2HQ==

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 459 KB
102 KB 146ms
74ms Script
application/javascript 142.251.16.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.97 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

43dc73ea4dfba9e39db345005a2d920a8808219d3e876bfafc8e34be7e350789

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:22:33 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 104312
x-xss-protection: 0
last-modified: Tue, 05 Mar 2024 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 05 Mar 2024 01:22:33 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 317 KB
106 KB 90ms
89ms Script
application/javascript 142.251.16.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.97 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

7d1f2a826dcf495f9a4929b456e5deb283c67867f262bddcd352c273ac4ebb8e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:22:33 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 108696
x-xss-protection: 0
last-modified: Tue, 05 Mar 2024 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 05 Mar 2024 01:22:33 GMT

GET
H3 200 win-red-mark-small-24c5e97a925e2a929cae4a87ecdfcdf27f56974fd8172bdd34af91145aebca91.png
secure.winred.com/assets/ 9 KB
9 KB 64ms
64ms Image
image/webp 104.19.211.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.winred.com/assets/win-red-mark-small-24c5e97a925e2a929cae4a87ecdfcdf27f56974fd8172bdd34af91145aebca91.png

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.211.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

36f0bf882a876b13aeb20cf7a495421a43f336da5422072a58f58ce303fb6284

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:22:32 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
x-amz-version-id: vDixGhlpa5KjCGcmvMpc5mEiU1LWC.jh
cf-cache-status: HIT
x-amz-request-id: DFEXV9Q8DBE1V6XD
age: 5655
cf-polished: origFmt=png, origSize=11635
content-disposition: inline; filename="win-red-mark-small-24c5e97a925e2a929cae4a87ecdfcdf27f56974fd8172bdd34af91145aebca91.webp"
alt-svc: h3=":443"; ma=86400
content-length: 8708
x-amz-id-2: /utr+stE4FdRw+PVz7XYryOE3qOwrajsuCK2dxDSp1UImhlebSlsbkuZz6p4p55MgJh4Qcezuss=
cf-bgj: imgq:85,h2pri
last-modified: Fri, 23 Feb 2024 02:52:53 GMT
server: cloudflare
etag: "972c0cca8d1e490484e89513f902e847"
vary: Accept
content-type: image/webp
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 85f64babd8623a08-YYZ
expires: Tue, 05 Mar 2024 05:22:32 GMT

GET
H3 200 win-red-full-red-5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848.svg
secure.winred.com/assets/ 19 KB
7 KB 52ms
51ms Image
image/svg+xml 104.19.211.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.winred.com/assets/win-red-full-red-5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848.svg

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.211.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:22:33 GMT
x-amz-version-id: h6JYfO46CxPHIVbhCFXhjqzuvgXn2_Zk
x-content-type-options: nosniff
strict-transport-security: max-age=0; includeSubDomains
cf-cache-status: HIT
x-amz-request-id: SYVKE6PZK8XW4XXW
age: 2876
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-amz-id-2: 6d0AIzqvzmxAqdSUCxk5MS6Iawf0Lp68gsmQE1nKUEwzbZJlWIz3hbyCiPgBrknm5prKcil1JXc=
last-modified: Fri, 23 Feb 2024 02:52:53 GMT
server: cloudflare
etag: W/"d31530d4186af669daf4f47099614593"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=14400
cf-ray: 85f64bacfa973a08-YYZ
expires: Tue, 05 Mar 2024 05:22:33 GMT

GET
H2 200 v84a3a4012de94ce1a686ba8c167c359c1696973893317 Show response
static.cloudflareinsights.com/beacon.min.js/ 20 KB
7 KB 126ms
88ms Script
text/javascript 104.16.56.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/v84a3a4012de94ce1a686ba8c167c359c1696973893317
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.56.101 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101

Request headers

Referer: https://secure.winred.com/
Origin: https://secure.winred.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:22:33 GMT
content-encoding: gzip
last-modified: Tue, 10 Oct 2023 21:38:13 GMT
server: cloudflare
etag: W/"2023.10.0"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 85f64bad3d393a0a-YYZ

GET
H3 200 DJT-BACKGROUND_%281%29.png
d35ligi1n5bgzc.cloudfront.net/backgrounds/images/000/870/605/large/ 2 MB
2 MB 27ms
27ms Image
image/png 3.161.213.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d35ligi1n5bgzc.cloudfront.net/backgrounds/images/000/870/605/large/DJT-BACKGROUND_%281%29.png
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/stylesheets/rv_page_01hr3zrzm75ssesdfsbybbd0zh/1709531012.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 3.161.213.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-213-13.yul62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d6169b910866f67ee0e3cdf2915e3e3c90082569f63b0d263bc15642ccd559f3

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 02:11:47 GMT
x-amz-version-id: faOxPNzSF.GG0scG7vrE_xPG4_C1xXpX
via: 1.1 fbdc01f132101cb05310363b09502a86.cloudfront.net (CloudFront)
last-modified: Tue, 27 Feb 2024 16:34:49 GMT
server: AmazonS3
age: 83447
x-amz-cf-pop: YUL62-P1
etag: "1df9beee66a3e8a5d7b7c6a40f61222a"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 2083487
x-amz-cf-id: 6_1NIeFTYJh5IUZLOz27nOcKzz35rpDp5jyMdbiqLMQ9ABGFOrK0zQ==

GET
H3 200 icon-dropdown-background-52b35865280d33e30f9708871085b8db6862e75bc159d6e8e3cd77af6c36bdde.png
secure.winred.com/assets/ 290 B
817 B 43ms
43ms Image
image/webp 104.19.211.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.winred.com/assets/icon-dropdown-background-52b35865280d33e30f9708871085b8db6862e75bc159d6e8e3cd77af6c36bdde.png

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/assets/landing_page-b5085350195c50801834c19cd56b1cabc8b9ea2b81e3a74f8486f6b3e2ae2898.css

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.211.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

96b04ef160f8b50520a48707a452fecdd6e6771c643706d5949020a2dea15962

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/assets/landing_page-b5085350195c50801834c19cd56b1cabc8b9ea2b81e3a74f8486f6b3e2ae2898.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:22:33 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
x-amz-version-id: fRPbt7Ftewe5B.sQa5Oo22FZwwQFISug
cf-cache-status: HIT
x-amz-request-id: Z5XHQ4WEYN2PTN01
age: 4554
cf-polished: origFmt=png, origSize=560
content-disposition: inline; filename="icon-dropdown-background-52b35865280d33e30f9708871085b8db6862e75bc159d6e8e3cd77af6c36bdde.webp"
alt-svc: h3=":443"; ma=86400
content-length: 290
x-amz-id-2: ++83OeTcasHygyszl137UOasAmAubsgZVfqOJBKer3MWtiwEaj3vHoeHZ8Cr5gh5zFBjjMaBMos=
cf-bgj: imgq:85,h2pri
last-modified: Fri, 23 Feb 2024 02:52:50 GMT
server: cloudflare
etag: "571ee659b7ee9af9291e7dd8176721d5"
vary: Accept
content-type: image/webp
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 85f64bad0aa93a08-YYZ
expires: Tue, 05 Mar 2024 05:22:33 GMT

GET
H3 200 gen_204 Show response
maps.googleapis.com/maps/api/mapsjs/ 3 B
45 B 130ms
59ms XHR
application/json 172.253.62.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.62.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f95.1e100.net

Software

scaffolding on HTTPServer2 /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:22:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://secure.winred.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23
x-xss-protection: 0

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 266 KB
91 KB 68ms
66ms Script
application/javascript 142.251.16.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.97 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

77bcc02eadd368e485122deaa80ceb3ee5f7f0b9fa967e4dcde4049d0e3a0301

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:22:33 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 92882
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 05 Mar 2024 01:22:33 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 113ms
37ms Script
text/javascript 172.253.62.139
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.139 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f139.1e100.net

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 05 Mar 2024 00:56:04 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 1589
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Tue, 05 Mar 2024 02:56:04 GMT

GET
H2 200 m-outer-3437aaddcdf6922d623e172c2d6f9278.html Show response
js.stripe.com/v3/ Frame B3BA 200 B
1 KB 37ms
36ms Document
text/html 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

35dcc382eb69d00369d708708cdc545f3968b68fa5bbe3e728d11fedd04f93bb

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 1996
cache-control: max-age=31536000
content-length: 200
content-security-policy: base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-security-policy-report-only: base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Tue, 05 Mar 2024 00:49:18 GMT
etag: "3437aaddcdf6922d623e172c2d6f9278"
last-modified: Fri, 01 Mar 2024 22:43:32 GMT
server: Cloudfront
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 47c0295005ec7d8570406951491004c2.cloudfront.net (CloudFront)
x-amz-cf-id: fPeZuPmFWPfQQsy5CN2k0fVjN3ysRNJmu5fS6ECJC_pg-j89GdlPOQ==
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
x-content-type-options: nosniff

GET
H2 200 controller-1b517d3dc8887d756b42ce62fc15d620.html Show response
js.stripe.com/v3/ Frame D6F4 297 B
1 KB 40ms
39ms Document
text/html 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/controller-1b517d3dc8887d756b42ce62fc15d620.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

04dd08cd5be76d0779ac2b77f734115d0fa01d5b6f14db00adca5433bdf30065

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://api.stripe.com https://merchant-ui-api.stripe.com https://stripe.com/cookie-settings/enforcement-mode https://errors.stripe.com https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src 'self'; img-src 'self' https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'sha256-0hAheEzaMe6uXIKV4EehS9pu1am1lj/KnnzrOYqckXk='; worker-src 'none'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 53
cache-control: max-age=60, stale-while-revalidate=900
content-length: 297
content-security-policy: base-uri 'none'; connect-src 'self' https://api.stripe.com https://merchant-ui-api.stripe.com https://stripe.com/cookie-settings/enforcement-mode https://errors.stripe.com https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src 'self'; img-src 'self' https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'sha256-0hAheEzaMe6uXIKV4EehS9pu1am1lj/KnnzrOYqckXk='; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Tue, 05 Mar 2024 01:21:41 GMT
etag: "1b517d3dc8887d756b42ce62fc15d620"
last-modified: Mon, 04 Mar 2024 21:05:23 GMT
server: Cloudfront
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 47c0295005ec7d8570406951491004c2.cloudfront.net (CloudFront)
x-amz-cf-id: 5_df8KEY-VQHGQCAfO0dV9jLh2moZnOb0nJXXdpP9SDm36brV7ttFA==
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
x-content-type-options: nosniff

GET
H2 200 elements-inner-card-441445cbb512a63599ab0df61abfb641.html Show response
js.stripe.com/v3/ Frame BF6D 798 B
2 KB 37ms
37ms Document
text/html 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/elements-inner-card-441445cbb512a63599ab0df61abfb641.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

73526c7c8cb533a80c1437cfcaa300b2a8775da0bb4541fc2ce20da10d48df33

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://ppm.stripe.com; default-src 'self'; font-src data: https:; form-action 'none'; frame-src 'self' https://www.affirm.com https://checkout.link.com https://b.stripecdn.com; img-src 'self' https://q.stripe.com https://b.stripecdn.com https://js.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 744
cache-control: max-age=31536000
content-length: 798
content-security-policy: base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://ppm.stripe.com; default-src 'self'; font-src data: https:; form-action 'none'; frame-src 'self' https://www.affirm.com https://checkout.link.com https://b.stripecdn.com; img-src 'self' https://q.stripe.com https://b.stripecdn.com https://js.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-security-policy-report-only: base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://ppm.stripe.com; default-src 'self'; font-src data: https:; form-action 'none'; frame-src 'self' https://www.affirm.com https://checkout.link.com https://b.stripecdn.com; img-src 'self' https://q.stripe.com https://b.stripecdn.com https://js.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Tue, 05 Mar 2024 01:10:16 GMT
etag: "441445cbb512a63599ab0df61abfb641"
last-modified: Mon, 04 Mar 2024 21:05:23 GMT
server: Cloudfront
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 47c0295005ec7d8570406951491004c2.cloudfront.net (CloudFront)
x-amz-cf-id: nSQrTIvk59H7vdBZaiAnpiRofONKrBZb6DtSV4QwZ8t5LmLnqifqDw==
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
x-content-type-options: nosniff

GET
H2 200 current_with_info Show response
app.winred.com/api/v3/users/ 162 B
1 KB 216ms
165ms XHR
application/vnd.api+json 104.19.212.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.winred.com/api/v3/users/current_with_info?organization_token=rv_org_6KNvU36Z2qWJ2gfUBWqGZGoc&redirect=https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/assets/application-landing-page-e23d78f5dae749bd70067ba6d3bdf2e924c8866792d4dc2d5570569787a0c676.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.212.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

97955476b5df2d77cfc51a2a498e46cc559ed1822f69c999c7fc9fb7b5689953

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://secure.winred.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

x-rack-cors-original-access-control-allow-origin: https://secure.winred.com
x-rack-cors: hit
date: Tue, 05 Mar 2024 01:22:33 GMT
x-rack-cors-original-access-control-max-age: 0
x-rack-cors-original-access-control-allow-credentials: true
strict-transport-security: max-age=0; includeSubDomains
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
content-encoding: br
x-rack-cors-original-access-control-allow-methods: GET, POST, OPTIONS
x-rack-cors-original-access-control-expose-headers
alt-svc: h3=":443"; ma=86400
x-request-id: af5a4543-5be6-4064-beba-fe783cbad989
x-runtime: 0.010050
server: cloudflare
etag: W/"97955476b5df2d77cfc51a2a498e46cc"
access-control-max-age: 0
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/vnd.api+json
access-control-allow-origin: https://secure.winred.com
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
vary: Origin
cf-ray: 85f64baeb90039cc-YYZ

GET
H3 200 rv_page_01hr3zrzm75ssesdfsbybbd0zh-9fcbb6d04685cd54fcf661b9e48369bba4ec6bb1 Show response
secure.winred.com/api/v3/donations/live/ 461 B
530 B 85ms
84ms XHR
application/json 104.19.211.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/api/v3/donations/live/rv_page_01hr3zrzm75ssesdfsbybbd0zh-9fcbb6d04685cd54fcf661b9e48369bba4ec6bb1?stream_id=afb27b30ac04af833b868fca9abb1065f2d554d9&_=1709601753079

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/assets/application-landing-page-e23d78f5dae749bd70067ba6d3bdf2e924c8866792d4dc2d5570569787a0c676.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.211.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bb234fbf380336f7d3007a7c8fb0b793db61e871f1d65e8e1bc65b134cb0ec58

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24
X-CSRF-Token: lVfKlJdjcRX25AV5GyNJYHWbPWnh1YT4og3e85IjQBg35zpXo4Sl53OG60gpvxS21FpqpT02+buWffpvZhApkg==
X-Requested-With: XMLHttpRequest
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

x-rack-cors: miss; no-origin
date: Tue, 05 Mar 2024 01:22:33 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: MISS
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-request-id: dfaa2a73-d1b3-4ae2-ad38-3db1333c29be
x-runtime: 0.009107
server: cloudflare
etag: W/"bb234fbf380336f7d3007a7c8fb0b793"
vary: Origin, Accept-Encoding
content-type: application/json
cache-control: public, max-age=60
cf-ray: 85f64bae6ccb3a08-YYZ
expires: Tue, 05 Mar 2024 01:23:33 GMT

GET
H3 200 rv_page_01hr3zrzm75ssesdfsbybbd0zh-4f7c82f70c55d32a024862ed129dea43d5423022 Show response
secure.winred.com/api/v3/donations/live/ 466 B
512 B 85ms
84ms XHR
application/json 104.19.211.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/api/v3/donations/live/rv_page_01hr3zrzm75ssesdfsbybbd0zh-4f7c82f70c55d32a024862ed129dea43d5423022?stream_id=b6419ff9c5e4708ebb53061c35169ffbe13c3cbc&_=1709601753080

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/assets/application-landing-page-e23d78f5dae749bd70067ba6d3bdf2e924c8866792d4dc2d5570569787a0c676.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.211.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

56a172a3f51e1de1ba63e706b074a691934e794f6531e25bed71df6e60ec84a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24
X-CSRF-Token: lVfKlJdjcRX25AV5GyNJYHWbPWnh1YT4og3e85IjQBg35zpXo4Sl53OG60gpvxS21FpqpT02+buWffpvZhApkg==
X-Requested-With: XMLHttpRequest
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

x-rack-cors: miss; no-origin
date: Tue, 05 Mar 2024 01:22:33 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: MISS
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-request-id: 8d9082c0-5474-4973-9a45-79a314fd7cca
x-runtime: 0.010214
server: cloudflare
etag: W/"56a172a3f51e1de1ba63e706b074a691"
vary: Origin, Accept-Encoding
content-type: application/json
cache-control: public, max-age=60
cf-ray: 85f64bae6ccc3a08-YYZ
expires: Tue, 05 Mar 2024 01:23:33 GMT

GET
H2 200 controller-1b517d3dc8887d756b42ce62fc15d620.html Show response
js.stripe.com/v3/ Frame B0D7 297 B
1 KB 36ms
36ms Document
text/html 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/controller-1b517d3dc8887d756b42ce62fc15d620.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

04dd08cd5be76d0779ac2b77f734115d0fa01d5b6f14db00adca5433bdf30065

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://api.stripe.com https://merchant-ui-api.stripe.com https://stripe.com/cookie-settings/enforcement-mode https://errors.stripe.com https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src 'self'; img-src 'self' https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'sha256-0hAheEzaMe6uXIKV4EehS9pu1am1lj/KnnzrOYqckXk='; worker-src 'none'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 53
cache-control: max-age=60, stale-while-revalidate=900
content-length: 297
content-security-policy: base-uri 'none'; connect-src 'self' https://api.stripe.com https://merchant-ui-api.stripe.com https://stripe.com/cookie-settings/enforcement-mode https://errors.stripe.com https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src 'self'; img-src 'self' https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'sha256-0hAheEzaMe6uXIKV4EehS9pu1am1lj/KnnzrOYqckXk='; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Tue, 05 Mar 2024 01:21:41 GMT
etag: "1b517d3dc8887d756b42ce62fc15d620"
last-modified: Mon, 04 Mar 2024 21:05:23 GMT
server: Cloudfront
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 47c0295005ec7d8570406951491004c2.cloudfront.net (CloudFront)
x-amz-cf-id: goqgwRPhb4OMw76gT-Ndtp_zR2zA9raCxZejijBABkK7eHweOLaGWg==
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
x-content-type-options: nosniff

GET
H2 200 payment-request-inner-google-pay-0ad4ab4836fd48b704f9836c381309d4.html Show response
js.stripe.com/v3/ Frame 35D7 408 B
1 KB 39ms
39ms Document
text/html 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/payment-request-inner-google-pay-0ad4ab4836fd48b704f9836c381309d4.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

375cd0866100903ea8dd941ab323f78564bfc406a6055c729d8c14b284f1ca5e

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://r.stripe.com https://google.com/pay https://www.google.com/pay https://pay.google.com; default-src 'none'; form-action 'none'; frame-src https://pay.google.com; img-src https://q.stripe.com https://www.gstatic.com; script-src 'self' https://pay.google.com; style-src 'self'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 193
cache-control: max-age=31536000
content-length: 408
content-security-policy: base-uri 'none'; connect-src 'self' https://r.stripe.com https://google.com/pay https://www.google.com/pay https://pay.google.com; default-src 'none'; form-action 'none'; frame-src https://pay.google.com; img-src https://q.stripe.com https://www.gstatic.com; script-src 'self' https://pay.google.com; style-src 'self'; report-uri https://q.stripe.com/csp-report
content-security-policy-report-only: base-uri 'none'; connect-src 'self' https://r.stripe.com https://google.com/pay https://www.google.com/pay https://pay.google.com; default-src 'none'; form-action 'none'; frame-src https://pay.google.com; img-src https://q.stripe.com https://www.gstatic.com; script-src 'self' https://pay.google.com; style-src 'self'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Tue, 05 Mar 2024 01:19:38 GMT
etag: "0ad4ab4836fd48b704f9836c381309d4"
last-modified: Mon, 04 Mar 2024 21:05:38 GMT
server: Cloudfront
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 47c0295005ec7d8570406951491004c2.cloudfront.net (CloudFront)
x-amz-cf-id: u9v_8F6KCuYtXAbD5o660F9yMTiheG_wDVudPw8Yx6othYoMe6JKCQ==
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
x-content-type-options: nosniff

GET
H2 200 payment-request-inner-browser-bd09705d396c9abb97489a362b8310e0.html Show response
js.stripe.com/v3/ Frame FA3C 344 B
2 KB 38ms
38ms Document
text/html 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/payment-request-inner-browser-bd09705d396c9abb97489a362b8310e0.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

f86da5e9aacdcab57c6381b2053c36e9ef22ffe815d128b1a80083dbda3f480d

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://google.com/pay https://www.google.com/pay https://pay.google.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src 'self'; img-src 'self' https://q.stripe.com https://www.gstatic.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 37
cache-control: max-age=60, stale-while-revalidate=900
content-length: 344
content-security-policy: base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://google.com/pay https://www.google.com/pay https://pay.google.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src 'self'; img-src 'self' https://q.stripe.com https://www.gstatic.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-security-policy-report-only: base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://google.com/pay https://www.google.com/pay https://pay.google.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src 'self'; img-src 'self' https://q.stripe.com https://www.gstatic.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Tue, 05 Mar 2024 01:21:56 GMT
etag: "bd09705d396c9abb97489a362b8310e0"
last-modified: Mon, 04 Mar 2024 21:05:38 GMT
server: Cloudfront
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 47c0295005ec7d8570406951491004c2.cloudfront.net (CloudFront)
x-amz-cf-id: fci3HRsFEOTv1M41uVvmKoLSvkWIK9CmIPnRBotkBXVk_dsEgP5DVg==
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
x-content-type-options: nosniff

GET
H3 200 DJT-USFLAG.png
d35ligi1n5bgzc.cloudfront.net/widget_images/images/000/853/672/small_square/ 5 KB
5 KB 26ms
26ms Image
image/png 3.161.213.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d35ligi1n5bgzc.cloudfront.net/widget_images/images/000/853/672/small_square/DJT-USFLAG.png
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 3.161.213.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-213-13.yul62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 03ff26aeebf7456b7511420741d9058e4966ab8525a27bb212aa10604f1b550e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

x-amz-version-id: i7c0KUoS2JwTP679YgHcOaA9X3_2yeiC
date: Mon, 04 Mar 2024 15:10:22 GMT
via: 1.1 fbdc01f132101cb05310363b09502a86.cloudfront.net (CloudFront)
last-modified: Fri, 09 Feb 2024 15:03:38 GMT
server: AmazonS3
age: 36732
x-amz-cf-pop: YUL62-P1
x-amz-server-side-encryption: AES256
etag: "cdd07b6117b5bead9e9206e276f82805"
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 4622
x-amz-cf-id: 1pEjsqAwPXyUKEXSv3epDbEOAhAYq21qYl2vVPEuOYjtaUMo5fJldg==

GET
H3 200 statistics Show response
secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm/forms/ 1 KB
1 KB 339ms
338ms XHR
text/html 104.19.211.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm/forms/statistics

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.211.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b34677f777d8a73eb410a7679891d9a72ef425d7c474b8993d14284a83399e27

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24
X-CSRF-Token: lVfKlJdjcRX25AV5GyNJYHWbPWnh1YT4og3e85IjQBg35zpXo4Sl53OG60gpvxS21FpqpT02+buWffpvZhApkg==
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

x-rack-cors: miss; no-origin
date: Tue, 05 Mar 2024 01:22:33 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-permitted-cross-domain-policies: none
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
x-request-id: 458d39b4-8709-4ce7-98a9-62532838df36
x-runtime: 0.268066
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
x-download-options: noopen
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/html; charset=utf-8
cache-control: max-age=0, private, must-revalidate
cf-ray: 85f64bae9d133a08-YYZ

GET
H3

200

main.js Show response
secure.winred.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/a0d8959cb7d0/ Frame BD00
Redirect Chain

https://secure.winred.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://secure.winred.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/a0d8959cb7d0/main.js

8 KB
4 KB

38ms
38ms

Script
application/javascript

104.19.211.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/a0d8959cb7d0/main.js

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24

Protocol

Server

104.19.211.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

de0725f3840e27ed1defac8f5faa6a8a9dea9b7790a39e17534fbaf8e011a3e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:22:33 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
content-encoding: br
server: cloudflare
vary: accept-encoding
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
cf-ray: 85f64baf2df93a08-YYZ
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Tue, 05 Mar 2024 01:22:33 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
server: cloudflare
vary: accept-encoding
access-control-allow-origin: *
location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/a0d8959cb7d0/main.js
cache-control: max-age=300, public
cf-ray: 85f64baead2d3a08-YYZ
alt-svc: h3=":443"; ma=86400

GET
H2 200 m-outer-15a2b40a058ddff1cffdb63779fe3de1.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame B3BA 526 B
1 KB 37ms
37ms Script
text/javascript 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/m-outer-15a2b40a058ddff1cffdb63779fe3de1.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

ba2338aa6670580269c762f51c4291daef913201aa8f4d4fd166c1a878262652

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 00:49:19 GMT
via: 1.1 47c0295005ec7d8570406951491004c2.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=31556926; includeSubDomains; preload
age: 1995
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
content-length: 526
last-modified: Fri, 01 Mar 2024 22:43:31 GMT
server: Cloudfront
etag: "d96c709017743c0759cf3853d1806ba5"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: SLNpNws-EMbPPDnZ5EhkLWkxhHtJJN5WEQ8AamE_aN6Pm88eDjp-QQ==

GET
H2 200 shared-ef74aa054e59fdac81b538dfec92a050.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame D6F4 537 KB
117 KB 56ms
56ms Script
text/javascript 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-ef74aa054e59fdac81b538dfec92a050.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/controller-1b517d3dc8887d756b42ce62fc15d620.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

39dfb37816eab2a94aa07e46af7d0523d11a47ca1f7d21544570e3c409fa0586

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/controller-1b517d3dc8887d756b42ce62fc15d620.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:09:34 GMT
content-encoding: br
via: 1.1 47c0295005ec7d8570406951491004c2.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 780
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Mon, 04 Mar 2024 21:05:37 GMT
server: Cloudfront
etag: W/"d49550815942227dc97b7500620f7224"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: wbsjVW7MXCyTCwhq4HUmXeUFr0EM4FJOGlN75zVaLvVY9jWlEcD9Wg==

GET
H2 200 controller-04d5ca8de94b7905dcf997a15299c7fc.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame D6F4 699 KB
182 KB 41ms
41ms Script
text/javascript 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/controller-04d5ca8de94b7905dcf997a15299c7fc.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/controller-1b517d3dc8887d756b42ce62fc15d620.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

2977f53d6b12e6f52f665d17184d9d978ea0fcc0409cfad267cc1ac88b337543

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/controller-1b517d3dc8887d756b42ce62fc15d620.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:09:34 GMT
content-encoding: gzip
via: 1.1 47c0295005ec7d8570406951491004c2.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 780
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Mon, 04 Mar 2024 21:05:34 GMT
server: Cloudfront
etag: W/"f10c423591daea093ee5530eda913c19"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: tDLll-zpg7lxyNV5HZkSte3Wk0tElEqKBfFlcXpRGNyli4yKyWbkUQ==

GET
H2 200 shared-ef74aa054e59fdac81b538dfec92a050.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame BF6D 537 KB
117 KB 74ms
73ms Script
text/javascript 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-ef74aa054e59fdac81b538dfec92a050.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-card-441445cbb512a63599ab0df61abfb641.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

39dfb37816eab2a94aa07e46af7d0523d11a47ca1f7d21544570e3c409fa0586

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-card-441445cbb512a63599ab0df61abfb641.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:09:34 GMT
content-encoding: br
via: 1.1 47c0295005ec7d8570406951491004c2.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 780
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Mon, 04 Mar 2024 21:05:37 GMT
server: Cloudfront
etag: W/"d49550815942227dc97b7500620f7224"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: yW6ePn8dG5AYjX64m3q6vbdaLy_E09iNukC9NbBz8tQ1Uo32SWBsgw==

GET
H2 200 ui-shared-1bf6ace40c8ba59385d7846cb107d9c6.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame BF6D 414 KB
107 KB 63ms
63ms Script
text/javascript 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/ui-shared-1bf6ace40c8ba59385d7846cb107d9c6.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-card-441445cbb512a63599ab0df61abfb641.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

9ff1964bffc8efed18dfd92699b69a974e6f354348b0743c31a6784384eb7c3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-card-441445cbb512a63599ab0df61abfb641.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:10:18 GMT
content-encoding: br
via: 1.1 47c0295005ec7d8570406951491004c2.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 770
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Mon, 04 Mar 2024 21:05:37 GMT
server: Cloudfront
etag: W/"1a73e2c92e7625b5ccbedca19583ed45"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: bzMiDSoY8eUK8H6WmP_BFkN_x_n_7iIsnDQDJQG-3Pbgd6jSW_ORNQ==

GET
H2 200 elements-inner-card-026c2480c57711722e470dc9a369461a.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame BF6D 55 KB
14 KB 39ms
39ms Script
text/javascript 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/elements-inner-card-026c2480c57711722e470dc9a369461a.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-card-441445cbb512a63599ab0df61abfb641.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

f3a531a933d649e125e1a79d2e43c7f48f71aaf457d2847c1c8efea16e3cc23c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-card-441445cbb512a63599ab0df61abfb641.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:09:32 GMT
content-encoding: br
via: 1.1 47c0295005ec7d8570406951491004c2.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 781
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Mon, 04 Mar 2024 18:06:15 GMT
server: Cloudfront
etag: W/"f7df0c4fdb403694dab0d43ab79ed837"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: eD4xDcRj2Q-b2M78XaoQJUUVQYVfr0l_yjBDOjYbcC0SgvLEKEhOrA==

GET
H2 200 ui-shared-1d27f4e2b314637ba4bb9d7ff79c23c7.css
js.stripe.com/v3/fingerprinted/css/ Frame BF6D 20 KB
4 KB 62ms
61ms Stylesheet
text/css 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/css/ui-shared-1d27f4e2b314637ba4bb9d7ff79c23c7.css

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-card-441445cbb512a63599ab0df61abfb641.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

394724ca0118829643c12fb5a033cb66680e51327ba157677d18dec209278a3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-card-441445cbb512a63599ab0df61abfb641.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 00:23:40 GMT
content-encoding: gzip
via: 1.1 47c0295005ec7d8570406951491004c2.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 3541
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Fri, 01 Mar 2024 22:43:18 GMT
server: Cloudfront
etag: W/"b361d7109e9925ca18e32c9da528520f"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: XSHXjczOxqGgYzaPuZ06IfnO5Kz0v50pVZmDgdtQUDuB7v8ntEwBeQ==

GET
H2 200 elements-inner-card-53aa57bec7f6d40d72327654fd43a92e.css
js.stripe.com/v3/fingerprinted/css/ Frame BF6D 14 KB
2 KB 62ms
62ms Stylesheet
text/css 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/css/elements-inner-card-53aa57bec7f6d40d72327654fd43a92e.css

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-card-441445cbb512a63599ab0df61abfb641.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

eac1bb2890c6ae6d2cc8653765f594f1209eda9eb0036eef9fde51299e883a5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-card-441445cbb512a63599ab0df61abfb641.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:14:53 GMT
content-encoding: br
via: 1.1 47c0295005ec7d8570406951491004c2.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 461
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Wed, 28 Feb 2024 22:56:36 GMT
server: Cloudfront
etag: W/"87bf0041cf7ae5e77d770c423e25828a"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: KzK6Pr8lS73AGBU5pORGt4EUrNbnOASXTUyhvkYpud6hW685ZbmkWw==

GET
H2 200 shared-ef74aa054e59fdac81b538dfec92a050.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame B0D7 537 KB
117 KB 69ms
68ms Script
text/javascript 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-ef74aa054e59fdac81b538dfec92a050.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/controller-1b517d3dc8887d756b42ce62fc15d620.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

39dfb37816eab2a94aa07e46af7d0523d11a47ca1f7d21544570e3c409fa0586

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/controller-1b517d3dc8887d756b42ce62fc15d620.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:09:34 GMT
content-encoding: br
via: 1.1 47c0295005ec7d8570406951491004c2.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 780
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Mon, 04 Mar 2024 21:05:37 GMT
server: Cloudfront
etag: W/"d49550815942227dc97b7500620f7224"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: fsshkhTCTL8vgrUjzBMwi-uUKJSTWEHYpMgpSuH5JhyZOs7GSSGigA==

GET
H2 200 controller-04d5ca8de94b7905dcf997a15299c7fc.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame B0D7 699 KB
182 KB 76ms
76ms Script
text/javascript 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/controller-04d5ca8de94b7905dcf997a15299c7fc.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/controller-1b517d3dc8887d756b42ce62fc15d620.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

2977f53d6b12e6f52f665d17184d9d978ea0fcc0409cfad267cc1ac88b337543

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/controller-1b517d3dc8887d756b42ce62fc15d620.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:09:34 GMT
content-encoding: gzip
via: 1.1 47c0295005ec7d8570406951491004c2.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 780
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Mon, 04 Mar 2024 21:05:34 GMT
server: Cloudfront
etag: W/"f10c423591daea093ee5530eda913c19"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: m4OfcuZuLSFoJ5Z1_6GyqRXgkJt1Kj7aFmSK2IaVSjM_aTCZB5QN4g==

GET
H2 200 pay.js Show response
pay.google.com/gp/p/js/ Frame 35D7 118 KB
36 KB 142ms
68ms Script
application/javascript 172.253.115.92
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pay.google.com/gp/p/js/pay.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/payment-request-inner-google-pay-0ad4ab4836fd48b704f9836c381309d4.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.92 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f92.1e100.net

Software

ESF /

Resource Hash

67a60e8d0877049f837dff6121f5db7d5799af3ee03bf0f8b77dd491904c5c52

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendHttp/cspreport, script-src 'report-sample' 'nonce-L5tQvbMD5HjioWcV29b-fw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendHttp/cspreport/allowlist
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:22:33 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
content-security-policy: require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendHttp/cspreport, script-src 'report-sample' 'nonce-L5tQvbMD5HjioWcV29b-fw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendHttp/cspreport/allowlist
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/gp/p/_/InstantbuyFrontendHttp/web-reports?context=eJzjKtHikmLw1pBiWFYqxVBRK8WwZKYUg2fNTabOPTeZ1nU9YlrY_pRJk-sZU33UM6aZvM-Z4k48ZxJ885zp3ZeXTBxfXzJJALEaEO_w8WAR85nOejh6OivfuumsKkCsuX46ayAQO6XPYA0AYp_6GaxRQCzEw3Hz-cz1bAIrGs9PZAIA3qYzGA"
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: private, max-age=600
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Tue, 05 Mar 2024 01:22:33 GMT

GET
H2 200 shared-ef74aa054e59fdac81b538dfec92a050.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 35D7 537 KB
117 KB 63ms
63ms Script
text/javascript 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-ef74aa054e59fdac81b538dfec92a050.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/payment-request-inner-google-pay-0ad4ab4836fd48b704f9836c381309d4.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

39dfb37816eab2a94aa07e46af7d0523d11a47ca1f7d21544570e3c409fa0586

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/payment-request-inner-google-pay-0ad4ab4836fd48b704f9836c381309d4.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:09:34 GMT
content-encoding: br
via: 1.1 47c0295005ec7d8570406951491004c2.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 780
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Mon, 04 Mar 2024 21:05:37 GMT
server: Cloudfront
etag: W/"d49550815942227dc97b7500620f7224"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: sKarmonc6kckazS64CZu-v7DHRLZn6-d2wiM12aWF4Rdxp5-sw_DIA==

GET
H2 200 payment-request-inner-google-pay-c83e5fd7cbd25a878b3ffc70ebb53333.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 35D7 12 KB
5 KB 37ms
37ms Script
text/javascript 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/payment-request-inner-google-pay-c83e5fd7cbd25a878b3ffc70ebb53333.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/payment-request-inner-google-pay-0ad4ab4836fd48b704f9836c381309d4.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

06e9cfa1e2fb5b8269f55ebb7dc5ced06737bc1e3faec047ca535265a9d7ac85

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/payment-request-inner-google-pay-0ad4ab4836fd48b704f9836c381309d4.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 00:52:20 GMT
content-encoding: br
via: 1.1 47c0295005ec7d8570406951491004c2.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 1829
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Fri, 01 Mar 2024 22:43:31 GMT
server: Cloudfront
etag: W/"7946a1d9a17729b6659d22b18a313c0e"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: mvN7Gp5oKRNVnS1FQE9p7_gXsWFP1LGC5tYhWyZaMnqx-QznJLNMaw==

GET
H2 200 shared-ef74aa054e59fdac81b538dfec92a050.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame FA3C 537 KB
117 KB 66ms
66ms Script
text/javascript 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-ef74aa054e59fdac81b538dfec92a050.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/payment-request-inner-browser-bd09705d396c9abb97489a362b8310e0.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

39dfb37816eab2a94aa07e46af7d0523d11a47ca1f7d21544570e3c409fa0586

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/payment-request-inner-browser-bd09705d396c9abb97489a362b8310e0.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:09:34 GMT
content-encoding: br
via: 1.1 47c0295005ec7d8570406951491004c2.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 780
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Mon, 04 Mar 2024 21:05:37 GMT
server: Cloudfront
etag: W/"d49550815942227dc97b7500620f7224"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: p2oLNWcKJ7H6cHCa21tqWubHYBW3HSjvWbNXAOeA2xboTiojDzsmWw==

GET
H2 200 payment-request-inner-browser-792795e2c4e2210721d96228540c4e06.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame FA3C 13 KB
6 KB 65ms
65ms Script
text/javascript 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/payment-request-inner-browser-792795e2c4e2210721d96228540c4e06.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/payment-request-inner-browser-bd09705d396c9abb97489a362b8310e0.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

fedfc64728beee4dcdf576abb2dd3c44b462afc3b5db8c53704629a1ee6dd14c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/payment-request-inner-browser-bd09705d396c9abb97489a362b8310e0.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 00:29:36 GMT
content-encoding: br
via: 1.1 47c0295005ec7d8570406951491004c2.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 3219
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Fri, 01 Mar 2024 22:43:31 GMT
server: Cloudfront
etag: W/"32dba56f50e599b5cc53a055305f8c45"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: YpY827zTyyLfVV1kwgz1iNtQUyvmgAd-YC4kil2vyMS2KIXrt0VNiA==

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 318 KB
106 KB 67ms
67ms Script
application/javascript 142.251.16.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-0YWKLMCX4D&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.97 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

2b675ec61017240815a048dad88bdaf046107e39953416dca182976a05fda6cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:22:33 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 108058
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 05 Mar 2024 01:22:33 GMT

GET
H3 200 destination Show response
www.googletagmanager.com/gtag/ 190 KB
69 KB 90ms
89ms Script
application/javascript 142.251.16.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=DC-9381094&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.97 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

3a0979ec055c654b6cd4128f9e85c09b5c9af08bd4d1d893c20940c1f262b41b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:22:33 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 71052
x-xss-protection: 0
last-modified: Tue, 05 Mar 2024 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 05 Mar 2024 01:22:33 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 125ms
50ms Script
application/javascript 146.75.28.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.75.28.157 Ashburn, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:22:33 GMT
content-encoding: gzip
last-modified: Thu, 27 Oct 2022 15:55:14 GMT
etag: "32ad004436155ec972bc50e6238b5b67+gzip"
vary: Accept-Encoding,Host
x-cache: HIT
content-type: application/javascript; charset=utf-8
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn: FT
cache-control: no-cache
accept-ranges: bytes
content-length: 15375
x-served-by: cache-iad-kiad7000116-IAD

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 215 KB
58 KB 108ms
36ms Script
application/x-javascript 31.13.66.19
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

31.13.66.19 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-iad3.fbcdn.net

Software

Resource Hash

50b6e67cfcfe4ac8fe9cee705b681f696065306ee42bcd4e6b37a17dba333ac5

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

permissions-policy-report-only: clipboard-read=(), clipboard-write=(), picture-in-picture=();report-to="permissions_policy"
content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Tue, 05 Mar 2024 01:22:33 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 57348
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
pragma: public
x-fb-debug: 3/hOLQV7WXzVca2NWn6grymNKjyJZNIRKU61aVlmTzWg6Leyp0Dz7wMs1yQBulwdnZnEFjAt9syJ/WdmqZAT3w==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 ratag Show response
a.ads.rmbl.ws/ 3 KB
2 KB 63ms
16ms Script
application/javascript 172.98.56.41
RUMBLE

General

Check archive.org

Show headers Download Go to

Full URL: https://a.ads.rmbl.ws/ratag?id=AV-6622
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.98.56.41 , Canada, ASN399647 (RUMBLE, CA),
Reverse DNS
Software: nginx /
Resource Hash: 13d21037700a2badd96b9537ae21bcc71720f629b20a8c637c3c891b16600047

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:22:33 GMT
content-encoding: gzip
server: nginx
etag: W/"788ed2f782eb45b57dff78c742214a69"
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=900
access-control-allow-credentials: true

GET
H2 200 collect Show response
gtm.winred.com/g/ 731 B
980 B 231ms
184ms XHR
text/plain 104.16.250.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gtm.winred.com/g/collect?v=2&tid=G-X6H0114PDF&gtm=45je42t1v867905447z872410129za200&_p=1709601752789&gcd=13l3l3l3l1&npa=0&dma=0&cid=2069319955.1709601754&ul=en-us&sr=1600x1200&_fplc=0&ur=CA-ON&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&sst.uc=CA&sst.gse=1&sst.etld=google.ca&sst.gcd=13l3l3l3l1&sst.tft=1709601752789&_s=1&sid=1709601753&sct=1&seg=0&dl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm%3Futm_term%3Dsv24&dt=MAGA&en=page_view&_fv=1&_nsi=1&_ss=1&ep.pagepath=%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm&ep.pagehostname=secure.winred.com&ep.parsedurl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm&epn.load_time_sec=-1709601752.4&epn.event_fire_time=1709601753253&ep.event_uuid=748f46f3-42e6-4f57-b01c-528041b55ba0&ep.isVideoPage=f&ep.referrer=&tfd=1137&richsstsse

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.250.69 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc5741d4569f7588ca2837839345c9dec5ff5adcdbbd2743c4d9a159e90ed2cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:22:33 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
server: cloudflare
strict-transport-security: max-age=0; includeSubDomains
vary: Accept-Encoding
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 85f64bafff3b3a08-YYZ
alt-svc: h3=":443"; ma=86400

POST
H2 200 collect Show response
www.google-analytics.com/j/ 3 B
209 B 45ms
45ms XHR
text/plain 172.253.62.139
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=563779294&t=pageview&_s=1&dl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm%3Futm_term%3Dsv24&ul=en-us&de=UTF-8&dt=MAGA&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YCDAiEABBAAAACAEK~&jid=1061310776&gjid=1644107758&cid=2069319955.1709601754&tid=UA-73658561-7&_gid=970251179.1709601754&_slc=1&gtm=45He42t1n71NTQZ9Nv72410129za220&cd61=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm%3Futm_term%3Dsv24&gcd=13l3l3l3l1&dma=0&z=2011960288

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.139 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f139.1e100.net

Software

Golfe2 /

Resource Hash

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 01:22:33 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
350 B 114ms
43ms XHR
text/plain 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-73658561-7&cid=2069319955.1709601754&jid=1061310776&gjid=1644107758&_gid=970251179.1709601754&_u=YCDAiEABBAAAAGAEK~&z=1967322199

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f155.1e100.net

Software

Golfe2 /

Resource Hash

8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Tue, 05 Mar 2024 01:22:33 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 16 B
84 B 44ms
44ms XHR
text/plain 172.253.62.139
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=563779294&t=pageview&_s=1&dl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm%3Futm_term%3Dsv24&ul=en-us&de=UTF-8&dt=MAGA&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YCDACEABBAAAAGAEK~&jid=1446788077&gjid=89362190&cid=2069319955.1709601754&tid=UA-60901920-1&_gid=970251179.1709601754&_r=1&_slc=1&gtm=45He42t1n71M27JCGv72350723za220&gcd=13l3l3l3l1&dma=0&z=428061092

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.139 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f139.1e100.net

Software

Golfe2 /

Resource Hash

641defe78e044cbd72e13110f131016fc26c1e8b00ef29ad142e177a0e54bfe1

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 01:22:33 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
132 B 37ms
37ms Image
image/gif 172.253.62.139
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=563779294&t=event&ni=0&_s=1&dl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm%3Futm_term%3Dsv24&ul=en-us&de=UTF-8&dt=MAGA&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=donation%20landing%20page&ea=user%20session%20start&el=landing%20page%20settings&_u=YCDAiEABBAAAAGAEK~&jid=&gjid=&cid=2069319955.1709601754&tid=UA-73658561-7&_gid=970251179.1709601754&gtm=45He42t1n71NTQZ9Nv72410129za220&cd41=anonymous&cd58=t&cd61=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm%3Futm_term%3Dsv24&gcd=13l3l3l3l1&dma=0&z=504398294

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.139 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f139.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Mar 2024 09:05:15 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 58638
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 inner.html Show response
m.stripe.network/ Frame 0E4A 930 B
2 KB 126ms
27ms Document
text/html 54.192.51.79
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.network/inner.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/m-outer-15a2b40a058ddff1cffdb63779fe3de1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.51.79 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-51-79.yul62.r.cloudfront.net

Software

Cloudfront /

Resource Hash

947ac0903521f5eceefc90637c066306a8ca67466ccc188bb0107fb7cfb532d1

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src https://m.stripe.network https://m.stripe.com; default-src 'none'; font-src https://m.stripe.network https://fonts.gstatic.com; form-action 'none'; frame-src https://m.stripe.network https://js.stripe.com; img-src https://m.stripe.network https://m.stripe.com https://b.stripecdn.com; script-src https://m.stripe.network 'sha256-/5Guo2nzv5n/w6ukZpOBZOtTJBJPSkJ6mhHpnBgm3Ls='; style-src https://m.stripe.network; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 293
cache-control: max-age=300, public
content-length: 930
content-security-policy: base-uri 'none'; connect-src https://m.stripe.network https://m.stripe.com; default-src 'none'; font-src https://m.stripe.network https://fonts.gstatic.com; form-action 'none'; frame-src https://m.stripe.network https://js.stripe.com; img-src https://m.stripe.network https://m.stripe.com https://b.stripecdn.com; script-src https://m.stripe.network 'sha256-/5Guo2nzv5n/w6ukZpOBZOtTJBJPSkJ6mhHpnBgm3Ls='; style-src https://m.stripe.network; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Tue, 05 Mar 2024 01:17:42 GMT
etag: "06bfcd88af438673a8bf9b845a11aa6e"
last-modified: Fri, 30 Jun 2023 14:32:28 GMT
server: Cloudfront
strict-transport-security: max-age=31556926; includeSubDomains; preload
vary: Accept-Encoding, Origin
via: 1.1 0012c469abc357ca0c936faaf17aa31a.cloudfront.net (CloudFront)
x-amz-cf-id: eBT0j-grCU33_lYWBFwmQzVcND8AMJoR2j6K71da9E4_j3wQ_RkhnQ==
x-amz-cf-pop: YUL62-C2
x-cache: Hit from cloudfront
x-content-type-options: nosniff

POST
H3 200 85f64ba9ccee53e9 Show response
secure.winred.com/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame BD00 0
342 B 62ms
61ms XHR
text/plain 104.19.211.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/cdn-cgi/challenge-platform/h/g/jsd/r/85f64ba9ccee53e9

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/cdn-cgi/challenge-platform/scripts/jsd/main.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.211.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 05 Mar 2024 01:22:33 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
content-encoding: br
server: cloudflare
content-type: text/plain; charset=UTF-8
cf-ray: 85f64bb0f95c3a08-YYZ
alt-svc: h3=":443"; ma=86400

GET
H2 200 .deploy_status_henson.json Show response
js.stripe.com/v3/ Frame D6F4 474 B
917 B 107ms
37ms Fetch
application/json 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/.deploy_status_henson.json

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-ef74aa054e59fdac81b538dfec92a050.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

5e155e1f89e5ca084a3510deea330a8ca019b906bc61469408830959033ce71f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/v3/controller-1b517d3dc8887d756b42ce62fc15d620.html
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Tue, 05 Mar 2024 01:21:42 GMT
via: 1.1 077b94dab77b8114aebf503be197d7d8.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
age: 53
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
content-length: 474
last-modified: Mon, 04 Mar 2024 21:49:34 GMT
server: Cloudfront
etag: "741c7a42906bbd9aa745c3aea07bcd08"
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=60
accept-ranges: bytes
x-amz-cf-id: eX3scalQEkKf0or6wKZFqB8unuiitI6EqRHSXtKlEVMvDBt32QSbhw==

GET
H2 200 .deploy_status_henson.json Show response
js.stripe.com/v3/ Frame D6F4 474 B
916 B 95ms
37ms Fetch
application/json 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/.deploy_status_henson.json

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-ef74aa054e59fdac81b538dfec92a050.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

5e155e1f89e5ca084a3510deea330a8ca019b906bc61469408830959033ce71f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/v3/controller-1b517d3dc8887d756b42ce62fc15d620.html
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Tue, 05 Mar 2024 01:21:42 GMT
via: 1.1 077b94dab77b8114aebf503be197d7d8.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
age: 53
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
content-length: 474
last-modified: Mon, 04 Mar 2024 21:49:34 GMT
server: Cloudfront
etag: "741c7a42906bbd9aa745c3aea07bcd08"
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=60
accept-ranges: bytes
x-amz-cf-id: MYdQwQLiU9Fo3WbtBD_-NIwwmWvRbH9zKwsgQc8Wmsv2NFUirLG3Jg==

GET
H2 200 .deploy_status_henson.json Show response
js.stripe.com/v3/ Frame BF6D 474 B
916 B 62ms
38ms Fetch
application/json 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/.deploy_status_henson.json

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-ef74aa054e59fdac81b538dfec92a050.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

5e155e1f89e5ca084a3510deea330a8ca019b906bc61469408830959033ce71f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/v3/elements-inner-card-441445cbb512a63599ab0df61abfb641.html
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Tue, 05 Mar 2024 01:21:42 GMT
via: 1.1 077b94dab77b8114aebf503be197d7d8.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
age: 53
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
content-length: 474
last-modified: Mon, 04 Mar 2024 21:49:34 GMT
server: Cloudfront
etag: "741c7a42906bbd9aa745c3aea07bcd08"
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=60
accept-ranges: bytes
x-amz-cf-id: 80nupgEJ7_qPJuGP_gCYovvxtLq50zl6ySYReixXPT4qOJnKeBAcsg==

GET
H2 200 countryRanges-9ffc15b92962ca316164b9a5ff4c1917.json Show response
js.stripe.com/v3/fingerprinted/data/ Frame BF6D 145 KB
37 KB 49ms
49ms Fetch
application/json 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/data/countryRanges-9ffc15b92962ca316164b9a5ff4c1917.json

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-ef74aa054e59fdac81b538dfec92a050.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

007b4be1404b0f21a158fa83a2ae9375393b2d932a17e9745aa392fcadc7cf2f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://js.stripe.com/v3/elements-inner-card-441445cbb512a63599ab0df61abfb641.html
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Tue, 05 Mar 2024 01:12:44 GMT
content-encoding: br
via: 1.1 077b94dab77b8114aebf503be197d7d8.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 592
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Fri, 01 Mar 2024 22:43:19 GMT
server: Cloudfront
etag: W/"9ffc15b92962ca316164b9a5ff4c1917"
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: m9YRjpxaAz53Ui6CxWKSK39RIJT6gMLAYo4cBXpK-5CSvZYPN3hn-A==

GET
H2 200 .deploy_status_henson.json Show response
js.stripe.com/v3/ Frame B0D7 474 B
917 B 36ms
36ms Fetch
application/json 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/.deploy_status_henson.json

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-ef74aa054e59fdac81b538dfec92a050.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

5e155e1f89e5ca084a3510deea330a8ca019b906bc61469408830959033ce71f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/v3/controller-1b517d3dc8887d756b42ce62fc15d620.html
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Tue, 05 Mar 2024 01:21:42 GMT
via: 1.1 077b94dab77b8114aebf503be197d7d8.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
age: 53
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
content-length: 474
last-modified: Mon, 04 Mar 2024 21:49:34 GMT
server: Cloudfront
etag: "741c7a42906bbd9aa745c3aea07bcd08"
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=60
accept-ranges: bytes
x-amz-cf-id: FkAtGbba_C3TBqUjKPtxjCpIFUW1Fy2PdWJBfLoCTrqqzEJU-ugIMA==

GET
H2 200 .deploy_status_henson.json Show response
js.stripe.com/v3/ Frame B0D7 474 B
917 B 36ms
36ms Fetch
application/json 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/.deploy_status_henson.json

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-ef74aa054e59fdac81b538dfec92a050.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

5e155e1f89e5ca084a3510deea330a8ca019b906bc61469408830959033ce71f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/v3/controller-1b517d3dc8887d756b42ce62fc15d620.html
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Tue, 05 Mar 2024 01:21:42 GMT
via: 1.1 077b94dab77b8114aebf503be197d7d8.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
age: 53
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
content-length: 474
last-modified: Mon, 04 Mar 2024 21:49:34 GMT
server: Cloudfront
etag: "741c7a42906bbd9aa745c3aea07bcd08"
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=60
accept-ranges: bytes
x-amz-cf-id: L5mWE_SI8ONdsPkrejsT9IKJxmP10jgw-kPddVQWqNnNnjgWP-CXDA==

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
70 B 44ms
43ms XHR
text/plain 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-60901920-1&cid=2069319955.1709601754&jid=1446788077&gjid=89362190&_gid=970251179.1709601754&_u=YCDACEABBAAAAGAEK~&z=756716541

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f155.1e100.net

Software

Golfe2 /

Resource Hash

8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Tue, 05 Mar 2024 01:22:33 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 257 KB
87 KB 71ms
71ms Script
application/javascript 142.251.16.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-HNR33QTX08&cx=c&_slc=1

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.97 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

72b6328c9e287c5f37ea936731b59e68a31fc241990f2fdbd1d967e3294d661e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:22:33 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 89405
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 05 Mar 2024 01:22:33 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
408 B 129ms
55ms Image
image/gif 172.253.122.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-73658561-7&cid=2069319955.1709601754&jid=1061310776&_u=YCDAiEABBAAAAGAEK~&z=1438067585

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f99.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 01:22:34 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.ca/ads/ 42 B
107 B 214ms
139ms Image
image/gif 142.251.16.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-73658561-7&cid=2069319955.1709601754&jid=1061310776&_u=YCDAiEABBAAAAGAEK~&z=1438067585

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.94 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f94.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 01:22:34 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
analytics.google.com/g/s/ 0
246 B 163ms
89ms Ping
text/plain 142.251.163.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/s/collect?dma=0&gtm=45j91e42t1v867905447z872410129z9867900975za200&_gsid=X6H0114PDFyJP4kLgx5DEWKHwTeF4YFQ
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.163.102 Farmingdale, United States, ASN15169 (GOOGLE, US),
Reverse DNS: wv-in-f102.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 01:22:34 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
56 B 44ms
43ms Ping
text/plain 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&dma=0&tid=G-X6H0114PDF&cid=ULISyEABy7oNGI9yiZxhGpJMAWtSSBuAOSHr5MJ6Vgk%3D.1709601754&gtm=45j91e42t1v867905447z872410129z9867900975za200&aip=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bh-in-f155.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 01:22:33 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.ca/ads/ 42 B
408 B 210ms
137ms Image
image/gif 142.251.16.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&dma=0&tid=G-X6H0114PDF&cid=ULISyEABy7oNGI9yiZxhGpJMAWtSSBuAOSHr5MJ6Vgk%3D.1709601754&gtm=45j91e42t1v867905447z872410129z9867900975za200&aip=1&z=352967818

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.94 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f94.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 01:22:34 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adsct
t.co/1/i/ 43 B
377 B 197ms
70ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=fe627013-6e8f-480a-a7a8-2780e2685d17&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=cd08df19-e381-4fbf-b949-133875b18e14&tw_document_href=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm%3Futm_term%3Dsv24&tw_iframe_status=0&txn_id=of93e&type=javascript&version=2.3.29

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

x-response-time: 5
date: Tue, 05 Mar 2024 01:22:34 GMT
strict-transport-security: max-age=0
server: tsa_b
content-type: image/gif;charset=utf-8
x-transaction-id: 852551b7228bd6ed
cache-control: no-cache, no-store, max-age=0
perf: 7469935968
x-connection-hash: 922ba3e059a85fb7982d22c506647e4dba7ba9388e31d88280251851ae447b8d
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/1/i/ 43 B
723 B 242ms
132ms Image
image/gif 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=fe627013-6e8f-480a-a7a8-2780e2685d17&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=cd08df19-e381-4fbf-b949-133875b18e14&tw_document_href=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm%3Futm_term%3Dsv24&tw_iframe_status=0&txn_id=of93e&type=javascript&version=2.3.29

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

x-response-time: 78
date: Tue, 05 Mar 2024 01:22:33 GMT
strict-transport-security: max-age=631138519
server: tsa_b
content-type: image/gif;charset=utf-8
x-transaction-id: 75a062e2ca0fbf1e
cache-control: no-cache, no-store, max-age=0
perf: 7469935968
x-connection-hash: c21a40ab565a5c3364ce8c8669d7f453f1f3a180edaae5b842cee8e08556582d
content-length: 43

GET
H2

200

activityi;dc_pre=CJGYjer624QDFfwX-QAdS7oJ0A;src=9381094;type=pagev0;cat=djt_p0;ord=7769649750614;npa=0;auiddc=1106069799.1709601753;pscdl=noapi;gtm=45fe42t1z872350723za201;gcd=13l3l3l3l1;dma=0;uaa=... Show response
9381094.fls.doubleclick.net/ Frame 7450
Redirect Chain

https://9381094.fls.doubleclick.net/activityi;src=9381094;type=pagev0;cat=djt_p0;ord=7769649750614;npa=0;auiddc=1106069799.1709601753;pscdl=noapi;gtm=45fe42t1z872350723za201;gcd=13l3l3l3l1;dma=0;ua...
https://9381094.fls.doubleclick.net/activityi;dc_pre=CJGYjer624QDFfwX-QAdS7oJ0A;src=9381094;type=pagev0;cat=djt_p0;ord=7769649750614;npa=0;auiddc=1106069799.1709601753;pscdl=noapi;gtm=45fe42t1z8723...

588 B
666 B

100ms
97ms

Document
text/html

172.253.63.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://9381094.fls.doubleclick.net/activityi;dc_pre=CJGYjer624QDFfwX-QAdS7oJ0A;src=9381094;type=pagev0;cat=djt_p0;ord=7769649750614;npa=0;auiddc=1106069799.1709601753;pscdl=noapi;gtm=45fe42t1z872350723za201;gcd=13l3l3l3l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm%3Futm_term%3Dsv24?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=DC-9381094&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f149.1e100.net

Software

cafe /

Resource Hash

bc8891da4a264054779959982425273e98b5857abfe24a00082d90fdc976201e

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 361
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Mar 2024 01:22:34 GMT
expires: Tue, 05 Mar 2024 01:22:34 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Mar 2024 01:22:34 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://9381094.fls.doubleclick.net/activityi;dc_pre=CJGYjer624QDFfwX-QAdS7oJ0A;src=9381094;type=pagev0;cat=djt_p0;ord=7769649750614;npa=0;auiddc=1106069799.1709601753;pscdl=noapi;gtm=45fe42t1z872350723za201;gcd=13l3l3l3l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm%3Futm_term%3Dsv24?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 1599889267195467 Show response
connect.facebook.net/signals/config/ 61 KB
13 KB 37ms
36ms Script
application/x-javascript 31.13.66.19
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1599889267195467?v=2.9.148&r=stable&domain=secure.winred.com&hme=20c913bdcd4be51a752120153aa5caaecb3ee86c7f26cf737846e40b202aba68&ex_m=62%2C106%2C94%2C98%2C53%2C3%2C88%2C61%2C14%2C86%2C79%2C44%2C46%2C150%2C153%2C164%2C160%2C161%2C163%2C25%2C89%2C45%2C68%2C162%2C145%2C148%2C157%2C158%2C165%2C115%2C13%2C43%2C169%2C168%2C117%2C16%2C29%2C32%2C1%2C36%2C57%2C58%2C59%2C63%2C83%2C15%2C12%2C85%2C82%2C81%2C95%2C97%2C31%2C96%2C26%2C22%2C146%2C149%2C124%2C24%2C9%2C10%2C11%2C5%2C6%2C21%2C19%2C20%2C49%2C54%2C56%2C66%2C90%2C23%2C67%2C8%2C7%2C71%2C41%2C18%2C92%2C91%2C17%2C4%2C73%2C80%2C72%2C78%2C40%2C39%2C77%2C33%2C35%2C76%2C48%2C74%2C28%2C37%2C65%2C0%2C84%2C75%2C2%2C30%2C55%2C34%2C93%2C38%2C70%2C60%2C99%2C52%2C51%2C27%2C87%2C50%2C47%2C42%2C69%2C64%2C100

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

31.13.66.19 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-iad3.fbcdn.net

Software

Resource Hash

9db8b420e21f5db6aa0dd50677268861205363d1975b4089e46abe4c8797a6c4

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

permissions-policy-report-only: clipboard-read=(), clipboard-write=(), picture-in-picture=();report-to="permissions_policy"
content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Tue, 05 Mar 2024 01:22:34 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 12878
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
pragma: public
x-fb-debug: HiPpSmeSPMu4t7T/XOp4KEMfx3fbfO0yARpFrFKnNCtQIVDDsGnlAF1Ac/XYSLCCpPEUkD6jY4e50pGvwc92ZQ==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(), clipboard-read=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H3 204 collect
www.google-analytics.com/g/ 0
17 B 46ms
46ms Ping
text/plain 172.253.62.139
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-0YWKLMCX4D&gtm=45je42t1v9102512289z872350723za200&_p=1709601752789&gcd=13l3l3l3l1&npa=0&dma=0&cid=2069319955.1709601754&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_s=1&sid=1709601754&sct=1&seg=0&dl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm%3Futm_term%3Dsv24&dt=MAGA&en=page_view&_fv=1&_ss=1&ep.cookieDomain=auto&tfd=1667
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-0YWKLMCX4D&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.253.62.139 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bc-in-f139.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 01:22:34 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/11091438865/ 3 KB
2 KB 130ms
55ms Script
text/javascript 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11091438865/?random=1709601754074&cv=11&fst=1709601754074&bg=ffffff&guid=ON&async=1&gtm=45je42t1v9102512289z872350723za200&gcd=13l3l3l3l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm%3Futm_term%3Dsv24&hn=www.googleadservices.com&frm=0&tiba=MAGA&npa=0&pscdl=noapi&auid=1106069799.1709601753&uamb=0&uaw=0&fdr=QA&data=event%3Dgtag.config%3BcookieDomain%3Dauto&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-0YWKLMCX4D&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f155.1e100.net

Software

cafe /

Resource Hash

67c06bfbabd110128342ef6c5c68b7debd64a694ba9fe335322c84b1e937b3b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 01:22:34 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1353
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 out-4.5.43.js Show response
m.stripe.network/ Frame 0E4A 87 KB
14 KB 31ms
31ms Script
text/javascript 54.192.51.79
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.network/out-4.5.43.js

Requested by

Host: m.stripe.network
URL: https://m.stripe.network/inner.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.51.79 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-51-79.yul62.r.cloudfront.net

Software

Cloudfront /

Resource Hash

e039e607c78306c7e029a7fd0ecdb14f86456f16e1a5ce65aa26b4fdf1d38a3c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://m.stripe.network/inner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:18:01 GMT
content-encoding: br
via: 1.1 0012c469abc357ca0c936faaf17aa31a.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
last-modified: Fri, 30 Jun 2023 14:32:28 GMT
server: Cloudfront
age: 273
x-content-type-options: nosniff
etag: W/"69cb7809b5011312e716f29b3d19dce6"
x-amz-cf-pop: YUL62-C2
vary: Accept-Encoding, Origin
x-cache: Hit from cloudfront
content-type: text/javascript; charset=utf-8
cache-control: max-age=300, public
x-amz-cf-id: d94aSye69JmNBnKwFkloC9soEdo5uRRyKAqK5ZrAjGnqRInWk_K0Kw==

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 57ms
55ms Image
image/gif 172.253.122.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-60901920-1&cid=2069319955.1709601754&jid=1446788077&_u=YCDACEABBAAAAGAEK~&z=667368735

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f99.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 01:22:34 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.ca/ads/ 42 B
107 B 65ms
65ms Image
image/gif 142.251.16.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-60901920-1&cid=2069319955.1709601754&jid=1446788077&_u=YCDACEABBAAAAGAEK~&z=667368735

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.94 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f94.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 01:22:34 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 payframe Show response
pay.google.com/gp/p/ui/ Frame 0DCD 19 KB
8 KB 70ms
68ms Document
text/html 172.253.115.92
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pay.google.com/gp/p/ui/payframe?origin=https%3A%2F%2Fjs.stripe.com&mid=

Requested by

Host: pay.google.com
URL: https://pay.google.com/gp/p/js/pay.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.92 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f92.1e100.net

Software

ESF /

Resource Hash

a3a3a23af0f131c5d2799855fe985d416d6d4a892c378386ca2d21831b6d271e

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport script-src 'report-sample' 'nonce-2OiGFbmt5-drIp0n47ShSA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport;worker-src 'self' script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport/allowlist
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://js.stripe.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=3600
content-encoding: gzip
content-security-policy: require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport script-src 'report-sample' 'nonce-2OiGFbmt5-drIp0n47ShSA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport;worker-src 'self' script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport/allowlist
content-type: text/html; charset=utf-8
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-site
date: Tue, 05 Mar 2024 01:22:34 GMT
expires: Tue, 05 Mar 2024 01:22:34 GMT
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
reporting-endpoints: default="/gp/p/_/InstantbuyFrontendBuyflowPayframeUi/web-reports?context=eJzjKtHikmLw1pBiWFYqxVBRK8WwZKYUg2fNTabOPTeZ1nU9YlrY_pRJk-sZU33UM6aZvM-Z4k48ZxJ885zp3ZeXTBxfXzJJALEaEO_w8WAR85nOejh6OivfuumsKkCsuX46ayAQO6XPYA0AYp_6GaxRQCzEzXHr-cz1bAI7bv7yBQCs5jNl"
server: ESF
strict-transport-security: max-age=31536000
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-content-type-options: nosniff
x-ua-compatible: IE=edge
x-xss-protection: 0

POST
H2 200 wallet-config Show response
merchant-ui-api.stripe.com/elements/ Frame B0D7 2 KB
3 KB 245ms
160ms Fetch
application/json 198.137.150.81
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://merchant-ui-api.stripe.com/elements/wallet-config

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-ef74aa054e59fdac81b538dfec92a050.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

198.137.150.81 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

a900e644fa21a464f600a3e5fa718c7219ee838436783762a8383c367a88fddb

Security Headers

Name	Value
Content-Security-Policy	report-uri https://q.stripe.com/csp-report?p=elements%2Fwallet-config; block-all-mixed-content; default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; img-src 'self'; script-src 'self' 'report-sample'; style-src 'self'
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Tue, 05 Mar 2024 01:22:34 GMT
content-security-policy: report-uri https://q.stripe.com/csp-report?p=elements%2Fwallet-config; block-all-mixed-content; default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; img-src 'self'; script-src 'self' 'report-sample'; style-src 'self'
strict-transport-security: max-age=63072000; includeSubDomains; preload
cross-origin-resource-policy: same-site
content-length: 2528
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
access-control-max-age: 300
access-control-allow-methods: GET, POST
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://js.stripe.com
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
vary: Origin
access-control-allow-headers: x-stripe-csrf-token
cross-origin-opener-policy-report-only: same-origin; report-to=https://q.stripe.com/coop-report
expires: 0

GET
H2 200 collect Show response
gtm.winred.com/g/ 323 B
502 B 381ms
380ms XHR
text/plain 104.16.250.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gtm.winred.com/g/collect?v=2&tid=G-X6H0114PDF&gtm=45je42t1v867905447z872410129za200&_p=1709601752789&gcd=13l3l3l3l1&npa=0&dma=0&cid=2069319955.1709601754&ul=en-us&sr=1600x1200&_fplc=0&ur=CA-ON&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&sst.uc=CA&sst.gse=1&sst.etld=google.ca&sst.gcd=13l3l3l3l1&sst.tft=1709601752789&_s=2&sid=1709601753&sct=1&seg=0&dl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm%3Futm_term%3Dsv24&dt=MAGA&en=user%20session%20start&ep.pagepath=%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm&ep.pagehostname=secure.winred.com&ep.parsedurl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm&epn.load_time_sec=-1709601752.4&epn.event_fire_time=1709601753326&ep.event_uuid=d91d666f-a90c-4c90-9f43-db5c75668c45&ep.isVideoPage=f&ep.referrer=&ep.category=donation%20landing%20page&ep.action=user%20session%20start&ep.label=landing%20page%20settings&ep.customCSS=t&ep.usercategory=anonymous&_et=4&tfd=1752&richsstsse

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.250.69 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ab60613ece9b5b3525ad9007dfd6f69d61039cd11be7311166fc90665337c1c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:22:34 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
server: cloudflare
strict-transport-security: max-age=0; includeSubDomains
vary: Accept-Encoding
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 85f64bb38d8b3a08-YYZ
alt-svc: h3=":443"; ma=86400

POST
H2 200 wallet-config Show response
merchant-ui-api.stripe.com/elements/ Frame D6F4 2 KB
3 KB 239ms
163ms Fetch
application/json 198.137.150.81
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://merchant-ui-api.stripe.com/elements/wallet-config

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-ef74aa054e59fdac81b538dfec92a050.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

198.137.150.81 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

53db143c0f616cffe22042f63f44d12fa6c48c991e6bd1611cd8ccdc492b4aca

Security Headers

Name	Value
Content-Security-Policy	report-uri https://q.stripe.com/csp-report?p=elements%2Fwallet-config; block-all-mixed-content; default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; img-src 'self'; script-src 'self' 'report-sample'; style-src 'self'
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Tue, 05 Mar 2024 01:22:34 GMT
content-security-policy: report-uri https://q.stripe.com/csp-report?p=elements%2Fwallet-config; block-all-mixed-content; default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; img-src 'self'; script-src 'self' 'report-sample'; style-src 'self'
strict-transport-security: max-age=63072000; includeSubDomains; preload
cross-origin-resource-policy: same-site
content-length: 2528
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
access-control-max-age: 300
access-control-allow-methods: GET, POST
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://js.stripe.com
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
vary: Origin
access-control-allow-headers: x-stripe-csrf-token
cross-origin-opener-policy-report-only: same-origin; report-to=https://q.stripe.com/coop-report
expires: 0

POST
H2 200 b Show response
r.stripe.com/ Frame D6F4 0
275 B 355ms
168ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-ef74aa054e59fdac81b538dfec92a050.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: green
date: Tue, 05 Mar 2024 01:22:34 GMT
x-stripe-server-envoy-start-time-us: 1709601754479503
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 2
x-stripe-client-envoy-start-time-us: 1709601754479192
access-control-allow-credentials: true
content-length: 0

POST
H2 200 b Show response
r.stripe.com/ Frame D6F4 0
274 B 362ms
176ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-ef74aa054e59fdac81b538dfec92a050.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: green
date: Tue, 05 Mar 2024 01:22:34 GMT
x-stripe-server-envoy-start-time-us: 1709601754487368
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 3
x-stripe-client-envoy-start-time-us: 1709601754487099
access-control-allow-credentials: true
content-length: 0

GET
H2 200 .deploy_status_henson.json Show response
js.stripe.com/v3/ Frame BF6D 474 B
917 B 40ms
39ms Fetch
application/json 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/.deploy_status_henson.json

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-ef74aa054e59fdac81b538dfec92a050.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

5e155e1f89e5ca084a3510deea330a8ca019b906bc61469408830959033ce71f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/v3/elements-inner-card-441445cbb512a63599ab0df61abfb641.html
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Tue, 05 Mar 2024 01:21:42 GMT
via: 1.1 077b94dab77b8114aebf503be197d7d8.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
age: 54
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
content-length: 474
last-modified: Mon, 04 Mar 2024 21:49:34 GMT
server: Cloudfront
etag: "741c7a42906bbd9aa745c3aea07bcd08"
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=60
accept-ranges: bytes
x-amz-cf-id: YsvExNNERep1W5_347HlEVMytLvBfLmulhmjfJO3uHZuFRAHeyYEbA==

POST
H2 200 b Show response
r.stripe.com/ Frame B0D7 0
274 B 369ms
202ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-ef74aa054e59fdac81b538dfec92a050.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: green
date: Tue, 05 Mar 2024 01:22:34 GMT
x-stripe-server-envoy-start-time-us: 1709601754513667
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 3
x-stripe-client-envoy-start-time-us: 1709601754513393
access-control-allow-credentials: true
content-length: 0

POST
H2 200 b Show response
r.stripe.com/ Frame B0D7 0
274 B 379ms
214ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-ef74aa054e59fdac81b538dfec92a050.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: green
date: Tue, 05 Mar 2024 01:22:34 GMT
x-stripe-server-envoy-start-time-us: 1709601754524216
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 4
x-stripe-client-envoy-start-time-us: 1709601754523888
access-control-allow-credentials: true
content-length: 0

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 316ms
105ms Image
text/plain 163.70.128.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1599889267195467&ev=PageView&dl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm%3Futm_term%3Dsv24&rl=&if=false&ts=1709601754206&sw=1600&sh=1200&v=2.9.148&r=stable&ec=0&o=4126&fbp=fb.1.1709601754204.463142585&cs_est=true&ler=empty&cdl=API_unavailable&it=1709601754044&coo=false&rqm=GET

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

163.70.128.35 Saint-Denis, France, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-03-cdg4.facebook.com

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Tue, 05 Mar 2024 01:22:34 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 m=_b,_tp Show response
www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.aJG4B4GDzQo.es5.O/am=gEEy/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/ujg=1/rs=AMi... Frame 0DCD 159 KB
57 KB 113ms
39ms Script
text/javascript 172.253.115.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.aJG4B4GDzQo.es5.O/am=gEEy/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/ujg=1/rs=AMitfrg3bEgbETt1a518MAJ-4sWcLZ9qIQ/m=_b,_tp

Requested by

Host: pay.google.com
URL: https://pay.google.com/gp/p/ui/payframe?origin=https%3A%2F%2Fjs.stripe.com&mid=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f94.1e100.net

Software

sffe /

Resource Hash

567b54fd60398b184a0476703aec2d6d70dac4177e293af5b6b5bfaf0b35d374

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 17:18:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29048
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/payments-consumer-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57677
x-xss-protection: 0
last-modified: Fri, 01 Mar 2024 17:33:22 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="boq-infra/payments-consumer-boq-js-css-signers"
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/payments-consumer-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/payments-consumer-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Tue, 04 Mar 2025 17:18:26 GMT

POST
H2 200 b Show response
r.stripe.com/ Frame B0D7 0
274 B 327ms
181ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-ef74aa054e59fdac81b538dfec92a050.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: green
date: Tue, 05 Mar 2024 01:22:34 GMT
x-stripe-server-envoy-start-time-us: 1709601754492540
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 3
x-stripe-client-envoy-start-time-us: 1709601754492354
access-control-allow-credentials: true
content-length: 0

POST
H2 204 collect
analytics.google.com/g/ 0
54 B 44ms
43ms Ping
text/plain 142.251.163.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-HNR33QTX08&_ono=1&gtm=45je42t1v9164375506za200&_p=1709601752789&_gaz=1&gcd=13l3l3l3l2&npa=0&dma=0&ul=en-us&sr=1600x1200&cid=2069319955.1709601754&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_eu=EBAI&_s=1&dl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm%3Futm_term%3Dsv24&dt=MAGA&sid=1709601754&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1&tfd=1844
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-HNR33QTX08&cx=c&_slc=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.163.102 Farmingdale, United States, ASN15169 (GOOGLE, US),
Reverse DNS: wv-in-f102.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 01:22:34 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 collect
stats.g.doubleclick.net/g/ 0
17 B 44ms
44ms Ping
text/plain 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&_ono=1&tid=G-HNR33QTX08&cid=2069319955.1709601754&gtm=45je42t1v9164375506za200&aip=1&dma=0&gcd=13l3l3l3l2&npa=0
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-HNR33QTX08&cx=c&_slc=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.253.122.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bh-in-f155.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 01:22:34 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.ca/ads/ 42 B
107 B 53ms
52ms Image
image/gif 142.251.16.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&_ono=1&tid=G-HNR33QTX08&cid=2069319955.1709601754&gtm=45je42t1v9164375506za200&aip=1&dma=0&gcd=13l3l3l3l2&npa=0&z=768793779

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.94 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f94.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 01:22:34 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_pre=CJGYjer624QDFfwX-QAdS7oJ0A;src=9381094;type=pagev0;cat=djt_p0;ord=7769649750614;npa=0;auiddc=*;pscdl=noapi;gtm=45fe42t1z872350723za201;gcd=13l3l3l3l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;...
adservice.google.com/ddm/fls/z/ Frame 7450 42 B
401 B 173ms
101ms Image
image/gif 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CJGYjer624QDFfwX-QAdS7oJ0A;src=9381094;type=pagev0;cat=djt_p0;ord=7769649750614;npa=0;auiddc=*;pscdl=noapi;gtm=45fe42t1z872350723za201;gcd=13l3l3l3l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm%3Futm_term%3Dsv24

Requested by

Host: 9381094.fls.doubleclick.net
URL: https://9381094.fls.doubleclick.net/activityi;dc_pre=CJGYjer624QDFfwX-QAdS7oJ0A;src=9381094;type=pagev0;cat=djt_p0;ord=7769649750614;npa=0;auiddc=1106069799.1709601753;pscdl=noapi;gtm=45fe42t1z872350723za201;gcd=13l3l3l3l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm%3Futm_term%3Dsv24?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f155.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://9381094.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 01:22:34 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 6 Show response
m.stripe.com/ Frame 0E4A 156 B
668 B 278ms
95ms XHR
application/json 44.237.70.166
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.com/6

Requested by

Host: m.stripe.network
URL: https://m.stripe.network/out-4.5.43.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.237.70.166 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-44-237-70-166.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

59baf813b441feeb356bc088f9ec1ea4acbd920703ccf118e514ff99124d37e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://m.stripe.network/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-stripe-bg-intended-route-color: blue
date: Tue, 05 Mar 2024 01:22:34 GMT
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1709601754539267
server: nginx
content-type: application/json;charset=utf-8
x-stripe-server-envoy-upstream-service-time-ms: 3
access-control-allow-origin: https://m.stripe.network
x-stripe-client-envoy-start-time-us: 1709601754538972
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 156

POST
H2 200 b Show response
r.stripe.com/ Frame D6F4 0
274 B 240ms
192ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-ef74aa054e59fdac81b538dfec92a050.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: green
date: Tue, 05 Mar 2024 01:22:34 GMT
x-stripe-server-envoy-start-time-us: 1709601754503303
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 3
x-stripe-client-envoy-start-time-us: 1709601754502950
access-control-allow-credentials: true
content-length: 0

GET
H3 200 /
www.google.com/pagead/1p-user-list/11091438865/ 42 B
64 B 82ms
81ms Image
image/gif 172.253.122.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/11091438865/?random=1709601754074&cv=11&fst=1709600400000&bg=ffffff&guid=ON&async=1&gtm=45je42t1v9102512289z872350723za200&gcd=13l3l3l3l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm%3Futm_term%3Dsv24&frm=0&tiba=MAGA&npa=0&data=event%3Dgtag.config%3BcookieDomain%3Dauto&fmt=3&is_vtc=1&cid=CAQSGwB7FLtqS-EDeNTD9-qIZENKDMvoHYy8_wCRxQ&random=3555589795&rmt_tld=0&ipr=y

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f99.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 01:22:34 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.ca/pagead/1p-user-list/11091438865/ 42 B
154 B 50ms
49ms Image
image/gif 142.251.16.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-user-list/11091438865/?random=1709601754074&cv=11&fst=1709600400000&bg=ffffff&guid=ON&async=1&gtm=45je42t1v9102512289z872350723za200&gcd=13l3l3l3l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm%3Futm_term%3Dsv24&frm=0&tiba=MAGA&npa=0&data=event%3Dgtag.config%3BcookieDomain%3Dauto&fmt=3&is_vtc=1&cid=CAQSGwB7FLtqS-EDeNTD9-qIZENKDMvoHYy8_wCRxQ&random=3555589795&rmt_tld=1&ipr=y

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.94 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f94.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 01:22:34 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 m=Das5Le Show response
www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.aJG4B4GDzQo.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.gic... Frame 0DCD 75 KB
27 KB 38ms
37ms Script
text/javascript 172.253.115.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.aJG4B4GDzQo.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.gicXl1wwshw.L.B1.O/am=gEEy/d=1/exm=_b,_tp/excm=_b,_tp,payframeview/ed=1/wt=2/ujg=1/rs=AMitfrgsw7a2G5ArNqeMkX_N3seX62x4Fg/ee=EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SNUn3:ZwDk9d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;oGtAuc:sOXFj;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;wR5FRb:siKnQd;yEQyxe:p8L0ob;yxTchf:KUM7Z/m=Das5Le

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.aJG4B4GDzQo.es5.O/am=gEEy/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/ujg=1/rs=AMitfrg3bEgbETt1a518MAJ-4sWcLZ9qIQ/m=_b,_tp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f94.1e100.net

Software

sffe /

Resource Hash

f079dba5305aa07544d431a42f6836a03db06fb5ce5fc70416e240f728bcdda1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 17:18:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29046
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/payments-consumer-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27665
x-xss-protection: 0
last-modified: Thu, 29 Feb 2024 02:22:02 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="boq-infra/payments-consumer-boq-js-css-signers"
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/payments-consumer-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/payments-consumer-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Tue, 04 Mar 2025 17:18:28 GMT

GET
H2 200 hcaptcha-invisible-1f6c59c3982eff179fc5d02d754852d5.html Show response
js.stripe.com/v3/ Frame 84FD 71 KB
23 KB 38ms
38ms Document
text/html 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/hcaptcha-invisible-1f6c59c3982eff179fc5d02d754852d5.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

496a9f211c8a2c4f3d98c05064de0c18af9f8d47f21a73ef373e9764a3c0c712

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://errors.stripe.com https://r.stripe.com; default-src 'self'; form-action 'none'; frame-src 'self' https://b.stripecdn.com; img-src 'self' https://q.stripe.com; object-src 'none'; script-src 'self' 'sha256-go4NKd0rlVXQUNTp22Cip558xUPdziw0XMec8rVzB7o='; style-src 'self'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-origin: *
age: 776
cache-control: max-age=31536000
content-encoding: br
content-security-policy: base-uri 'none'; connect-src 'self' https://errors.stripe.com https://r.stripe.com; default-src 'self'; form-action 'none'; frame-src 'self' https://b.stripecdn.com; img-src 'self' https://q.stripe.com; object-src 'none'; script-src 'self' 'sha256-go4NKd0rlVXQUNTp22Cip558xUPdziw0XMec8rVzB7o='; style-src 'self'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Tue, 05 Mar 2024 01:09:39 GMT
etag: W/"1f6c59c3982eff179fc5d02d754852d5"
last-modified: Mon, 04 Mar 2024 21:05:37 GMT
server: Cloudfront
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 47c0295005ec7d8570406951491004c2.cloudfront.net (CloudFront)
x-amz-cf-id: NY0t-VtJ5DEdEQm2sGtbFwobqm8cz4ChwIhZuDbWL8K2G79XgLxjSg==
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
x-content-type-options: nosniff

POST
H2 200 b Show response
r.stripe.com/ Frame D6F4 0
274 B 183ms
183ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-ef74aa054e59fdac81b538dfec92a050.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: green
date: Tue, 05 Mar 2024 01:22:34 GMT
x-stripe-server-envoy-start-time-us: 1709601754554218
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 3
x-stripe-client-envoy-start-time-us: 1709601754553944
access-control-allow-credentials: true
content-length: 0

GET
H2 200 phone-numbers-lib-5113174565c377315fd5b8d695d8b541.js Show response
js.stripe.com/v3/fingerprinted/js/ 148 KB
35 KB 38ms
38ms Script
text/javascript 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/phone-numbers-lib-5113174565c377315fd5b8d695d8b541.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

621661fe1c7a59420c624f7a421c566ebfb38cfbc7edd98ee0462c44d15971f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 00:55:32 GMT
content-encoding: br
via: 1.1 47c0295005ec7d8570406951491004c2.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 1623
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Fri, 01 Mar 2024 22:43:31 GMT
server: Cloudfront
etag: W/"f7a3e754fa2fa9117506f69f618b5778"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: WKcEOtzhZ803f28Zt9GYcKmnKt9C5o-vVNQb7zPTMAOL4w20OuVMlw==

GET
H2 200 elements-inner-link-button-for-card-e4e1e1f3d4edcbb031e52c60566fe4f4.html Show response
js.stripe.com/v3/ Frame 1B0C 78 KB
17 KB 37ms
37ms Document
text/html 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/elements-inner-link-button-for-card-e4e1e1f3d4edcbb031e52c60566fe4f4.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

b3b12123ee7e114e0e37c3c6d087ca29b59fab0c2fe28064d70de38e1fc7c1d9

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://ppm.stripe.com; default-src 'self'; font-src data: https:; form-action 'none'; frame-src 'self' https://www.affirm.com https://checkout.link.com https://b.stripecdn.com; img-src 'self' https://q.stripe.com https://b.stripecdn.com https://js.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-origin: *
age: 766
cache-control: max-age=31536000
content-encoding: br
content-security-policy: base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://ppm.stripe.com; default-src 'self'; font-src data: https:; form-action 'none'; frame-src 'self' https://www.affirm.com https://checkout.link.com https://b.stripecdn.com; img-src 'self' https://q.stripe.com https://b.stripecdn.com https://js.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-security-policy-report-only: base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://ppm.stripe.com; default-src 'self'; font-src data: https:; form-action 'none'; frame-src 'self' https://www.affirm.com https://checkout.link.com https://b.stripecdn.com; img-src 'self' https://q.stripe.com https://b.stripecdn.com https://js.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Tue, 05 Mar 2024 01:10:36 GMT
etag: W/"e4e1e1f3d4edcbb031e52c60566fe4f4"
last-modified: Mon, 04 Mar 2024 21:05:23 GMT
server: Cloudfront
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 47c0295005ec7d8570406951491004c2.cloudfront.net (CloudFront)
x-amz-cf-id: m06iD2wtv_z6qHNg8I3xloQ6ltu2qzKZ6x3Hs4QqN_MTFa94mME_lA==
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
x-content-type-options: nosniff

GET
H3 200 pay Show response
pay.google.com/gp/p/ui/ Frame 0DCD 1 MB
376 KB 68ms
67ms XHR
text/html 172.253.115.92
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pay.google.com/gp/p/ui/pay

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.92 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f92.1e100.net

Software

ESF /

Resource Hash

791ae0aff6caaad83a9694df71c3686604f9387eb800f4a2bd81cdb31fbf2382

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport, script-src 'report-sample' 'nonce-FgoxMxNCaDf3aVN4yPw3iw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com https://sandbox.google.com https://payments.google.com https://payments.sandbox.google.com https://pay.google.com https://pay.sandbox.google.com;report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport/allowlist
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:22:34 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
content-security-policy: require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport, script-src 'report-sample' 'nonce-FgoxMxNCaDf3aVN4yPw3iw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com https://sandbox.google.com https://payments.google.com https://payments.sandbox.google.com https://pay.google.com https://pay.sandbox.google.com;report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport/allowlist
x-content-type-options: nosniff
cross-origin-resource-policy: same-site
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/gp/p/_/InstantbuyFrontendBuyflowPayUi/web-reports?context=eJzjKtHikmLw1pBiWFYqxVBRK8WwZKYUg2fNTabOPTeZ1nU9YlrY_pRJk-sZU33UM6aZvM-Z4k48ZxJ885zp3ZeXTBxfXzJJALEaEO_w8WAR85nOejh6OivfuumsKkCsuX46ayAQO6XPYA0AYp_6GaxRQCzEw3Hr-cz1bAI_nk54yggA4bsz4Q"
x-ua-compatible: IE=edge
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: unsafe-none
server: ESF
x-frame-options: DENY
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
cache-control: private, max-age=3600
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Tue, 05 Mar 2024 01:22:34 GMT

GET
H2 200 m=Wt6vjf,hhhU8,FCpbqb,WhJNk Show response
www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.aJG4B4GDzQo.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.gic... Frame 0DCD 10 KB
4 KB 38ms
37ms Script
text/javascript 172.253.115.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.aJG4B4GDzQo.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.gicXl1wwshw.L.B1.O/am=gEEy/d=1/exm=Das5Le,_b,_tp/excm=_b,_tp,payframeview/ed=1/wt=2/ujg=1/rs=AMitfrgsw7a2G5ArNqeMkX_N3seX62x4Fg/ee=EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SNUn3:ZwDk9d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;oGtAuc:sOXFj;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;wR5FRb:siKnQd;yEQyxe:p8L0ob;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f94.1e100.net

Software

sffe /

Resource Hash

155970940e45fe02f1fc59749acdb5fb0dfffa36378aa0781787c2dab8ba4be1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 19:50:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19953
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/payments-consumer-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4166
x-xss-protection: 0
last-modified: Thu, 29 Feb 2024 02:22:02 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="boq-infra/payments-consumer-boq-js-css-signers"
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/payments-consumer-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/payments-consumer-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Tue, 04 Mar 2025 19:50:01 GMT

GET
H2 200 m=byfTOb,lsjVmc,LEikZe,lwddkf,EFQ78c Show response
www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.aJG4B4GDzQo.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.gic... Frame 0DCD 37 KB
14 KB 38ms
38ms Script
text/javascript 172.253.115.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.aJG4B4GDzQo.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.gicXl1wwshw.L.B1.O/am=gEEy/d=1/exm=Das5Le,FCpbqb,WhJNk,Wt6vjf,_b,_tp,hhhU8/excm=_b,_tp,payframeview/ed=1/wt=2/ujg=1/rs=AMitfrgsw7a2G5ArNqeMkX_N3seX62x4Fg/ee=EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SNUn3:ZwDk9d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;oGtAuc:sOXFj;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;wR5FRb:siKnQd;yEQyxe:p8L0ob;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe,lwddkf,EFQ78c

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f94.1e100.net

Software

sffe /

Resource Hash

63bcc3b4d3734595ad591fd0f1917dc9d4b9e08a2189710a43293ee18136dbd9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 17:18:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29044
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/payments-consumer-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14348
x-xss-protection: 0
last-modified: Thu, 29 Feb 2024 02:22:02 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="boq-infra/payments-consumer-boq-js-css-signers"
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/payments-consumer-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/payments-consumer-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Tue, 04 Mar 2025 17:18:30 GMT

POST
H3 200 log Show response
play.google.com/ Frame 0DCD 131 B
155 B 71ms
70ms XHR
text/plain 142.251.163.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.102 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f102.1e100.net

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://pay.google.com/
X-Goog-AuthUser: 0
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Tue, 05 Mar 2024 01:22:34 GMT
content-encoding: gzip
server: Playlog
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: X-Playlog-Web
content-length: 131
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 05 Mar 2024 01:22:34 GMT

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 121ms
45ms Preflight
text/plain 142.251.163.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.100 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f100.1e100.net

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: x-goog-authuser
Access-Control-Request-Method: POST
Origin: https://pay.google.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://pay.google.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/plain; charset=UTF-8
date: Tue, 05 Mar 2024 01:22:34 GMT
server: Playlog
x-frame-options: SAMEORIGIN
x-xss-protection: 0

POST
H3 200 log Show response
play.google.com/ Frame 0DCD 131 B
155 B 76ms
74ms XHR
text/plain 142.251.163.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.102 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f102.1e100.net

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://pay.google.com/
X-Goog-AuthUser: 0
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Tue, 05 Mar 2024 01:22:34 GMT
content-encoding: gzip
server: Playlog
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: X-Playlog-Web
content-length: 131
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 05 Mar 2024 01:22:34 GMT

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 117ms
43ms Preflight
text/plain 142.251.163.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.100 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f100.1e100.net

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: x-goog-authuser
Access-Control-Request-Method: POST
Origin: https://pay.google.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://pay.google.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/plain; charset=UTF-8
date: Tue, 05 Mar 2024 01:22:34 GMT
server: Playlog
x-frame-options: SAMEORIGIN
x-xss-protection: 0

POST
H3 200 log Show response
play.google.com/ Frame 0DCD 131 B
155 B 72ms
70ms XHR
text/plain 142.251.163.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.102 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f102.1e100.net

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://pay.google.com/
X-Goog-AuthUser: 0
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Tue, 05 Mar 2024 01:22:34 GMT
content-encoding: gzip
server: Playlog
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: X-Playlog-Web
content-length: 131
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 05 Mar 2024 01:22:34 GMT

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 118ms
44ms Preflight
text/plain 142.251.163.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.100 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f100.1e100.net

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: x-goog-authuser
Access-Control-Request-Method: POST
Origin: https://pay.google.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://pay.google.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/plain; charset=UTF-8
date: Tue, 05 Mar 2024 01:22:34 GMT
server: Playlog
x-frame-options: SAMEORIGIN
x-xss-protection: 0

POST
H3 200 log Show response
play.google.com/ Frame 0DCD 131 B
155 B 90ms
89ms XHR
text/plain 142.251.163.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.102 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f102.1e100.net

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://pay.google.com/
X-Goog-AuthUser: 0
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Tue, 05 Mar 2024 01:22:34 GMT
content-encoding: gzip
server: Playlog
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: X-Playlog-Web
content-length: 131
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 05 Mar 2024 01:22:34 GMT

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 117ms
45ms Preflight
text/plain 142.251.163.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.100 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f100.1e100.net

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: x-goog-authuser
Access-Control-Request-Method: POST
Origin: https://pay.google.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://pay.google.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/plain; charset=UTF-8
date: Tue, 05 Mar 2024 01:22:34 GMT
server: Playlog
x-frame-options: SAMEORIGIN
x-xss-protection: 0

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 115ms
44ms Preflight
text/plain 142.251.163.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.100 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f100.1e100.net

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: x-goog-authuser
Access-Control-Request-Method: POST
Origin: https://pay.google.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://pay.google.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/plain; charset=UTF-8
date: Tue, 05 Mar 2024 01:22:34 GMT
server: Playlog
x-frame-options: SAMEORIGIN
x-xss-protection: 0

POST
H3 200 log Show response
play.google.com/ Frame 0DCD 131 B
155 B 71ms
70ms XHR
text/plain 142.251.163.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.102 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f102.1e100.net

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://pay.google.com/
X-Goog-AuthUser: 0
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Tue, 05 Mar 2024 01:22:34 GMT
content-encoding: gzip
server: Playlog
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: X-Playlog-Web
content-length: 131
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 05 Mar 2024 01:22:34 GMT

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 119ms
51ms Preflight
text/plain 142.251.163.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.100 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f100.1e100.net

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: x-goog-authuser
Access-Control-Request-Method: POST
Origin: https://pay.google.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://pay.google.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/plain; charset=UTF-8
date: Tue, 05 Mar 2024 01:22:34 GMT
server: Playlog
x-frame-options: SAMEORIGIN
x-xss-protection: 0

POST
H3 200 log Show response
play.google.com/ Frame 0DCD 131 B
155 B 65ms
65ms XHR
text/plain 142.251.163.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.102 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f102.1e100.net

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://pay.google.com/
X-Goog-AuthUser: 0
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Tue, 05 Mar 2024 01:22:34 GMT
content-encoding: gzip
server: Playlog
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: X-Playlog-Web
content-length: 131
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 05 Mar 2024 01:22:34 GMT

POST
H2 200 b Show response
r.stripe.com/ Frame B0D7 0
274 B 149ms
147ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-ef74aa054e59fdac81b538dfec92a050.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: green
date: Tue, 05 Mar 2024 01:22:34 GMT
x-stripe-server-envoy-start-time-us: 1709601754560815
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 3
x-stripe-client-envoy-start-time-us: 1709601754560503
access-control-allow-credentials: true
content-length: 0

GET
H2 200 shared-ef74aa054e59fdac81b538dfec92a050.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 1B0C 537 KB
117 KB 41ms
40ms Script
text/javascript 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-ef74aa054e59fdac81b538dfec92a050.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-link-button-for-card-e4e1e1f3d4edcbb031e52c60566fe4f4.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

39dfb37816eab2a94aa07e46af7d0523d11a47ca1f7d21544570e3c409fa0586

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-link-button-for-card-e4e1e1f3d4edcbb031e52c60566fe4f4.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:09:34 GMT
content-encoding: br
via: 1.1 47c0295005ec7d8570406951491004c2.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 781
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Mon, 04 Mar 2024 21:05:37 GMT
server: Cloudfront
etag: W/"d49550815942227dc97b7500620f7224"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: f3omat9NIhV1jYhN0MZxkoJtJGtmly14r0oor32znG5hoWrNyMdK0Q==

GET
H2 200 elements-inner-link-button-for-card-3e3c6751186392e3859c5f4470b4d0df.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 1B0C 25 KB
10 KB 40ms
39ms Script
text/javascript 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/elements-inner-link-button-for-card-3e3c6751186392e3859c5f4470b4d0df.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-link-button-for-card-e4e1e1f3d4edcbb031e52c60566fe4f4.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

c67fd705b4a52a62066cd60979c65edfa8b0d6c3da9a8d88d21afd56c11042e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-link-button-for-card-e4e1e1f3d4edcbb031e52c60566fe4f4.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 00:37:37 GMT
content-encoding: gzip
via: 1.1 47c0295005ec7d8570406951491004c2.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 2716
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Fri, 01 Mar 2024 22:43:29 GMT
server: Cloudfront
etag: W/"12873bf8979ee1f4c70fe3749e63d8a2"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: 7_z4woZe7PZI4gwCBlPqzAyHw_3VeGnAicNbkUxt1YwBiK_AkBqJjg==

GET
H2 200 elements-inner-link-button-for-card-e0892059cc36c5a207d4915b8be6a4f3.css
js.stripe.com/v3/fingerprinted/css/ Frame 1B0C 25 KB
4 KB 39ms
38ms Stylesheet
text/css 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/css/elements-inner-link-button-for-card-e0892059cc36c5a207d4915b8be6a4f3.css

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-link-button-for-card-e4e1e1f3d4edcbb031e52c60566fe4f4.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

d9b7faa0259f5b0961455f53b4a507fba4bd0ed70dffac0bdaf2f94298c74b40

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-link-button-for-card-e4e1e1f3d4edcbb031e52c60566fe4f4.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:10:36 GMT
content-encoding: br
via: 1.1 47c0295005ec7d8570406951491004c2.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 783
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Fri, 01 Mar 2024 22:43:18 GMT
server: Cloudfront
etag: W/"ec65bfd4737d216032b538eb56aec1bd"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: 8eojTH8rGZXKY_LxYHWgrzjBvHJQwGaGnBFyZ1K1y92oRZr09sOqGQ==

GET
H2 200 .deploy_status_henson.json Show response
js.stripe.com/v3/ Frame 84FD 474 B
916 B 37ms
36ms Fetch
application/json 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/.deploy_status_henson.json

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/hcaptcha-invisible-1f6c59c3982eff179fc5d02d754852d5.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

5e155e1f89e5ca084a3510deea330a8ca019b906bc61469408830959033ce71f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/v3/hcaptcha-invisible-1f6c59c3982eff179fc5d02d754852d5.html
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Tue, 05 Mar 2024 01:21:42 GMT
via: 1.1 077b94dab77b8114aebf503be197d7d8.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
age: 54
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
content-length: 474
last-modified: Mon, 04 Mar 2024 21:49:34 GMT
server: Cloudfront
etag: "741c7a42906bbd9aa745c3aea07bcd08"
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=60
accept-ranges: bytes
x-amz-cf-id: aJuBlRvzsZe8kad5QESm3jUfiUhAybSvaTk3jnEIYN70o6r4a92ZqA==

GET
H2 200 HCaptchaInvisible.html Show response
b.stripecdn.com/stripethirdparty-srv/assets/v20.20/ Frame D698 419 B
1 KB 130ms
32ms Document
text/html 3.161.213.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://b.stripecdn.com/stripethirdparty-srv/assets/v20.20/HCaptchaInvisible.html?id=e9a85cc3-a52b-4f0b-b825-423d8233d94d&origin=https%3A%2F%2Fjs.stripe.com

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/hcaptcha-invisible-1f6c59c3982eff179fc5d02d754852d5.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.161.213.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-3-161-213-60.yul62.r.cloudfront.net

Software

Cloudfront /

Resource Hash

7046e325bee6e4ffd4581616a2b76772f5749fbd45eb77998a1b5810ed476d2e

Security Headers

Name	Value
Content-Security-Policy	base-uri 'self'; connect-src 'self' https://hcaptcha.com https://.hcaptcha.com https://errors.stripe.com; default-src 'self'; form-action 'none'; frame-src https://hcaptcha.com https://.hcaptcha.com; img-src 'self'; object-src 'none'; script-src 'self' https://hcaptcha.com https://.hcaptcha.com; style-src 'self' https://hcaptcha.com https://.hcaptcha.com; worker-src 'none'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 56
cache-control: max-age=60, stale-while-revalidate=900
content-length: 419
content-security-policy: base-uri 'self'; connect-src 'self' https://hcaptcha.com https://*.hcaptcha.com https://errors.stripe.com; default-src 'self'; form-action 'none'; frame-src https://hcaptcha.com https://*.hcaptcha.com; img-src 'self'; object-src 'none'; script-src 'self' https://hcaptcha.com https://*.hcaptcha.com; style-src 'self' https://hcaptcha.com https://*.hcaptcha.com; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Tue, 05 Mar 2024 01:21:39 GMT
etag: "4c0d839a05613b0f5d6f591f2ff1422c"
last-modified: Wed, 28 Feb 2024 17:12:28 GMT
server: Cloudfront
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding,Origin
via: 1.1 f084ab450a6c71ebe23f8602cefd27ae.cloudfront.net (CloudFront)
x-amz-cf-id: UlyNnd7FNhYxXeQbnpqdi5pFZBVJIHQ-hdKeB4Wg6FHblYt_yUBspw==
x-amz-cf-pop: YUL62-P1
x-cache: Hit from cloudfront
x-content-type-options: nosniff

GET
H2 200 elements-inner-payment-request-7cdcfcabc14b295d272b2a3834c63c39.html Show response
js.stripe.com/v3/ Frame 04F8 820 B
2 KB 37ms
36ms Document
text/html 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/elements-inner-payment-request-7cdcfcabc14b295d272b2a3834c63c39.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

b44b2c7d9284c33b357e892a41d1c396c1d28dba57e5b65f8e86edfd969c73f8

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://ppm.stripe.com; default-src 'self'; font-src data: https:; form-action 'none'; frame-src 'self' https://www.affirm.com https://checkout.link.com https://b.stripecdn.com; img-src 'self' https://q.stripe.com https://b.stripecdn.com https://js.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 2717
cache-control: max-age=31536000
content-length: 820
content-security-policy: base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://ppm.stripe.com; default-src 'self'; font-src data: https:; form-action 'none'; frame-src 'self' https://www.affirm.com https://checkout.link.com https://b.stripecdn.com; img-src 'self' https://q.stripe.com https://b.stripecdn.com https://js.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-security-policy-report-only: base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://ppm.stripe.com; default-src 'self'; font-src data: https:; form-action 'none'; frame-src 'self' https://www.affirm.com https://checkout.link.com https://b.stripecdn.com; img-src 'self' https://q.stripe.com https://b.stripecdn.com https://js.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Tue, 05 Mar 2024 00:37:26 GMT
etag: "7cdcfcabc14b295d272b2a3834c63c39"
last-modified: Mon, 04 Mar 2024 21:05:23 GMT
server: Cloudfront
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 47c0295005ec7d8570406951491004c2.cloudfront.net (CloudFront)
x-amz-cf-id: r3YV-rZCDmbIRn2yxVYL-7l-XiAnbxGsPGHnF1w0qX_BrOmb98hT2Q==
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
x-content-type-options: nosniff

POST
H2 200 b Show response
r.stripe.com/ Frame B0D7 0
274 B 113ms
113ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-ef74aa054e59fdac81b538dfec92a050.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: green
date: Tue, 05 Mar 2024 01:22:34 GMT
x-stripe-server-envoy-start-time-us: 1709601754573706
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 4
x-stripe-client-envoy-start-time-us: 1709601754573521
access-control-allow-credentials: true
content-length: 0

GET
H2 200 shared-ef74aa054e59fdac81b538dfec92a050.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 04F8 537 KB
117 KB 42ms
40ms Script
text/javascript 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-ef74aa054e59fdac81b538dfec92a050.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-payment-request-7cdcfcabc14b295d272b2a3834c63c39.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

39dfb37816eab2a94aa07e46af7d0523d11a47ca1f7d21544570e3c409fa0586

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-payment-request-7cdcfcabc14b295d272b2a3834c63c39.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:09:34 GMT
content-encoding: br
via: 1.1 47c0295005ec7d8570406951491004c2.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 781
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Mon, 04 Mar 2024 21:05:37 GMT
server: Cloudfront
etag: W/"d49550815942227dc97b7500620f7224"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: LdpPQt0Apu5IjmtbZFc8Kb8U8fp5z-KzCce7ug1gIGLJWNy4S_WQXw==

GET
H2 200 ui-shared-1bf6ace40c8ba59385d7846cb107d9c6.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 04F8 414 KB
107 KB 44ms
43ms Script
text/javascript 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/ui-shared-1bf6ace40c8ba59385d7846cb107d9c6.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-payment-request-7cdcfcabc14b295d272b2a3834c63c39.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

9ff1964bffc8efed18dfd92699b69a974e6f354348b0743c31a6784384eb7c3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-payment-request-7cdcfcabc14b295d272b2a3834c63c39.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:10:18 GMT
content-encoding: br
via: 1.1 47c0295005ec7d8570406951491004c2.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 771
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Mon, 04 Mar 2024 21:05:37 GMT
server: Cloudfront
etag: W/"1a73e2c92e7625b5ccbedca19583ed45"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: b7HK2MI9YTmIfeS1t6C538XI3pWmYjJD1A9p4wFMmfGmvsxceWOC6g==

GET
H2 200 elements-inner-payment-request-5045daf48c86b743da2874b548c46415.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 04F8 73 KB
23 KB 37ms
37ms Script
text/javascript 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/elements-inner-payment-request-5045daf48c86b743da2874b548c46415.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-payment-request-7cdcfcabc14b295d272b2a3834c63c39.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

80354fb397ad4656fa5814c41d9fd5464583c402b2b5a95cb649875927931743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-payment-request-7cdcfcabc14b295d272b2a3834c63c39.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:09:42 GMT
content-encoding: br
via: 1.1 47c0295005ec7d8570406951491004c2.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 773
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Mon, 04 Mar 2024 18:06:16 GMT
server: Cloudfront
etag: W/"654586738640c3c5cbfea23a1dc67e7d"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: yuY6Mno0d10-Knoi1NTEgNB_biml-T5lM2j7QMxwX5cMx_Fl6dr8vw==

GET
H2 200 ui-shared-1d27f4e2b314637ba4bb9d7ff79c23c7.css
js.stripe.com/v3/fingerprinted/css/ Frame 04F8 20 KB
4 KB 40ms
39ms Stylesheet
text/css 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/css/ui-shared-1d27f4e2b314637ba4bb9d7ff79c23c7.css

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-payment-request-7cdcfcabc14b295d272b2a3834c63c39.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

394724ca0118829643c12fb5a033cb66680e51327ba157677d18dec209278a3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-payment-request-7cdcfcabc14b295d272b2a3834c63c39.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 00:23:40 GMT
content-encoding: gzip
via: 1.1 47c0295005ec7d8570406951491004c2.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 3542
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Fri, 01 Mar 2024 22:43:18 GMT
server: Cloudfront
etag: W/"b361d7109e9925ca18e32c9da528520f"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: 0p6ekqfhKSlA88djFtVRtb3ttToiHSLd4ClDTfdEkJOrXn5Ue058PQ==

GET
H2 200 elements-inner-payment-request-30c75c9984170b682d45e5a26a564e7b.css
js.stripe.com/v3/fingerprinted/css/ Frame 04F8 11 KB
3 KB 50ms
49ms Stylesheet
text/css 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/css/elements-inner-payment-request-30c75c9984170b682d45e5a26a564e7b.css

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-payment-request-7cdcfcabc14b295d272b2a3834c63c39.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

b86c2a2bbfa9454750609b50a03f9510289842fc2268544bfc53921e1d9e65e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-payment-request-7cdcfcabc14b295d272b2a3834c63c39.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:09:42 GMT
content-encoding: br
via: 1.1 47c0295005ec7d8570406951491004c2.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
age: 773
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
last-modified: Mon, 04 Mar 2024 18:06:05 GMT
server: Cloudfront
etag: W/"fa32759e8db8ce19c25f0147f1281e2d"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
x-amz-cf-id: ITA2ZJhs77J_8QbNwRDijsvI2JThRECm4W_KI1DMo3gyb-mOxmVf2w==

GET
H3 200 ga-audiences
www.google.ca/ads/ 42 B
63 B 53ms
52ms Image
image/gif 142.251.16.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.94 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f94.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 01:22:34 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 6 Show response
m.stripe.com/ Frame 0E4A 156 B
667 B 98ms
97ms XHR
application/json 44.237.70.166
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.com/6

Requested by

Host: m.stripe.network
URL: https://m.stripe.network/out-4.5.43.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.237.70.166 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-44-237-70-166.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

59baf813b441feeb356bc088f9ec1ea4acbd920703ccf118e514ff99124d37e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://m.stripe.network/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-stripe-bg-intended-route-color: blue
date: Tue, 05 Mar 2024 01:22:34 GMT
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1709601754651888
server: nginx
content-type: application/json;charset=utf-8
x-stripe-server-envoy-upstream-service-time-ms: 2
access-control-allow-origin: https://m.stripe.network
x-stripe-client-envoy-start-time-us: 1709601754651567
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 156

POST
H2 200 6 Show response
m.stripe.com/ Frame 0E4A 156 B
667 B 143ms
142ms XHR
application/json 44.237.70.166
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.com/6

Requested by

Host: m.stripe.network
URL: https://m.stripe.network/out-4.5.43.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.237.70.166 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-44-237-70-166.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

59baf813b441feeb356bc088f9ec1ea4acbd920703ccf118e514ff99124d37e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://m.stripe.network/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-stripe-bg-intended-route-color: blue
date: Tue, 05 Mar 2024 01:22:34 GMT
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1709601754700153
server: nginx
content-type: application/json;charset=utf-8
x-stripe-server-envoy-upstream-service-time-ms: 1
access-control-allow-origin: https://m.stripe.network
x-stripe-client-envoy-start-time-us: 1709601754699948
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 156

GET
H2 200 .deploy_status_henson.json Show response
js.stripe.com/v3/ Frame 04F8 474 B
916 B 37ms
37ms Fetch
application/json 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/.deploy_status_henson.json

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-ef74aa054e59fdac81b538dfec92a050.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

5e155e1f89e5ca084a3510deea330a8ca019b906bc61469408830959033ce71f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/v3/elements-inner-payment-request-7cdcfcabc14b295d272b2a3834c63c39.html
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Tue, 05 Mar 2024 01:21:42 GMT
via: 1.1 077b94dab77b8114aebf503be197d7d8.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
age: 54
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
content-length: 474
last-modified: Mon, 04 Mar 2024 21:49:34 GMT
server: Cloudfront
etag: "741c7a42906bbd9aa745c3aea07bcd08"
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=60
accept-ranges: bytes
x-amz-cf-id: BTsa-gLmX5W6Ev2cjn4EGp2pV3vqH9CEofdx_npeDZj9HdbyGth2CQ==

GET
H2 200 api.js Show response
hcaptcha.com/1/ Frame D698 376 KB
107 KB 77ms
34ms Script
application/javascript 104.19.219.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hcaptcha.com/1/api.js?onload=captchaLoad&render=explicit

Requested by

Host: b.stripecdn.com
URL: https://b.stripecdn.com/stripethirdparty-srv/assets/v20.20/HCaptchaInvisible.html?id=e9a85cc3-a52b-4f0b-b825-423d8233d94d&origin=https%3A%2F%2Fjs.stripe.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.219.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f8372e4920304819a1afe1cb4a33def279a032e5d0154b53df47d05abdfc8077

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b.stripecdn.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:22:34 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 0012c469abc357ca0c936faaf17aa31a.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-content-type-options: nosniff
x-amz-version-id: Y83AnVQfVaYtiCkhua7rz_C8xbCj9kI1
age: 0
x-amz-cf-pop: YUL62-C2
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 26 Feb 2024 13:10:44 GMT
server: cloudflare
etag: W/"cf161ae1463888e6b05f1ecd1d11305b"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=300
cf-ray: 85f64bb6bcc339cf-YYZ
x-amz-cf-id: T6R00O6lO14cMYPWNOiOZSD8AyVlgYOx8yeO6tCKwrFVFwfiyj5L7A==

GET
H2 200 vendors~AddressAutocomplete~AffirmInContext~AmazonPayButton~AuthMap~DemoPayButton~DynamicMap~GoogleA~35711e2c.292fe004c7b932cf1066.bundle.js Show response
b.stripecdn.com/stripethirdparty-srv/assets/v20.20/ Frame D698 114 KB
35 KB 33ms
33ms Script
text/javascript 3.161.213.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://b.stripecdn.com/stripethirdparty-srv/assets/v20.20/vendors~AddressAutocomplete~AffirmInContext~AmazonPayButton~AuthMap~DemoPayButton~DynamicMap~GoogleA~35711e2c.292fe004c7b932cf1066.bundle.js

Requested by

Host: b.stripecdn.com
URL: https://b.stripecdn.com/stripethirdparty-srv/assets/v20.20/HCaptchaInvisible.html?id=e9a85cc3-a52b-4f0b-b825-423d8233d94d&origin=https%3A%2F%2Fjs.stripe.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.161.213.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-3-161-213-60.yul62.r.cloudfront.net

Software

Cloudfront /

Resource Hash

fa38eebb1eca7c94241152ae35cec12209d942905dc49f6d00dbe50636441258

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b.stripecdn.com/stripethirdparty-srv/assets/v20.20/HCaptchaInvisible.html?id=e9a85cc3-a52b-4f0b-b825-423d8233d94d&origin=https%3A%2F%2Fjs.stripe.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Tue, 05 Mar 2024 01:05:59 GMT
via: 1.1 f084ab450a6c71ebe23f8602cefd27ae.cloudfront.net (CloudFront)
age: 996
x-amz-cf-pop: YUL62-P1
x-cache: Hit from cloudfront
last-modified: Wed, 28 Feb 2024 17:12:29 GMT
server: Cloudfront
etag: W/"74e21b04fc13efe6e788fca7016ae74c"
vary: Accept-Encoding,Origin
content-type: text/javascript; charset=utf-8
cache-control: max-age=31536000, public
timing-allow-origin: *
x-amz-cf-id: pWC5DWRIJWIJPghfDKD1gMjehfY8nP4eMLI7EQthbpfRINH0tVFwqQ==

GET
H2 200 HCaptchaInvisible.b27e55a4db75cd3e653a.bundle.js Show response
b.stripecdn.com/stripethirdparty-srv/assets/v20.20/ Frame D698 18 KB
7 KB 49ms
49ms Script
text/javascript 3.161.213.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://b.stripecdn.com/stripethirdparty-srv/assets/v20.20/HCaptchaInvisible.b27e55a4db75cd3e653a.bundle.js

Requested by

Host: b.stripecdn.com
URL: https://b.stripecdn.com/stripethirdparty-srv/assets/v20.20/HCaptchaInvisible.html?id=e9a85cc3-a52b-4f0b-b825-423d8233d94d&origin=https%3A%2F%2Fjs.stripe.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.161.213.60 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-3-161-213-60.yul62.r.cloudfront.net

Software

Cloudfront /

Resource Hash

1a4f525d80a13304cfd01fb38dae9c118c952a65ba41168201849316389edba3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b.stripecdn.com/stripethirdparty-srv/assets/v20.20/HCaptchaInvisible.html?id=e9a85cc3-a52b-4f0b-b825-423d8233d94d&origin=https%3A%2F%2Fjs.stripe.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Tue, 05 Mar 2024 00:45:51 GMT
via: 1.1 f084ab450a6c71ebe23f8602cefd27ae.cloudfront.net (CloudFront)
age: 2204
x-amz-cf-pop: YUL62-P1
x-cache: Hit from cloudfront
last-modified: Wed, 28 Feb 2024 17:12:28 GMT
server: Cloudfront
etag: W/"5c3a6ff7fd254a2eb476e4e980564068"
vary: Accept-Encoding,Origin
content-type: text/javascript; charset=utf-8
cache-control: max-age=31536000, public
timing-allow-origin: *
x-amz-cf-id: VU44QcNz7IyR2NRQKDmCYVg8q5WCXTOJFfzIIos9by9lfm5fMpiSdg==

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 241 KB
84 KB 69ms
69ms Script
application/javascript 142.251.16.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-11094181768

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.97 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

b4517e9b56d54096b1f6945b42cf2f7874a260c931fd7a7aee706fceea3082e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:22:34 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85514
x-xss-protection: 0
last-modified: Tue, 05 Mar 2024 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 05 Mar 2024 01:22:34 GMT

POST
H3 204 rum Show response
secure.winred.com/cdn-cgi/ 0
142 B 24ms
19ms XHR
text/plain 104.19.211.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/v84a3a4012de94ce1a686ba8c167c359c1696973893317

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.211.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
content-type: application/json

Response headers

date: Tue, 05 Mar 2024 01:22:34 GMT
x-content-type-options: nosniff
server: cloudflare
vary: Origin
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://secure.winred.com
x-frame-options: DENY
access-control-allow-credentials: true
cf-ray: 85f64bb77cba3a08-YYZ

GET
H2 200 hcaptcha.html Show response
newassets.hcaptcha.com/captcha/v1/fadb9c6/static/ Frame 8ED8 2 KB
1 KB 43ms
38ms Document
text/html 104.19.219.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newassets.hcaptcha.com/captcha/v1/fadb9c6/static/hcaptcha.html?_v=4l6uwpy4knb

Requested by

Host: hcaptcha.com
URL: https://hcaptcha.com/1/api.js?onload=captchaLoad&render=explicit

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.219.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5d1472f984f903349331c5a8c6629a64439faa7cbdeaeb02d8d5dc6be01ed151

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://b.stripecdn.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-origin: *
age: 385947
alt-svc: h3=":443"; ma=86400
cache-control: max-age=1209600
cf-cache-status: HIT
cf-ray: 85f64bb78e1539cf-YYZ
content-encoding: br
content-type: text/html
cross-origin-embedder-policy: credentialless
cross-origin-resource-policy: cross-origin
date: Tue, 05 Mar 2024 01:22:34 GMT
last-modified: Mon, 26 Feb 2024 13:10:44 GMT
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
via: 1.1 d03af248468c898a111754f0666c2316.cloudfront.net (CloudFront)
x-amz-cf-id: ifHS0wcms2MsdZ-vNrMueOR1YMpAQ87HESBXWegh4FOdLcjz_h2wuw==
x-amz-cf-pop: YTO50-P2
x-amz-server-side-encryption: AES256
x-amz-version-id: w380JAJSDRpHmjdLNet.Oei.HbAumRcl
x-cache: Hit from cloudfront
x-content-type-options: nosniff

GET
H2 200 hcaptcha.js Show response
newassets.hcaptcha.com/captcha/v1/fadb9c6/ Frame 8ED8 376 KB
106 KB 29ms
29ms Script
application/javascript 104.19.219.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newassets.hcaptcha.com/captcha/v1/fadb9c6/hcaptcha.js

Requested by

Host: newassets.hcaptcha.com
URL: https://newassets.hcaptcha.com/captcha/v1/fadb9c6/static/hcaptcha.html?_v=4l6uwpy4knb

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.219.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f8372e4920304819a1afe1cb4a33def279a032e5d0154b53df47d05abdfc8077

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://newassets.hcaptcha.com/captcha/v1/fadb9c6/static/hcaptcha.html?_v=4l6uwpy4knb
Origin: https://newassets.hcaptcha.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:22:34 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 0012c469abc357ca0c936faaf17aa31a.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-content-type-options: nosniff
x-amz-version-id: Y83AnVQfVaYtiCkhua7rz_C8xbCj9kI1
age: 137052
x-amz-cf-pop: YUL62-C2
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 26 Feb 2024 13:10:44 GMT
server: cloudflare
etag: W/"cf161ae1463888e6b05f1ecd1d11305b"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=1209600
cf-ray: 85f64bb7deb439cf-YYZ
x-amz-cf-id: T6R00O6lO14cMYPWNOiOZSD8AyVlgYOx8yeO6tCKwrFVFwfiyj5L7A==

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/11094181768/ 3 KB
2 KB 57ms
57ms Script
text/javascript 142.251.163.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11094181768/?random=1709601754900&cv=11&fst=1709601754900&bg=ffffff&guid=ON&async=1&gtm=45be42t1v9102692410za200&gcd=13l3l3l3l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm%3Futm_term%3Dsv24&hn=www.googleadservices.com&frm=0&tiba=MAGA&npa=0&pscdl=noapi&auid=1106069799.1709601753&uamb=0&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-11094181768

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f155.1e100.net

Software

cafe /

Resource Hash

4676a12af77fdf53bc72913c6a28986c1f80374da45c64bf68aa4a7948abedaa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 01:22:34 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1341
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 checksiteconfig Show response
api2.hcaptcha.com/ Frame 8ED8 719 B
940 B 71ms
64ms XHR
application/json 104.19.219.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api2.hcaptcha.com/checksiteconfig?v=fadb9c6&host=b.stripecdn.com&sitekey=463b917e-e264-403f-ad34-34af0ee10294&sc=1&swa=1&spst=1

Requested by

Host: newassets.hcaptcha.com
URL: https://newassets.hcaptcha.com/captcha/v1/fadb9c6/hcaptcha.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.219.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e72afb30396e01243e6e2546e110f9ba69551e3fef008ee2669658fe4e5954d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://newassets.hcaptcha.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 05 Mar 2024 01:22:35 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
server: cloudflare
vary: Origin, Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://newassets.hcaptcha.com
access-control-allow-credentials: true
cf-ray: 85f64bb8982c39cf-YYZ
access-control-allow-headers: Cache-Control, Content-Type, DNT, Referer, User-Agent
alt-svc: h3=":443"; ma=86400

GET
H3 200 /
www.google.com/pagead/1p-user-list/11094181768/ 42 B
64 B 84ms
84ms Image
image/gif 172.253.122.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/11094181768/?random=1709601754900&cv=11&fst=1709600400000&bg=ffffff&guid=ON&async=1&gtm=45be42t1v9102692410za200&gcd=13l3l3l3l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm%3Futm_term%3Dsv24&frm=0&tiba=MAGA&npa=0&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQB7FLtqaPxuVS8uFgXKIPjv4QzV0juWoetr6ij9umCuZCCcuedPT83E&random=1124584185&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f99.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 01:22:35 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.ca/pagead/1p-user-list/11094181768/ 42 B
64 B 47ms
46ms Image
image/gif 142.251.16.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-user-list/11094181768/?random=1709601754900&cv=11&fst=1709600400000&bg=ffffff&guid=ON&async=1&gtm=45be42t1v9102692410za200&gcd=13l3l3l3l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm%3Futm_term%3Dsv24&frm=0&tiba=MAGA&npa=0&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQB7FLtqaPxuVS8uFgXKIPjv4QzV0juWoetr6ij9umCuZCCcuedPT83E&random=1124584185&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.94 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f94.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 01:22:35 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 hsw.js Show response
newassets.hcaptcha.com/c/4753532/ Frame 8ED8 505 KB
220 KB 47ms
47ms Script
application/javascript 104.19.219.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newassets.hcaptcha.com/c/4753532/hsw.js

Requested by

Host: newassets.hcaptcha.com
URL: https://newassets.hcaptcha.com/captcha/v1/fadb9c6/hcaptcha.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.219.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b0dc7511f9f3b8369a23f2a94f49b27b025a3719b0fba66b2c20701d6ab82820

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://newassets.hcaptcha.com/captcha/v1/fadb9c6/static/hcaptcha.html?_v=4l6uwpy4knb
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:22:35 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 67dd4d73b80aece69a8e725c6d612b6e.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-content-type-options: nosniff
x-amz-version-id: xYmORh03N7Se5zk_65rH8kcKE5HmZuvB
age: 37691
x-amz-cf-pop: YTO50-P2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 27 Feb 2024 12:49:07 GMT
server: cloudflare
etag: W/"33b2f95bda4299b75e695ffc983fcda5"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3024000
cf-ray: 85f64bb90a9339ed-YYZ
x-amz-cf-id: OsOXXcds708Kk5aLo64H2SF6uKIdngboSKaegfCz5pXeLPfEa7w6Vw==

POST
H2 200 b Show response
r.stripe.com/ Frame D6F4 0
274 B 96ms
96ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-ef74aa054e59fdac81b538dfec92a050.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: green
date: Tue, 05 Mar 2024 01:22:35 GMT
x-stripe-server-envoy-start-time-us: 1709601755288975
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 2
x-stripe-client-envoy-start-time-us: 1709601755288678
access-control-allow-credentials: true
content-length: 0

POST
H2 200 b Show response
r.stripe.com/ Frame B0D7 0
274 B 95ms
94ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-ef74aa054e59fdac81b538dfec92a050.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: green
date: Tue, 05 Mar 2024 01:22:35 GMT
x-stripe-server-envoy-start-time-us: 1709601755289009
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 2
x-stripe-client-envoy-start-time-us: 1709601755288712
access-control-allow-credentials: true
content-length: 0

POST
H2 200 b Show response
r.stripe.com/ Frame BF6D 0
274 B 96ms
96ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-ef74aa054e59fdac81b538dfec92a050.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: green
date: Tue, 05 Mar 2024 01:22:35 GMT
x-stripe-server-envoy-start-time-us: 1709601755490686
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 3
x-stripe-client-envoy-start-time-us: 1709601755490365
access-control-allow-credentials: true
content-length: 0

POST
H2 200 b Show response
r.stripe.com/ Frame D6F4 0
273 B 113ms
112ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-ef74aa054e59fdac81b538dfec92a050.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: green
date: Tue, 05 Mar 2024 01:22:35 GMT
x-stripe-server-envoy-start-time-us: 1709601755506220
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 4
x-stripe-client-envoy-start-time-us: 1709601755505977
access-control-allow-credentials: true
content-length: 0

POST
H2 200 463b917e-e264-403f-ad34-34af0ee10294 Show response
api.hcaptcha.com/getcaptcha/ Frame 8ED8 3 KB
3 KB 258ms
254ms XHR
application/octet-stream 104.19.219.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.hcaptcha.com/getcaptcha/463b917e-e264-403f-ad34-34af0ee10294

Requested by

Host: newassets.hcaptcha.com
URL: https://newassets.hcaptcha.com/captcha/v1/fadb9c6/hcaptcha.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.219.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1bd21ce44eeced85ecbf92e6a93cf791c68f798db170741fd3a67d77880ce7f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept: application/json, application/octet-stream
Referer: https://newassets.hcaptcha.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
content-type: application/x-www-form-urlencoded

Response headers

date: Tue, 05 Mar 2024 01:22:35 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin, Accept-Encoding
content-type: application/octet-stream
access-control-allow-origin: https://newassets.hcaptcha.com
access-control-allow-credentials: true
cf-ray: 85f64bbbae0e39cf-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 3286

POST
H2 200 b Show response
r.stripe.com/ Frame B0D7 0
274 B 98ms
98ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-ef74aa054e59fdac81b538dfec92a050.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: green
date: Tue, 05 Mar 2024 01:22:35 GMT
x-stripe-server-envoy-start-time-us: 1709601755560715
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 3
x-stripe-client-envoy-start-time-us: 1709601755560541
access-control-allow-credentials: true
content-length: 0

POST
H2 200 b Show response
r.stripe.com/ Frame D6F4 0
274 B 95ms
95ms Fetch
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-ef74aa054e59fdac81b538dfec92a050.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: green
date: Tue, 05 Mar 2024 01:22:36 GMT
x-stripe-server-envoy-start-time-us: 1709601756766335
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 2
x-stripe-client-envoy-start-time-us: 1709601756765926
access-control-allow-credentials: true
content-length: 0

GET
H2 200 common.js Show response
maps.googleapis.com/maps-api-v3/api/js/56/1/ 255 KB
56 KB 37ms
36ms Script
text/javascript 172.253.62.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps-api-v3/api/js/56/1/common.js

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f95.1e100.net

Software

sffe /

Resource Hash

9ea16efa9e53039fffb7ccf6bee49de744e04402da82e1070d45733ef4a36711

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 23:47:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5736
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56751
x-xss-protection: 0
last-modified: Tue, 20 Feb 2024 19:28:53 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="maps-api-js"
vary: Accept-Encoding, Origin
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 04 Mar 2025 23:47:02 GMT

GET
H2 200 util.js Show response
maps.googleapis.com/maps-api-v3/api/js/56/1/ 180 KB
56 KB 42ms
42ms Script
text/javascript 172.253.62.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps-api-v3/api/js/56/1/util.js

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f95.1e100.net

Software

sffe /

Resource Hash

c6dc2d05669b7d0b896bb7185ed18035463aa200da0022364d446579365a8350

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:17:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 316
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56881
x-xss-protection: 0
last-modified: Tue, 20 Feb 2024 19:28:53 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="maps-api-js"
vary: Accept-Encoding, Origin
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 05 Mar 2025 01:17:22 GMT

GET
H2 200 trusted-types-checker-efd8cf45ce422659c098993bfc62531b.js Show response
js.stripe.com/v3/fingerprinted/js/ 176 B
677 B 38ms
37ms Script
text/javascript 52.85.151.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/trusted-types-checker-efd8cf45ce422659c098993bfc62531b.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.151.31 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-151-31.iad89.r.cloudfront.net

Software

Cloudfront /

Resource Hash

07b6b3d899dd69c0e9eb463e23e10e30e82588eddf95d15d45bb505c6703a813

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:16:45 GMT
via: 1.1 47c0295005ec7d8570406951491004c2.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=31556926; includeSubDomains; preload
age: 360
x-amz-cf-pop: IAD89-C3
x-cache: Hit from cloudfront
content-length: 176
last-modified: Fri, 01 Mar 2024 22:43:32 GMT
server: Cloudfront
etag: "96f5b26d366f47393b3ff36fe7471474"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: NTIjgiA-8LmgztNn70u-bVc9gkmTsfqTsaT5SFw6JW4tjnZyXbJbhA==

GET
H3 200 collect Show response
gtm.winred.com/g/ 322 B
585 B 433ms
432ms XHR
text/plain 104.16.250.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gtm.winred.com/g/collect?v=2&tid=G-X6H0114PDF&gtm=45je42t1v867905447z872410129za200&_p=1709601752789&gcd=13l3l3l3l1&npa=0&dma=0&cid=2069319955.1709601754&ul=en-us&sr=1600x1200&ur=CA-ON&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&sst.uc=CA&sst.gse=1&sst.etld=google.ca&sst.gcd=13l3l3l3l1&sst.tft=1709601752789&_s=3&sid=1709601753&sct=1&seg=0&dl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm%3Futm_term%3Dsv24&dt=MAGA&en=page_load_time_event&ep.pagepath=%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm&ep.pagehostname=secure.winred.com&ep.parsedurl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm&epn.load_time_sec=2.4&epn.event_fire_time=1709601754774&ep.event_uuid=77bb077a-d137-4895-9d57-b31d5658dfb5&ep.isVideoPage=f&ep.referrer=&ep.category=donation%20landing%20page&ep.action=user%20session%20start&ep.label=landing%20page%20settings&ep.customCSS=t&ep.usercategory=anonymous&epn.loading_time_sec_on_window_load=2.37&_et=1204&tfd=7375&richsstsse

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.250.69 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f97f3418898da4d132398f7eb525629ba58c883ea55a48495ff61ae2e9265ed5

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 01:22:40 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
server: cloudflare
strict-transport-security: max-age=0; includeSubDomains
vary: Accept-Encoding
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 85f64bd6aabaa246-YYZ
alt-svc: h3=":443"; ma=86400

GET
H3 200 ga-audiences
www.google.ca/ads/ 42 B
63 B 53ms
53ms Image
image/gif 142.251.16.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.94 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f94.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 01:22:40 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

59 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

33 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
app.winred.com/api/v3/users	1970-01-21 04:29:21	Name: rvid Value: f70f37fd-d948-4067-8d47-251bb89624e4
.secure.winred.com/	1970-01-20 18:53:23	Name: __cf_bm Value: aehI4bBwQ3rIKVRJHGS4FGnSs_jw2vllLMcvc5UBuq0-1709601752-1.0.1.1-M7n6waTaQ3m6NxoL6UIHFk.o.ZCti1_Ayi_l7955zFHIRM4rg8rK3sq8WFaW7bvyx.ISSF8t.6eSZoixo9j8GQ
.winred.com/	1970-01-20 21:02:57	Name: _gcl_au Value: 1.1.1106069799.1709601753
secure.winred.com/	1969-12-31 23:59:59	Name: origin_url Value: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24
.winred.com/	1970-01-20 18:54:48	Name: _gid Value: GA1.2.970251179.1709601754
.winred.com/	1970-01-20 18:53:21	Name: _dc_gtm_UA-73658561-7 Value: 1
.winred.com/	1970-01-20 18:53:21	Name: _gat_UA-60901920-1 Value: 1
secure.winred.com/	1969-12-31 23:59:59	Name: sso_tries Value: 1
secure.winred.com/	1970-01-21 04:29:21	Name: rvid Value: f70f37fd-d948-4067-8d47-251bb89624e4
.winred.com/	1969-12-31 23:59:59	Name: _revv_v3_session Value: ZXlsbHlGblRsdGxtSVlXeWtqSTV2WkEraTZra2FNQ0xZQmJ4eXNwbXdNSnljOGVoREhIMzJQV1UySG1KdVN2Tm9DYnlPVDJUS2ZDSUVUTS9zSksrYzJ6dDdtV1lETEhPU01HZmxlTVhnbDZ1WGprZnR5UXNhbHpqcHlSdTF0bGJCSjQvYU5iSy9STXhpa3FBNm5ENXl6dVhSL0lGTmFEeDBlazk3dkNIVkp0UTdIdEZqMmFRR2ZIN0tkNnJEU0xOeTRwSUc2anhkRjlMZ3N2eThUMTRPUFpweXlvbnpYeTQ0cm0zRUNyaXA1Uk1JcThOZXNqZkZrbmp4dDdWaGNmc3dDTC9GaHEvVG1IeGFOL0hIek53QkkvS3VlMmxXVU5UTk5lY053UDVURmxaS1FvSlRZQ1F6RXpXbTU0T3d4ejF5YVQzcmxFVnlzWks0VmNaTSszUUVXbXR5VU9KeC9ud25HelNsSzUrQ1BnPS0tQ083NGhoOHA5VnZ6TVRzNGFWYnpxdz09--301c938e0336efead005b064adaaf18d5c05674a
.winred.com/	1970-01-21 04:29:21	Name: FPID Value: FPID2.2.ULISyEABy7oNGI9yiZxhGpJMAWtSSBuAOSHr5MJ6Vgk%3D.1709601754
.winred.com/	1970-01-20 18:53:23	Name: FPGSID Value: 1.1709601753.1709601753.G-X6H0114PDF.yJP4kLgx5DEWKHwTeF4YFQ
.secure.winred.com/	1970-01-21 03:38:57	Name: cf_clearance Value: pgdIgOS4qnkwYROS1G3WVp66KVC22RaOsxAdP_H3Vn4-1709601753-1.0.1.1-gndUD_AznDWXFtU8USJlQnGKrJl7mwGtJIiVex.pjtt4Ka.cpQhm7OjBM5dKHcwkYXYSqHcEqZlSuvGICfDzKg
secure.winred.com/	1970-01-20 21:17:18	Name: _cids Value: W10=
.winred.com/	1970-01-21 04:29:21	Name: _ga_0YWKLMCX4D Value: GS1.1.1709601754.1.0.1709601754.0.0.0
.winred.com/	1970-01-21 04:29:21	Name: _ga Value: GA1.1.2069319955.1709601754
.t.co/	1970-01-21 04:29:21	Name: muc_ads Value: d26905b4-a6db-4c15-b3f4-dacb956341de
.winred.com/	1970-01-20 21:02:57	Name: _fbp Value: fb.1.1709601754204.463142585
.twitter.com/	1970-01-21 04:29:21	Name: guest_id_marketing Value: v1%3A170960175412404819
.twitter.com/	1970-01-21 04:29:21	Name: guest_id_ads Value: v1%3A170960175412404819
.twitter.com/	1970-01-21 04:29:21	Name: personalization_id Value: "v1_0GsbxL3BPKNO8Lmg/mfWIg=="
.twitter.com/	1970-01-21 04:29:21	Name: guest_id Value: v1%3A170960175412404819
.winred.com/	1970-01-21 04:29:21	Name: _ga_HNR33QTX08 Value: GS1.2.1709601754.1.0.1709601754.60.0.0
.doubleclick.net/	1970-01-20 23:12:33	Name: receive-cookie-deprecation Value: 1
.winred.com/	1970-01-20 18:54:33	Name: FPLC Value: zjgZJAJTL37MJHwHQ1mHpyesjOAsjyEw7qKLnQJ5%2Fv3OYUqqqvHqAKqu%2BpCIbqYyQhA1yubOtAq%2Fluk4NGRdjPVQGYGq%2BwC%2BeSnJPmOSzuTQ3bX73BLWscYlZcxwTg%3D%3D
m.stripe.com/	1970-01-21 04:29:21	Name: m Value: ee293502-378b-4943-b849-391815a8e1228bc0c1
.secure.winred.com/	1970-01-21 03:38:57	Name: __stripe_mid Value: cf19fd14-c29a-41bc-a781-55d18c6eb95d30bc52
.secure.winred.com/	1970-01-20 18:53:23	Name: __stripe_sid Value: ca62df89-0806-4d9b-ba6f-5e6feadc6eb1dac96b
.google.com/	1970-01-20 23:16:52	Name: NID Value: 512=tP3uuMWwXMzZWD80wi-KopkblFttXB0HKMEJjobyLYur_Xns70CMAzEQrCuVZ6lS3P34n03DkAjeDekEIJ86qFXZCN66VUR746sBDt7w8JDJWmghj2Q_X6_KCuILyWDel63LRyDv0a3vKLyj2zgRL5h8_ODqaEt8sfgx_PdoBZA
.winred.com/	1970-01-21 04:29:21	Name: _ga_X6H0114PDF Value: GS1.1.1709601753.1.0.1709601754.0.0.0
.doubleclick.net/	1970-01-21 04:29:21	Name: IDE Value: AHWqTUl1RXxeImKqvRByQNzoRZ7bgjpyPIfLpIqhUuDrq77xznPFk7-SmcZAXMGT
api2.hcaptcha.com/	1970-01-20 18:53:23	Name: __cflb Value: 0H28vk2VKwPbLoawFincekpozDKK5F2coqCLTnqV59o
api.hcaptcha.com/	1970-01-20 19:36:33	Name: hmt_id Value: ff7aa5d9-3690-4116-86a7-e1b98752bfe9

147 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24(Line 81) Message: [Report Only] Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'none'". Either the 'unsafe-inline' keyword, a hash ('sha256-Y62uClxHT/+p4DiZMnaZYOnhl+f8evm7bGF7TDZ40fg='), or a nonce ('nonce-...') is required to enable inline execution.
security	error	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24(Line 85) Message: [Report Only] Refused to load the script 'https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	error	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24(Line 88) Message: [Report Only] Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'none'". Either the 'unsafe-inline' keyword, a hash ('sha256-RYHBU9XwtItfN/gbdli5CLzQBpf00XF5v0ziJN9bFnI='), or a nonce ('nonce-...') is required to enable inline execution.
security	error	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24(Line 89) Message: [Report Only] Refused to load the script 'https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	error	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24(Line 91) Message: [Report Only] Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'none'". Either the 'unsafe-inline' keyword, a hash ('sha256-CjpKldNDinZf7V2Y+g385YiXEGq737MTWxw+TRczzvE='), or a nonce ('nonce-...') is required to enable inline execution.
security	error	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: [Report Only] Refused to load the script 'https://js.stripe.com/v3/' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	error	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: [Report Only] Refused to load the script 'https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	error	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: [Report Only] Refused to load the script 'https://secure.winred.com/assets/application-landing-page-e23d78f5dae749bd70067ba6d3bdf2e924c8866792d4dc2d5570569787a0c676.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	error	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24(Line 113) Message: [Report Only] Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'none'". Either the 'unsafe-inline' keyword, a hash ('sha256-yGeKb3AVzRckwWH8I5vART4qyYjtesQSTRch7VE67zs='), or a nonce ('nonce-...') is required to enable inline execution.
security	error	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24(Line 810) Message: [Report Only] Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'none'". Either the 'unsafe-inline' keyword, a hash ('sha256-q2xCvcIbBLakLjLlgrn73DQQN5cP2J0gXz60IiegeOo='), or a nonce ('nonce-...') is required to enable inline execution.
security	error	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24(Line 865) Message: [Report Only] Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'none'". Either the 'unsafe-inline' keyword, a hash ('sha256-1Bw7TjWNUn7YZ0rmm7mwPGunSUts+BNo8XU3SKc+TwM='), or a nonce ('nonce-...') is required to enable inline execution.
security	error	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: [Report Only] Refused to load the script 'https://static.cloudflareinsights.com/beacon.min.js/v84a3a4012de94ce1a686ba8c167c359c1696973893317' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	error	URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places(Line 306) Message: [Report Only] Refused to connect to 'https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N(Line 82) Message: [Report Only] Refused to load the script 'https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N(Line 82) Message: [Report Only] Refused to load the script 'https://www.google-analytics.com/analytics.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://secure.winred.com/assets/application-landing-page-e23d78f5dae749bd70067ba6d3bdf2e924c8866792d4dc2d5570569787a0c676.js Message: [Report Only] Refused to connect to 'https://app.winred.com/api/v3/users/current_with_info?organization_token=rv_org_6KNvU36Z2qWJ2gfUBWqGZGoc&redirect=https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	error	URL: https://secure.winred.com/assets/application-landing-page-e23d78f5dae749bd70067ba6d3bdf2e924c8866792d4dc2d5570569787a0c676.js Message: [Report Only] Refused to connect to 'https://secure.winred.com/api/v3/donations/live/rv_page_01hr3zrzm75ssesdfsbybbd0zh-9fcbb6d04685cd54fcf661b9e48369bba4ec6bb1?stream_id=afb27b30ac04af833b868fca9abb1065f2d554d9&_=1709601753079' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	error	URL: https://secure.winred.com/assets/application-landing-page-e23d78f5dae749bd70067ba6d3bdf2e924c8866792d4dc2d5570569787a0c676.js Message: [Report Only] Refused to connect to 'https://secure.winred.com/api/v3/donations/live/rv_page_01hr3zrzm75ssesdfsbybbd0zh-4f7c82f70c55d32a024862ed129dea43d5423022?stream_id=b6419ff9c5e4708ebb53061c35169ffbe13c3cbc&_=1709601753080' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	error	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24(Line 855) Message: [Report Only] Refused to connect to 'https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm/forms/statistics' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	error	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24(Line 865) Message: [Report Only] Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'none'". Either the 'unsafe-inline' keyword, a hash ('sha256-Yzt2QhBFFgFbINCVyGospXEHcXOIJcHe5HZ4IJc9JKc='), or a nonce ('nonce-...') is required to enable inline execution.
security	error	Message: [Report Only] Refused to load the script 'https://secure.winred.com/cdn-cgi/challenge-platform/scripts/jsd/main.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	error	URL: about:blank Message: [Report Only] Refused to load the script 'https://secure.winred.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/a0d8959cb7d0/main.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG(Line 108) Message: [Report Only] Refused to load the script 'https://www.googletagmanager.com/gtag/js?id=G-0YWKLMCX4D&l=dataLayer&cx=c' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG(Line 108) Message: [Report Only] Refused to load the script 'https://www.googletagmanager.com/gtag/destination?id=DC-9381094&l=dataLayer&cx=c' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG(Line 108) Message: [Report Only] Refused to load the script 'https://www.google-analytics.com/analytics.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG(Line 108) Message: [Report Only] Refused to load the script 'https://static.ads-twitter.com/uwt.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG(Line 688) Message: [Report Only] Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'none'". Either the 'unsafe-inline' keyword, a hash ('sha256-X1YB4YDsT/76vITASbLgpo+d53L/JfPn68r1qyazC1E='), or a nonce ('nonce-...') is required to enable inline execution.
security	error	Message: [Report Only] Refused to load the script 'https://connect.facebook.net/en_US/fbevents.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG(Line 688) Message: [Report Only] Refused to load the script 'https://a.ads.rmbl.ws/ratag?id=AV-6622' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c(Line 568) Message: [Report Only] Refused to connect to 'https://gtm.winred.com/g/collect?v=2&tid=G-X6H0114PDF&gtm=45je42t1v867905447z872410129za200&_p=1709601752789&gcd=13l3l3l3l1&npa=0&dma=0&cid=2069319955.1709601754&ul=en-us&sr=1600x1200&_fplc=0&ur=CA-ON&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&sst.uc=CA&sst.gse=1&sst.etld=google.ca&sst.gcd=13l3l3l3l1&sst.tft=1709601752789&_s=1&sid=1709601753&sct=1&seg=0&dl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm%3Futm_term%3Dsv24&dt=MAGA&en=page_view&_fv=1&_nsi=1&_ss=1&ep.pagepath=%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm&ep.pagehostname=secure.winred.com&ep.parsedurl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm&epn.load_time_sec=-1709601752.4&epn.event_fire_time=1709601753253&ep.event_uuid=748f46f3-42e6-4f57-b01c-528041b55ba0&ep.isVideoPage=f&ep.referrer=&tfd=1137&richsstsse' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	error	URL: https://www.google-analytics.com/analytics.js(Line 35) Message: [Report Only] Refused to connect to 'https://www.google-analytics.com/j/collect?v=1&_v=j101&a=563779294&t=pageview&_s=1&dl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm%3Futm_term%3Dsv24&ul=en-us&de=UTF-8&dt=MAGA&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YCDAiEABBAAAACAEK~&jid=1061310776&gjid=1644107758&cid=2069319955.1709601754&tid=UA-73658561-7&_gid=970251179.1709601754&_slc=1&gtm=45He42t1n71NTQZ9Nv72410129za220&cd61=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm%3Futm_term%3Dsv24&gcd=13l3l3l3l1&dma=0&z=2011960288' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	error	URL: https://www.google-analytics.com/analytics.js(Line 35) Message: [Report Only] Refused to connect to 'https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-73658561-7&cid=2069319955.1709601754&jid=1061310776&gjid=1644107758&_gid=970251179.1709601754&_u=YCDAiEABBAAAAGAEK~&z=1967322199' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	error	URL: https://www.google-analytics.com/analytics.js(Line 35) Message: [Report Only] Refused to connect to 'https://www.google-analytics.com/j/collect?v=1&_v=j101&a=563779294&t=pageview&_s=1&dl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm%3Futm_term%3Dsv24&ul=en-us&de=UTF-8&dt=MAGA&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YCDACEABBAAAAGAEK~&jid=1446788077&gjid=89362190&cid=2069319955.1709601754&tid=UA-60901920-1&_gid=970251179.1709601754&_r=1&_slc=1&gtm=45He42t1n71M27JCGv72350723za220&gcd=13l3l3l3l1&dma=0&z=428061092' because it violates the following Content Security Policy directive: "connect-src 'none'".
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
security	error	URL: https://secure.winred.com/cdn-cgi/challenge-platform/scripts/jsd/main.js Message: [Report Only] Refused to connect to 'https://secure.winred.com/cdn-cgi/challenge-platform/h/g/jsd/r/85f64ba9ccee53e9' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG(Line 688) Message: [Report Only] Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'none'". Either the 'unsafe-inline' keyword, a hash ('sha256-CWJ/WRSiXljvQU6HBwplzPj7J5fTBy0m8cGIEguVbFA='), or a nonce ('nonce-...') is required to enable inline execution.
security	error	URL: https://www.google-analytics.com/analytics.js(Line 35) Message: [Report Only] Refused to connect to 'https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-60901920-1&cid=2069319955.1709601754&jid=1446788077&gjid=89362190&_gid=970251179.1709601754&_u=YCDACEABBAAAAGAEK~&z=756716541' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	error	URL: https://www.google-analytics.com/analytics.js(Line 23) Message: [Report Only] Refused to load the script 'https://www.googletagmanager.com/gtag/js?id=G-HNR33QTX08&cx=c&_slc=1' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	error	URL: https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c(Line 185) Message: [Report Only] Refused to connect to 'https://analytics.google.com/g/s/collect?dma=0&gtm=45j91e42t1v867905447z872410129z9867900975za200&_gsid=X6H0114PDFyJP4kLgx5DEWKHwTeF4YFQ' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c(Line 185) Message: [Report Only] Refused to connect to 'https://analytics.google.com/g/s/collect?dma=0&gtm=45j91e42t1v867905447z872410129z9867900975za200&_gsid=X6H0114PDFyJP4kLgx5DEWKHwTeF4YFQ' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c(Line 185) Message: [Report Only] Refused to connect to 'https://stats.g.doubleclick.net/g/collect?v=2&dma=0&tid=G-X6H0114PDF&cid=ULISyEABy7oNGI9yiZxhGpJMAWtSSBuAOSHr5MJ6Vgk%3D.1709601754&gtm=45j91e42t1v867905447z872410129z9867900975za200&aip=1' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c(Line 185) Message: [Report Only] Refused to connect to 'https://stats.g.doubleclick.net/g/collect?v=2&dma=0&tid=G-X6H0114PDF&cid=ULISyEABy7oNGI9yiZxhGpJMAWtSSBuAOSHr5MJ6Vgk%3D.1709601754&gtm=45j91e42t1v867905447z872410129z9867900975za200&aip=1' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	error	URL: https://connect.facebook.net/en_US/fbevents.js(Line 23) Message: [Report Only] Refused to load the script 'https://connect.facebook.net/signals/config/1599889267195467?v=2.9.148&r=stable&domain=secure.winred.com&hme=20c913bdcd4be51a752120153aa5caaecb3ee86c7f26cf737846e40b202aba68&ex_m=62%2C106%2C94%2C98%2C53%2C3%2C88%2C61%2C14%2C86%2C79%2C44%2C46%2C150%2C153%2C164%2C160%2C161%2C163%2C25%2C89%2C45%2C68%2C162%2C145%2C148%2C157%2C158%2C165%2C115%2C13%2C43%2C169%2C168%2C117%2C16%2C29%2C32%2C1%2C36%2C57%2C58%2C59%2C63%2C83%2C15%2C12%2C85%2C82%2C81%2C95%2C97%2C31%2C96%2C26%2C22%2C146%2C149%2C124%2C24%2C9%2C10%2C11%2C5%2C6%2C21%2C19%2C20%2C49%2C54%2C56%2C66%2C90%2C23%2C67%2C8%2C7%2C71%2C41%2C18%2C92%2C91%2C17%2C4%2C73%2C80%2C72%2C78%2C40%2C39%2C77%2C33%2C35%2C76%2C48%2C74%2C28%2C37%2C65%2C0%2C84%2C75%2C2%2C30%2C55%2C34%2C93%2C38%2C70%2C60%2C99%2C52%2C51%2C27%2C87%2C50%2C47%2C42%2C69%2C64%2C100' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	error	URL: https://www.googletagmanager.com/gtag/js?id=G-0YWKLMCX4D&l=dataLayer&cx=c(Line 214) Message: [Report Only] Refused to connect to 'https://www.google-analytics.com/g/collect?v=2&tid=G-0YWKLMCX4D&gtm=45je42t1v9102512289z872350723za200&_p=1709601752789&gcd=13l3l3l3l1&npa=0&dma=0&cid=2069319955.1709601754&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_s=1&sid=1709601754&sct=1&seg=0&dl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm%3Futm_term%3Dsv24&dt=MAGA&en=page_view&_fv=1&_ss=1&ep.cookieDomain=auto&tfd=1667' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtag/js?id=G-0YWKLMCX4D&l=dataLayer&cx=c(Line 214) Message: [Report Only] Refused to connect to 'https://www.google-analytics.com/g/collect?v=2&tid=G-0YWKLMCX4D&gtm=45je42t1v9102512289z872350723za200&_p=1709601752789&gcd=13l3l3l3l1&npa=0&dma=0&cid=2069319955.1709601754&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_s=1&sid=1709601754&sct=1&seg=0&dl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm%3Futm_term%3Dsv24&dt=MAGA&en=page_view&_fv=1&_ss=1&ep.cookieDomain=auto&tfd=1667' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtag/js?id=G-0YWKLMCX4D&l=dataLayer&cx=c(Line 210) Message: [Report Only] Refused to load the script 'https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11091438865/?random=1709601754074&cv=11&fst=1709601754074&bg=ffffff&guid=ON&async=1&gtm=45je42t1v9102512289z872350723za200&gcd=13l3l3l3l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm%3Futm_term%3Dsv24&hn=www.googleadservices.com&frm=0&tiba=MAGA&npa=0&pscdl=noapi&auid=1106069799.1709601753&uamb=0&uaw=0&fdr=QA&data=event%3Dgtag.config%3BcookieDomain%3Dauto&rfmt=3&fmt=4' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	error	URL: https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c(Line 568) Message: [Report Only] Refused to connect to 'https://gtm.winred.com/g/collect?v=2&tid=G-X6H0114PDF&gtm=45je42t1v867905447z872410129za200&_p=1709601752789&gcd=13l3l3l3l1&npa=0&dma=0&cid=2069319955.1709601754&ul=en-us&sr=1600x1200&_fplc=0&ur=CA-ON&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&sst.uc=CA&sst.gse=1&sst.etld=google.ca&sst.gcd=13l3l3l3l1&sst.tft=1709601752789&_s=2&sid=1709601753&sct=1&seg=0&dl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm%3Futm_term%3Dsv24&dt=MAGA&en=user%2...sing-committee%2Flp-email-quit-tuesday-bm&ep.pagehostname=secure.winred.com&ep.parsedurl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm&epn.load_time_sec=-1709601752.4&epn.event_fire_time=1709601753326&ep.event_uuid=d91d666f-a90c-4c90-9f43-db5c75668c45&ep.isVideoPage=f&ep.referrer=&ep.category=donation%20landing%20page&ep.action=user%20session%20start&ep.label=landing%20page%20settings&ep.customCSS=t&ep.usercategory=anonymous&_et=4&tfd=1752&richsstsse' because it violates the following Content Security Policy directive: "connect-src 'none'".
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://connect.facebook.net/signals/config/1599889267195467?v=2.9.148&r=stable&domain=secure.winred.com&hme=20c913bdcd4be51a752120153aa5caaecb3ee86c7f26cf737846e40b202aba68&ex_m=62%2C106%2C94%2C98%2C53%2C3%2C88%2C61%2C14%2C86%2C79%2C44%2C46%2C150%2C153%2C164%2C160%2C161%2C163%2C25%2C89%2C45%2C68%2C162%2C145%2C148%2C157%2C158%2C165%2C115%2C13%2C43%2C169%2C168%2C117%2C16%2C29%2C32%2C1%2C36%2C57%2C58%2C59%2C63%2C83%2C15%2C12%2C85%2C82%2C81%2C95%2C97%2C31%2C96%2C26%2C22%2C146%2C149%2C124%2C24%2C9%2C10%2C11%2C5%2C6%2C21%2C19%2C20%2C49%2C54%2C56%2C66%2C90%2C23%2C67%2C8%2C7%2C71%2C41%2C18%2C92%2C91%2C17%2C4%2C73%2C80%2C72%2C78%2C40%2C39%2C77%2C33%2C35%2C76%2C48%2C74%2C28%2C37%2C65%2C0%2C84%2C75%2C2%2C30%2C55%2C34%2C93%2C38%2C70%2C60%2C99%2C52%2C51%2C27%2C87%2C50%2C47%2C42%2C69%2C64%2C100(Line 105) Message: Unrecognized feature: 'attribution-reporting'.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
security	error	URL: https://www.googletagmanager.com/gtag/js?id=G-HNR33QTX08&cx=c&_slc=1(Line 160) Message: [Report Only] Refused to connect to 'https://analytics.google.com/g/collect?v=2&tid=G-HNR33QTX08&_ono=1&gtm=45je42t1v9164375506za200&_p=1709601752789&_gaz=1&gcd=13l3l3l3l2&npa=0&dma=0&ul=en-us&sr=1600x1200&cid=2069319955.1709601754&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_eu=EBAI&_s=1&dl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm%3Futm_term%3Dsv24&dt=MAGA&sid=1709601754&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1&tfd=1844' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtag/js?id=G-HNR33QTX08&cx=c&_slc=1(Line 160) Message: [Report Only] Refused to connect to 'https://analytics.google.com/g/collect?v=2&tid=G-HNR33QTX08&_ono=1&gtm=45je42t1v9164375506za200&_p=1709601752789&_gaz=1&gcd=13l3l3l3l2&npa=0&dma=0&ul=en-us&sr=1600x1200&cid=2069319955.1709601754&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_eu=EBAI&_s=1&dl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm%3Futm_term%3Dsv24&dt=MAGA&sid=1709601754&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1&tfd=1844' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtag/js?id=G-HNR33QTX08&cx=c&_slc=1(Line 160) Message: [Report Only] Refused to connect to 'https://stats.g.doubleclick.net/g/collect?v=2&_ono=1&tid=G-HNR33QTX08&cid=2069319955.1709601754&gtm=45je42t1v9164375506za200&aip=1&dma=0&gcd=13l3l3l3l2&npa=0' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtag/js?id=G-HNR33QTX08&cx=c&_slc=1(Line 160) Message: [Report Only] Refused to connect to 'https://stats.g.doubleclick.net/g/collect?v=2&_ono=1&tid=G-HNR33QTX08&cid=2069319955.1709601754&gtm=45je42t1v9164375506za200&aip=1&dma=0&gcd=13l3l3l3l2&npa=0' because it violates the following Content Security Policy directive: "connect-src 'none'".
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
security	error	URL: https://js.stripe.com/v3/ Message: [Report Only] Refused to load the script 'https://js.stripe.com/v3/fingerprinted/js/phone-numbers-lib-5113174565c377315fd5b8d695d8b541.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG(Line 4) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG(Line 688) Message: [Report Only] Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'none'". Either the 'unsafe-inline' keyword, a hash ('sha256-Wbw1pzQPBvA3XyLpz7zNnLjxgyjZTjqb4BPIrOdV1Ek='), or a nonce ('nonce-...') is required to enable inline execution.
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG(Line 688) Message: [Report Only] Refused to load the script 'https://www.googletagmanager.com/gtag/js?id=AW-11094181768' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	error	URL: https://static.cloudflareinsights.com/beacon.min.js/v84a3a4012de94ce1a686ba8c167c359c1696973893317 Message: [Report Only] Refused to connect to 'https://secure.winred.com/cdn-cgi/rum?' because it violates the following Content Security Policy directive: "connect-src 'none'".
security	error	URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG(Line 688) Message: [Report Only] Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'none'". Either the 'unsafe-inline' keyword, a hash ('sha256-bdt9E3fbNrmM9dieUHboM6wI3gBr7jAfnvgp8Fh2cbs='), or a nonce ('nonce-...') is required to enable inline execution.
security	error	URL: https://www.googletagmanager.com/gtag/js?id=AW-11094181768(Line 111) Message: [Report Only] Refused to load the script 'https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11094181768/?random=1709601754900&cv=11&fst=1709601754900&bg=ffffff&guid=ON&async=1&gtm=45be42t1v9102692410za200&gcd=13l3l3l3l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm%3Futm_term%3Dsv24&hn=www.googleadservices.com&frm=0&tiba=MAGA&npa=0&pscdl=noapi&auid=1106069799.1709601753&uamb=0&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=4' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-email-quit-tuesday-bm?utm_term=sv24 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
security	error	URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places(Line 210) Message: [Report Only] Refused to load the script 'https://maps.googleapis.com/maps-api-v3/api/js/56/1/common.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	error	URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places(Line 210) Message: [Report Only] Refused to load the script 'https://maps.googleapis.com/maps-api-v3/api/js/56/1/util.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	error	URL: https://js.stripe.com/v3/ Message: [Report Only] Refused to load the script 'https://js.stripe.com/v3/fingerprinted/js/trusted-types-checker-efd8cf45ce422659c098993bfc62531b.js' because it violates the following Content Security Policy directive: "script-src 'none'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security	error	URL: https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c(Line 568) Message: [Report Only] Refused to connect to 'https://gtm.winred.com/g/collect?v=2&tid=G-X6H0114PDF&gtm=45je42t1v867905447z872410129za200&_p=1709601752789&gcd=13l3l3l3l1&npa=0&dma=0&cid=2069319955.1709601754&ul=en-us&sr=1600x1200&ur=CA-ON&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&sst.uc=CA&sst.gse=1&sst.etld=google.ca&sst.gcd=13l3l3l3l1&sst.tft=1709601752789&_s=3&sid=1709601753&sct=1&seg=0&dl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm%3Futm_term%3Dsv24&dt=MAGA&en=page_load_time...sday-bm&ep.pagehostname=secure.winred.com&ep.parsedurl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-email-quit-tuesday-bm&epn.load_time_sec=2.4&epn.event_fire_time=1709601754774&ep.event_uuid=77bb077a-d137-4895-9d57-b31d5658dfb5&ep.isVideoPage=f&ep.referrer=&ep.category=donation%20landing%20page&ep.action=user%20session%20start&ep.label=landing%20page%20settings&ep.customCSS=t&ep.usercategory=anonymous&epn.loading_time_sec_on_window_load=2.37&_et=1204&tfd=7375&richsstsse' because it violates the following Content Security Policy directive: "connect-src 'none'".

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

9381094.fls.doubleclick.net
a.ads.rmbl.ws
adservice.google.com
analytics.google.com
analytics.twitter.com
api.hcaptcha.com
api2.hcaptcha.com
app.winred.com
b.stripecdn.com
connect.facebook.net
d35ligi1n5bgzc.cloudfront.net
googleads.g.doubleclick.net
gtm.winred.com
hcaptcha.com
js.stripe.com
lh7-us.googleusercontent.com
m.stripe.com
m.stripe.network
maps.googleapis.com
merchant-ui-api.stripe.com
newassets.hcaptcha.com
pay.google.com
play.google.com
r.stripe.com
secure.winred.com
static.ads-twitter.com
static.cloudflareinsights.com
stats.g.doubleclick.net
t.co
trk.cpro20.com
www.facebook.com
www.google-analytics.com
www.google.ca
www.google.com
www.googletagmanager.com
www.gstatic.com
104.16.250.69
104.16.56.101
104.19.211.89
104.19.212.89
104.19.219.90
104.244.42.195
104.244.42.5
142.251.16.94
142.251.16.97
142.251.163.100
142.251.163.102
142.251.163.155
146.75.28.157
163.70.128.35
172.253.115.92
172.253.115.94
172.253.122.132
172.253.122.155
172.253.122.99
172.253.62.139
172.253.62.95
172.253.63.149
172.98.56.41
198.137.150.81
3.161.213.13
3.161.213.60
3.97.124.126
31.13.66.19
44.237.70.166
52.85.151.31
54.186.23.98
54.192.51.79
0030f5a99c7993b12e2fabfd97fc80fca835db69e270cb872bfa8e8821af3d82
007b4be1404b0f21a158fa83a2ae9375393b2d932a17e9745aa392fcadc7cf2f
03ff26aeebf7456b7511420741d9058e4966ab8525a27bb212aa10604f1b550e
04dd08cd5be76d0779ac2b77f734115d0fa01d5b6f14db00adca5433bdf30065
06e9cfa1e2fb5b8269f55ebb7dc5ced06737bc1e3faec047ca535265a9d7ac85
07b6b3d899dd69c0e9eb463e23e10e30e82588eddf95d15d45bb505c6703a813
13d21037700a2badd96b9537ae21bcc71720f629b20a8c637c3c891b16600047
155970940e45fe02f1fc59749acdb5fb0dfffa36378aa0781787c2dab8ba4be1
1a4f525d80a13304cfd01fb38dae9c118c952a65ba41168201849316389edba3
1bd21ce44eeced85ecbf92e6a93cf791c68f798db170741fd3a67d77880ce7f9
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
2977f53d6b12e6f52f665d17184d9d978ea0fcc0409cfad267cc1ac88b337543
2b675ec61017240815a048dad88bdaf046107e39953416dca182976a05fda6cd
35dcc382eb69d00369d708708cdc545f3968b68fa5bbe3e728d11fedd04f93bb
3637616b969f382f9b9533caba50ca0359df5a357d13a6c501d871badb1fa869
36f0bf882a876b13aeb20cf7a495421a43f336da5422072a58f58ce303fb6284
375cd0866100903ea8dd941ab323f78564bfc406a6055c729d8c14b284f1ca5e
394724ca0118829643c12fb5a033cb66680e51327ba157677d18dec209278a3d
39dfb37816eab2a94aa07e46af7d0523d11a47ca1f7d21544570e3c409fa0586
3a0979ec055c654b6cd4128f9e85c09b5c9af08bd4d1d893c20940c1f262b41b
43dc73ea4dfba9e39db345005a2d920a8808219d3e876bfafc8e34be7e350789
4676a12af77fdf53bc72913c6a28986c1f80374da45c64bf68aa4a7948abedaa
496a9f211c8a2c4f3d98c05064de0c18af9f8d47f21a73ef373e9764a3c0c712
4ec0827f796bdadb833f52dd7ea841e12158d9f488554ecb73479cc2ea6f6d8e
4ff20e86436e2a88288ec278caab0ad0d32b279426bed6c101e5a97b8d9349e8
502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358
50b6e67cfcfe4ac8fe9cee705b681f696065306ee42bcd4e6b37a17dba333ac5
53db143c0f616cffe22042f63f44d12fa6c48c991e6bd1611cd8ccdc492b4aca
567b54fd60398b184a0476703aec2d6d70dac4177e293af5b6b5bfaf0b35d374
56a172a3f51e1de1ba63e706b074a691934e794f6531e25bed71df6e60ec84a8
59baf813b441feeb356bc088f9ec1ea4acbd920703ccf118e514ff99124d37e9
5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848
5d1472f984f903349331c5a8c6629a64439faa7cbdeaeb02d8d5dc6be01ed151
5e155e1f89e5ca084a3510deea330a8ca019b906bc61469408830959033ce71f
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101
621661fe1c7a59420c624f7a421c566ebfb38cfbc7edd98ee0462c44d15971f9
63bcc3b4d3734595ad591fd0f1917dc9d4b9e08a2189710a43293ee18136dbd9
641defe78e044cbd72e13110f131016fc26c1e8b00ef29ad142e177a0e54bfe1
67a60e8d0877049f837dff6121f5db7d5799af3ee03bf0f8b77dd491904c5c52
67c06bfbabd110128342ef6c5c68b7debd64a694ba9fe335322c84b1e937b3b3
7046e325bee6e4ffd4581616a2b76772f5749fbd45eb77998a1b5810ed476d2e
72b6328c9e287c5f37ea936731b59e68a31fc241990f2fdbd1d967e3294d661e
73526c7c8cb533a80c1437cfcaa300b2a8775da0bb4541fc2ce20da10d48df33
77bcc02eadd368e485122deaa80ceb3ee5f7f0b9fa967e4dcde4049d0e3a0301
791ae0aff6caaad83a9694df71c3686604f9387eb800f4a2bd81cdb31fbf2382
7d1f2a826dcf495f9a4929b456e5deb283c67867f262bddcd352c273ac4ebb8e
80354fb397ad4656fa5814c41d9fd5464583c402b2b5a95cb649875927931743
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50
947ac0903521f5eceefc90637c066306a8ca67466ccc188bb0107fb7cfb532d1
961951e588ed2cbd0dadda321becf5c4d27451bb0896262f86e7d922da5794ca
96b04ef160f8b50520a48707a452fecdd6e6771c643706d5949020a2dea15962
97955476b5df2d77cfc51a2a498e46cc559ed1822f69c999c7fc9fb7b5689953
9db8b420e21f5db6aa0dd50677268861205363d1975b4089e46abe4c8797a6c4
9ea16efa9e53039fffb7ccf6bee49de744e04402da82e1070d45733ef4a36711
9ff1964bffc8efed18dfd92699b69a974e6f354348b0743c31a6784384eb7c3d
a3a3a23af0f131c5d2799855fe985d416d6d4a892c378386ca2d21831b6d271e
a5caff2ac88482537395bf5cb6f74a309086645d160f73b5dad867f44c2d782c
a900e644fa21a464f600a3e5fa718c7219ee838436783762a8383c367a88fddb
ab60613ece9b5b3525ad9007dfd6f69d61039cd11be7311166fc90665337c1c0
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
b0dc7511f9f3b8369a23f2a94f49b27b025a3719b0fba66b2c20701d6ab82820
b34677f777d8a73eb410a7679891d9a72ef425d7c474b8993d14284a83399e27
b3b12123ee7e114e0e37c3c6d087ca29b59fab0c2fe28064d70de38e1fc7c1d9
b44b2c7d9284c33b357e892a41d1c396c1d28dba57e5b65f8e86edfd969c73f8
b4517e9b56d54096b1f6945b42cf2f7874a260c931fd7a7aee706fceea3082e4
b86c2a2bbfa9454750609b50a03f9510289842fc2268544bfc53921e1d9e65e3
b94b05ccc912f4deadb7dffd20326ce301931340c02efcb1e2a80fb55c59c6c2
ba2338aa6670580269c762f51c4291daef913201aa8f4d4fd166c1a878262652
bb234fbf380336f7d3007a7c8fb0b793db61e871f1d65e8e1bc65b134cb0ec58
bc8891da4a264054779959982425273e98b5857abfe24a00082d90fdc976201e
c3c2125ebaeb07268bbc110c5f11486686b0d1b756115142dfbfc855cf82ba43
c67fd705b4a52a62066cd60979c65edfa8b0d6c3da9a8d88d21afd56c11042e9
c6dc2d05669b7d0b896bb7185ed18035463aa200da0022364d446579365a8350
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
ce483bd57a7d0576c16db84df9cf92b4d94a2c8472f3254dbd2a759704d0fbfd
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee
d6169b910866f67ee0e3cdf2915e3e3c90082569f63b0d263bc15642ccd559f3
d9b7faa0259f5b0961455f53b4a507fba4bd0ed70dffac0bdaf2f94298c74b40
dc5741d4569f7588ca2837839345c9dec5ff5adcdbbd2743c4d9a159e90ed2cb
de0725f3840e27ed1defac8f5faa6a8a9dea9b7790a39e17534fbaf8e011a3e0
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e039e607c78306c7e029a7fd0ecdb14f86456f16e1a5ce65aa26b4fdf1d38a3c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e72afb30396e01243e6e2546e110f9ba69551e3fef008ee2669658fe4e5954d2
eac1bb2890c6ae6d2cc8653765f594f1209eda9eb0036eef9fde51299e883a5b
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f079dba5305aa07544d431a42f6836a03db06fb5ce5fc70416e240f728bcdda1
f3a531a933d649e125e1a79d2e43c7f48f71aaf457d2847c1c8efea16e3cc23c
f8372e4920304819a1afe1cb4a33def279a032e5d0154b53df47d05abdfc8077
f86da5e9aacdcab57c6381b2053c36e9ef22ffe815d128b1a80083dbda3f480d
f97f3418898da4d132398f7eb525629ba58c883ea55a48495ff61ae2e9265ed5
fa38eebb1eca7c94241152ae35cec12209d942905dc49f6d00dbe50636441258
fedfc64728beee4dcdf576abb2dd3c44b462afc3b5db8c53704629a1ee6dd14c
ff3bcb4b6ff50975328f38e8553353ce3c0a5bf93a578f9c4d6affc81870c349

secure.winred.com Open in urlscan Pro 104.19.211.89 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

162 Requests

99 %HTTPS

0 %IPv6

22 Domains

36 Subdomains

31 IPs

4 Countries

6390 kBTransfer

16840 kBSize

33 Cookies

9 Outgoing links

Page URL History

Redirected requests

162 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

secure.winred.com Open in urlscan Pro
104.19.211.89 Public Scan

Screenshot
Live screenshot

Full Image

162
Requests

99 %
HTTPS

0 %
IPv6

22
Domains

36
Subdomains

31
IPs

4
Countries

6390 kB
Transfer

16840 kB
Size

33
Cookies

162 HTTP transactions
0 data transactions