www.rightwing.org Open in urlscan Pro
2606:4700:10::ac43:1c08 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://trk.cp20.com/click/g4x7-3p1c3h-8c1e8p-f5ddgdm4/pmreg33oorqwg5boonxxk4tdmvewiir2ejuxezlgej6q====
Effective URL:
https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewslett...
Submission: On October 10 via api (October 10th 2022, 2:07:47 pm UTC) from US — Scanned from CA

Summary HTTP 204 Redirects Links 5 Behaviour Indicators

Summary

This website contacted 29 IPs in 2 countries across 27 domains to perform 204 HTTP transactions. The main IP is 2606:4700:10::ac43:1c08, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.rightwing.org. The Cisco Umbrella rank of the primary domain is 398792.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on May 16th 2022. Valid for: a year.

This is the only time www.rightwing.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	216.24.224.100 216.24.224.100	17358 (MOZGROUP-...) (MOZGROUP-CAMPAIGNER)
39	2606:4700:10:... 2606:4700:10::ac43:1c08	13335 (CLOUDFLAR...) (CLOUDFLARENET)
22	2607:f8b0:400... 2607:f8b0:4006:80d::2002	15169 (GOOGLE) (GOOGLE)
14	199.232.36.157 199.232.36.157	54113 (FASTLY) (FASTLY)
1	2607:f8b0:400... 2607:f8b0:4006:80b::2008	15169 (GOOGLE) (GOOGLE)
1	2600:9000:251... 2600:9000:2512:f000:a:cbb7:a940:93a1	16509 (AMAZON-02) (AMAZON-02)
2	104.154.142.214 104.154.142.214	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
13	2607:f8b0:400... 2607:f8b0:4006:806::2002	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f01... 2a03:2880:f012:8:face:b00c:0:1	32934 (FACEBOOK) (FACEBOOK)
2	2607:f8b0:400... 2607:f8b0:4006:81d::200e	15169 (GOOGLE) (GOOGLE)
1	2600:9000:20e... 2600:9000:20ed:c000:8:8845:1500:93a1	16509 (AMAZON-02) (AMAZON-02)
3	104.244.42.136 104.244.42.136	13414 (TWITTER) (TWITTER)
8	2600:9000:21d... 2600:9000:21dd:9600:b:6268:b880:93a1	16509 (AMAZON-02) (AMAZON-02)
3	2607:f8b0:400... 2607:f8b0:4004:c1b::9a	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:816::2002	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:809::2002	15169 (GOOGLE) (GOOGLE)
7	2607:f8b0:400... 2607:f8b0:4006:820::2002	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f11... 2a03:2880:f112:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1 1	2600:1f18:730... 2600:1f18:730:b140:e92e:bb73:a654:a315	14618 (AMAZON-AES) (AMAZON-AES)
1	52.207.19.117 52.207.19.117	14618 (AMAZON-AES) (AMAZON-AES)
11	2607:f8b0:400... 2607:f8b0:400b:803::2003	15169 (GOOGLE) (GOOGLE)
1 6	2607:f8b0:400... 2607:f8b0:4006:821::2004	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:816::2003	15169 (GOOGLE) (GOOGLE)
3	2606:2800:220... 2606:2800:220:13d:2176:94a:948:148e	15133 (EDGECAST) (EDGECAST)
4	2607:f8b0:400... 2607:f8b0:4006:823::200a	15169 (GOOGLE) (GOOGLE)
5	2607:f8b0:400... 2607:f8b0:4006:809::2003	15169 (GOOGLE) (GOOGLE)
24	2607:f8b0:400... 2607:f8b0:4006:81f::2001	15169 (GOOGLE) (GOOGLE)
2 3	2620:116:800b... 2620:116:800b:21:a021:b886:81cc:55cf	14618 (AMAZON-AES) (AMAZON-AES)
2 2	35.190.90.30 35.190.90.30	15169 (GOOGLE) (GOOGLE)
23	142.250.72.98 142.250.72.98	15169 (GOOGLE) (GOOGLE)
3 3	35.186.253.211 35.186.253.211	15169 (GOOGLE) (GOOGLE)
4 4	8.28.7.81 8.28.7.81	62713 (AS-PUBMATIC) (AS-PUBMATIC)
3 3	8.43.72.98 8.43.72.98	26667 (RUBICONPR...) (RUBICONPROJECT)
4 4	104.18.18.126 104.18.18.126	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3 3	3.225.218.147 3.225.218.147	14618 (AMAZON-AES) (AMAZON-AES)
3 3	184.50.205.90 184.50.205.90	16625 (AKAMAI-AS) (AKAMAI-AS)
4	2607:f8b0:400... 2607:f8b0:4006:80a::2003	15169 (GOOGLE) (GOOGLE)
204	29

1 216.24.224.100 (United States) 1 redirects

ASN17358 (MOZGROUP-CAMPAIGNER, US)
PTR: trk.cpro20.com

trk.cp20.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

39 2606:4700:10::ac43:1c08 (United States)

ASN13335 (CLOUDFLARENET, US)

www.rightwing.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

22 2607:f8b0:4006:80d::2002 (Rockville, United States)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 199.232.36.157 (New York, United States)

ASN54113 (FASTLY, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:80b::2008 (Rockville, United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2512:f000:a:cbb7:a940:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn2.lockerdomecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.154.142.214 (Council Bluffs, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 214.142.154.104.bc.googleusercontent.com

lockerdome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2607:f8b0:4006:806::2002 (Rockville, United States)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f012:8:face:b00c:0:1 (Secaucus, United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:81d::200e (Rockville, United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20ed:c000:8:8845:1500:93a1 (United States)

ASN16509 (AMAZON-02, US)

b-code.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.244.42.136 (United States)

ASN13414 (TWITTER, US)

syndication.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2600:9000:21dd:9600:b:6268:b880:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn1.lockerdomecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4004:c1b::9a (Washington, United States)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:816::2002 (Rockville, United States)

ASN15169 (GOOGLE, US)

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:809::2002 (Rockville, United States)

ASN15169 (GOOGLE, US)

adservice.google.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2607:f8b0:4006:820::2002 (Rockville, United States)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f112:83:face:b00c:0:25de (Secaucus, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:730:b140:e92e:bb73:a654:a315 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)

rp.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.207.19.117 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-207-19-117.compute-1.amazonaws.com

rp4.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2607:f8b0:400b:803::2003 (Highland Park, United States)

ASN15169 (GOOGLE, US)

csi.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2607:f8b0:4006:821::2004 (Rockville, United States) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:816::2003 (Rockville, United States)

ASN15169 (GOOGLE, US)

www.google.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:2800:220:13d:2176:94a:948:148e (United States)

ASN15133 (EDGECAST, US)

cdn.syndication.twimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pbs.twimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4006:823::200a (Rockville, United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2607:f8b0:4006:809::2003 (Rockville, United States)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

24 2607:f8b0:4006:81f::2001 (Rockville, United States)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:116:800b:21:a021:b886:81cc:55cf (United States) 2 redirects

ASN14618 (AMAZON-AES, US)

cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.190.90.30 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 30.90.190.35.bc.googleusercontent.com

odr.mookie1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

23 142.250.72.98 (United States)

ASN15169 (GOOGLE, US)
PTR: lga34s32-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.186.253.211 (Kansas City, United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: 211.253.186.35.bc.googleusercontent.com

rtb.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 8.28.7.81 (United States) 4 redirects

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 8.43.72.98 (United States) 3 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.18.18.126 (Shahr, Iran, Islamic Republic Of) 4 redirects

ASN13335 (CLOUDFLARENET, US)

ssum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 3.225.218.147 (Ashburn, United States) 3 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-225-218-147.compute-1.amazonaws.com

cc.adingo.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 184.50.205.90 (Edison, United States) 3 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a184-50-205-90.deploy.static.akamaitechnologies.com

e.dlx.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4006:80a::2003 (Rockville, United States)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
42	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 131 tpc.googlesyndication.com — Cisco Umbrella Rank: 170	618 KB
41	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 68 stats.g.doubleclick.net — Cisco Umbrella Rank: 171 securepubads.g.doubleclick.net — Cisco Umbrella Rank: 215 cm.g.doubleclick.net — Cisco Umbrella Rank: 304	279 KB
39	rightwing.org www.rightwing.org — Cisco Umbrella Rank: 398792	497 KB
20	gstatic.com csi.gstatic.com www.gstatic.com fonts.gstatic.com	105 KB
17	twitter.com platform.twitter.com — Cisco Umbrella Rank: 991 syndication.twitter.com — Cisco Umbrella Rank: 1241	525 KB
9	google.com 1 redirects adservice.google.com — Cisco Umbrella Rank: 136 www.google.com — Cisco Umbrella Rank: 19	2 KB
9	lockerdomecdn.com cdn2.lockerdomecdn.com — Cisco Umbrella Rank: 39433 cdn1.lockerdomecdn.com — Cisco Umbrella Rank: 22467	142 KB
4	casalemedia.com 4 redirects ssum-sec.casalemedia.com — Cisco Umbrella Rank: 703	4 KB
4	pubmatic.com 4 redirects image6.pubmatic.com — Cisco Umbrella Rank: 915	2 KB
4	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 228	177 KB
4	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 118	3 KB
4	google.ca adservice.google.ca — Cisco Umbrella Rank: 14059 www.google.ca — Cisco Umbrella Rank: 7572	2 KB
3	addthis.com 3 redirects e.dlx.addthis.com — Cisco Umbrella Rank: 2488	2 KB
3	adingo.jp 3 redirects cc.adingo.jp — Cisco Umbrella Rank: 4024	1 KB
3	rubiconproject.com 3 redirects pixel.rubiconproject.com — Cisco Umbrella Rank: 493	1 KB
3	openx.net 3 redirects rtb.openx.net — Cisco Umbrella Rank: 2302	600 B
3	quantserve.com 2 redirects cms.quantserve.com — Cisco Umbrella Rank: 1504	1 KB
3	twimg.com cdn.syndication.twimg.com — Cisco Umbrella Rank: 2667 pbs.twimg.com — Cisco Umbrella Rank: 673	37 KB
3	liadm.com 1 redirects b-code.liadm.com — Cisco Umbrella Rank: 4534 rp.liadm.com — Cisco Umbrella Rank: 2494 rp4.liadm.com — Cisco Umbrella Rank: 6039	12 KB
2	mookie1.com 2 redirects odr.mookie1.com — Cisco Umbrella Rank: 1482	745 B
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 115	222 B
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 94	20 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 203	111 KB
2	lockerdome.com lockerdome.com — Cisco Umbrella Rank: 13964	37 KB
1	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 1003	695 B
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 129	57 KB
1	cp20.com 1 redirects trk.cp20.com — Cisco Umbrella Rank: 42394	483 B
204	27

	Domain	Requested by
39	www.rightwing.org	www.rightwing.org
24	tpc.googlesyndication.com	googleads.g.doubleclick.net pagead2.googlesyndication.com tpc.googlesyndication.com
23	cm.g.doubleclick.net	googleads.g.doubleclick.net
18	pagead2.googlesyndication.com	www.rightwing.org pagead2.googlesyndication.com tpc.googlesyndication.com googleads.g.doubleclick.net www.googletagservices.com
14	platform.twitter.com	www.rightwing.org platform.twitter.com
11	csi.gstatic.com	pagead2.googlesyndication.com securepubads.g.doubleclick.net
11	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net
8	cdn1.lockerdomecdn.com	lockerdome.com
6	www.google.com	1 redirects www.rightwing.org tpc.googlesyndication.com googleads.g.doubleclick.net
5	www.gstatic.com	googleads.g.doubleclick.net
4	fonts.gstatic.com	fonts.googleapis.com
4	ssum-sec.casalemedia.com	4 redirects
4	image6.pubmatic.com	4 redirects
4	securepubads.g.doubleclick.net	googleads.g.doubleclick.net
4	www.googletagservices.com	googleads.g.doubleclick.net
4	fonts.googleapis.com	googleads.g.doubleclick.net
3	e.dlx.addthis.com	3 redirects
3	cc.adingo.jp	3 redirects
3	pixel.rubiconproject.com	3 redirects
3	rtb.openx.net	3 redirects
3	cms.quantserve.com	2 redirects googleads.g.doubleclick.net
3	adservice.google.com	pagead2.googlesyndication.com
3	adservice.google.ca	pagead2.googlesyndication.com
3	stats.g.doubleclick.net	lockerdome.com www.google-analytics.com
3	syndication.twitter.com	platform.twitter.com www.rightwing.org
2	odr.mookie1.com	2 redirects
2	pbs.twimg.com	www.rightwing.org
2	www.facebook.com	www.rightwing.org
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	connect.facebook.net	www.rightwing.org connect.facebook.net
2	lockerdome.com	cdn2.lockerdomecdn.com
1	cdn.syndication.twimg.com	platform.twitter.com
1	www.google.ca	www.rightwing.org
1	rp4.liadm.com	www.rightwing.org
1	rp.liadm.com	1 redirects
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	b-code.liadm.com	www.googletagmanager.com
1	cdn2.lockerdomecdn.com	www.rightwing.org
1	www.googletagmanager.com	www.rightwing.org
1	trk.cp20.com	1 redirects
204	40

This site contains links to these domains. Also see Links.

Domain
www.cnn.com
www.uscg.mil
www.breitbart.com
www.safesubscribe.org
www.facebook.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-05-16` - `2023-05-16`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
platform.twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2022-07-21` - `2023-08-21`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.lockerdomecdn.com Amazon	`2022-01-25` - `2023-02-23`	a year	crt.sh
*.lockerdome.com Go Daddy Secure Certificate Authority - G2	`2021-09-27` - `2022-10-29`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-07-19` - `2022-10-17`	3 months	crt.sh
*.liadm.com Amazon	`2022-01-31` - `2023-03-01`	a year	crt.sh
syndication.twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2022-02-22` - `2023-02-22`	a year	crt.sh
*.googleadservices.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.google.ca GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.twimg.com DigiCert TLS RSA SHA256 2020 CA1	`2021-10-20` - `2022-10-19`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.quantserve.com DigiCert TLS RSA SHA256 2020 CA1	`2022-08-09` - `2023-09-09`	a year	crt.sh

This page contains 23 frames:

Primary Page: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Frame ID: 759BC1DA8C5DADC22CAC1D9DCBFDBF20
Requests: 74 HTTP requests in this frame

Frame: https://lockerdome.com/lad/14001166036186214?pubid=ld-6064-290&pubo=https%3A%2F%2Fwww.rightwing.org&rid=&width=696&utm_source=iref&utm_medium=email
Frame ID: E6EC1C060246EDC752037ABC2EC8475D
Requests: 6 HTTP requests in this frame

Frame: https://lockerdome.com/lad/13360564449522790?pubid=ld-2765-5011&pubo=https%3A%2F%2Fwww.rightwing.org&rid=&width=1068&utm_source=iref&utm_medium=email
Frame ID: CAF6250FB180DDAFA2E21F9C1FCF3C9E
Requests: 14 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.7dae38096d06923d683a2a807172322a.html?origin=https%3A%2F%2Fwww.rightwing.org
Frame ID: A1574698279D959A7A4F368C450648B8
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20190131/zrt_lookup.html
Frame ID: A7904545F10C2C8665A75286546B9151
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&adk=1812271804&adf=3025194257&lmt=1665370584&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F%3Futm_source%3Diref%26utm_placement%3DRWnewsletter%26utm_medium%3Demail&ea=0&pra=5&wgl=1&easpi=0&asntp=0&asntpv=0&asntpl=0&asntpm=0&asntpc=0&asna=5&asnd=5&asnp=5&asns=5&asmat=1&asptt=-1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665410860601&bpp=3&bdt=299&idt=188&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=3409364873373&rume=1&frm=20&pv=2&ga_vid=1820485934.1665410861&ga_sid=1665410861&ga_hid=1530091123&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531706%2C21066428%2C44772928%2C31061691%2C31061693&oid=2&pvsid=2143541351964157&tmod=1384303463&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=209
Frame ID: 837B9AEC3300051CCC176E716C3AC377
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/embed/Tweet.html?dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOlsibGlua3RyLmVlIiwidHIuZWUiLCJ0ZXJyYS5jb20uYnIiLCJ3d3cubGlua3RyLmVlIiwid3d3LnRyLmVlIiwid3d3LnRlcnJhLmNvbS5iciJdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdGltZWxpbmVfMTIwMzQiOnsiYnVja2V0IjoidHJlYXRtZW50IiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9lZGl0X2JhY2tlbmQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19jaGluX3BpbGxzXzE0NzQxIjp7ImJ1Y2tldCI6ImNvbG9yX2ljb25zIiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9yZXN1bHRfbWlncmF0aW9uXzEzOTc5Ijp7ImJ1Y2tldCI6InR3ZWV0X3Jlc3VsdCIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2V4cGVyaW1lbnRzX2Nvb2tpZV9leHBpcmF0aW9uIjp7ImJ1Y2tldCI6MTIwOTYwMCwidmVyc2lvbiI6bnVsbH0sInRmd19kdXBsaWNhdGVfc2NyaWJlc190b19zZXR0aW5ncyI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdmlkZW9faGxzX2R5bmFtaWNfbWFuaWZlc3RzXzE1MDgyIjp7ImJ1Y2tldCI6InRydWVfYml0cmF0ZSIsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9mcm9udGVuZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9fQ%3D%3D&frame=false&hideCard=false&hideThread=false&id=1576904966442291201&lang=en&origin=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F&sessionId=8c80bdd13dcf88f12b9ce2d2b6211a0330a58e2a&theme=light&widgetsVersion=1c23387b1f70c%3A1664388199485&width=550px
Frame ID: E5695E3D1A58AE07F992E9C262699AC0
Requests: 16 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 48DF8BF5BF9A618F6866B4C07FE71F2F
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1
Frame ID: 3325F629DF1073315C7342F31B65E629
Requests: 5 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Frame ID: 3F62BC354F033F378818C8C009A72F88
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4569349609&adk=2326741806&adf=3494845914&pi=t.ma~as.4569349609&w=640&lmt=1665370584&format=640x300&url=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F%3Futm_source%3Diref%26utm_placement%3DRWnewsletter%26utm_medium%3Demail&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665410861731&bpp=1&bdt=1429&idt=1&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D867106d61160b6c9-22b4b0dda6d70054%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MbyADlkn0RlwRTMZcKMKfzwuHe6Uw&gpic=UID%3D0000057649a3ca06%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MYih3xMQ1vc46x04ozbfApuVR_C2w&prev_fmts=0x0%2C1600x1200&nras=2&correlator=3409364873373&rume=1&frm=20&pv=1&ga_vid=1820485934.1665410861&ga_sid=1665410861&ga_hid=1530091123&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=294&ady=616&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531706%2C21066428%2C44772928%2C31061691%2C31061693&oid=2&pvsid=2143541351964157&tmod=1384303463&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=4mXr6XsNci&p=https%3A//www.rightwing.org&dtd=9
Frame ID: 189A3B812C17F855703FCACC07833522
Requests: 18 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4569349609&adk=2326741806&adf=3205953851&pi=t.ma~as.4569349609&w=640&lmt=1665370584&format=640x300&url=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F%3Futm_source%3Diref%26utm_placement%3DRWnewsletter%26utm_medium%3Demail&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665410861742&bpp=1&bdt=1440&idt=1&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D867106d61160b6c9-22b4b0dda6d70054%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MbyADlkn0RlwRTMZcKMKfzwuHe6Uw&gpic=UID%3D0000057649a3ca06%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MYih3xMQ1vc46x04ozbfApuVR_C2w&prev_fmts=0x0%2C1600x1200%2C640x300&nras=2&correlator=3409364873373&rume=1&frm=20&pv=1&ga_vid=1820485934.1665410861&ga_sid=1665410861&ga_hid=1530091123&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=294&ady=2693&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531706%2C21066428%2C44772928%2C31061691%2C31061693&oid=2&pvsid=2143541351964157&tmod=1384303463&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=j1fUCfNGgG&p=https%3A//www.rightwing.org&dtd=4
Frame ID: CB972B71B1BE8DEA209F31D468E9232E
Requests: 18 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=250&slotname=4569349609&adk=642246285&adf=1543753041&pi=t.ma~as.4569349609&w=300&lmt=1665370584&format=300x250&url=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F%3Futm_source%3Diref%26utm_placement%3DRWnewsletter%26utm_medium%3Demail&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665410861748&bpp=1&bdt=1446&idt=1&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D867106d61160b6c9-22b4b0dda6d70054%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MbyADlkn0RlwRTMZcKMKfzwuHe6Uw&gpic=UID%3D0000057649a3ca06%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MYih3xMQ1vc46x04ozbfApuVR_C2w&prev_fmts=0x0%2C1600x1200%2C640x300%2C640x300&nras=2&correlator=3409364873373&rume=1&frm=20&pv=1&ga_vid=1820485934.1665410861&ga_sid=1665410861&ga_hid=1530091123&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1022&ady=213&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531706%2C21066428%2C44772928%2C31061691%2C31061693&oid=2&pvsid=2143541351964157&tmod=1384303463&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=5&uci=a!5&fsb=1&xpc=KKoyP6WuFL&p=https%3A//www.rightwing.org&dtd=4
Frame ID: 21689FABBEB892A69705F08FEEBF70D0
Requests: 13 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/gnLtmcL-mn53pq-EJRMXOCFACjpZd0iqiIv80oTeKas.js
Frame ID: 971FC7C604B64E408FFA626F567FED7E
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: E68ACDFFF51B118ABE752DE275E7FA6C
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 52E36C39C80A82E51AB3F98472B5E59D
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: C44414CE0B2E7DD3049EEFB8FC7C0F18
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 84D16272248F159AA2DF3B5A935ADD2C
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/gnLtmcL-mn53pq-EJRMXOCFACjpZd0iqiIv80oTeKas.js
Frame ID: 470D7ECB1C76ED5DD22F8AA90BB991F0
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 0DF126F6F498B5CED2F59C1D27FE7E20
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/gnLtmcL-mn53pq-EJRMXOCFACjpZd0iqiIv80oTeKas.js
Frame ID: 1CD4315B292223237F28AE53AA095CAE
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: FF4642831A153AB0AE6B6121B6BE73A6
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/gnLtmcL-mn53pq-EJRMXOCFACjpZd0iqiIv80oTeKas.js
Frame ID: 072F20DFFF64C9FC141E1A1D2186BC76
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Biden Sends Thank You MESSAGE To Hero Before Firing Him! | RightWing

Page URL History Show full URLs

https://trk.cp20.com/click/g4x7-3p1c3h-8c1e8p-f5ddgdm4/pmreg33oorqwg5boonxxk4tdmvewiir2ejuxezlgej... HTTP 302
https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_... Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js

Twitter (Widgets) Expand

Overall confidence: 100%
Detected patterns

//platform\.twitter\.com/widgets\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

204
Requests

90 %
HTTPS

65 %
IPv6

27
Domains

40
Subdomains

29
IPs

2
Countries

2624 kB
Transfer

7657 kB
Size

37
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: https://www.cnn.com/2022/10/03/us/hurricane-ian-florida-recovery-monday/index.html
Title: over 100 people

Search URL Search Domain Scan URL

URL: https://www.uscg.mil/Coronavirus/Information/Article/2753898/mandatory-vaccination-for-military-members-faqs/
Title: mandate

Search URL Search Domain Scan URL

URL: https://www.breitbart.com/politics/2022/10/01/biden-thanks-coast-guard-rescue-swimmer-hes-kicking-out-vaccine-mandate/
Title: said

Search URL Search Domain Scan URL

URL: https://www.safesubscribe.org/request-form/?brandId=6143ffdec43c36aed5a30be0a954f7fa
Title: Do Not Sell My Personal Information

Search URL Search Domain Scan URL

URL: https://www.facebook.com/rightwingusa/
Title: Follow Us on Facebook

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://trk.cp20.com/click/g4x7-3p1c3h-8c1e8p-f5ddgdm4/pmreg33oorqwg5boonxxk4tdmvewiir2ejuxezlgej6q==== HTTP 302
https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 76

https://rp.liadm.com/j?dtstmp=1665410860870&aid=a-07ec&se=e30&duid=21abd367d78b--01gf13j1nzcd00z72dfv47taer&tna=v2.5.0&pu=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F%3Futm_source%3Diref%26utm_placement%3DRWnewsletter%26utm_medium%3Demail&wpn=lc-bundle&c=PHRpdGxlPkJpZGVuIFNlbmRzIFRoYW5rIFlvdSBNRVNTQUdFIFRvIEhlcm8gQmVmb3JlIEZpcmluZyBIaW0hIHwgUmlnaHRXaW5nPC90aXRsZT48bGluayByZWw9ImNhbm9uaWNhbCIgaHJlZj0iaHR0cHM6Ly93d3cucmlnaHR3aW5nLm9yZy9iaWRlbi1zZW5kcy10aGFuay15b3UtbWVzc2FnZS10by1tYW4tYmVmb3JlLWZpcmluZy1oaW0vIj48aDEgY2xhc3M9ImVudHJ5LXRpdGxlIj5CaWRlbiBTZW5kcyBUaGFuayBZb3UgTUVTU0FHRSBUbyBIZXJvIEJlZm9yZSBGaXJpbmcgSGltITwvaDE- HTTP 302
https://rp4.liadm.com/j?dtstmp=1665410860870&aid=a-07ec&se=e30&duid=21abd367d78b--01gf13j1nzcd00z72dfv47taer&tna=v2.5.0&pu=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F%3Futm_source%3Diref%26utm_placement%3DRWnewsletter%26utm_medium%3Demail&wpn=lc-bundle&c=PHRpdGxlPkJpZGVuIFNlbmRzIFRoYW5rIFlvdSBNRVNTQUdFIFRvIEhlcm8gQmVmb3JlIEZpcmluZyBIaW0hIHwgUmlnaHRXaW5nPC90aXRsZT48bGluayByZWw9ImNhbm9uaWNhbCIgaHJlZj0iaHR0cHM6Ly93d3cucmlnaHR3aW5nLm9yZy9iaWRlbi1zZW5kcy10aGFuay15b3UtbWVzc2FnZS10by1tYW4tYmVmb3JlLWZpcmluZy1oaW0vIj48aDEgY2xhc3M9ImVudHJ5LXRpdGxlIj5CaWRlbiBTZW5kcyBUaGFuayBZb3UgTUVTU0FHRSBUbyBIZXJvIEJlZm9yZSBGaXJpbmcgSGltITwvaDE-&i6=MjYwNzo1MzAwOjYwOjc4Njc6Ojg%3D&n3pc=true

Request Chain 145

https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESEO7G-kN9oqj6yedbm8xkUQ8&google_push=AZmPxg8PWjqYVreBZHcpRhsJv3t5EG3qHAZ2DuK4Lnnfg71MW64kPrFNr2AG0iyrfi9RpsRRBdo0ZHn2LV7c-FIsO-U3hqU0Vmw&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=xaxis_dmp&google_push=AZmPxg8PWjqYVreBZHcpRhsJv3t5EG3qHAZ2DuK4Lnnfg71MW64kPrFNr2AG0iyrfi9RpsRRBdo0ZHn2LV7c-FIsO-U3hqU0Vmw&google_hm=MTA1OTY4MjkxODk4MjY0NTYyMjE

Request Chain 146

https://rtb.openx.net/sync/dds?google_gid=CAESELcFvWBYlUMuHsUFq8A5508&google_cver=1&google_push=AZmPxg_EtTXlaLzW-92xT4DAPVaMVDugD3QdNr4qKclQ73Au099iE4ZvFfAwlUOTfTHXh17bLopkh6GEm09GFiB-Cb0iGfB8zF0 HTTP 302
https://rtb.openx.net/sync/dds?google_gid=CAESELcFvWBYlUMuHsUFq8A5508&google_cver=1&google_push=AZmPxg_EtTXlaLzW-92xT4DAPVaMVDugD3QdNr4qKclQ73Au099iE4ZvFfAwlUOTfTHXh17bLopkh6GEm09GFiB-Cb0iGfB8zF0&ox_sc=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AZmPxg_EtTXlaLzW-92xT4DAPVaMVDugD3QdNr4qKclQ73Au099iE4ZvFfAwlUOTfTHXh17bLopkh6GEm09GFiB-Cb0iGfB8zF0&google_hm=feZ7ZFTKyR0dhTrXI77Ewg==

Request Chain 147

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEC1D-znKq2FaE3qa0Ordo7Y&google_cver=1&google_push=AZmPxg8R8bnXpzZ4HuJG0g_Hr127SerOdTk2N11rZSbS0LQ2PGk4YjYTe_NRh-xx2npyZeyNnq43Af7Ufj-3qrZjpPdPLXT23Q HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEC1D-znKq2FaE3qa0Ordo7Y&google_cver=1&google_push=AZmPxg8R8bnXpzZ4HuJG0g_Hr127SerOdTk2N11rZSbS0LQ2PGk4YjYTe_NRh-xx2npyZeyNnq43Af7Ufj-3qrZjpPdPLXT23Q&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=48g7gr1pSWuwHETgJ278kA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AZmPxg8R8bnXpzZ4HuJG0g_Hr127SerOdTk2N11rZSbS0LQ2PGk4YjYTe_NRh-xx2npyZeyNnq43Af7Ufj-3qrZjpPdPLXT23Q

Request Chain 148

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESENJ521UVj8FEi5W_J5KCmzo&google_cver=1&google_push=AZmPxg_2V3fhxc38VwFUxhuA3BbtFCo4Own4fI1PF6m73wN54GHCAxnei9y3Es2GN62TKvGRQK6QNuA7RW3tVR544eHt5LXjrw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDkyVU1MTTgtMjQtRUNJWg==&google_push=AZmPxg_2V3fhxc38VwFUxhuA3BbtFCo4Own4fI1PF6m73wN54GHCAxnei9y3Es2GN62TKvGRQK6QNuA7RW3tVR544eHt5LXjrw

Request Chain 149

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEHCUUbinJIdcqA5JdxtvsqI&google_cver=1&google_push=AZmPxg88cs37_iGMod6xyXrzkgf0MUXZGIH8OCLsVcMwzJNF12wK_Z2uyXdvJ97KIf6aGVYUxph00WrhU7rX794rbCyi7A6i08U HTTP 302
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEHCUUbinJIdcqA5JdxtvsqI&google_push=AZmPxg88cs37_iGMod6xyXrzkgf0MUXZGIH8OCLsVcMwzJNF12wK_Z2uyXdvJ97KIf6aGVYUxph00WrhU7rX794rbCyi7A6i08U&s=184023&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEHCUUbinJIdcqA5JdxtvsqI&google_hm=Y0QnLmu47UNT52BpOxFZWAAAALYAAAAB&google_nid=index&google_push=AZmPxg88cs37_iGMod6xyXrzkgf0MUXZGIH8OCLsVcMwzJNF12wK_Z2uyXdvJ97KIf6aGVYUxph00WrhU7rX794rbCyi7A6i08U

Request Chain 150

https://cc.adingo.jp/adx/push/?google_gid=CAESEGDFbX1B-P2sAOVyF-J3k_U&google_cver=1&google_push=AZmPxg-UNUB70xV5NpL3qTaqOnolnkd56VWF1ZMKqR9Ql9tJgu3XQ_b6OH9NCvuYex0MWqgjfDLX4kM4fXRsQKzz3_g5F-eXJNE HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AZmPxg-UNUB70xV5NpL3qTaqOnolnkd56VWF1ZMKqR9Ql9tJgu3XQ_b6OH9NCvuYex0MWqgjfDLX4kM4fXRsQKzz3_g5F-eXJNE&google_hm=f628fcef6bf2442b7322e0350d92ff60

Request Chain 152

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 169

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEEKI31cTEg8T4iW3LCEATYo&google_cver=1&google_push=AZmPxg-Q4wgdXWpk_ByTZfF1iB0DnmwP2591vMr0h0AYIqcUXVFjwebl8Bwd88R3lJAxlI2GmqyklEUNX3cFB49hmGn_Luczypyd4ZbE1sQ1uhhYfANlKQh1MES2kvfaxnCgIoqP0c3KXSBxenYaAui25Q HTTP 302
https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=AZmPxg-Q4wgdXWpk_ByTZfF1iB0DnmwP2591vMr0h0AYIqcUXVFjwebl8Bwd88R3lJAxlI2GmqyklEUNX3cFB49hmGn_Luczypyd4ZbE1sQ1uhhYfANlKQh1MES2kvfaxnCgIoqP0c3KXSBxenYaAui25Q&google_hm=4ir_IUCUhSE8N-GnDH80vA

Request Chain 170

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAZmPxg_5CC5DffqCsAhbHBN38P_QX2shTRTx-Bt-Fxx2i0deQ1Nka2xrQm7XleEADN5bwAeyqljaz0Yh9zOPb63q4pf2bxpLhx9aex7LYaP-O-3PHIvy0VHSMl5FBlbiZBniaJzWMoaQiRYtauhCnLLQJA&google_gid=CAESENJzd57tP-BktMyn8zvv314&google_cver=1 HTTP 302
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAZmPxg_5CC5DffqCsAhbHBN38P_QX2shTRTx-Bt-Fxx2i0deQ1Nka2xrQm7XleEADN5bwAeyqljaz0Yh9zOPb63q4pf2bxpLhx9aex7LYaP-O-3PHIvy0VHSMl5FBlbiZBniaJzWMoaQiRYtauhCnLLQJA&google_gid=CAESENJzd57tP-BktMyn8zvv314&google_cver=1&rd=Y HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjEwMTAxNDA3NDIwMDAyODMyMTkxODQ5MQ%3D%3D&google_push=AZmPxg_5CC5DffqCsAhbHBN38P_QX2shTRTx-Bt-Fxx2i0deQ1Nka2xrQm7XleEADN5bwAeyqljaz0Yh9zOPb63q4pf2bxpLhx9aex7LYaP-O-3PHIvy0VHSMl5FBlbiZBniaJzWMoaQiRYtauhCnLLQJA

Request Chain 171

https://rtb.openx.net/sync/dds?google_gid=CAESEOlfIXv7HpksIcZCH-4oCSI&google_cver=1&google_push=AZmPxg-6bpdSXK6bJvX-QfeajyM0gHL-r5GcV-8fdoGN22qvDSWOZV58VNzjXhVfMjWUTZibrT2gLH-STkg8gLJ6QP_gdlOP1QwMllb-frxt1e4kUdREB7n7xb3oBhc-WL1wR1JB8ALWvB9BiVVf1S5JR5g HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AZmPxg-6bpdSXK6bJvX-QfeajyM0gHL-r5GcV-8fdoGN22qvDSWOZV58VNzjXhVfMjWUTZibrT2gLH-STkg8gLJ6QP_gdlOP1QwMllb-frxt1e4kUdREB7n7xb3oBhc-WL1wR1JB8ALWvB9BiVVf1S5JR5g&google_hm=feZ7ZFTKyR0dhTrXI77Ewg==

Request Chain 172

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESED_M1rYs_25RIrhpfMt4who&google_cver=1&google_push=AZmPxg8RY2k9_vkrR_e4jacMIW9OnE4C19EZ1ruWY86cpqAUrbQX4IIzac3NmJs4OSFe-PmPQmV-lLWXDBd8gIMADFkfLrXUOJAZ2A6n_uHjE6DyZJq-5dA0nEEJLm7CQ_yXQEli8iJs6pRlJHkoeAmws-4 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=48g7gr1pSWuwHETgJ278kA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AZmPxg8RY2k9_vkrR_e4jacMIW9OnE4C19EZ1ruWY86cpqAUrbQX4IIzac3NmJs4OSFe-PmPQmV-lLWXDBd8gIMADFkfLrXUOJAZ2A6n_uHjE6DyZJq-5dA0nEEJLm7CQ_yXQEli8iJs6pRlJHkoeAmws-4

Request Chain 173

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESELDcDdK0OQPiuta7ZBt1yxU&google_cver=1&google_push=AZmPxg9lNHQdMR98pbQ-JddmKJBoJHMoLYuY62ZEJnLjvwQCGjLGDxuTE2sxV5rqu66PeB2sf75slqnoXYFUfWFD9NSZoDir3YmGv7uM43Yyqp65uqpBQ8z0tvR7PysazVJ6pr34gpysGrPYP4YXcSsMGE8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDkyVU1MVFEtMVQtQ0lRVQ==&google_push=AZmPxg9lNHQdMR98pbQ-JddmKJBoJHMoLYuY62ZEJnLjvwQCGjLGDxuTE2sxV5rqu66PeB2sf75slqnoXYFUfWFD9NSZoDir3YmGv7uM43Yyqp65uqpBQ8z0tvR7PysazVJ6pr34gpysGrPYP4YXcSsMGE8

Request Chain 174

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEALzr-Ks5MZVye7Os6ya2sQ&google_cver=1&google_push=AZmPxg_YkGXH6MxGULHVJabtqa3YZNSP8FJfFj452KrNDwzeAHEJUVbnTHgQoAdYmF2NfVx1MP95-uIPE08uKqWTxAJwMYT1bRmU2VY-nYnLczmhsk6KJ8dQcqO94AmDPKgVPdiJi6Rr4G0_uxqMLQUbyTg HTTP 302
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEALzr-Ks5MZVye7Os6ya2sQ&google_hm=Y0QnLmu47UNT52BpOxFZWAAAALYAAAAB&google_nid=index&google_push=AZmPxg_YkGXH6MxGULHVJabtqa3YZNSP8FJfFj452KrNDwzeAHEJUVbnTHgQoAdYmF2NfVx1MP95-uIPE08uKqWTxAJwMYT1bRmU2VY-nYnLczmhsk6KJ8dQcqO94AmDPKgVPdiJi6Rr4G0_uxqMLQUbyTg

Request Chain 175

https://cc.adingo.jp/adx/push/?google_gid=CAESEB6TTgQV7EpdaTx_KJzFupY&google_cver=1&google_push=AZmPxg8enzFH2bLvhf1D05YHLPdAT0-nhpvP5VeC6hAdkozp0N4_TO9ujKzj2zNA687CexejAB6y-80SpxKlxEqT0jTQd9kPOrsA_FDbNc42RQM0NNv6adthcTZab9uNXHacCNUvH-g9TLXh_dV1xHkcwnw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AZmPxg8enzFH2bLvhf1D05YHLPdAT0-nhpvP5VeC6hAdkozp0N4_TO9ujKzj2zNA687CexejAB6y-80SpxKlxEqT0jTQd9kPOrsA_FDbNc42RQM0NNv6adthcTZab9uNXHacCNUvH-g9TLXh_dV1xHkcwnw&google_hm=f628fcef6bf2442b7322e0350d92ff60

Request Chain 200

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEERVxQGVfBktotJXhtYKKGY&google_cver=1&google_push=AZmPxg-up8sSkWV594hMlMGqXA6WTbCgNh2ORLntq5V1h4UMci6q4CveoPKjuF77_3NILKWwrUSI9tBQVFuigaO6dsNPu0PsLzO1 HTTP 302
https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=AZmPxg-up8sSkWV594hMlMGqXA6WTbCgNh2ORLntq5V1h4UMci6q4CveoPKjuF77_3NILKWwrUSI9tBQVFuigaO6dsNPu0PsLzO1&google_hm=4ir_IUCUhSE8N-GnDH80vA

Request Chain 201

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAZmPxg9dUQJa-fX_zhEbjMtxFFg2L-HKF2jHeandf47o5Tp1AjzLOls6n4m-wAHoVk88WHoaO9uVBz-mH-SWNEbY5Q-HBUrEiBhReQ&google_gid=CAESEBBmxD19kku-707Mhfmv3TA&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjEwMTAxNDA3NDIwMDAxMjgyODk3ODgxNA%3D%3D&google_push=AZmPxg9dUQJa-fX_zhEbjMtxFFg2L-HKF2jHeandf47o5Tp1AjzLOls6n4m-wAHoVk88WHoaO9uVBz-mH-SWNEbY5Q-HBUrEiBhReQ

Request Chain 202

https://odr.mookie1.com/t/v2/sync?tagid=V2_4530&src.visitorid=CAESEF6wA06EsRb-Vrg6KCYcB0Y&google_cver=1&google_push=AZmPxg89UbpMZOz1kJlyaGkLo90cPivMIiNDzJs2bpQ6btbGdyZ3iKSKbC837M0CPpj1TOo79bfuZJ6nzKLoCA1YfH_NPuoCiJ2O HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=xaxis_dev_dmp&google_push=AZmPxg89UbpMZOz1kJlyaGkLo90cPivMIiNDzJs2bpQ6btbGdyZ3iKSKbC837M0CPpj1TOo79bfuZJ6nzKLoCA1YfH_NPuoCiJ2O&google_hm=MTA1OTY4MjkxODk4MjY0NTYyMjE

Request Chain 203

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEPQEcJl_tOXxPnD2Pw_JdSk&google_cver=1&google_push=AZmPxg_MRT0TUwX1nMcCQZuz7M2w0sbJDwYV_lTLUEKIakXRFSBFStB2iNoQrbvm3VuEIWr8WWdCWRMM3yaMlfDvJ4QQer3QMnd1rA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=48g7gr1pSWuwHETgJ278kA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AZmPxg_MRT0TUwX1nMcCQZuz7M2w0sbJDwYV_lTLUEKIakXRFSBFStB2iNoQrbvm3VuEIWr8WWdCWRMM3yaMlfDvJ4QQer3QMnd1rA

Request Chain 204

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESENazlA3jzWsIGUx6POxzhbw&google_cver=1&google_push=AZmPxg_UrSFzylIy2-kDEs9jlKvUPk-4yAnpkcLVAHkbhVkedjD--FAhq5oU4IYYaMqP4xEWeUCAQYgF02LISWAWgoPDVbD7iqh45w HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDkyVU1NNUUtMVMtNVBOOA==&google_push=AZmPxg_UrSFzylIy2-kDEs9jlKvUPk-4yAnpkcLVAHkbhVkedjD--FAhq5oU4IYYaMqP4xEWeUCAQYgF02LISWAWgoPDVbD7iqh45w

Request Chain 205

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESENROOsPCvcMEm2BqQc5ahv4&google_cver=1&google_push=AZmPxg8plRrBjXLnic_b5A_zSqeHrFBxohfGFHfKl-ctUrt-TlyXcWOTTx0vc015mBEteXr8Zb5206KpelmZCyTYsU1iqXsXadTy HTTP 302
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESENROOsPCvcMEm2BqQc5ahv4&google_hm=Y0QnLmu47UNT52BpOxFZWAAAALYAAAAB&google_nid=index&google_push=AZmPxg8plRrBjXLnic_b5A_zSqeHrFBxohfGFHfKl-ctUrt-TlyXcWOTTx0vc015mBEteXr8Zb5206KpelmZCyTYsU1iqXsXadTy

Request Chain 206

https://cc.adingo.jp/adx/push/?google_gid=CAESEDW2xwOFl2H1UqFJmWbU4a0&google_cver=1&google_push=AZmPxg8Xu3yAVnA3GVuRoLKEnvrGa4SWZ8oob6zdzKd93p0Wo0CIm8aUMMnZFsyUshJ5FCctkBQ5OHJsLs1omLlpJnEl78IjVTdR9Q HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AZmPxg8Xu3yAVnA3GVuRoLKEnvrGa4SWZ8oob6zdzKd93p0Wo0CIm8aUMMnZFsyUshJ5FCctkBQ5OHJsLs1omLlpJnEl78IjVTdR9Q&google_hm=f628fcef6bf2442b7322e0350d92ff60

204 HTTP transactions
12 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/
Redirect Chain

https://trk.cp20.com/click/g4x7-3p1c3h-8c1e8p-f5ddgdm4/pmreg33oorqwg5boonxxk4tdmvewiir2ejuxezlgej6q====
https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email

133 KB
21 KB

84ms
53ms

Document
text/html

2606:4700:10::ac43:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1c08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 61b919b6ebdf51ec13f26134d27ade8102b80dcd9ed6cffcbd38662884a184ca

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 332
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 757fec74bf924bb9-YUL
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 10 Oct 2022 14:07:40 GMT
last-modified: Mon, 10 Oct 2022 02:56:24 GMT
link: <https://www.rightwing.org/wp-json/>; rel="https://api.w.org/", <https://www.rightwing.org/wp-json/wp/v2/posts/35230>; rel="alternate"; type="application/json", <https://www.rightwing.org/?p=35230>; rel=shortlink
server: cloudflare
vary: Accept-Encoding,Cookie

Redirect headers

Cache-Control: private
Content-Length: 266
Content-Type: text/html; charset=utf-8
Date: Mon, 10 Oct 2022 14:07:39 GMT
Location: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Refresh: 0; URL=https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Server: Microsoft-IIS/8.5

GET
H2 200 style.min.css
www.rightwing.org/wp-includes/css/dist/block-library/ 87 KB
12 KB 29ms
27ms Stylesheet
text/css 2606:4700:10::ac43:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.rightwing.org/wp-includes/css/dist/block-library/style.min.css?ver=6.0.2
Requested by: Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1c08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d7705700d24d5919255576642ad2c28bfc790390b7183a369038ff5c1e814d51

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 12 Jul 2022 19:28:12 GMT
server: cloudflare
age: 9079
etag: W/"15b64-5e3a0ab5d00d0"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=14400
cf-ray: 757fec750fe14bb9-YUL

GET
H2 200 main.css
www.rightwing.org/wp-content/plugins/auth0/assets/css/ 468 B
373 B 28ms
25ms Stylesheet
text/css 2606:4700:10::ac43:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.rightwing.org/wp-content/plugins/auth0/assets/css/main.css?ver=6.0.2
Requested by: Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1c08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5a1d53c953f6cb274ab08d0b4f72060a87585df1c3b362b8e3018353b7fb6546

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 14 Oct 2021 23:04:36 GMT
server: cloudflare
age: 9079
etag: W/"1d4-5ce581a472f29"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=14400
cf-ray: 757fec750fe44bb9-YUL

GET
H2 200 style.css
www.rightwing.org/wp-content/plugins/td-composer/td-multi-purpose/ 37 KB
5 KB 27ms
24ms Stylesheet
text/css 2606:4700:10::ac43:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.rightwing.org/wp-content/plugins/td-composer/td-multi-purpose/style.css?ver=e815948e5c9ec5801de67b92a1d5a59f
Requested by: Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1c08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3ed2e42d3ce5e24dcb11cddde4126e4f07c3afc590f708ad2cfbf7669002f92e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 07 Oct 2022 12:54:07 GMT
server: cloudflare
age: 9079
etag: W/"92ec-5ea714e2e40da"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=14400
cf-ray: 757fec750fe54bb9-YUL

GET
H2 200 style.css
www.rightwing.org/wp-content/themes/Newspaper/ 137 KB
26 KB 29ms
27ms Stylesheet
text/css 2606:4700:10::ac43:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.rightwing.org/wp-content/themes/Newspaper/style.css?ver=12
Requested by: Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1c08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8ada2a7ece980220cebf1c7580372e5ff56417e02b6f5def8fb715d057427b36

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 07 Oct 2022 12:53:48 GMT
server: cloudflare
age: 9079
etag: W/"22343-5ea714d0ee4df"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=14400
cf-ray: 757fec750fe64bb9-YUL

GET
H2 200 td_legacy_main.css
www.rightwing.org/wp-content/plugins/td-composer/legacy/Newspaper/assets/css/ 160 KB
24 KB 41ms
39ms Stylesheet
text/css 2606:4700:10::ac43:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.rightwing.org/wp-content/plugins/td-composer/legacy/Newspaper/assets/css/td_legacy_main.css?ver=e815948e5c9ec5801de67b92a1d5a59f
Requested by: Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1c08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8c21de3b659aaa30693e28670ce6526645a4af8ce4d49c38f9fe410552d36e4a

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 07 Oct 2022 12:54:07 GMT
server: cloudflare
age: 9079
etag: W/"281f9-5ea714e36eba5"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=14400
cf-ray: 757fec750fe74bb9-YUL

GET
H2 200 td_standard_pack_main.css
www.rightwing.org/wp-content/plugins/td-standard-pack/Newspaper/assets/css/ 715 KB
61 KB 31ms
29ms Stylesheet
text/css 2606:4700:10::ac43:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.rightwing.org/wp-content/plugins/td-standard-pack/Newspaper/assets/css/td_standard_pack_main.css?ver=48767bfdc5698c9103b4ef9b700012fd
Requested by: Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1c08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1008e0fea1bcea71d721ce0187eba5979aee7626901ea11940898b0db51320c0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 07 Oct 2022 12:54:08 GMT
server: cloudflare
age: 9079
etag: W/"b2d2a-5ea714e41f7d3"
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=14400
cf-ray: 757fec750fe84bb9-YUL

GET
H2 200 earnware-lib.js Show response
www.rightwing.org/wp-content/plugins/earnware-connect/public/js/ 4 KB
2 KB 30ms
28ms Script
application/javascript 2606:4700:10::ac43:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.rightwing.org/wp-content/plugins/earnware-connect/public/js/earnware-lib.js?ver=1.0.69
Requested by: Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1c08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 53d87ed8b9dea593a1d49c88373b68f9212b739588e032d5d070687c854984a4

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 11 Jul 2022 16:32:39 GMT
server: cloudflare
age: 9079
etag: W/"1017-5e38a19af830c"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 757fec750feb4bb9-YUL

GET
H2 200 jquery.min.js Show response
www.rightwing.org/wp-includes/js/jquery/ 87 KB
30 KB 40ms
38ms Script
application/javascript 2606:4700:10::ac43:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.rightwing.org/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Requested by: Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1c08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 26 Jul 2021 14:18:22 GMT
server: cloudflare
age: 9079
etag: W/"15db1-5c8076d048caa"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 757fec750ff64bb9-YUL

GET
H2 200 jquery-migrate.min.js Show response
www.rightwing.org/wp-includes/js/jquery/ 11 KB
4 KB 39ms
38ms Script
application/javascript 2606:4700:10::ac43:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.rightwing.org/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Requested by: Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1c08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 18 Dec 2020 22:39:10 GMT
server: cloudflare
age: 9079
etag: W/"2bd8-5b6c4c6ebd971"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 757fec750ff74bb9-YUL

GET
H2 200 earnware-tracking.js Show response
www.rightwing.org/wp-content/plugins/earnware-connect/public/js/ 1 KB
400 B 40ms
39ms Script
application/javascript 2606:4700:10::ac43:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.rightwing.org/wp-content/plugins/earnware-connect/public/js/earnware-tracking.js?ver=1.0.69
Requested by: Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1c08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 843ce787c060f04c0334bb78db17bbea63a9f9c5b99466b3998be06be0d64305

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 11 Jul 2022 16:32:39 GMT
server: cloudflare
age: 9079
etag: W/"40a-5e38a19af830c"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 757fec750ff94bb9-YUL

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 162 KB
54 KB 111ms
51ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-1109401964623664

Requested by

Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fd3bbcd4377b397d238cc9eabac9dfbeac05b0b4762efaccc73fbb5d627b467e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.rightwing.org/
Origin: https://www.rightwing.org
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 54730
x-xss-protection: 0
server: cafe
etag: 10856264812083040876
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 10 Oct 2022 14:07:40 GMT

GET
H2 200 Right-Wing-Logo-N.png
www.rightwing.org/wp-content/uploads/sites/6/2022/07/ 7 KB
7 KB 43ms
34ms Image
image/png 2606:4700:10::ac43:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.rightwing.org/wp-content/uploads/sites/6/2022/07/Right-Wing-Logo-N.png
Requested by: Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1c08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 91d44223446a76d41931c43f6e693a4518ffeca65412451cdefff8e9dda43391

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
cf-cache-status: HIT
last-modified: Fri, 01 Jul 2022 12:05:11 GMT
server: cloudflare
age: 9079
etag: "1a54-5e2bd32bcf657"
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 757fec7598e44bb9-YUL
content-length: 6740

GET
H2 200 Right-Wing-Logo-ML.png
www.rightwing.org/wp-content/uploads/sites/6/2022/03/ 6 KB
6 KB 48ms
40ms Image
image/png 2606:4700:10::ac43:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.rightwing.org/wp-content/uploads/sites/6/2022/03/Right-Wing-Logo-ML.png
Requested by: Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1c08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f583c324daf6d4fd4399694b042e2a822117a05263ef59ef3b895c14c4c388cd

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
cf-cache-status: HIT
last-modified: Mon, 28 Mar 2022 20:33:01 GMT
server: cloudflare
age: 9079
etag: "1613-5db4d37f4b526"
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 757fec7598e74bb9-YUL
content-length: 5651

GET
H2 200 shutterstock_2166335989-696x464.jpg
www.rightwing.org/wp-content/uploads/sites/6/2022/10/ 64 KB
64 KB 34ms
26ms Image
image/jpeg 2606:4700:10::ac43:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.rightwing.org/wp-content/uploads/sites/6/2022/10/shutterstock_2166335989-696x464.jpg
Requested by: Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1c08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9ab404cb176787bb58cb49507d311a2a76fc8288eb2e7d1cbe3df517b3e2a1da

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
cf-cache-status: HIT
cf-bgj: h2pri
last-modified: Tue, 04 Oct 2022 05:46:22 GMT
server: cloudflare
age: 332
etag: "ff4d-5ea2efaed1dd1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 757fec7598e94bb9-YUL
content-length: 65357

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 162 KB
54 KB 115ms
56ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c7a1f721f6581b9badc1c775d6493a5f7729c470ce7ccbe84823ac44e0ba89e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 54745
x-xss-protection: 0
server: cafe
etag: 10761061714830510009
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 10 Oct 2022 14:07:40 GMT

GET
H2 200 widgets.js Show response
platform.twitter.com/ 97 KB
29 KB 87ms
18ms Script
application/javascript 199.232.36.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.232.36.157 New York, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 9bd8dcc115a0e9fce94520cecad5254352b86d55bca2506833057bb52e87ee1a

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
content-encoding: gzip
last-modified: Wed, 28 Sep 2022 20:05:37 GMT
etag: "f26384f93da6974ed577808dfa1fede5+gzip"
vary: Accept-Encoding
access-control-allow-methods: GET
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
access-control-allow-origin: *
x-cache: HIT, HIT
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=1800
accept-ranges: bytes
tw-cdn: FT
content-length: 29223
x-served-by: cache-iad-kcgs7200162-IAD, cache-lga21978-LGA

GET
H2 200 shutterstock_680847808-218x150.jpg
www.rightwing.org/wp-content/uploads/sites/6/2022/10/ 8 KB
8 KB 35ms
28ms Image
image/jpeg 2606:4700:10::ac43:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.rightwing.org/wp-content/uploads/sites/6/2022/10/shutterstock_680847808-218x150.jpg
Requested by: Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1c08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ceb8444cb437d3f16ad2590f8b9d764c4f143a6301c54cc297d72ec737ad1959

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
cf-cache-status: HIT
cf-bgj: h2pri
last-modified: Fri, 07 Oct 2022 06:45:00 GMT
server: cloudflare
age: 41995
etag: "1f8f-5ea6c2619e4d0"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 757fec7598ec4bb9-YUL
content-length: 8079

GET
H2 200 shutterstock_1716116671-218x150.jpg
www.rightwing.org/wp-content/uploads/sites/6/2022/10/ 7 KB
7 KB 37ms
30ms Image
image/jpeg 2606:4700:10::ac43:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.rightwing.org/wp-content/uploads/sites/6/2022/10/shutterstock_1716116671-218x150.jpg
Requested by: Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1c08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ca704f6fd04a7cbcffe1c503bf3e7aa34034f984b73646b5cb76c812cd7634c9

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
cf-cache-status: HIT
cf-bgj: h2pri
last-modified: Fri, 07 Oct 2022 06:20:09 GMT
server: cloudflare
age: 533
etag: "1d72-5ea6bcd3c5e13"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 757fec7598ef4bb9-YUL
content-length: 7538

GET
H2 200 shutterstock_190246493-218x150.jpg
www.rightwing.org/wp-content/uploads/sites/6/2022/10/ 7 KB
7 KB 51ms
44ms Image
image/jpeg 2606:4700:10::ac43:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.rightwing.org/wp-content/uploads/sites/6/2022/10/shutterstock_190246493-218x150.jpg
Requested by: Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1c08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2c838363a436edd65ce14a47a13b01410ed28828744717be7f94bec77e09d7f9

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
cf-cache-status: HIT
cf-bgj: h2pri
last-modified: Thu, 06 Oct 2022 07:02:34 GMT
server: cloudflare
age: 533
etag: "1b23-5ea584718abd1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 757fec7598f34bb9-YUL
content-length: 6947

GET
H2 200 shutterstock_121141399-218x150.jpg
www.rightwing.org/wp-content/uploads/sites/6/2022/10/ 7 KB
7 KB 37ms
30ms Image
image/jpeg 2606:4700:10::ac43:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.rightwing.org/wp-content/uploads/sites/6/2022/10/shutterstock_121141399-218x150.jpg
Requested by: Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1c08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b58a0072c69e0c38ba92247bf44992ba450fdd97689770a39829813f9c2254d3

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
cf-cache-status: HIT
cf-bgj: h2pri
last-modified: Thu, 06 Oct 2022 06:58:18 GMT
server: cloudflare
age: 533
etag: "1a62-5ea5837d6e5cc"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 757fec7598f64bb9-YUL
content-length: 6754

GET
H2 200 shutterstock_36608650-218x150.jpg
www.rightwing.org/wp-content/uploads/sites/6/2022/10/ 14 KB
14 KB 35ms
29ms Image
image/jpeg 2606:4700:10::ac43:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.rightwing.org/wp-content/uploads/sites/6/2022/10/shutterstock_36608650-218x150.jpg
Requested by: Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1c08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f8943d6b18e8375293e87f22631581e81161cf3a328db2043acf50dcbb9945f2

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
cf-cache-status: HIT
cf-bgj: h2pri
last-modified: Thu, 06 Oct 2022 06:53:47 GMT
server: cloudflare
age: 533
etag: "3802-5ea5827b2db6f"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 757fec75a9144bb9-YUL
content-length: 14338

GET
H2 200 shutterstock_1622521543-218x150.jpg
www.rightwing.org/wp-content/uploads/sites/6/2022/10/ 14 KB
14 KB 37ms
31ms Image
image/jpeg 2606:4700:10::ac43:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.rightwing.org/wp-content/uploads/sites/6/2022/10/shutterstock_1622521543-218x150.jpg
Requested by: Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1c08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1a746b0004e187b2874ed7f3fcbb6d6468fd02fdcb1e70292faa45c07d150e01

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
cf-cache-status: HIT
cf-bgj: h2pri
last-modified: Tue, 04 Oct 2022 22:24:14 GMT
server: cloudflare
age: 533
etag: "3900-5ea3ceb87d869"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 757fec75a9154bb9-YUL
content-length: 14592

GET
H2 200 shutterstock_1024058209-218x150.jpg
www.rightwing.org/wp-content/uploads/sites/6/2022/10/ 12 KB
13 KB 52ms
46ms Image
image/jpeg 2606:4700:10::ac43:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.rightwing.org/wp-content/uploads/sites/6/2022/10/shutterstock_1024058209-218x150.jpg
Requested by: Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1c08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: be826a42960c2537c8fee4fcece922ebf0f834ce89cb0036de8e81f8c56030d3

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
cf-cache-status: HIT
cf-bgj: h2pri
last-modified: Mon, 03 Oct 2022 22:42:40 GMT
server: cloudflare
age: 533
etag: "31b1-5ea290fa0a02c"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 757fec75a9164bb9-YUL
content-length: 12721

GET
H2 200 shutterstock_362877266-218x150.jpg
www.rightwing.org/wp-content/uploads/sites/6/2022/10/ 11 KB
12 KB 53ms
47ms Image
image/jpeg 2606:4700:10::ac43:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.rightwing.org/wp-content/uploads/sites/6/2022/10/shutterstock_362877266-218x150.jpg
Requested by: Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1c08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fba481fab20272ef7a48caf00ada54029f59dcbfafcaaf934d2a6477531c2a81

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
cf-cache-status: HIT
cf-bgj: h2pri
last-modified: Sun, 02 Oct 2022 22:26:18 GMT
server: cloudflare
age: 533
etag: "2dee-5ea14b73cd23d"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 757fec75a9174bb9-YUL
content-length: 11758

GET
H2 200 shutterstock_1055583416-218x150.jpg
www.rightwing.org/wp-content/uploads/sites/6/2022/10/ 9 KB
9 KB 39ms
34ms Image
image/jpeg 2606:4700:10::ac43:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.rightwing.org/wp-content/uploads/sites/6/2022/10/shutterstock_1055583416-218x150.jpg
Requested by: Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1c08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 810faff3965c7e15bffa14a46c643567f11f9212cc892d9dca35b0bd07df1a60

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
cf-cache-status: HIT
cf-bgj: h2pri
last-modified: Sun, 02 Oct 2022 22:24:17 GMT
server: cloudflare
age: 13880
etag: "2337-5ea14b007053c"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 757fec75a9184bb9-YUL
content-length: 9015

GET
H2 200 shutterstock_1949881045-100x70.jpg
www.rightwing.org/wp-content/uploads/sites/6/2022/09/ 2 KB
2 KB 37ms
32ms Image
image/jpeg 2606:4700:10::ac43:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.rightwing.org/wp-content/uploads/sites/6/2022/09/shutterstock_1949881045-100x70.jpg
Requested by: Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1c08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d2fcc0c54dc21211f0c3a83aa556d3c7b3564ddf94d6cf6acbd130899cac1936

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
cf-cache-status: HIT
cf-bgj: h2pri
last-modified: Fri, 30 Sep 2022 06:42:57 GMT
server: cloudflare
age: 8381
etag: "97b-5e9df4deb69e3"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 757fec75a9194bb9-YUL
content-length: 2427

GET
H2 200 shutterstock_1168340341-100x70.jpg
www.rightwing.org/wp-content/uploads/sites/6/2022/09/ 3 KB
3 KB 50ms
45ms Image
image/jpeg 2606:4700:10::ac43:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.rightwing.org/wp-content/uploads/sites/6/2022/09/shutterstock_1168340341-100x70.jpg
Requested by: Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1c08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a0afb8074484b63a4167543d75d5b89396465cd27cb561521f11b1c80ad31b01

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
cf-cache-status: HIT
cf-bgj: h2pri
last-modified: Fri, 30 Sep 2022 06:38:40 GMT
server: cloudflare
age: 42072
etag: "bc9-5e9df3e9c931c"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 757fec75a91a4bb9-YUL
content-length: 3017

GET
H2 200 shutterstock_1936368721-100x70.jpg
www.rightwing.org/wp-content/uploads/sites/6/2022/09/ 3 KB
3 KB 46ms
41ms Image
image/jpeg 2606:4700:10::ac43:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.rightwing.org/wp-content/uploads/sites/6/2022/09/shutterstock_1936368721-100x70.jpg
Requested by: Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1c08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 942635f66fd7fbfcb36341add770dd34ee62126993b74ae08aca14f35b3dc35c

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
cf-cache-status: HIT
cf-bgj: h2pri
last-modified: Fri, 30 Sep 2022 06:39:41 GMT
server: cloudflare
age: 42073
etag: "b98-5e9df4236a697"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 757fec75a91c4bb9-YUL
content-length: 2968

GET
H2 200 shutterstock_692329453-100x70.jpg
www.rightwing.org/wp-content/uploads/sites/6/2022/09/ 3 KB
3 KB 47ms
42ms Image
image/jpeg 2606:4700:10::ac43:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.rightwing.org/wp-content/uploads/sites/6/2022/09/shutterstock_692329453-100x70.jpg
Requested by: Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1c08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6c673e591d9884911d15476ef26e0000b08437accd19238873d5ca9bb3341cc9

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
cf-cache-status: HIT
cf-bgj: h2pri
last-modified: Fri, 30 Sep 2022 06:33:50 GMT
server: cloudflare
age: 42072
etag: "bd4-5e9df2d4b621b"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 757fec75a91f4bb9-YUL
content-length: 3028

GET
H2 200 shutterstock_1938407416-100x70.jpg
www.rightwing.org/wp-content/uploads/sites/6/2022/09/ 3 KB
3 KB 46ms
42ms Image
image/jpeg 2606:4700:10::ac43:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.rightwing.org/wp-content/uploads/sites/6/2022/09/shutterstock_1938407416-100x70.jpg
Requested by: Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1c08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 55460e7a9b69d3b241020d790d2d51ef396008c58d0a2e1530382f4e85503e75

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
cf-cache-status: HIT
cf-bgj: h2pri
last-modified: Wed, 28 Sep 2022 21:44:29 GMT
server: cloudflare
age: 42072
etag: "c57-5e9c3aa60d921"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 757fec75a9204bb9-YUL
content-length: 3159

GET
H2 200 shutterstock_314942846-100x70.jpg
www.rightwing.org/wp-content/uploads/sites/6/2022/09/ 4 KB
4 KB 48ms
43ms Image
image/jpeg 2606:4700:10::ac43:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.rightwing.org/wp-content/uploads/sites/6/2022/09/shutterstock_314942846-100x70.jpg
Requested by: Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1c08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f790baf0f92372fc3c701fb574a9c5d2df3540a772bca2eb192985267d7bb420

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
cf-cache-status: HIT
cf-bgj: h2pri
last-modified: Wed, 28 Sep 2022 22:47:04 GMT
server: cloudflare
age: 42072
etag: "e15-5e9c48a2619b8"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 757fec75a9214bb9-YUL
content-length: 3605

GET
H2 200 shutterstock_1936368757-100x70.jpg
www.rightwing.org/wp-content/uploads/sites/6/2022/09/ 3 KB
3 KB 50ms
45ms Image
image/jpeg 2606:4700:10::ac43:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.rightwing.org/wp-content/uploads/sites/6/2022/09/shutterstock_1936368757-100x70.jpg
Requested by: Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1c08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dd694be126b3523950b0fea5c037a4f417022a72e111381687e5d45f19f8a4b9

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
cf-cache-status: HIT
cf-bgj: h2pri
last-modified: Tue, 27 Sep 2022 22:49:46 GMT
server: cloudflare
age: 42072
etag: "af9-5e9b075fdf7e9"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 757fec75a9224bb9-YUL
content-length: 2809

GET
H2 200 shutterstock_402776938-100x70.jpg
www.rightwing.org/wp-content/uploads/sites/6/2022/09/ 5 KB
5 KB 39ms
35ms Image
image/jpeg 2606:4700:10::ac43:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.rightwing.org/wp-content/uploads/sites/6/2022/09/shutterstock_402776938-100x70.jpg
Requested by: Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1c08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1270f79e995bae3e90354d46e3d809106d82090ec50c8a7a391ec50d24774a8d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
cf-cache-status: HIT
cf-bgj: h2pri
last-modified: Tue, 27 Sep 2022 22:47:14 GMT
server: cloudflare
age: 42072
etag: "12bc-5e9b06cee5748"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 757fec75a9244bb9-YUL
content-length: 4796

GET
H2 200 shutterstock_111203738-100x70.jpg
www.rightwing.org/wp-content/uploads/sites/6/2022/09/ 2 KB
3 KB 41ms
37ms Image
image/jpeg 2606:4700:10::ac43:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.rightwing.org/wp-content/uploads/sites/6/2022/09/shutterstock_111203738-100x70.jpg
Requested by: Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1c08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3c308940af700950ec8a9ac2fb2bd1de8d3a426531446e3cbc3d5d51f2dd3b9c

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
cf-cache-status: HIT
cf-bgj: h2pri
last-modified: Sat, 24 Sep 2022 16:32:31 GMT
server: cloudflare
age: 42072
etag: "9b8-5e96ed74d36a9"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 757fec75a9264bb9-YUL
content-length: 2488

GET
H2 200 shutterstock_787487767-100x70.jpg
www.rightwing.org/wp-content/uploads/sites/6/2022/09/ 2 KB
3 KB 52ms
48ms Image
image/jpeg 2606:4700:10::ac43:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.rightwing.org/wp-content/uploads/sites/6/2022/09/shutterstock_787487767-100x70.jpg
Requested by: Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1c08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4fbc0c4def1cd0b37241266c7a7c30169fb96388d3eadd055031a5f14670695f

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
cf-cache-status: HIT
cf-bgj: h2pri
last-modified: Sat, 24 Sep 2022 16:30:09 GMT
server: cloudflare
age: 42072
etag: "9c7-5e96eced523fd"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 757fec75a9294bb9-YUL
content-length: 2503

GET
H2 200 shutterstock_1821865595-100x70.jpg
www.rightwing.org/wp-content/uploads/sites/6/2022/09/ 3 KB
3 KB 42ms
38ms Image
image/jpeg 2606:4700:10::ac43:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.rightwing.org/wp-content/uploads/sites/6/2022/09/shutterstock_1821865595-100x70.jpg
Requested by: Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1c08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: adae09db1e4eec81817f4a7131ccbae5de55937ae712b370e35a3a427bc345cb

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
cf-cache-status: HIT
cf-bgj: h2pri
last-modified: Fri, 23 Sep 2022 05:56:56 GMT
server: cloudflare
age: 42072
etag: "ba2-5e951d877ee71"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 757fec75a92a4bb9-YUL
content-length: 2978

GET
H2 200 earnware-merge.js Show response
www.rightwing.org/wp-content/plugins/earnware-connect/public/js/ 1 KB
791 B 20ms
20ms Script
application/javascript 2606:4700:10::ac43:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.rightwing.org/wp-content/plugins/earnware-connect/public/js/earnware-merge.js?ver=1.0.69
Requested by: Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1c08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 743f65b0622a16c8d51e6d35c9d7a4e058efd02fe7bceb4baa86a87abe05b01f

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 11 Jul 2022 16:32:39 GMT
server: cloudflare
age: 9079
etag: W/"50c-5e38a19af830c"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 757fec75687f4bb9-YUL

GET
H2 200 tagdiv_theme.min.js Show response
www.rightwing.org/wp-content/plugins/td-composer/legacy/Newspaper/js/ 298 KB
71 KB 20ms
20ms Script
application/javascript 2606:4700:10::ac43:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.rightwing.org/wp-content/plugins/td-composer/legacy/Newspaper/js/tagdiv_theme.min.js?ver=12
Requested by: Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1c08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 887880bbd37c109dca66464d026c316a5747e607b6c70cfd8addbf047ef42e95

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 07 Oct 2022 12:54:08 GMT
server: cloudflare
age: 9079
etag: W/"4a964-5ea714e375906"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 757fec7568884bb9-YUL

GET
H2 200 comment-reply.min.js Show response
www.rightwing.org/wp-includes/js/ 3 KB
1 KB 48ms
40ms Script
application/javascript 2606:4700:10::ac43:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.rightwing.org/wp-includes/js/comment-reply.min.js?ver=6.0.2
Requested by: Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1c08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e174a58a503ab84b3d1b9de12fd3895788204485170f1289e445f7b5b98ec789

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 25 May 2022 23:18:56 GMT
server: cloudflare
age: 9079
etag: W/"ba5-5dfde4c19c280"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 757fec7598df4bb9-YUL

GET
H2 200 wp-emoji-release.min.js Show response
www.rightwing.org/wp-includes/js/ 18 KB
5 KB 40ms
36ms Script
application/javascript 2606:4700:10::ac43:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.rightwing.org/wp-includes/js/wp-emoji-release.min.js?ver=6.0.2
Requested by: Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1c08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 25 May 2022 23:18:56 GMT
server: cloudflare
age: 9079
etag: W/"48b9-5dfde4c1a0101"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 757fec75a92c4bb9-YUL

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 149 KB
57 KB 88ms
35ms Script
application/javascript 2607:f8b0:4006:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-P6S6PPP

Requested by

Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::2008 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a5b8e9a55b7a45a82d2263f777f7299973e376b2c7d631198561719bae1d58f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 57659
x-xss-protection: 0
last-modified: Mon, 10 Oct 2022 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 10 Oct 2022 14:07:40 GMT

GET
H2 200 newspaper.woff
www.rightwing.org/wp-content/themes/Newspaper/images/icons/ 32 KB
32 KB 38ms
37ms Font
font/woff 2606:4700:10::ac43:1c08
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.rightwing.org/wp-content/themes/Newspaper/images/icons/newspaper.woff?21
Requested by: Host: www.rightwing.org
URL: https://www.rightwing.org/wp-content/themes/Newspaper/style.css?ver=12
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1c08 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c21a4f4dea997c97bf301a6d477a7968fabb123e8e00f99ae6fac7f4767324d6

Request headers

Referer: https://www.rightwing.org/wp-content/themes/Newspaper/style.css?ver=12
Origin: https://www.rightwing.org
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
cf-cache-status: HIT
last-modified: Fri, 07 Oct 2022 12:53:33 GMT
server: cloudflare
age: 38303
etag: "8040-5ea714c229f48"
vary: Accept-Encoding
content-type: font/woff
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 757fec75a92f4bb9-YUL
content-length: 32832

GET
H2 200 ajs.js Show response
cdn2.lockerdomecdn.com/_js/ 7 KB
3 KB 58ms
18ms Script
application/javascript 2600:9000:2512:f000:a:cbb7:a940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.lockerdomecdn.com/_js/ajs.js
Requested by: Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2512:f000:a:cbb7:a940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: f8c4fdb5d5d285dc8316d90b5f924e13abb66c4ec75d273f2f5b1f5bd91c3d92

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 07:46:45 GMT
content-encoding: gzip
via: 1.1 7c1248297a08764c17a9223ad5c211f8.cloudfront.net (CloudFront)
last-modified: Wed, 05 Oct 2022 17:14:24 GMT
x-amz-cf-pop: JFK50-P7
age: 22855
etag: W/"1a40-183a9243133"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=86400
accept-ranges: bytes
x-amz-cf-id: ldWOVdSfK5ULjYhFE9h77ajQ3TbjxpfkK9YYWtVbDGE-Qt2dkkKDXQ==

GET
H/1.1 200
OK 14001166036186214 Show response
lockerdome.com/lad/ Frame E6EC 42 KB
16 KB 213ms
87ms Document
text/html 104.154.142.214
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://lockerdome.com/lad/14001166036186214?pubid=ld-6064-290&pubo=https%3A%2F%2Fwww.rightwing.org&rid=&width=696&utm_source=iref&utm_medium=email
Requested by: Host: cdn2.lockerdomecdn.com
URL: https://cdn2.lockerdomecdn.com/_js/ajs.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.154.142.214 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 214.142.154.104.bc.googleusercontent.com
Software: /
Resource Hash: 858a810d10e72c46e613ef996356319b7c2ca8f186091895d165a7a99a38b4f6

Request headers

Referer: https://www.rightwing.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: no-cache, max-age=0, must-revalidate, no-store
Content-Encoding: gzip
Content-Length: 15415
Content-Type: text/html; charset=utf-8
Date: Mon, 10 Oct 2022 14:07:40 GMT

GET
H/1.1 200
OK 13360564449522790 Show response
lockerdome.com/lad/ Frame CAF6 103 KB
21 KB 259ms
139ms Document
text/html 104.154.142.214
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://lockerdome.com/lad/13360564449522790?pubid=ld-2765-5011&pubo=https%3A%2F%2Fwww.rightwing.org&rid=&width=1068&utm_source=iref&utm_medium=email
Requested by: Host: cdn2.lockerdomecdn.com
URL: https://cdn2.lockerdomecdn.com/_js/ajs.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.154.142.214 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 214.142.154.104.bc.googleusercontent.com
Software: /
Resource Hash: 817275171bafe3a2f1046c0db2c8c225548bc2062f91861415d6d6298eae18a3

Request headers

Referer: https://www.rightwing.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: no-cache, max-age=0, must-revalidate, no-store
Content-Encoding: gzip
Content-Length: 20746
Content-Type: text/html; charset=utf-8
Date: Mon, 10 Oct 2022 14:07:40 GMT

GET
H2 200 widget_iframe.7dae38096d06923d683a2a807172322a.html Show response
platform.twitter.com/widgets/ Frame A157 320 KB
103 KB 21ms
21ms Document
text/html 199.232.36.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.7dae38096d06923d683a2a807172322a.html?origin=https%3A%2F%2Fwww.rightwing.org
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.232.36.157 New York, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 8c0531412c543b9bd978e29acb8f5cf330db9891115d1e9924519d9a675b7b74

Request headers

Referer: https://www.rightwing.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: public, max-age=315360000
content-encoding: gzip
content-length: 105445
content-type: text/html; charset=utf-8
date: Mon, 10 Oct 2022 14:07:40 GMT
etag: "50d73c0b4a4c7e4697b9c6ac6f1ecd75+gzip"
last-modified: Wed, 28 Sep 2022 20:04:27 GMT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
tw-cdn: FT
vary: Accept-Encoding
x-cache: HIT, HIT
x-served-by: cache-iad-kjyo7100170-IAD, cache-lga21978-LGA

GET
H2 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209290101/ 349 KB
123 KB 92ms
91ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209290101/show_ads_impl_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-1109401964623664

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38f200a6187e70ab6a45089eb0d4154f6e94e680c5f178e42c7955c9a4feb39e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 125809
x-xss-protection: 0
server: cafe
etag: 11822736211717850915
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Mon, 10 Oct 2022 14:07:40 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20221003/r20190131/ Frame A790 10 KB
5 KB 71ms
24ms Document
text/html 2607:f8b0:4006:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20221003/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-1109401964623664

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:806::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f7408c25067cd0a9d9fe835cb4c05e394a50751d3fcde0c461db19a309abb02a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.rightwing.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 73931
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 4420
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 09 Oct 2022 17:35:29 GMT
etag: 9671129459699598864
expires: Sun, 23 Oct 2022 17:35:29 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 101 KB
27 KB 71ms
20ms Script
application/x-javascript 2a03:2880:f012:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

00a92494627ed8f758972b7dc47b3af186497c0637ea867a33fdb604c1548674

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Mon, 10 Oct 2022 14:07:40 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 26840
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: Pojj6JnFxZs4Q8zU0h26kXTB8QVrQS5KEj+mm1e8Pf78jJZ1IV2HH8f5CsFUzBRe+FW1tDTvoXV0T0opuKXOow==
x-fb-trip-id: 1512268381
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 65ms
18ms Script
text/javascript 2607:f8b0:4006:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P6S6PPP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::200e Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 10 Oct 2022 12:34:58 GMT
last-modified: Tue, 27 Sep 2022 22:01:05 GMT
server: Golfe2
age: 5562
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20039
expires: Mon, 10 Oct 2022 14:34:58 GMT

GET
H2 200 a-07ec.min.js Show response
b-code.liadm.com/ 28 KB
11 KB 64ms
20ms Script
application/javascript 2600:9000:20ed:c000:8:8845:1500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://b-code.liadm.com/a-07ec.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P6S6PPP
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20ed:c000:8:8845:1500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 847f5d63ddcb0763f753afd3ce867d9b0aee9ce18eb86590365d9206a14d7aff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 07:54:18 GMT
content-encoding: gzip
via: 1.1 235099561ba63a2b7662a2b20d9ac036.cloudfront.net (CloudFront)
x-amz-cf-pop: PHL50-C1
age: 22402
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=86400
x-amz-cf-id: 4g58u_pDZ_78b0RctCdGnPs9_au6WO2wmBWXi7iGPqkiPMrwk_BuaQ==

GET
H2 200 settings Show response
syndication.twitter.com/ Frame A157 852 B
677 B 137ms
46ms Fetch
application/json 104.244.42.136
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://syndication.twitter.com/settings?session_id=8c80bdd13dcf88f12b9ce2d2b6211a0330a58e2a

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/widgets/widget_iframe.7dae38096d06923d683a2a807172322a.html?origin=https%3A%2F%2Fwww.rightwing.org

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.136 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

d234d0084ff13555f7cee9211dc834356cae63b833c6c217dc81d87f6835ca6c

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://platform.twitter.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

x-response-time: 7
date: Mon, 10 Oct 2022 14:07:39 GMT
content-encoding: gzip
strict-transport-security: max-age=631138519
last-modified: Mon, 10 Oct 2022 14:07:40 GMT
server: tsa_b
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://platform.twitter.com
x-transaction-id: ec0f3f865d2baf05
cache-control: must-revalidate, max-age=600
access-control-allow-credentials: true
perf: 7626143928
x-connection-hash: bcab552c0744de9adad8fa7dfe1bf7204ce55b75adf89851bf7b2ae7d573a369
content-length: 356

GET
H3 200 164962974163650 Show response
connect.facebook.net/signals/config/ 292 KB
84 KB 41ms
18ms Script
application/x-javascript 2a03:2880:f012:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/164962974163650?v=2.9.84&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

240fa12b094a1a37ff12b65e724a086c4e615f45f41a29617d7293ab0d58a540

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Mon, 10 Oct 2022 14:07:40 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 85895
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: 5kVwl+rE6HTA+MiAGQYvsAOtfJV+zv/5mGIZQoUqyMmPd7H0+FW5Lcd0T7bq4VnGBkEwQ8mbF4Hh9wk0CiQ1lg==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 2 B
209 B 335ms
34ms XHR
text/plain 2607:f8b0:4006:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j98&a=1530091123&t=pageview&_s=1&dl=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F%3Futm_source%3Diref%26utm_placement%3DRWnewsletter%26utm_medium%3Demail&ul=en-us&de=UTF-8&dt=Biden%20Sends%20Thank%20You%20MESSAGE%20To%20Hero%20Before%20Firing%20Him!%20%7C%20RightWing&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAACAAI~&jid=807105247&gjid=1774535173&cid=1820485934.1665410861&tid=UA-129295169-1&_gid=242077969.1665410861&_r=1&gtm=2wga50P6S6PPP&z=563000490

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::200e Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.rightwing.org/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:41 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.rightwing.org
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 9bf9d4ad5ad982fcea2c079d6b4e9ccc2e5fee11158f41c64853a8ea87254a33_small
cdn1.lockerdomecdn.com/uploads/ Frame E6EC 15 KB
15 KB 87ms
20ms Image
image/jpeg 2600:9000:21dd:9600:b:6268:b880:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn1.lockerdomecdn.com/uploads/9bf9d4ad5ad982fcea2c079d6b4e9ccc2e5fee11158f41c64853a8ea87254a33_small
Requested by: Host: lockerdome.com
URL: https://lockerdome.com/lad/14001166036186214?pubid=ld-6064-290&pubo=https%3A%2F%2Fwww.rightwing.org&rid=&width=696&utm_source=iref&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21dd:9600:b:6268:b880:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f8beaa4df0dc4c9587752057d48a977aa3a6b615f44e6dba2ecfc062e4fb5951

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://lockerdome.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

x-amz-version-id: iEytkoqQeL73fASc1llPMou1QWVxIaJp
date: Mon, 10 Oct 2022 12:00:50 GMT
via: 1.1 2ef71b29bcfbfc8755cad5f92a3c329a.cloudfront.net (CloudFront)
last-modified: Tue, 04 Oct 2022 20:10:56 GMT
server: AmazonS3
x-amz-cf-pop: EWR53-C2
age: 7611
etag: "962d2f995b0341a9e04753e9cf14a831"
x-cache: Hit from cloudfront
content-type: image/jpeg
accept-ranges: bytes
content-length: 15202
x-amz-cf-id: Z4lfKpG2_m5whiB2AQLO5jz5hC9mbMLZKkE1yoNbbREwdIG4JM36QQ==

GET
H2 200 445b4d232541787c63e2cbe16e8c34eba2d4b1ea148cb521e2f21b23aabdfd39_small
cdn1.lockerdomecdn.com/uploads/ Frame E6EC 19 KB
19 KB 89ms
23ms Image
image/jpeg 2600:9000:21dd:9600:b:6268:b880:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn1.lockerdomecdn.com/uploads/445b4d232541787c63e2cbe16e8c34eba2d4b1ea148cb521e2f21b23aabdfd39_small
Requested by: Host: lockerdome.com
URL: https://lockerdome.com/lad/14001166036186214?pubid=ld-6064-290&pubo=https%3A%2F%2Fwww.rightwing.org&rid=&width=696&utm_source=iref&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21dd:9600:b:6268:b880:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 37249fb532fc1e5cbace0e818a6269ed1258c628c2bfdaa86382b9092d8451b7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://lockerdome.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

x-amz-version-id: P5B0MzSUzcDHStb364Zxpj6MxqYsgniw
date: Sun, 09 Oct 2022 21:53:27 GMT
via: 1.1 2ef71b29bcfbfc8755cad5f92a3c329a.cloudfront.net (CloudFront)
last-modified: Mon, 08 Aug 2022 20:36:03 GMT
server: AmazonS3
x-amz-cf-pop: EWR53-C2
age: 58454
etag: "12df36c82f1353b0990a589f17505e9c"
x-cache: Hit from cloudfront
content-type: image/jpeg
accept-ranges: bytes
content-length: 18957
x-amz-cf-id: T6VWd7hcmS4LLJtaFJ3WhK8gX-rgryHpuDWAZDIX3fILkVQg9LvYSg==

GET
H2 200 dc.js Show response
stats.g.doubleclick.net/ Frame E6EC 45 KB
17 KB 77ms
25ms Script
text/javascript 2607:f8b0:4004:c1b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/dc.js

Requested by

Host: lockerdome.com
URL: https://lockerdome.com/lad/14001166036186214?pubid=ld-6064-290&pubo=https%3A%2F%2Fwww.rightwing.org&rid=&width=696&utm_source=iref&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://lockerdome.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 10 Oct 2022 12:58:27 GMT
last-modified: Tue, 27 Sep 2022 22:01:05 GMT
server: Golfe2
age: 4153
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17093
expires: Mon, 10 Oct 2022 14:58:27 GMT

GET
DATA 200
OK truncated Show response
/ Frame E6EC 11 KB
0 Script
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 03f4b4c697512d4338998beaa499614dc197d44ab12eb74fabad7fab5a9ebfbe

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type: text/javascript;charset=utf-8

GET
DATA 200
OK truncated Show response
/ Frame E6EC 10 KB
0 Script
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 38e07eea34e6d29147f6995c529cb6e0c9b988373b953e2e0fc72a9021a29a9e

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type: text/javascript;charset=utf-8

GET
H3 200 rum_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20221003/r20110914/ 55 KB
21 KB 38ms
38ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221003/r20110914/rum_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209290101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b12fd2368eeda5cf09fe595adde491622d408a95daad0dfd4070fb7103108b84

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Sun, 09 Oct 2022 19:48:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 65980
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21935
x-xss-protection: 0
server: cafe
etag: 14060987636467261181
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 23 Oct 2022 19:48:00 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 393 B
695 B 80ms
34ms Script
text/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.rightwing.org&callback=_gfp_s_&client=ca-pub-1109401964623664&gpid_exp=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209290101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d1978246c579ad24ed45077436af671efcbe10c49c0f8101289e0f847e340011

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 251
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.ca/adsid/ 107 B
792 B 90ms
44ms Script
application/javascript 2607:f8b0:4006:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=www.rightwing.org

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209290101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:809::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 89ms
41ms Script
application/javascript 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.rightwing.org

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209290101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 837B 149 KB
43 KB 486ms
444ms Document
text/html 2607:f8b0:4006:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&adk=1812271804&adf=3025194257&lmt=1665370584&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F%3Futm_source%3Diref%26utm_placement%3DRWnewsletter%26utm_medium%3Demail&ea=0&pra=5&wgl=1&easpi=0&asntp=0&asntpv=0&asntpl=0&asntpm=0&asntpc=0&asna=5&asnd=5&asnp=5&asns=5&asmat=1&asptt=-1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665410860601&bpp=3&bdt=299&idt=188&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=3409364873373&rume=1&frm=20&pv=2&ga_vid=1820485934.1665410861&ga_sid=1665410861&ga_hid=1530091123&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531706%2C21066428%2C44772928%2C31061691%2C31061693&oid=2&pvsid=2143541351964157&tmod=1384303463&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=209

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209290101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:806::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c69ac85c56bbddf6691357a0d0456f5ddff140b221c388d526f3f19c5f5a4fb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.rightwing.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 43686
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 10 Oct 2022 14:07:41 GMT
expires: Mon, 10 Oct 2022 14:07:41 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 b3ef3e176a13336a854fcf1444d5c6e62d1e436df0a9b2b65c05b5e5357dae7b_small
cdn1.lockerdomecdn.com/uploads/ Frame CAF6 21 KB
21 KB 43ms
39ms Image
image/jpeg 2600:9000:21dd:9600:b:6268:b880:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn1.lockerdomecdn.com/uploads/b3ef3e176a13336a854fcf1444d5c6e62d1e436df0a9b2b65c05b5e5357dae7b_small
Requested by: Host: lockerdome.com
URL: https://lockerdome.com/lad/13360564449522790?pubid=ld-2765-5011&pubo=https%3A%2F%2Fwww.rightwing.org&rid=&width=1068&utm_source=iref&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21dd:9600:b:6268:b880:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8acb2c63af9378ee91f6f4ac4e398c3810755f5d25993833417bf21cc1a19743

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://lockerdome.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Sun, 09 Oct 2022 23:52:46 GMT
x-amz-version-id: WgHosCirzqSf1VQuNrRVumrxYKeT6M5T
via: 1.1 2ef71b29bcfbfc8755cad5f92a3c329a.cloudfront.net (CloudFront)
last-modified: Wed, 10 Nov 2021 15:14:44 GMT
server: AmazonS3
x-amz-cf-pop: EWR53-C2
age: 51295
etag: "0107085cce619937ad77413f22685f81"
x-cache: Hit from cloudfront
content-type: image/jpeg
accept-ranges: bytes
content-length: 21315
x-amz-cf-id: LlcrjPPA8f_kT6ovkEEO2tSZjXr0WruaURSnu0XmjvUVnG352HKEGQ==

GET
H2 200 924a34153d617dbcc56d3e2521aede5424a95a48cbcea1f4fea749a17fcac4d0_small
cdn1.lockerdomecdn.com/uploads/ Frame CAF6 17 KB
17 KB 40ms
37ms Image
image/jpeg 2600:9000:21dd:9600:b:6268:b880:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn1.lockerdomecdn.com/uploads/924a34153d617dbcc56d3e2521aede5424a95a48cbcea1f4fea749a17fcac4d0_small
Requested by: Host: lockerdome.com
URL: https://lockerdome.com/lad/13360564449522790?pubid=ld-2765-5011&pubo=https%3A%2F%2Fwww.rightwing.org&rid=&width=1068&utm_source=iref&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21dd:9600:b:6268:b880:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 64fd144b959afc9171b54d6de20c92633b709a9f7bc715140995ab26356b7268

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://lockerdome.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

x-amz-version-id: 56UoJsJWKIIkIQbocpmFIuvN9iPX.On4
date: Mon, 10 Oct 2022 12:41:54 GMT
via: 1.1 2ef71b29bcfbfc8755cad5f92a3c329a.cloudfront.net (CloudFront)
last-modified: Wed, 28 Sep 2022 13:46:30 GMT
server: AmazonS3
x-amz-cf-pop: EWR53-C2
age: 5147
etag: "e566fbf8072a7e89d3ec61fed74f8e89"
x-cache: Hit from cloudfront
content-type: image/jpeg
accept-ranges: bytes
content-length: 17331
x-amz-cf-id: v0S94KVL9iJOq6qKf3xkavo0BnmCi6dxB6LqDqQm5_S1pufLVS_nYA==

GET
H2 200 ecda89d9bd5442ac3ba3670833ce0c9372ef2a2b74e0207ce315c62f15bf3f75_small
cdn1.lockerdomecdn.com/uploads/ Frame CAF6 21 KB
21 KB 40ms
39ms Image
image/jpeg 2600:9000:21dd:9600:b:6268:b880:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn1.lockerdomecdn.com/uploads/ecda89d9bd5442ac3ba3670833ce0c9372ef2a2b74e0207ce315c62f15bf3f75_small
Requested by: Host: lockerdome.com
URL: https://lockerdome.com/lad/13360564449522790?pubid=ld-2765-5011&pubo=https%3A%2F%2Fwww.rightwing.org&rid=&width=1068&utm_source=iref&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21dd:9600:b:6268:b880:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a90d839af4aa27ae1d91568e5b633c2e607611d789f52acab32028598b3af187

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://lockerdome.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

x-amz-version-id: ysphl5XV27N30YTaZ.AcxnsTYvJsA6nf
date: Mon, 10 Oct 2022 11:34:05 GMT
via: 1.1 2ef71b29bcfbfc8755cad5f92a3c329a.cloudfront.net (CloudFront)
last-modified: Tue, 19 Jul 2022 19:00:52 GMT
server: AmazonS3
x-amz-cf-pop: EWR53-C2
age: 9216
etag: "9e49a67aa5ec3ac6e30a406b4bc628d5"
x-cache: Hit from cloudfront
content-type: image/jpeg
accept-ranges: bytes
content-length: 21207
x-amz-cf-id: 5fKHJbii9NYH0Ca8WxKcGMi2n6OCkoKvhQd3nmHKtAwYNA5KsB_3pw==

GET
H2 200 d5b436212974d837b2b8b893834d17a768182053ecb02c082db9931a2be7ee7d_small
cdn1.lockerdomecdn.com/uploads/ Frame CAF6 12 KB
12 KB 48ms
48ms Image
image/jpeg 2600:9000:21dd:9600:b:6268:b880:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn1.lockerdomecdn.com/uploads/d5b436212974d837b2b8b893834d17a768182053ecb02c082db9931a2be7ee7d_small
Requested by: Host: lockerdome.com
URL: https://lockerdome.com/lad/13360564449522790?pubid=ld-2765-5011&pubo=https%3A%2F%2Fwww.rightwing.org&rid=&width=1068&utm_source=iref&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21dd:9600:b:6268:b880:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1c31106f082313d65105d241541d5924743c4ef0edc6ae0ef3b71535af68a5f4

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://lockerdome.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

x-amz-version-id: NlxcN.1hEKlAChmm2SVim0kCCJ6.ft6q
date: Sun, 09 Oct 2022 18:51:58 GMT
via: 1.1 2ef71b29bcfbfc8755cad5f92a3c329a.cloudfront.net (CloudFront)
last-modified: Mon, 26 Sep 2022 13:42:38 GMT
server: AmazonS3
x-amz-cf-pop: EWR53-C2
age: 69343
etag: "35b20e7b8cef08755c805003efd72fa2"
x-cache: Hit from cloudfront
content-type: image/jpeg
accept-ranges: bytes
content-length: 11815
x-amz-cf-id: wQAkcKhb5N8XRnnFvn8MSIfSo4XuCHUz-NxJD4hliRn-rKiDNRcg4w==

GET
H2 200 3154aea46d55e602a0e108d2e399db8db6458544d0fdd6da3ae3c30366432073_small
cdn1.lockerdomecdn.com/uploads/ Frame CAF6 14 KB
15 KB 50ms
49ms Image
image/jpeg 2600:9000:21dd:9600:b:6268:b880:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn1.lockerdomecdn.com/uploads/3154aea46d55e602a0e108d2e399db8db6458544d0fdd6da3ae3c30366432073_small
Requested by: Host: lockerdome.com
URL: https://lockerdome.com/lad/13360564449522790?pubid=ld-2765-5011&pubo=https%3A%2F%2Fwww.rightwing.org&rid=&width=1068&utm_source=iref&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21dd:9600:b:6268:b880:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a84415c4ebfb14e3e3e1c198fdac4bb4ced59c3da29495b7b048eb75f099e0eb

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://lockerdome.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

x-amz-version-id: qa2SPbWQyQ6W.I0yed_AjC_sPIApdKNn
date: Mon, 10 Oct 2022 13:01:57 GMT
via: 1.1 2ef71b29bcfbfc8755cad5f92a3c329a.cloudfront.net (CloudFront)
last-modified: Tue, 13 Sep 2022 20:26:54 GMT
server: AmazonS3
x-amz-cf-pop: EWR53-C2
age: 3944
etag: "bb9b257ca72a34f1f102483453ecf502"
x-cache: Hit from cloudfront
content-type: image/jpeg
accept-ranges: bytes
content-length: 14717
x-amz-cf-id: UolFxiXgKTKZMXtb7bd6ElcaLvUMOXhBk0xgFBedXuygbSvwJbwcmw==

GET
H2 200 1d844a22ce007452958e4d341eae3cb3156406b148141c797bc91ae1224541c0_small
cdn1.lockerdomecdn.com/uploads/ Frame CAF6 18 KB
19 KB 55ms
55ms Image
image/jpeg 2600:9000:21dd:9600:b:6268:b880:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn1.lockerdomecdn.com/uploads/1d844a22ce007452958e4d341eae3cb3156406b148141c797bc91ae1224541c0_small
Requested by: Host: lockerdome.com
URL: https://lockerdome.com/lad/13360564449522790?pubid=ld-2765-5011&pubo=https%3A%2F%2Fwww.rightwing.org&rid=&width=1068&utm_source=iref&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21dd:9600:b:6268:b880:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ffb39ba508f9f38f71af158f8be5cec977594bdd9ff2a87aaa3c9c9087e2cdb1

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://lockerdome.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Sun, 09 Oct 2022 16:14:35 GMT
x-amz-version-id: kwbPJPYzsJtBN0vSaFZsO32PIcdqSF6F
via: 1.1 2ef71b29bcfbfc8755cad5f92a3c329a.cloudfront.net (CloudFront)
last-modified: Thu, 29 Sep 2022 17:56:42 GMT
server: AmazonS3
x-amz-cf-pop: EWR53-C2
age: 78786
etag: "12f17d8f976b890a3576a12e9b5a8787"
x-cache: Hit from cloudfront
content-type: image/jpeg
accept-ranges: bytes
content-length: 18726
x-amz-cf-id: 3J34PaehAjiEvyYEOL_B-qA4W-ChCSo_DKvsxouITZUzBXnOd5rwEA==

GET
H2 200 dc.js Show response
stats.g.doubleclick.net/ Frame CAF6 45 KB
17 KB 65ms
64ms Script
text/javascript 2607:f8b0:4004:c1b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/dc.js

Requested by

Host: lockerdome.com
URL: https://lockerdome.com/lad/13360564449522790?pubid=ld-2765-5011&pubo=https%3A%2F%2Fwww.rightwing.org&rid=&width=1068&utm_source=iref&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://lockerdome.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 10 Oct 2022 12:58:27 GMT
last-modified: Tue, 27 Sep 2022 22:01:05 GMT
server: Golfe2
age: 4153
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17093
expires: Mon, 10 Oct 2022 14:58:27 GMT

GET
DATA 200
OK truncated Show response
/ Frame CAF6 10 KB
0 Script
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 865b8ce84206cb17c13c05f6f769151fe9f8a51a2aa66577434916d835efe992

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type: text/javascript;charset=utf-8

GET
DATA 200
OK truncated Show response
/ Frame CAF6 10 KB
0 Script
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dd1f0617a8729030cfd68cb8c6c4fcba450691b06b267237fe03cbf6e27e293b

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type: text/javascript;charset=utf-8

GET
H2 200 /
www.facebook.com/tr/ 0
204 B 59ms
19ms Image
text/plain 2a03:2880:f112:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=164962974163650&ev=PageView&dl=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F%3Futm_source%3Diref%26utm_placement%3DRWnewsletter%26utm_medium%3Demail&rl=&if=false&ts=1665410860857&sw=1600&sh=1200&v=2.9.84&r=stable&ec=0&o=30&fbp=fb.1.1665410860856.543017217&it=1665410860746&coo=false&rqm=GET

Requested by

Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Mon, 10 Oct 2022 14:07:40 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0

GET
DATA 200
OK truncated Show response
/ Frame CAF6 10 KB
0 Script
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3507a0fdbd185a707bae36b35022393bae7c170083ecb9df30cd00abc9853ee7

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type: text/javascript;charset=utf-8

GET
DATA 200
OK truncated Show response
/ Frame CAF6 10 KB
0 Script
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f65814fc7ae77179647df580b3569537de80903be7313f643165fc2b3adc1d61

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type: text/javascript;charset=utf-8

GET
H2

200

j Show response
rp4.liadm.com/
Redirect Chain

https://rp.liadm.com/j?dtstmp=1665410860870&aid=a-07ec&se=e30&duid=21abd367d78b--01gf13j1nzcd00z72dfv47taer&tna=v2.5.0&pu=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-befo...
https://rp4.liadm.com/j?dtstmp=1665410860870&aid=a-07ec&se=e30&duid=21abd367d78b--01gf13j1nzcd00z72dfv47taer&tna=v2.5.0&pu=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-bef...

13 B
553 B

88ms
25ms

XHR
application/json

52.207.19.117
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://rp4.liadm.com/j?dtstmp=1665410860870&aid=a-07ec&se=e30&duid=21abd367d78b--01gf13j1nzcd00z72dfv47taer&tna=v2.5.0&pu=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F%3Futm_source%3Diref%26utm_placement%3DRWnewsletter%26utm_medium%3Demail&wpn=lc-bundle&c=PHRpdGxlPkJpZGVuIFNlbmRzIFRoYW5rIFlvdSBNRVNTQUdFIFRvIEhlcm8gQmVmb3JlIEZpcmluZyBIaW0hIHwgUmlnaHRXaW5nPC90aXRsZT48bGluayByZWw9ImNhbm9uaWNhbCIgaHJlZj0iaHR0cHM6Ly93d3cucmlnaHR3aW5nLm9yZy9iaWRlbi1zZW5kcy10aGFuay15b3UtbWVzc2FnZS10by1tYW4tYmVmb3JlLWZpcmluZy1oaW0vIj48aDEgY2xhc3M9ImVudHJ5LXRpdGxlIj5CaWRlbiBTZW5kcyBUaGFuayBZb3UgTUVTU0FHRSBUbyBIZXJvIEJlZm9yZSBGaXJpbmcgSGltITwvaDE-&i6=MjYwNzo1MzAwOjYwOjc4Njc6Ojg%3D&n3pc=true

Requested by

Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email

Protocol

Server

52.207.19.117 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-207-19-117.compute-1.amazonaws.com

Software

Resource Hash

efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:41 GMT
x-pixel-event-id: 2393db6f-38b8-4d31-9543-1edded3980ab
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
strict-transport-security: max-age=31536000; includeSubDomains
x-frame-options: DENY
vary: Origin
content-type: application/json
request-time: 0
access-control-allow-origin: null
access-control-allow-credentials: true
trace-id: c476345d90f7b854
content-length: 13
x-xss-protection: 1; mode=block

Redirect headers

date: Mon, 10 Oct 2022 14:07:40 GMT
strict-transport-security: max-age=31536000; includeSubDomains
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
x-frame-options: DENY
vary: Origin
location: https://rp4.liadm.com/j?dtstmp=1665410860870&aid=a-07ec&se=e30&duid=21abd367d78b--01gf13j1nzcd00z72dfv47taer&tna=v2.5.0&pu=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F%3Futm_source%3Diref%26utm_placement%3DRWnewsletter%26utm_medium%3Demail&wpn=lc-bundle&c=PHRpdGxlPkJpZGVuIFNlbmRzIFRoYW5rIFlvdSBNRVNTQUdFIFRvIEhlcm8gQmVmb3JlIEZpcmluZyBIaW0hIHwgUmlnaHRXaW5nPC90aXRsZT48bGluayByZWw9ImNhbm9uaWNhbCIgaHJlZj0iaHR0cHM6Ly93d3cucmlnaHR3aW5nLm9yZy9iaWRlbi1zZW5kcy10aGFuay15b3UtbWVzc2FnZS10by1tYW4tYmVmb3JlLWZpcmluZy1oaW0vIj48aDEgY2xhc3M9ImVudHJ5LXRpdGxlIj5CaWRlbiBTZW5kcyBUaGFuayBZb3UgTUVTU0FHRSBUbyBIZXJvIEJlZm9yZSBGaXJpbmcgSGltITwvaDE-&i6=MjYwNzo1MzAwOjYwOjc4Njc6Ojg%3D&n3pc=true
access-control-allow-origin: https://www.rightwing.org
request-time: 0
access-control-allow-credentials: true
trace-id: bea8cf95e93d9c93
content-length: 0
x-xss-protection: 1; mode=block

GET
DATA 200
OK truncated Show response
/ Frame CAF6 10 KB
0 Script
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e79487b8f0a88e4751bb35370c943229fda617736d43b606831865c33b5e171c

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type: text/javascript;charset=utf-8

GET
DATA 200
OK truncated Show response
/ Frame CAF6 10 KB
0 Script
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dd65086c8a088883a3b0b8e81a72a4d4d5cc50f47bab0687c94be466ebd5c6e7

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type: text/javascript;charset=utf-8

GET
H2 200 tweet.495a42551da1e5c4c5171224e18a5a07.js Show response
platform.twitter.com/js/ 7 KB
3 KB 18ms
17ms Script
application/javascript 199.232.36.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/tweet.495a42551da1e5c4c5171224e18a5a07.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.232.36.157 New York, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 251feee5dacd7cd6acb23ff9f266b3a4a5407369b24a56b97dc041ccf918adc6

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
content-encoding: gzip
last-modified: Wed, 28 Sep 2022 20:04:20 GMT
etag: "090b14bdcf073940eb641311b50eb08d+gzip"
vary: Accept-Encoding
access-control-allow-methods: GET
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
access-control-allow-origin: *
x-cache: HIT, HIT
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=315360000
accept-ranges: bytes
tw-cdn: FT
content-length: 2619
x-served-by: cache-iad-kcgs7200096-IAD, cache-lga21978-LGA

POST
H2 204 csi
csi.gstatic.com/ 0
327 B 132ms
38ms Ping
image/gif 2607:f8b0:400b:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&top=1&puid=1~l92umkid&c=2143541351964157&e=42531706%2C21066428%2C44772928%2C31061691%2C31061693&ctx=1&met.6=6.1_CgsY9wIgPyoECAESAA
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20221003/r20110914/rum_fy2021.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:400b:803::2003 Highland Park, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:41 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 Tweet.html Show response
platform.twitter.com/embed/ Frame E569 345 B
342 B 18ms
18ms Document
text/html 199.232.36.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/Tweet.html?dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOlsibGlua3RyLmVlIiwidHIuZWUiLCJ0ZXJyYS5jb20uYnIiLCJ3d3cubGlua3RyLmVlIiwid3d3LnRyLmVlIiwid3d3LnRlcnJhLmNvbS5iciJdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdGltZWxpbmVfMTIwMzQiOnsiYnVja2V0IjoidHJlYXRtZW50IiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9lZGl0X2JhY2tlbmQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19jaGluX3BpbGxzXzE0NzQxIjp7ImJ1Y2tldCI6ImNvbG9yX2ljb25zIiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9yZXN1bHRfbWlncmF0aW9uXzEzOTc5Ijp7ImJ1Y2tldCI6InR3ZWV0X3Jlc3VsdCIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2V4cGVyaW1lbnRzX2Nvb2tpZV9leHBpcmF0aW9uIjp7ImJ1Y2tldCI6MTIwOTYwMCwidmVyc2lvbiI6bnVsbH0sInRmd19kdXBsaWNhdGVfc2NyaWJlc190b19zZXR0aW5ncyI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdmlkZW9faGxzX2R5bmFtaWNfbWFuaWZlc3RzXzE1MDgyIjp7ImJ1Y2tldCI6InRydWVfYml0cmF0ZSIsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9mcm9udGVuZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9fQ%3D%3D&frame=false&hideCard=false&hideThread=false&id=1576904966442291201&lang=en&origin=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F&sessionId=8c80bdd13dcf88f12b9ce2d2b6211a0330a58e2a&theme=light&widgetsVersion=1c23387b1f70c%3A1664388199485&width=550px
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.232.36.157 New York, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: b732714708d8501ed2fb66876e6e68f7ee98c728408dead9b1364dc61587faea

Request headers

Referer: https://www.rightwing.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: public, max-age=1800
content-encoding: gzip
content-length: 215
content-type: text/html; charset=utf-8
date: Mon, 10 Oct 2022 14:07:40 GMT
etag: "f2d186f7e817e008e05da9a9316e1e2c+gzip"
last-modified: Thu, 29 Sep 2022 22:02:12 GMT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
tw-cdn: FT
vary: Accept-Encoding
x-cache: HIT, HIT
x-served-by: cache-iad-kiad7000027-IAD, cache-lga21978-LGA

GET
H2 200 embed.runtime.8a84349b69f78c533972.js Show response
platform.twitter.com/embed/ Frame E569 9 KB
4 KB 19ms
18ms Script
application/javascript 199.232.36.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.runtime.8a84349b69f78c533972.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/Tweet.html?dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOlsibGlua3RyLmVlIiwidHIuZWUiLCJ0ZXJyYS5jb20uYnIiLCJ3d3cubGlua3RyLmVlIiwid3d3LnRyLmVlIiwid3d3LnRlcnJhLmNvbS5iciJdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdGltZWxpbmVfMTIwMzQiOnsiYnVja2V0IjoidHJlYXRtZW50IiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9lZGl0X2JhY2tlbmQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19jaGluX3BpbGxzXzE0NzQxIjp7ImJ1Y2tldCI6ImNvbG9yX2ljb25zIiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9yZXN1bHRfbWlncmF0aW9uXzEzOTc5Ijp7ImJ1Y2tldCI6InR3ZWV0X3Jlc3VsdCIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2V4cGVyaW1lbnRzX2Nvb2tpZV9leHBpcmF0aW9uIjp7ImJ1Y2tldCI6MTIwOTYwMCwidmVyc2lvbiI6bnVsbH0sInRmd19kdXBsaWNhdGVfc2NyaWJlc190b19zZXR0aW5ncyI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdmlkZW9faGxzX2R5bmFtaWNfbWFuaWZlc3RzXzE1MDgyIjp7ImJ1Y2tldCI6InRydWVfYml0cmF0ZSIsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9mcm9udGVuZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9fQ%3D%3D&frame=false&hideCard=false&hideThread=false&id=1576904966442291201&lang=en&origin=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F&sessionId=8c80bdd13dcf88f12b9ce2d2b6211a0330a58e2a&theme=light&widgetsVersion=1c23387b1f70c%3A1664388199485&width=550px
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.232.36.157 New York, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 6910bddbfe9281f7f9834a4dffc8ab07227b2dad41eca04d91d6c790adf56244

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOlsibGlua3RyLmVlIiwidHIuZWUiLCJ0ZXJyYS5jb20uYnIiLCJ3d3cubGlua3RyLmVlIiwid3d3LnRyLmVlIiwid3d3LnRlcnJhLmNvbS5iciJdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdGltZWxpbmVfMTIwMzQiOnsiYnVja2V0IjoidHJlYXRtZW50IiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9lZGl0X2JhY2tlbmQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19jaGluX3BpbGxzXzE0NzQxIjp7ImJ1Y2tldCI6ImNvbG9yX2ljb25zIiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9yZXN1bHRfbWlncmF0aW9uXzEzOTc5Ijp7ImJ1Y2tldCI6InR3ZWV0X3Jlc3VsdCIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2V4cGVyaW1lbnRzX2Nvb2tpZV9leHBpcmF0aW9uIjp7ImJ1Y2tldCI6MTIwOTYwMCwidmVyc2lvbiI6bnVsbH0sInRmd19kdXBsaWNhdGVfc2NyaWJlc190b19zZXR0aW5ncyI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdmlkZW9faGxzX2R5bmFtaWNfbWFuaWZlc3RzXzE1MDgyIjp7ImJ1Y2tldCI6InRydWVfYml0cmF0ZSIsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9mcm9udGVuZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9fQ%3D%3D&frame=false&hideCard=false&hideThread=false&id=1576904966442291201&lang=en&origin=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F&sessionId=8c80bdd13dcf88f12b9ce2d2b6211a0330a58e2a&theme=light&widgetsVersion=1c23387b1f70c%3A1664388199485&width=550px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
content-encoding: gzip
last-modified: Thu, 29 Sep 2022 22:02:12 GMT
etag: "ebce741827c6e1a4b7cbfd08422dd265+gzip"
vary: Accept-Encoding
access-control-allow-methods: GET
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
access-control-allow-origin: *
x-cache: HIT, HIT
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=315360000
accept-ranges: bytes
tw-cdn: FT
content-length: 4172
x-served-by: cache-iad-kcgs7200110-IAD, cache-lga21978-LGA

GET
H2 200 embed.8601.e33219e82c67975cfd90.js Show response
platform.twitter.com/embed/ Frame E569 493 KB
159 KB 21ms
20ms Script
application/javascript 199.232.36.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.8601.e33219e82c67975cfd90.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/Tweet.html?dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOlsibGlua3RyLmVlIiwidHIuZWUiLCJ0ZXJyYS5jb20uYnIiLCJ3d3cubGlua3RyLmVlIiwid3d3LnRyLmVlIiwid3d3LnRlcnJhLmNvbS5iciJdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdGltZWxpbmVfMTIwMzQiOnsiYnVja2V0IjoidHJlYXRtZW50IiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9lZGl0X2JhY2tlbmQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19jaGluX3BpbGxzXzE0NzQxIjp7ImJ1Y2tldCI6ImNvbG9yX2ljb25zIiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9yZXN1bHRfbWlncmF0aW9uXzEzOTc5Ijp7ImJ1Y2tldCI6InR3ZWV0X3Jlc3VsdCIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2V4cGVyaW1lbnRzX2Nvb2tpZV9leHBpcmF0aW9uIjp7ImJ1Y2tldCI6MTIwOTYwMCwidmVyc2lvbiI6bnVsbH0sInRmd19kdXBsaWNhdGVfc2NyaWJlc190b19zZXR0aW5ncyI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdmlkZW9faGxzX2R5bmFtaWNfbWFuaWZlc3RzXzE1MDgyIjp7ImJ1Y2tldCI6InRydWVfYml0cmF0ZSIsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9mcm9udGVuZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9fQ%3D%3D&frame=false&hideCard=false&hideThread=false&id=1576904966442291201&lang=en&origin=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F&sessionId=8c80bdd13dcf88f12b9ce2d2b6211a0330a58e2a&theme=light&widgetsVersion=1c23387b1f70c%3A1664388199485&width=550px
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.232.36.157 New York, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: c58eb93005d09e7485d3960dbaad514527ed100b67dabe61d0076033dfc986ab

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOlsibGlua3RyLmVlIiwidHIuZWUiLCJ0ZXJyYS5jb20uYnIiLCJ3d3cubGlua3RyLmVlIiwid3d3LnRyLmVlIiwid3d3LnRlcnJhLmNvbS5iciJdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdGltZWxpbmVfMTIwMzQiOnsiYnVja2V0IjoidHJlYXRtZW50IiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9lZGl0X2JhY2tlbmQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19jaGluX3BpbGxzXzE0NzQxIjp7ImJ1Y2tldCI6ImNvbG9yX2ljb25zIiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9yZXN1bHRfbWlncmF0aW9uXzEzOTc5Ijp7ImJ1Y2tldCI6InR3ZWV0X3Jlc3VsdCIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2V4cGVyaW1lbnRzX2Nvb2tpZV9leHBpcmF0aW9uIjp7ImJ1Y2tldCI6MTIwOTYwMCwidmVyc2lvbiI6bnVsbH0sInRmd19kdXBsaWNhdGVfc2NyaWJlc190b19zZXR0aW5ncyI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdmlkZW9faGxzX2R5bmFtaWNfbWFuaWZlc3RzXzE1MDgyIjp7ImJ1Y2tldCI6InRydWVfYml0cmF0ZSIsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9mcm9udGVuZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9fQ%3D%3D&frame=false&hideCard=false&hideThread=false&id=1576904966442291201&lang=en&origin=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F&sessionId=8c80bdd13dcf88f12b9ce2d2b6211a0330a58e2a&theme=light&widgetsVersion=1c23387b1f70c%3A1664388199485&width=550px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
content-encoding: gzip
last-modified: Thu, 29 Sep 2022 22:02:12 GMT
etag: "92567b1d6329691140c4857e646f4242+gzip"
vary: Accept-Encoding
access-control-allow-methods: GET
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
access-control-allow-origin: *
x-cache: HIT, HIT
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=315360000
accept-ranges: bytes
tw-cdn: FT
content-length: 162782
x-served-by: cache-iad-kjyo7100072-IAD, cache-lga21978-LGA

GET
H2 200 embed.Tweet.c69f27d562a9c1a5cdbc.js Show response
platform.twitter.com/embed/ Frame E569 17 KB
7 KB 18ms
18ms Script
application/javascript 199.232.36.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.Tweet.c69f27d562a9c1a5cdbc.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/Tweet.html?dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOlsibGlua3RyLmVlIiwidHIuZWUiLCJ0ZXJyYS5jb20uYnIiLCJ3d3cubGlua3RyLmVlIiwid3d3LnRyLmVlIiwid3d3LnRlcnJhLmNvbS5iciJdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdGltZWxpbmVfMTIwMzQiOnsiYnVja2V0IjoidHJlYXRtZW50IiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9lZGl0X2JhY2tlbmQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19jaGluX3BpbGxzXzE0NzQxIjp7ImJ1Y2tldCI6ImNvbG9yX2ljb25zIiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9yZXN1bHRfbWlncmF0aW9uXzEzOTc5Ijp7ImJ1Y2tldCI6InR3ZWV0X3Jlc3VsdCIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2V4cGVyaW1lbnRzX2Nvb2tpZV9leHBpcmF0aW9uIjp7ImJ1Y2tldCI6MTIwOTYwMCwidmVyc2lvbiI6bnVsbH0sInRmd19kdXBsaWNhdGVfc2NyaWJlc190b19zZXR0aW5ncyI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdmlkZW9faGxzX2R5bmFtaWNfbWFuaWZlc3RzXzE1MDgyIjp7ImJ1Y2tldCI6InRydWVfYml0cmF0ZSIsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9mcm9udGVuZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9fQ%3D%3D&frame=false&hideCard=false&hideThread=false&id=1576904966442291201&lang=en&origin=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F&sessionId=8c80bdd13dcf88f12b9ce2d2b6211a0330a58e2a&theme=light&widgetsVersion=1c23387b1f70c%3A1664388199485&width=550px
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.232.36.157 New York, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 3a759e23c654a2e7137251caab80927cd535d1b6154b11b931d0b3b1f084069c

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOlsibGlua3RyLmVlIiwidHIuZWUiLCJ0ZXJyYS5jb20uYnIiLCJ3d3cubGlua3RyLmVlIiwid3d3LnRyLmVlIiwid3d3LnRlcnJhLmNvbS5iciJdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdGltZWxpbmVfMTIwMzQiOnsiYnVja2V0IjoidHJlYXRtZW50IiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9lZGl0X2JhY2tlbmQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19jaGluX3BpbGxzXzE0NzQxIjp7ImJ1Y2tldCI6ImNvbG9yX2ljb25zIiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9yZXN1bHRfbWlncmF0aW9uXzEzOTc5Ijp7ImJ1Y2tldCI6InR3ZWV0X3Jlc3VsdCIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2V4cGVyaW1lbnRzX2Nvb2tpZV9leHBpcmF0aW9uIjp7ImJ1Y2tldCI6MTIwOTYwMCwidmVyc2lvbiI6bnVsbH0sInRmd19kdXBsaWNhdGVfc2NyaWJlc190b19zZXR0aW5ncyI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdmlkZW9faGxzX2R5bmFtaWNfbWFuaWZlc3RzXzE1MDgyIjp7ImJ1Y2tldCI6InRydWVfYml0cmF0ZSIsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9mcm9udGVuZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9fQ%3D%3D&frame=false&hideCard=false&hideThread=false&id=1576904966442291201&lang=en&origin=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F&sessionId=8c80bdd13dcf88f12b9ce2d2b6211a0330a58e2a&theme=light&widgetsVersion=1c23387b1f70c%3A1664388199485&width=550px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:40 GMT
content-encoding: gzip
last-modified: Thu, 29 Sep 2022 22:02:12 GMT
etag: "99643784ddadc7baa0165b0dfc97398f+gzip"
vary: Accept-Encoding
access-control-allow-methods: GET
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
access-control-allow-origin: *
x-cache: HIT, HIT
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=315360000
accept-ranges: bytes
tw-cdn: FT
content-length: 6743
x-served-by: cache-iad-kcgs7200093-IAD, cache-lga21978-LGA

GET
H2 200 embed.749.467388cca0b3fe9c3291.js Show response
platform.twitter.com/embed/ Frame E569 19 KB
7 KB 19ms
18ms Script
application/javascript 199.232.36.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.749.467388cca0b3fe9c3291.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.8a84349b69f78c533972.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.232.36.157 New York, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: afe2c4d44f6a91b4d2ecbaf61d91e90f61cf159467b4a3fac9e51ed9b1e2920d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOlsibGlua3RyLmVlIiwidHIuZWUiLCJ0ZXJyYS5jb20uYnIiLCJ3d3cubGlua3RyLmVlIiwid3d3LnRyLmVlIiwid3d3LnRlcnJhLmNvbS5iciJdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdGltZWxpbmVfMTIwMzQiOnsiYnVja2V0IjoidHJlYXRtZW50IiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9lZGl0X2JhY2tlbmQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19jaGluX3BpbGxzXzE0NzQxIjp7ImJ1Y2tldCI6ImNvbG9yX2ljb25zIiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9yZXN1bHRfbWlncmF0aW9uXzEzOTc5Ijp7ImJ1Y2tldCI6InR3ZWV0X3Jlc3VsdCIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2V4cGVyaW1lbnRzX2Nvb2tpZV9leHBpcmF0aW9uIjp7ImJ1Y2tldCI6MTIwOTYwMCwidmVyc2lvbiI6bnVsbH0sInRmd19kdXBsaWNhdGVfc2NyaWJlc190b19zZXR0aW5ncyI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdmlkZW9faGxzX2R5bmFtaWNfbWFuaWZlc3RzXzE1MDgyIjp7ImJ1Y2tldCI6InRydWVfYml0cmF0ZSIsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9mcm9udGVuZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9fQ%3D%3D&frame=false&hideCard=false&hideThread=false&id=1576904966442291201&lang=en&origin=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F&sessionId=8c80bdd13dcf88f12b9ce2d2b6211a0330a58e2a&theme=light&widgetsVersion=1c23387b1f70c%3A1664388199485&width=550px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:41 GMT
content-encoding: gzip
last-modified: Thu, 29 Sep 2022 22:02:12 GMT
etag: "d3483b9c737e990765e6ba56d01154a3+gzip"
vary: Accept-Encoding
access-control-allow-methods: GET
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
access-control-allow-origin: *
x-cache: HIT, HIT
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=315360000
accept-ranges: bytes
tw-cdn: FT
content-length: 6789
x-served-by: cache-iad-kcgs7200103-IAD, cache-lga21978-LGA

GET
H2 200 embed.ondemand.i18n.en-js.362fa829f209057af8ce.js Show response
platform.twitter.com/embed/ Frame E569 3 KB
2 KB 20ms
19ms Script
application/javascript 199.232.36.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.ondemand.i18n.en-js.362fa829f209057af8ce.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.8a84349b69f78c533972.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.232.36.157 New York, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: b4cfe579c43da0984d14c5c8fcb573ee8b4a93af437659ab104b506da3060ed4

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOlsibGlua3RyLmVlIiwidHIuZWUiLCJ0ZXJyYS5jb20uYnIiLCJ3d3cubGlua3RyLmVlIiwid3d3LnRyLmVlIiwid3d3LnRlcnJhLmNvbS5iciJdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdGltZWxpbmVfMTIwMzQiOnsiYnVja2V0IjoidHJlYXRtZW50IiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9lZGl0X2JhY2tlbmQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19jaGluX3BpbGxzXzE0NzQxIjp7ImJ1Y2tldCI6ImNvbG9yX2ljb25zIiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9yZXN1bHRfbWlncmF0aW9uXzEzOTc5Ijp7ImJ1Y2tldCI6InR3ZWV0X3Jlc3VsdCIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2V4cGVyaW1lbnRzX2Nvb2tpZV9leHBpcmF0aW9uIjp7ImJ1Y2tldCI6MTIwOTYwMCwidmVyc2lvbiI6bnVsbH0sInRmd19kdXBsaWNhdGVfc2NyaWJlc190b19zZXR0aW5ncyI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdmlkZW9faGxzX2R5bmFtaWNfbWFuaWZlc3RzXzE1MDgyIjp7ImJ1Y2tldCI6InRydWVfYml0cmF0ZSIsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9mcm9udGVuZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9fQ%3D%3D&frame=false&hideCard=false&hideThread=false&id=1576904966442291201&lang=en&origin=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F&sessionId=8c80bdd13dcf88f12b9ce2d2b6211a0330a58e2a&theme=light&widgetsVersion=1c23387b1f70c%3A1664388199485&width=550px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:41 GMT
content-encoding: gzip
last-modified: Thu, 29 Sep 2022 22:02:12 GMT
etag: "6f089ffff33baf94b6a13b115ba6ca12+gzip"
vary: Accept-Encoding
access-control-allow-methods: GET
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
access-control-allow-origin: *
x-cache: HIT, HIT
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=315360000
accept-ranges: bytes
tw-cdn: FT
content-length: 1355
x-served-by: cache-iad-kcgs7200075-IAD, cache-lga21978-LGA

GET
H2 200 embed.ondemand.horizon-web.i18n.en-js.4d76caa3cb11562c7660.js Show response
platform.twitter.com/embed/ Frame E569 35 KB
11 KB 19ms
18ms Script
application/javascript 199.232.36.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.ondemand.horizon-web.i18n.en-js.4d76caa3cb11562c7660.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.8a84349b69f78c533972.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.232.36.157 New York, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4135c004ce36152b8f49f88b21366d7b589b906390a8cb78d38f41e357f88709

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOlsibGlua3RyLmVlIiwidHIuZWUiLCJ0ZXJyYS5jb20uYnIiLCJ3d3cubGlua3RyLmVlIiwid3d3LnRyLmVlIiwid3d3LnRlcnJhLmNvbS5iciJdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdGltZWxpbmVfMTIwMzQiOnsiYnVja2V0IjoidHJlYXRtZW50IiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9lZGl0X2JhY2tlbmQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19jaGluX3BpbGxzXzE0NzQxIjp7ImJ1Y2tldCI6ImNvbG9yX2ljb25zIiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9yZXN1bHRfbWlncmF0aW9uXzEzOTc5Ijp7ImJ1Y2tldCI6InR3ZWV0X3Jlc3VsdCIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2V4cGVyaW1lbnRzX2Nvb2tpZV9leHBpcmF0aW9uIjp7ImJ1Y2tldCI6MTIwOTYwMCwidmVyc2lvbiI6bnVsbH0sInRmd19kdXBsaWNhdGVfc2NyaWJlc190b19zZXR0aW5ncyI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdmlkZW9faGxzX2R5bmFtaWNfbWFuaWZlc3RzXzE1MDgyIjp7ImJ1Y2tldCI6InRydWVfYml0cmF0ZSIsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9mcm9udGVuZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9fQ%3D%3D&frame=false&hideCard=false&hideThread=false&id=1576904966442291201&lang=en&origin=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F&sessionId=8c80bdd13dcf88f12b9ce2d2b6211a0330a58e2a&theme=light&widgetsVersion=1c23387b1f70c%3A1664388199485&width=550px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:41 GMT
content-encoding: gzip
last-modified: Thu, 29 Sep 2022 22:02:12 GMT
etag: "f183514ec6ce4772d6c52319b8709038+gzip"
vary: Accept-Encoding
access-control-allow-methods: GET
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
access-control-allow-origin: *
x-cache: HIT, HIT
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=315360000
accept-ranges: bytes
tw-cdn: FT
content-length: 11307
x-served-by: cache-iad-kiad7000149-IAD, cache-lga21978-LGA

POST
H3 204 csi
csi.gstatic.com/ 0
17 B 118ms
80ms Ping
image/gif 2607:f8b0:400b:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&top=1&puid=2~l92umkit&c=2143541351964157&e=42531706%2C21066428%2C44772928%2C31061691%2C31061693&ctx=1&met.6=6.1_Cg0YuQcgPioGCAYSAhAB
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20221003/r20110914/rum_fy2021.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400b:803::2003 Highland Park, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:41 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
25 B 80ms
32ms XHR
text/plain 2607:f8b0:4004:c1b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j98&tid=UA-129295169-1&cid=1820485934.1665410861&jid=807105247&gjid=1774535173&_gid=242077969.1665410861&_u=YEBAAEAAAAAAACAAI~&z=1017037770

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.rightwing.org/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Mon, 10 Oct 2022 14:07:41 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.rightwing.org
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 embed.7995.214daeca23c15fbd3214.js Show response
platform.twitter.com/embed/ Frame E569 652 KB
179 KB 19ms
18ms Script
application/javascript 199.232.36.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.7995.214daeca23c15fbd3214.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.8a84349b69f78c533972.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.232.36.157 New York, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: e5462ee06f133a8c1692d4017edfff86d7f98c0ec037914d21d59bb77ef71395

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOlsibGlua3RyLmVlIiwidHIuZWUiLCJ0ZXJyYS5jb20uYnIiLCJ3d3cubGlua3RyLmVlIiwid3d3LnRyLmVlIiwid3d3LnRlcnJhLmNvbS5iciJdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdGltZWxpbmVfMTIwMzQiOnsiYnVja2V0IjoidHJlYXRtZW50IiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9lZGl0X2JhY2tlbmQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19jaGluX3BpbGxzXzE0NzQxIjp7ImJ1Y2tldCI6ImNvbG9yX2ljb25zIiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9yZXN1bHRfbWlncmF0aW9uXzEzOTc5Ijp7ImJ1Y2tldCI6InR3ZWV0X3Jlc3VsdCIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2V4cGVyaW1lbnRzX2Nvb2tpZV9leHBpcmF0aW9uIjp7ImJ1Y2tldCI6MTIwOTYwMCwidmVyc2lvbiI6bnVsbH0sInRmd19kdXBsaWNhdGVfc2NyaWJlc190b19zZXR0aW5ncyI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdmlkZW9faGxzX2R5bmFtaWNfbWFuaWZlc3RzXzE1MDgyIjp7ImJ1Y2tldCI6InRydWVfYml0cmF0ZSIsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9mcm9udGVuZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9fQ%3D%3D&frame=false&hideCard=false&hideThread=false&id=1576904966442291201&lang=en&origin=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F&sessionId=8c80bdd13dcf88f12b9ce2d2b6211a0330a58e2a&theme=light&widgetsVersion=1c23387b1f70c%3A1664388199485&width=550px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:41 GMT
content-encoding: gzip
last-modified: Thu, 29 Sep 2022 22:02:12 GMT
etag: "f64ca51070d0ed1e2dcbc4a1d8dedac0+gzip"
vary: Accept-Encoding
access-control-allow-methods: GET
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
access-control-allow-origin: *
x-cache: HIT, HIT
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=315360000
accept-ranges: bytes
tw-cdn: FT
content-length: 182581
x-served-by: cache-iad-kjyo7100051-IAD, cache-lga21978-LGA

GET
H2 200 embed.ondemand.Tweet.6a0004f5fa3b79cdeba4.js Show response
platform.twitter.com/embed/ Frame E569 78 KB
18 KB 17ms
17ms Script
application/javascript 199.232.36.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.ondemand.Tweet.6a0004f5fa3b79cdeba4.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.8a84349b69f78c533972.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.232.36.157 New York, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 5f241a6bf75de189509c53e4dd8c397a986fbc8500d1411432107e760bef96da

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOlsibGlua3RyLmVlIiwidHIuZWUiLCJ0ZXJyYS5jb20uYnIiLCJ3d3cubGlua3RyLmVlIiwid3d3LnRyLmVlIiwid3d3LnRlcnJhLmNvbS5iciJdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdGltZWxpbmVfMTIwMzQiOnsiYnVja2V0IjoidHJlYXRtZW50IiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9lZGl0X2JhY2tlbmQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19jaGluX3BpbGxzXzE0NzQxIjp7ImJ1Y2tldCI6ImNvbG9yX2ljb25zIiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9yZXN1bHRfbWlncmF0aW9uXzEzOTc5Ijp7ImJ1Y2tldCI6InR3ZWV0X3Jlc3VsdCIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2V4cGVyaW1lbnRzX2Nvb2tpZV9leHBpcmF0aW9uIjp7ImJ1Y2tldCI6MTIwOTYwMCwidmVyc2lvbiI6bnVsbH0sInRmd19kdXBsaWNhdGVfc2NyaWJlc190b19zZXR0aW5ncyI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdmlkZW9faGxzX2R5bmFtaWNfbWFuaWZlc3RzXzE1MDgyIjp7ImJ1Y2tldCI6InRydWVfYml0cmF0ZSIsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9mcm9udGVuZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9fQ%3D%3D&frame=false&hideCard=false&hideThread=false&id=1576904966442291201&lang=en&origin=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F&sessionId=8c80bdd13dcf88f12b9ce2d2b6211a0330a58e2a&theme=light&widgetsVersion=1c23387b1f70c%3A1664388199485&width=550px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:41 GMT
content-encoding: gzip
last-modified: Thu, 29 Sep 2022 22:02:12 GMT
etag: "b48ee2c02336474f29b1deb428a82c19+gzip"
vary: Accept-Encoding
access-control-allow-methods: GET
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
access-control-allow-origin: *
x-cache: HIT, HIT
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=315360000
accept-ranges: bytes
tw-cdn: FT
content-length: 18070
x-served-by: cache-iad-kiad7000138-IAD, cache-lga21978-LGA

GET
H2 200 embed.ondemand.Dropdown.c679e916d5b5132002a5.js Show response
platform.twitter.com/embed/ Frame E569 5 KB
2 KB 19ms
18ms Script
application/javascript 199.232.36.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.ondemand.Dropdown.c679e916d5b5132002a5.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.8a84349b69f78c533972.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.232.36.157 New York, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 67f13e8ba805fe8e31f17be59f8b9660d78a248476eda21ab6216552cae3a080

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOlsibGlua3RyLmVlIiwidHIuZWUiLCJ0ZXJyYS5jb20uYnIiLCJ3d3cubGlua3RyLmVlIiwid3d3LnRyLmVlIiwid3d3LnRlcnJhLmNvbS5iciJdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdGltZWxpbmVfMTIwMzQiOnsiYnVja2V0IjoidHJlYXRtZW50IiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9lZGl0X2JhY2tlbmQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19jaGluX3BpbGxzXzE0NzQxIjp7ImJ1Y2tldCI6ImNvbG9yX2ljb25zIiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9yZXN1bHRfbWlncmF0aW9uXzEzOTc5Ijp7ImJ1Y2tldCI6InR3ZWV0X3Jlc3VsdCIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2V4cGVyaW1lbnRzX2Nvb2tpZV9leHBpcmF0aW9uIjp7ImJ1Y2tldCI6MTIwOTYwMCwidmVyc2lvbiI6bnVsbH0sInRmd19kdXBsaWNhdGVfc2NyaWJlc190b19zZXR0aW5ncyI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdmlkZW9faGxzX2R5bmFtaWNfbWFuaWZlc3RzXzE1MDgyIjp7ImJ1Y2tldCI6InRydWVfYml0cmF0ZSIsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9mcm9udGVuZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9fQ%3D%3D&frame=false&hideCard=false&hideThread=false&id=1576904966442291201&lang=en&origin=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F&sessionId=8c80bdd13dcf88f12b9ce2d2b6211a0330a58e2a&theme=light&widgetsVersion=1c23387b1f70c%3A1664388199485&width=550px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:41 GMT
content-encoding: gzip
last-modified: Thu, 29 Sep 2022 22:02:12 GMT
etag: "9136c5402d5be832a7f07945a6e2c1c4+gzip"
vary: Accept-Encoding
access-control-allow-methods: GET
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
access-control-allow-origin: *
x-cache: HIT, HIT
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=315360000
accept-ranges: bytes
tw-cdn: FT
content-length: 2284
x-served-by: cache-iad-kjyo7100098-IAD, cache-lga21978-LGA

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
501 B 91ms
43ms Image
image/gif 2607:f8b0:4006:821::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j98&tid=UA-129295169-1&cid=1820485934.1665410861&jid=807105247&_u=YEBAAEAAAAAAACAAI~&z=2114731

Requested by

Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2004 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:41 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.ca/ads/ 42 B
501 B 87ms
39ms Image
image/gif 2607:f8b0:4006:816::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j98&tid=UA-129295169-1&cid=1820485934.1665410861&jid=807105247&_u=YEBAAEAAAAAAACAAI~&z=2114731

Requested by

Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::2003 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:41 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 tweet-result Show response
cdn.syndication.twimg.com/ Frame E569 6 KB
2 KB 365ms
81ms XHR
application/json 2606:2800:220:13d:2176:94a:948:148e
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.syndication.twimg.com/tweet-result?features=tfw_timeline_list%3Alinktr.ee%2Ctr.ee%2Cterra.com.br%2Cwww.linktr.ee%2Cwww.tr.ee%2Cwww.terra.com.br%3Btfw_horizon_timeline_12034%3Atreatment%3Btfw_tweet_edit_backend%3Aon%3Btfw_refsrc_session%3Aon%3Btfw_chin_pills_14741%3Acolor_icons%3Btfw_tweet_result_migration_13979%3Atweet_result%3Btfw_sensitive_media_interstitial_13963%3Ainterstitial%3Btfw_experiments_cookie_expiration%3A1209600%3Btfw_duplicate_scribes_to_settings%3Aon%3Btfw_video_hls_dynamic_manifests_15082%3Atrue_bitrate%3Btfw_tweet_edit_frontend%3Aon&id=1576904966442291201&lang=en

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.8601.e33219e82c67975cfd90.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:220:13d:2176:94a:948:148e , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

tsa_b / Express

Resource Hash

c85cfc4f5e29e2391d35c6c805b4146448d23cb99d2d7053456a558bbde1112d

Security Headers

Name	Value
Content-Security-Policy	connect-src 'self'; default-src 'self'; frame-src 'self'; font-src 'self'; form-action 'self'; img-src 'self'; media-src 'self'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://twitter.com/i/csp_report?a=O5RXE%3D%3D%3D&ro=false
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://platform.twitter.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

content-security-policy: connect-src 'self'; default-src 'self'; frame-src 'self'; font-src 'self'; form-action 'self'; img-src 'self'; media-src 'self'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://twitter.com/i/csp_report?a=O5RXE%3D%3D%3D&ro=false
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 10 Oct 2022 14:07:41 GMT
strict-transport-security: max-age=631138519
x-powered-by: Express
server-timing: x-cache;desc= ,x-tw-cdn;desc=VZ,edge;dur=64
x-xss-protection: 0
x-response-time: 40
server: tsa_b
etag: W/"1602-B/VKMBkipj6MY+Ocd/HnE+fQVkA"
vary: Origin, Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://platform.twitter.com
x-transaction-id: 0d5e9f6e50438d0c
cache-control: must-revalidate, max-age=60
access-control-allow-credentials: true
perf: 7626143928
x-connection-hash: be604d62c3dbd9476734a3966880043f8860460cd706d2ef034a317378280947
x-frame-options: SAMEORIGIN
x-tw-cdn: VZ, VZ, VZ
access-contol-allow-origin: platform.twitter.com

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209290101/ 151 KB
54 KB 54ms
54ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209290101/reactive_library_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209290101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2995089b59d69bc45f3a246e92b58fca37ccac9927db931374132d67da6b6856

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 55017
x-xss-protection: 0
server: cafe
etag: 15136804782301023809
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Mon, 10 Oct 2022 14:07:41 GMT

POST
H3 200 / Show response
www.facebook.com/tr/ Frame 48DF 0
18 B 41ms
19ms Document
text/plain 2a03:2880:f112:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://www.rightwing.org
Referer: https://www.rightwing.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://www.rightwing.org
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Mon, 10 Oct 2022 14:07:41 GMT
priority: u=0
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ 107 B
122 B 92ms
46ms Script
application/javascript 2607:f8b0:4006:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=www.rightwing.org

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209290101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:806::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 91ms
47ms Script
application/javascript 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.rightwing.org

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209290101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/ Frame 3325 10 KB
4 KB 23ms
22ms Document
text/html 2607:f8b0:4006:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209290101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:806::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f7408c25067cd0a9d9fe835cb4c05e394a50751d3fcde0c461db19a309abb02a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.rightwing.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 70811
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 4420
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 09 Oct 2022 18:27:30 GMT
etag: 9671129459699598864
expires: Sun, 23 Oct 2022 18:27:30 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 css2
fonts.googleapis.com/ Frame 3325 4 KB
1 KB 88ms
35ms Stylesheet
text/css 2607:f8b0:4006:823::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::200a Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c2777526a216d9692dd29697ebee7836fe8ae65f3a290faa20b75b64c0625205

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 10 Oct 2022 14:07:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 10 Oct 2022 12:16:17 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 10 Oct 2022 14:07:41 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 3325 205 B
744 B 71ms
19ms Image
image/png 2607:f8b0:4006:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:809::2003 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 22:20:43 GMT
x-content-type-options: nosniff
age: 316018
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 205
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Fri, 06 Oct 2023 22:20:43 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 3325 604 B
696 B 72ms
20ms Image
image/png 2607:f8b0:4006:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:809::2003 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Sun, 09 Oct 2022 00:11:42 GMT
x-content-type-options: nosniff
age: 136559
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 604
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Mon, 09 Oct 2023 00:11:42 GMT

GET
H2 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221003/r20110914/elements/html/ Frame 3325 19 KB
9 KB 72ms
21ms Script
text/javascript 2607:f8b0:4006:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221003/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81f::2001 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6efff8ce63d77eba89e9cc15af6dbccc657068130e89225fc662a0c580cea9b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 12:53:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4425
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8224
x-xss-protection: 0
server: cafe
etag: 17584738254627026664
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Oct 2022 12:53:56 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 3F62 8 KB
895 B 80ms
35ms Stylesheet
text/css 2607:f8b0:4006:823::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::200a Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a84fb0803620acdf77c0f41d652eb5538002ed610424bd0be051203ee50cf940

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 10 Oct 2022 14:07:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 10 Oct 2022 14:03:13 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 10 Oct 2022 14:07:41 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/ Frame 3F62 2 KB
902 B 60ms
19ms Script
text/javascript 2607:f8b0:4006:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2001 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

981c0bff12cb03203363a70e8ffe9b7fdf4af3b0b10c7a02a639eb13327574c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:02:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 313
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 875
x-xss-protection: 0
server: cafe
etag: 16974406330603315520
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Oct 2022 14:02:28 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221003/r20110914/ Frame 3F62 23 KB
9 KB 60ms
20ms Script
text/javascript 2607:f8b0:4006:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221003/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2001 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a2c6856e8437c3183ec517c59fc9724eb82cac59f685970113a7fb15ecd272c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:02:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 340
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9540
x-xss-protection: 0
server: cafe
etag: 6580860447119072478
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Oct 2022 14:02:01 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/ Frame 3F62 3 KB
1 KB 60ms
20ms Script
text/javascript 2607:f8b0:4006:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2001 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 13:59:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 506
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Oct 2022 13:59:15 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/ Frame 3F62 17 KB
7 KB 63ms
23ms Script
text/javascript 2607:f8b0:4006:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2001 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

65f4e452b96ef3e5e3a4631d99c63dd7239dcbcb88de679ac74ac30d3d4988cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 13:54:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 783
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7528
x-xss-protection: 0
server: cafe
etag: 13775775994264215463
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Oct 2022 13:54:38 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 3F62 142 KB
44 KB 37ms
36ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ba29faf5efe544ed157bbf56aafd0555a22103b36514708d7fcd196fc361c2f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 45072
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1664970042070988"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 10 Oct 2022 14:07:41 GMT

GET
H3 200 1d54d8cacad5994e062108e03542c880.js Show response
www.gstatic.com/mysidia/ Frame 3F62 33 KB
13 KB 60ms
20ms Script
text/javascript 2607:f8b0:4006:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/1d54d8cacad5994e062108e03542c880.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:809::2003 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

39ea310e86ee5d4b745f48121268b8848ebbc92d2b9a1a791c36c7a03512b101

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Fri, 07 Oct 2022 06:13:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 287669
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13786
x-xss-protection: 0
last-modified: Fri, 07 Oct 2022 06:02:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 05 Jan 2023 06:13:12 GMT

GET
H2 200 embed.ondemand.Card.f32c09a51b0c9cb3a8fe.js Show response
platform.twitter.com/embed/ Frame E569 2 KB
1012 B 18ms
18ms Script
application/javascript 199.232.36.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/embed.ondemand.Card.f32c09a51b0c9cb3a8fe.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/embed/embed.runtime.8a84349b69f78c533972.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.232.36.157 New York, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: a2960bcda61e057bc08ccd3ca3f1f52febd9308faa39e28151f03978d8768b95

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://platform.twitter.com/embed/Tweet.html?dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOlsibGlua3RyLmVlIiwidHIuZWUiLCJ0ZXJyYS5jb20uYnIiLCJ3d3cubGlua3RyLmVlIiwid3d3LnRyLmVlIiwid3d3LnRlcnJhLmNvbS5iciJdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdGltZWxpbmVfMTIwMzQiOnsiYnVja2V0IjoidHJlYXRtZW50IiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9lZGl0X2JhY2tlbmQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19jaGluX3BpbGxzXzE0NzQxIjp7ImJ1Y2tldCI6ImNvbG9yX2ljb25zIiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9yZXN1bHRfbWlncmF0aW9uXzEzOTc5Ijp7ImJ1Y2tldCI6InR3ZWV0X3Jlc3VsdCIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2V4cGVyaW1lbnRzX2Nvb2tpZV9leHBpcmF0aW9uIjp7ImJ1Y2tldCI6MTIwOTYwMCwidmVyc2lvbiI6bnVsbH0sInRmd19kdXBsaWNhdGVfc2NyaWJlc190b19zZXR0aW5ncyI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdmlkZW9faGxzX2R5bmFtaWNfbWFuaWZlc3RzXzE1MDgyIjp7ImJ1Y2tldCI6InRydWVfYml0cmF0ZSIsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9mcm9udGVuZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9fQ%3D%3D&frame=false&hideCard=false&hideThread=false&id=1576904966442291201&lang=en&origin=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F&sessionId=8c80bdd13dcf88f12b9ce2d2b6211a0330a58e2a&theme=light&widgetsVersion=1c23387b1f70c%3A1664388199485&width=550px
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:41 GMT
content-encoding: gzip
last-modified: Thu, 29 Sep 2022 22:02:12 GMT
etag: "2588f0073dfcd0054711d1efcd47f179+gzip"
vary: Accept-Encoding
access-control-allow-methods: GET
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
access-control-allow-origin: *
x-cache: HIT, HIT
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=315360000
accept-ranges: bytes
tw-cdn: FT
content-length: 907
x-served-by: cache-iad-kcgs7200061-IAD, cache-lga21978-LGA

GET
H2 200 embeds
syndication.twitter.com/i/jot/ Frame E569 43 B
150 B 294ms
294ms Image
image/gif 104.244.42.136
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://syndication.twitter.com/i/jot/embeds?l=%7B%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1665410861633%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22tweet%22%2C%22action%22%3A%22results%22%2C%22section%22%3A%22main%22%7D%2C%22context%22%3A%22rufous-eol%22%2C%22client_version%22%3A%221c23387b1f70c%3A1664388199485%22%2C%22dnt%22%3Atrue%2C%22widget_id%22%3A%22twitter-widget-0%22%2C%22widget_origin%22%3A%22https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F%22%2C%22widget_frame%22%3A%22false%22%2C%22widget_partner%22%3A%22%22%2C%22widget_site_screen_name%22%3A%22%22%2C%22widget_site_user_id%22%3A%22%22%2C%22widget_creator_screen_name%22%3A%22%22%2C%22widget_creator_user_id%22%3A%22%22%2C%22widget_iframe_version%22%3A%22a0e8f6b80948e%3A1664341807690%22%2C%22item_ids%22%3A%5B%221576904966442291201%22%5D%2C%22item_details%22%3A%7B%221576904966442291201%22%3A%7B%22item_type%22%3A0%7D%7D%7D&dnt=1

Requested by

Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.136 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://platform.twitter.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

x-response-time: 10
date: Mon, 10 Oct 2022 14:07:41 GMT
strict-transport-security: max-age=631138519
last-modified: Mon, 10 Oct 2022 14:07:41 GMT
server: tsa_b
vary: Origin
content-type: image/gif
x-transaction-id: aaf97bf5ef42c296
cache-control: must-revalidate, max-age=600
perf: 7626143928
x-connection-hash: bcab552c0744de9adad8fa7dfe1bf7204ce55b75adf89851bf7b2ae7d573a369
content-length: 43

GET
H2 200 NW6zE6OO_normal.jpg
pbs.twimg.com/profile_images/1095340768753999872/ Frame E569 2 KB
3 KB 20ms
19ms Image
image/jpeg 2606:2800:220:13d:2176:94a:948:148e
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/profile_images/1095340768753999872/NW6zE6OO_normal.jpg

Requested by

Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:220:13d:2176:94a:948:148e , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (nyb/1D35) /

Resource Hash

8b9774324602b235e08d18591065c8debab9a64762d990be1e08e8334ea2ecb7

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://platform.twitter.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:41 GMT
strict-transport-security: max-age=631138519
x-content-type-options: nosniff
age: 478451
x-cache: HIT
server-timing: x-cache;desc= HIT,x-tw-cdn;desc=VZ,edge;dur=1
content-length: 2339
x-response-time: 11
surrogate-key: profile_images profile_images/bucket/0 profile_images/1095340768753999872
last-modified: Tue, 12 Feb 2019 15:14:04 GMT
server: ECS (nyb/1D35)
x-tw-cdn: VZ, VZ, VZ
content-type: image/jpeg
access-control-allow-origin: *
x-transaction-id: c4bed49d3e0c4d9e
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
perf: 7626143928
x-connection-hash: 36ae81ccbaab304331aa53155bdd3db2b50744ed4c67d18ee85d46350dd6d228
accept-ranges: bytes
timing-allow-origin: https://twitter.com, https://mobile.twitter.com

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ 107 B
122 B 42ms
41ms Script
application/javascript 2607:f8b0:4006:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=www.rightwing.org

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209290101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:806::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 38ms
37ms Script
application/javascript 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.rightwing.org

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209290101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 189A 90 KB
33 KB 736ms
736ms Document
text/html 2607:f8b0:4006:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4569349609&adk=2326741806&adf=3494845914&pi=t.ma~as.4569349609&w=640&lmt=1665370584&format=640x300&url=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F%3Futm_source%3Diref%26utm_placement%3DRWnewsletter%26utm_medium%3Demail&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665410861731&bpp=1&bdt=1429&idt=1&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D867106d61160b6c9-22b4b0dda6d70054%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MbyADlkn0RlwRTMZcKMKfzwuHe6Uw&gpic=UID%3D0000057649a3ca06%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MYih3xMQ1vc46x04ozbfApuVR_C2w&prev_fmts=0x0%2C1600x1200&nras=2&correlator=3409364873373&rume=1&frm=20&pv=1&ga_vid=1820485934.1665410861&ga_sid=1665410861&ga_hid=1530091123&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=294&ady=616&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531706%2C21066428%2C44772928%2C31061691%2C31061693&oid=2&pvsid=2143541351964157&tmod=1384303463&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=4mXr6XsNci&p=https%3A//www.rightwing.org&dtd=9

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209290101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:806::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

37cd36086f28dca56d9b2346fc97a4138568e1b0ddf1f2c035bbeecd1cb33b42

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.rightwing.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 33261
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 10 Oct 2022 14:07:42 GMT
expires: Mon, 10 Oct 2022 14:07:42 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame CB97 87 KB
32 KB 858ms
857ms Document
text/html 2607:f8b0:4006:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4569349609&adk=2326741806&adf=3205953851&pi=t.ma~as.4569349609&w=640&lmt=1665370584&format=640x300&url=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F%3Futm_source%3Diref%26utm_placement%3DRWnewsletter%26utm_medium%3Demail&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665410861742&bpp=1&bdt=1440&idt=1&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D867106d61160b6c9-22b4b0dda6d70054%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MbyADlkn0RlwRTMZcKMKfzwuHe6Uw&gpic=UID%3D0000057649a3ca06%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MYih3xMQ1vc46x04ozbfApuVR_C2w&prev_fmts=0x0%2C1600x1200%2C640x300&nras=2&correlator=3409364873373&rume=1&frm=20&pv=1&ga_vid=1820485934.1665410861&ga_sid=1665410861&ga_hid=1530091123&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=294&ady=2693&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531706%2C21066428%2C44772928%2C31061691%2C31061693&oid=2&pvsid=2143541351964157&tmod=1384303463&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=j1fUCfNGgG&p=https%3A//www.rightwing.org&dtd=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209290101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:806::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

478f453884226671699bb70c45c8a93551d353066b6613f5d6934fd083c8f849

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.rightwing.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 33143
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 10 Oct 2022 14:07:42 GMT
expires: Mon, 10 Oct 2022 14:07:42 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 2168 76 KB
31 KB 377ms
376ms Document
text/html 2607:f8b0:4006:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=250&slotname=4569349609&adk=642246285&adf=1543753041&pi=t.ma~as.4569349609&w=300&lmt=1665370584&format=300x250&url=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F%3Futm_source%3Diref%26utm_placement%3DRWnewsletter%26utm_medium%3Demail&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665410861748&bpp=1&bdt=1446&idt=1&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D867106d61160b6c9-22b4b0dda6d70054%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MbyADlkn0RlwRTMZcKMKfzwuHe6Uw&gpic=UID%3D0000057649a3ca06%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MYih3xMQ1vc46x04ozbfApuVR_C2w&prev_fmts=0x0%2C1600x1200%2C640x300%2C640x300&nras=2&correlator=3409364873373&rume=1&frm=20&pv=1&ga_vid=1820485934.1665410861&ga_sid=1665410861&ga_hid=1530091123&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1022&ady=213&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531706%2C21066428%2C44772928%2C31061691%2C31061693&oid=2&pvsid=2143541351964157&tmod=1384303463&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=5&uci=a!5&fsb=1&xpc=KKoyP6WuFL&p=https%3A//www.rightwing.org&dtd=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209290101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:806::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

839d9a5cdab0e1c33d50a6998a2255ad3886c49fbd34515402d7ce51e01899ad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.rightwing.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 31457
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 10 Oct 2022 14:07:42 GMT
expires: Mon, 10 Oct 2022 14:07:42 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 88ms
47ms XHR
application/json 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20221003&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209290101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

368c875fab543097349c9ed14e93c6c41ed2b26b72ba01d1ecd75ea4acd243df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11250
x-xss-protection: 0

GET
H3 200 gnLtmcL-mn53pq-EJRMXOCFACjpZd0iqiIv80oTeKas.js Show response
pagead2.googlesyndication.com/bg/ Frame 971F 36 KB
16 KB 19ms
19ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/gnLtmcL-mn53pq-EJRMXOCFACjpZd0iqiIv80oTeKas.js

Requested by

Host: www.rightwing.org
URL: https://www.rightwing.org/biden-sends-thank-you-message-to-man-before-firing-him/?utm_source=iref&utm_placement=RWnewsletter&utm_medium=email

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8272ed99c2fe9a7e77a6af842513173821400a3a597748aa888bfcd284de29ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 21:41:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 318346
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16010
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 16:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 06 Oct 2023 21:41:55 GMT

GET
H2 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame 3F62 63 KB
24 KB 67ms
20ms Script
text/javascript 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

920b3418bd27c0a767e254c03fe306e969e631a33a871793ad7691e666983980

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 13:13:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3271
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23603
x-xss-protection: 0
server: cafe
etag: 16686504336640218216
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Mon, 10 Oct 2022 14:13:10 GMT

GET
H2 200 96qEpPq3
pbs.twimg.com/card_img/1579430482990678017/ Frame E569 32 KB
32 KB 18ms
18ms Image
image/jpeg 2606:2800:220:13d:2176:94a:948:148e
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pbs.twimg.com/card_img/1579430482990678017/96qEpPq3?format=jpg&name=small

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:220:13d:2176:94a:948:148e , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (nyb/1D32) /

Resource Hash

f783786aeb477992608a1b3e43e0ce53316c76d2b00d14b9f3557724cf7d5916

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://platform.twitter.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:41 GMT
strict-transport-security: max-age=631138519
x-content-type-options: nosniff
age: 9308
x-cache: HIT
server-timing: x-cache;desc= HIT,x-tw-cdn;desc=VZ,edge;dur=1
content-length: 32735
x-response-time: 48
surrogate-key: card_img card_img/bucket/0 card_img/1579430482990678017
last-modified: Mon, 10 Oct 2022 11:13:46 GMT
server: ECS (nyb/1D32)
x-tw-cdn: VZ, VZ, VZ
content-type: image/jpeg
access-control-allow-origin: *
x-transaction-id: 7ac4737e48c71a14
access-control-expose-headers: Content-Length
cache-control: max-age=604800, must-revalidate
perf: 7626143928
x-connection-hash: 9c3ce3ee155d39b4fa766536c8a42fd25c6d4635434d677d5becbc027451ad98
accept-ranges: bytes
timing-allow-origin: https://twitter.com, https://mobile.twitter.com

POST
H3 204 csi
csi.gstatic.com/ 0
17 B 39ms
39ms Ping
image/gif 2607:f8b0:400b:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&top=1&puid=3~l92umko6&c=2143541351964157&e=42531706%2C21066428%2C44772928%2C31061691%2C31061693&ctx=1&met.6=6.1_CgsYvA0gMioECAgSAA
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20221003/r20110914/rum_fy2021.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400b:803::2003 Highland Park, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:41 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 59ms
59ms Script
text/javascript 2607:f8b0:4006:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209290101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2001 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 10 Oct 2022 14:07:41 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame 3F62 0
17 B 40ms
39ms Ping
image/gif 2607:f8b0:400b:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~l92uml9b&chm=1&ctx=2&gqid=LCdEY4nxNpWrNY2_iMgH&qqid=CLPElPbq1foCFRGAWgUdR3cOyg&met.4=fb.b~lb.32~ol.55~bdt.-yk~bpp.-q6~idt.-l1~dtd.-kg~dt.-q9&met.3=492.g_1~733.3c~742.3c_1~748.3w~739.40~518.42~555.4s~556.4t_1~738.53~749.54_1~113.8m_4~112.8l_5&met.1=1.l92uml0q~14.6~15.1~16.6~17.6~18.6~19.6~20.6~21.6&met.7=CBIQBxgBIAwoDDBdOFJQDFg4YAxoOXBceI8JgAHjBogB80KqARUKE0dvb2dsZSBTYW5zOjQwMCw1MDCwAQG4AQM~CBwQChgBIBAoEDBNOD1QEFg5YBBoOXBMeJcJgAHrBogBwQywAQG4AQM~CAkQChgBIBEoETBROEBoOXBNePBMgAHESogB0rcBsAEBuAED~CB4QChgBIBEoETBPOD1oOXBNePsMgAHPCogBsRWwAQG4AQM~CBwQChgBIBEoETBSOEFoOXBReJQ9gAHoOogBu4kBsAEBuAED~CCoQChgBIBIoEjA9OCs~CBsQChgBIBIoEjBSOEA~CCgQChgBIN8BKN8BMLMCOFRA4AFI4AFQ4AFYjgJg8wFojgJwogJ437oBgAGzuAGIAZz3A7ABAbgBAw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400b:803::2003 Highland Park, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:41 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 embeds
syndication.twitter.com/i/jot/ Frame E569 43 B
95 B 51ms
51ms Image
image/gif 104.244.42.136
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://syndication.twitter.com/i/jot/embeds?l=%7B%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1665410861883%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22tweet%22%2C%22action%22%3A%22FCP%22%2C%22component%22%3A%22performance%22%2C%22section%22%3A%22main%22%7D%2C%22context%22%3A%22rufous-eol%22%2C%22client_version%22%3A%221c23387b1f70c%3A1664388199485%22%2C%22dnt%22%3Atrue%2C%22widget_id%22%3A%22twitter-widget-0%22%2C%22widget_origin%22%3A%22https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F%22%2C%22widget_frame%22%3A%22false%22%2C%22widget_partner%22%3A%22%22%2C%22widget_site_screen_name%22%3A%22%22%2C%22widget_site_user_id%22%3A%22%22%2C%22widget_creator_screen_name%22%3A%22%22%2C%22widget_creator_user_id%22%3A%22%22%2C%22widget_iframe_version%22%3A%22a0e8f6b80948e%3A1664341807690%22%2C%22item_ids%22%3A%5B%221576904966442291201%22%5D%2C%22item_details%22%3A%7B%221576904966442291201%22%3A%7B%22item_type%22%3A0%7D%7D%2C%22duration_ms%22%3A931.2999999523163%7D&dnt=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.136 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://platform.twitter.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

x-response-time: 12
date: Mon, 10 Oct 2022 14:07:41 GMT
strict-transport-security: max-age=631138519
last-modified: Mon, 10 Oct 2022 14:07:41 GMT
server: tsa_b
vary: Origin
content-type: image/gif
x-transaction-id: f1c996a561c3500e
cache-control: must-revalidate, max-age=600
perf: 7626143928
x-connection-hash: bcab552c0744de9adad8fa7dfe1bf7204ce55b75adf89851bf7b2ae7d573a369
content-length: 43

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame E68A 13 KB
5 KB 20ms
19ms Document
text/html 2607:f8b0:4006:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2001 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.rightwing.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 157708
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 08 Oct 2022 18:19:13 GMT
expires: Sun, 08 Oct 2023 18:19:13 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 52E3 783 B
537 B 82ms
40ms Document
text/html 2607:f8b0:4006:821::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2004 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

83d6011f32c94b8f44addd3fbb5c66a8107626fe9bf82faab0f6091b0016c3a6

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-HW2RREyF8b5AkO95bj38Hg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.rightwing.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 515
content-security-policy: script-src 'report-sample' 'nonce-HW2RREyF8b5AkO95bj38Hg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 10 Oct 2022 14:07:41 GMT
expires: Mon, 10 Oct 2022 14:07:41 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 gnLtmcL-mn53pq-EJRMXOCFACjpZd0iqiIv80oTeKas.js Show response
pagead2.googlesyndication.com/bg/ Frame E68A 36 KB
16 KB 19ms
18ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/gnLtmcL-mn53pq-EJRMXOCFACjpZd0iqiIv80oTeKas.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8272ed99c2fe9a7e77a6af842513173821400a3a597748aa888bfcd284de29ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 21:41:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 318346
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16010
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 16:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 06 Oct 2023 21:41:55 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 52E3 0
0 77ms
77ms Image
text/html 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20221003&jk=2143541351964157&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:80d::2002 Rockville, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame E68A 0
10 B 19ms
19ms Image
text/plain 2607:f8b0:4006:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?Ix6Y8A
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:81f::2001 Rockville, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:42 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 200 11077876128629403459
tpc.googlesyndication.com/simgad/ Frame 2168 41 KB
41 KB 21ms
20ms Image
image/png 2607:f8b0:4006:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/11077876128629403459?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qmi_Cn7ixYrNEmwUHhH7y17-49dmw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=250&slotname=4569349609&adk=642246285&adf=1543753041&pi=t.ma~as.4569349609&w=300&lmt=1665370584&format=300x250&url=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F%3Futm_source%3Diref%26utm_placement%3DRWnewsletter%26utm_medium%3Demail&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665410861748&bpp=1&bdt=1446&idt=1&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D867106d61160b6c9-22b4b0dda6d70054%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MbyADlkn0RlwRTMZcKMKfzwuHe6Uw&gpic=UID%3D0000057649a3ca06%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MYih3xMQ1vc46x04ozbfApuVR_C2w&prev_fmts=0x0%2C1600x1200%2C640x300%2C640x300&nras=2&correlator=3409364873373&rume=1&frm=20&pv=1&ga_vid=1820485934.1665410861&ga_sid=1665410861&ga_hid=1530091123&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1022&ady=213&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531706%2C21066428%2C44772928%2C31061691%2C31061693&oid=2&pvsid=2143541351964157&tmod=1384303463&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=5&uci=a!5&fsb=1&xpc=KKoyP6WuFL&p=https%3A//www.rightwing.org&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2001 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

aae3a0f48cc7e5812adf9de07ee38b2d8fc549a608eaa08f1968c505af8895a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Fri, 07 Oct 2022 10:56:14 GMT
x-content-type-options: nosniff
age: 270688
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41633
x-xss-protection: 0
last-modified: Thu, 29 Sep 2022 19:05:19 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 07 Oct 2023 10:56:14 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221003/r20110914/ Frame 2168 23 KB
9 KB 19ms
19ms Script
text/javascript 2607:f8b0:4006:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221003/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2001 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a2c6856e8437c3183ec517c59fc9724eb82cac59f685970113a7fb15ecd272c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:02:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 341
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9540
x-xss-protection: 0
server: cafe
etag: 6580860447119072478
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Oct 2022 14:02:01 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/ Frame 2168 3 KB
1 KB 32ms
31ms Script
text/javascript 2607:f8b0:4006:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2001 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 13:59:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 507
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Oct 2022 13:59:15 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/ Frame 2168 17 KB
7 KB 20ms
19ms Script
text/javascript 2607:f8b0:4006:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2001 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

65f4e452b96ef3e5e3a4631d99c63dd7239dcbcb88de679ac74ac30d3d4988cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 13:54:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 784
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7528
x-xss-protection: 0
server: cafe
etag: 13775775994264215463
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Oct 2022 13:54:38 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 2168 0
0 41ms
39ms Image
text/html 2607:f8b0:4006:821::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRqm-tF53K2MP6heY6Uq2VeP-Qz329VxsGsO-IBVJEF2XBlVQ6oIzm6Z1UN-Y6AwSED6hOMgGG7s5a71pMdH6aADis9Pg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=250&slotname=4569349609&adk=642246285&adf=1543753041&pi=t.ma~as.4569349609&w=300&lmt=1665370584&format=300x250&url=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F%3Futm_source%3Diref%26utm_placement%3DRWnewsletter%26utm_medium%3Demail&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665410861748&bpp=1&bdt=1446&idt=1&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D867106d61160b6c9-22b4b0dda6d70054%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MbyADlkn0RlwRTMZcKMKfzwuHe6Uw&gpic=UID%3D0000057649a3ca06%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MYih3xMQ1vc46x04ozbfApuVR_C2w&prev_fmts=0x0%2C1600x1200%2C640x300%2C640x300&nras=2&correlator=3409364873373&rume=1&frm=20&pv=1&ga_vid=1820485934.1665410861&ga_sid=1665410861&ga_hid=1530091123&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1022&ady=213&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531706%2C21066428%2C44772928%2C31061691%2C31061693&oid=2&pvsid=2143541351964157&tmod=1384303463&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=5&uci=a!5&fsb=1&xpc=KKoyP6WuFL&p=https%3A//www.rightwing.org&dtd=4
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:821::2004 Rockville, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2168 142 KB
44 KB 45ms
43ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ba29faf5efe544ed157bbf56aafd0555a22103b36514708d7fcd196fc361c2f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 45072
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1664970042070988"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 10 Oct 2022 14:07:42 GMT

GET
H3 200 one_click_handler_one_afma_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/ Frame 2168 32 KB
13 KB 32ms
31ms Script
text/javascript 2607:f8b0:4006:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/one_click_handler_one_afma_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2001 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e6b2f14124b01d5c1d881a1497577a41194823cdbd53b6766cbfe2a4816098bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 12:47:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4795
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13636
x-xss-protection: 0
server: cafe
etag: 14243585690576921461
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Oct 2022 12:47:47 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 2168 0
0 130ms
129ms Fetch
text/html 2607:f8b0:4006:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CsGgMLSdEY9ykMKbdhQasy7-wBO-Amd5s09WjxOgQ5IK7-5oCEAEg84aaAmD96KKB8AOgAf7Dg-YoyAECqAMByAPJBKoE1QJP0KxzsE3diEfjaAW48dXeZwLfvix0-y2Yl1Nl4r8pswARBwNKDZYUmo6HxzmiTEj12MjKoxayLOQoa15cB8HwfTN7gxsJVMiXQ0oMKv6VoZzbbHO3ymtZEuXUqFOfIEPxEi5u8kCTCjDwo4yuFoHOcyZv258a5QbTj7Y780vO-pL0bdusRIjrmGePa2QYeUXJO4GpaUdvk17SiqZoMMzxNIFtWKoD3Aojogn4SLM1Dsvbtw2PXTQq94IdxX4Vdzi30w_oMXI0L4-PRLhMbOaynxxbPwVITKl5bYRkebHGghfF29pmI3UIm0r7LVWaUxewQDGG3HTWITmjJuuAk_F1mwljE3KULILGsO5OVtBNraIg49WRpp_D0KLtVRiedXOzDjn3AVGb9MlAwcsQjF0tDgESh1wRny46LLzKQpna7KHdJB70WtEhtYaV_YRv2rBdvKNlo8AE9KTKq5UEkgUECAQYAZIFBAgFGASgBgKAB_7708UDqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwHyBwQQuoE70ggPCIBhEAEYHzICigI6AoBAgAoByAsB2BMM0BUBmBYBgBcBshccChoIABIUcHViLTExMDk0MDE5NjQ2MjM2NjQYAA&sigh=9FNQ5TJF97U&uach_m=[UACH]

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:806::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=250&slotname=4569349609&adk=642246285&adf=1543753041&pi=t.ma~as.4569349609&w=300&lmt=1665370584&format=300x250&url=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F%3Futm_source%3Diref%26utm_placement%3DRWnewsletter%26utm_medium%3Demail&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665410861748&bpp=1&bdt=1446&idt=1&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D867106d61160b6c9-22b4b0dda6d70054%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MbyADlkn0RlwRTMZcKMKfzwuHe6Uw&gpic=UID%3D0000057649a3ca06%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MYih3xMQ1vc46x04ozbfApuVR_C2w&prev_fmts=0x0%2C1600x1200%2C640x300%2C640x300&nras=2&correlator=3409364873373&rume=1&frm=20&pv=1&ga_vid=1820485934.1665410861&ga_sid=1665410861&ga_hid=1530091123&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1022&ady=213&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531706%2C21066428%2C44772928%2C31061691%2C31061693&oid=2&pvsid=2143541351964157&tmod=1384303463&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=5&uci=a!5&fsb=1&xpc=KKoyP6WuFL&p=https%3A//www.rightwing.org&dtd=4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Mon, 10 Oct 2022 14:07:42 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame C444 143 B
166 B 22ms
20ms Document
text/html 2607:f8b0:4006:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:806::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=250&slotname=4569349609&adk=642246285&adf=1543753041&pi=t.ma~as.4569349609&w=300&lmt=1665370584&format=300x250&url=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F%3Futm_source%3Diref%26utm_placement%3DRWnewsletter%26utm_medium%3Demail&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665410861748&bpp=1&bdt=1446&idt=1&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D867106d61160b6c9-22b4b0dda6d70054%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MbyADlkn0RlwRTMZcKMKfzwuHe6Uw&gpic=UID%3D0000057649a3ca06%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MYih3xMQ1vc46x04ozbfApuVR_C2w&prev_fmts=0x0%2C1600x1200%2C640x300%2C640x300&nras=2&correlator=3409364873373&rume=1&frm=20&pv=1&ga_vid=1820485934.1665410861&ga_sid=1665410861&ga_hid=1530091123&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1022&ady=213&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531706%2C21066428%2C44772928%2C31061691%2C31061693&oid=2&pvsid=2143541351964157&tmod=1384303463&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=5&uci=a!5&fsb=1&xpc=KKoyP6WuFL&p=https%3A//www.rightwing.org&dtd=4
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 1604
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 10 Oct 2022 13:40:58 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 84D1 1 KB
643 B 19ms
19ms Document
text/html 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 70812
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 09 Oct 2022 18:27:30 GMT
etag: 48472445140208031
expires: Mon, 10 Oct 2022 18:27:30 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 2168 209 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3f4574cb0add24e704e9a6fa7f6ccf890b3ed7fa9d689486700dfab8c61e1666

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 dpixel
cms.quantserve.com/ Frame 84D1 35 B
465 B 101ms
25ms Image
image/gif 2620:116:800b:21:a021:b886:81cc:55cf
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESELDrN6Ad4C2XIncB4h17lc4&google_cver=1&google_push=AZmPxg_d0J28xznK9XCtKTgjGtZ6kFcJD3qda3qKsOqgaRwzQZoZNJTB2-grXBmIcIxg7h5VFPvJnYfw8Mer4YJJZ2SIokw36xI

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800b:21:a021:b886:81cc:55cf , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:42 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 84D1
Redirect Chain

https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESEO7G-kN9oqj6yedbm8xkUQ8&google_push=AZmPxg8PWjqYVreBZHcpRhsJv3t5EG3qHAZ2DuK4Lnnfg71MW64kPrFNr2AG0iyrfi9RpsRRBdo0ZHn2LV7c-FIsO-U3hqU...
https://cm.g.doubleclick.net/pixel?google_nid=xaxis_dmp&google_push=AZmPxg8PWjqYVreBZHcpRhsJv3t5EG3qHAZ2DuK4Lnnfg71MW64kPrFNr2AG0iyrfi9RpsRRBdo0ZHn2LV7c-FIsO-U3hqU0Vmw&google_hm=MTA1OTY4MjkxODk4MjY...

170 B
232 B

101ms
55ms

Image
image/png

142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=xaxis_dmp&google_push=AZmPxg8PWjqYVreBZHcpRhsJv3t5EG3qHAZ2DuK4Lnnfg71MW64kPrFNr2AG0iyrfi9RpsRRBdo0ZHn2LV7c-FIsO-U3hqU0Vmw&google_hm=MTA1OTY4MjkxODk4MjY0NTYyMjE

Requested by

Protocol

Server

142.250.72.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:42 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
location: https://cm.g.doubleclick.net/pixel?google_nid=xaxis_dmp&google_push=AZmPxg8PWjqYVreBZHcpRhsJv3t5EG3qHAZ2DuK4Lnnfg71MW64kPrFNr2AG0iyrfi9RpsRRBdo0ZHn2LV7c-FIsO-U3hqU0Vmw&google_hm=MTA1OTY4MjkxODk4MjY0NTYyMjE
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 84D1
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESELcFvWBYlUMuHsUFq8A5508&google_cver=1&google_push=AZmPxg_EtTXlaLzW-92xT4DAPVaMVDugD3QdNr4qKclQ73Au099iE4ZvFfAwlUOTfTHXh17bLopkh6GEm09GFiB-Cb0iGfB8zF0
https://rtb.openx.net/sync/dds?google_gid=CAESELcFvWBYlUMuHsUFq8A5508&google_cver=1&google_push=AZmPxg_EtTXlaLzW-92xT4DAPVaMVDugD3QdNr4qKclQ73Au099iE4ZvFfAwlUOTfTHXh17bLopkh6GEm09GFiB-Cb0iGfB8zF0&o...
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AZmPxg_EtTXlaLzW-92xT4DAPVaMVDugD3QdNr4qKclQ73Au099iE4ZvFfAwlUOTfTHXh17bLopkh6GEm09GFiB-Cb0iGfB8zF0&google_hm=feZ7ZFTKyR0dhTrXI77Ewg==

170 B
232 B

160ms
126ms

Image
image/png

142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AZmPxg_EtTXlaLzW-92xT4DAPVaMVDugD3QdNr4qKclQ73Au099iE4ZvFfAwlUOTfTHXh17bLopkh6GEm09GFiB-Cb0iGfB8zF0&google_hm=feZ7ZFTKyR0dhTrXI77Ewg==

Requested by

Protocol

Server

142.250.72.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:41 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AZmPxg_EtTXlaLzW-92xT4DAPVaMVDugD3QdNr4qKclQ73Au099iE4ZvFfAwlUOTfTHXh17bLopkh6GEm09GFiB-Cb0iGfB8zF0&google_hm=feZ7ZFTKyR0dhTrXI77Ewg==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-request-id: 1ee17h04lmd0afrp8j5ri98obsr6kfn0

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 84D1
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=48g7gr1pSWuwHETgJ278kA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
329 B

69ms
53ms

Image
image/png

142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=48g7gr1pSWuwHETgJ278kA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AZmPxg8R8bnXpzZ4HuJG0g_Hr127SerOdTk2N11rZSbS0LQ2PGk4YjYTe_NRh-xx2npyZeyNnq43Af7Ufj-3qrZjpPdPLXT23Q

Requested by

Protocol

Server

142.250.72.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=48g7gr1pSWuwHETgJ278kA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AZmPxg8R8bnXpzZ4HuJG0g_Hr127SerOdTk2N11rZSbS0LQ2PGk4YjYTe_NRh-xx2npyZeyNnq43Af7Ufj-3qrZjpPdPLXT23Q
date: Mon, 10 Oct 2022 14:07:41 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 84D1
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESENJ521UVj8FEi5W_J5KCmzo&google_cver=1&google_push=AZmPxg_2V3fhxc38VwFUxhuA3BbtFCo4Own4fI1PF6m73wN54GHCAxnei9y3Es2GN62TKvGRQK6...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDkyVU1MTTgtMjQtRUNJWg==&google_push=AZmPxg_2V3fhxc38VwFUxhuA3BbtFCo4Own4fI1PF6m73wN54GHCAxnei9y3Es2GN62TKvGRQK6QNuA7RW3tVR544eHt5LXjrw

170 B
232 B

51ms
50ms

Image
image/png

142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDkyVU1MTTgtMjQtRUNJWg==&google_push=AZmPxg_2V3fhxc38VwFUxhuA3BbtFCo4Own4fI1PF6m73wN54GHCAxnei9y3Es2GN62TKvGRQK6QNuA7RW3tVR544eHt5LXjrw

Protocol

Server

142.250.72.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDkyVU1MTTgtMjQtRUNJWg==&google_push=AZmPxg_2V3fhxc38VwFUxhuA3BbtFCo4Own4fI1PF6m73wN54GHCAxnei9y3Es2GN62TKvGRQK6QNuA7RW3tVR544eHt5LXjrw
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 9ef75ea4f1dd62e53c52f84d8070c378
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 84D1
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEHCUUbinJIdcqA5JdxtvsqI&google_cver=1&googl...
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEHCUUbinJIdcqA5JdxtvsqI&google_push=AZ...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEHCUUbinJIdcqA5JdxtvsqI&google_hm=Y0QnLmu47UNT52BpOxFZWAAAALYAAAAB&google_nid=index&google_push=AZmPxg88cs37_iGMod6xyXrzkgf0MUXZGIH8O...

170 B
188 B

154ms
108ms

Image
image/png

142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEHCUUbinJIdcqA5JdxtvsqI&google_hm=Y0QnLmu47UNT52BpOxFZWAAAALYAAAAB&google_nid=index&google_push=AZmPxg88cs37_iGMod6xyXrzkgf0MUXZGIH8OCLsVcMwzJNF12wK_Z2uyXdvJ97KIf6aGVYUxph00WrhU7rX794rbCyi7A6i08U

Protocol

Server

142.250.72.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:42 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CAzbzc7MZsWqBVtoyJhRPft5wkgaAowFLIXShG5tFELUdScShpOXL2OnNG3a1yPuTonLEx1jiNQZ18LR2B44wIOeqSSJdTbfCg8jDHCaebawF5gQzcZQt6BJH0kwzTEXAHiv7hnHgbYQKA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEHCUUbinJIdcqA5JdxtvsqI&google_hm=Y0QnLmu47UNT52BpOxFZWAAAALYAAAAB&google_nid=index&google_push=AZmPxg88cs37_iGMod6xyXrzkgf0MUXZGIH8OCLsVcMwzJNF12wK_Z2uyXdvJ97KIf6aGVYUxph00WrhU7rX794rbCyi7A6i08U
cache-control: no-cache
cf-ray: 757fec81edb5a220-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 84D1
Redirect Chain

https://cc.adingo.jp/adx/push/?google_gid=CAESEGDFbX1B-P2sAOVyF-J3k_U&google_cver=1&google_push=AZmPxg-UNUB70xV5NpL3qTaqOnolnkd56VWF1ZMKqR9Ql9tJgu3XQ_b6OH9NCvuYex0MWqgjfDLX4kM4fXRsQKzz3_g5F-eXJNE
https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AZmPxg-UNUB70xV5NpL3qTaqOnolnkd56VWF1ZMKqR9Ql9tJgu3XQ_b6OH9NCvuYex0MWqgjfDLX4kM4fXRsQKzz3_g5F-eXJNE&google_hm=f628fcef6bf2442b7322...

170 B
232 B

88ms
55ms

Image
image/png

142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AZmPxg-UNUB70xV5NpL3qTaqOnolnkd56VWF1ZMKqR9Ql9tJgu3XQ_b6OH9NCvuYex0MWqgjfDLX4kM4fXRsQKzz3_g5F-eXJNE&google_hm=f628fcef6bf2442b7322e0350d92ff60

Requested by

Protocol

Server

142.250.72.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AZmPxg-UNUB70xV5NpL3qTaqOnolnkd56VWF1ZMKqR9Ql9tJgu3XQ_b6OH9NCvuYex0MWqgjfDLX4kM4fXRsQKzz3_g5F-eXJNE&google_hm=f628fcef6bf2442b7322e0350d92ff60
date: Mon, 10 Oct 2022 14:07:42 GMT
content-type: text/html; charset=UTF-8
server: nginx
p3p: CP=NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa HISa OUR SAMa OTRa STP UNI STA

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 84D1 0
232 B 167ms
51ms Image
text/html 142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13J3VJ6phlIvFbPGLmedKqIFDGtROrV5OKvNa181QGQi3VZCQaXr3bnu0rmNCLYpK4xhGikA

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.72.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:42 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame C444
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

49ms
49ms

Document
text/html

2607:f8b0:4006:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:806::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 10 Oct 2022 14:07:42 GMT
expires: Mon, 10 Oct 2022 14:07:42 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 10 Oct 2022 14:07:42 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame 2168 63 KB
23 KB 59ms
19ms Script
text/javascript 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

920b3418bd27c0a767e254c03fe306e969e631a33a871793ad7691e666983980

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 13:13:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3272
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23603
x-xss-protection: 0
server: cafe
etag: 16686504336640218216
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Mon, 10 Oct 2022 14:13:10 GMT

GET
H3 200 gnLtmcL-mn53pq-EJRMXOCFACjpZd0iqiIv80oTeKas.js Show response
pagead2.googlesyndication.com/bg/ Frame 470D 36 KB
16 KB 19ms
18ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/gnLtmcL-mn53pq-EJRMXOCFACjpZd0iqiIv80oTeKas.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8272ed99c2fe9a7e77a6af842513173821400a3a597748aa888bfcd284de29ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 21:41:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 318347
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16010
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 16:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 06 Oct 2023 21:41:55 GMT

POST
H3 204 csi
csi.gstatic.com/ 0
17 B 39ms
38ms Ping
image/gif 2607:f8b0:400b:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&top=1&puid=4~l92uml8z&c=2143541351964157&e=42531706%2C21066428%2C44772928%2C31061691%2C31061693&ctx=1&met.6=6.1_CgsY7REgOSoECAgSAA
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20221003/r20110914/rum_fy2021.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400b:803::2003 Highland Park, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:42 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame 2168 0
17 B 40ms
39ms Ping
image/gif 2607:f8b0:400b:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~l92umlox&chm=1&ctx=2&gqid=LSdEY4SaL8mToPMPsdKU-Aw&qqid=CJzvyfbq1foCFaZuwQodrOUPRg&met.4=fb.at~lb.bm~cmrload.co~ol.fz~bdt.-14b~bpp.-4~idt.-4~dtd.-1~dt.-5&met.3=733.cs~742.cs~748.d1~749.d3~736.d7~735.dc_1~555.dd~739.de~556.de_2~738.fr~113.ig_3~112.ig_3&met.1=1.l92uml6h~6.0~7.0~8.0~9.0~10.0~12.1~13.ah~14.an~15.ak~16.dd~17.dd~18.dg~19.fq~20.fq~21.fz~22.b5~23.b5&met.7=CAUQCBgBMP8COL8EaAFw-QJ4jfgBgAHh9QGIAYPiBLABAbgBAw~CBcQBhgBIIMDKIMDMLMDODBohANwmAN4zccCgAGhxQKIAaHFArABAbgBAw~CAkQChgBIIMDKIMDMJgDOBVohANwlwN48EyAAcRKiAHStwGwAQG4AQM~CB4QChgBIIMDKIMDMKoDOCdoigNwqQN4-wyAAc8KiAGxFbABAbgBAw~CBwQChgBIIQDKIQDMKADOB1oigNwnAN4lD2AAeg6iAG7iQGwAQG4AQM~CBsQBhgBIIQDKIQDMLIDOC4~CCoQChgBIIQDKIQDMLoDODY~CBwQChgBIIQDKIQDMK0DOCloigNwqgN48GyAAcRqiAGpggKwAQG4AQM~CCEQBBgBIIkDKIkDMIwEOIMBaIoDcIsEeKwCsAEBuAED~CCgQBRgBIJ0DKJ0DMLQDOBdonwNwtAN4vQOAAZEBiAGPAbABAbgBAw~CBwQBRgBIJ4DKJ4DMLMDOBVooANwsgN4lgeAAeoEiAGWCbABAbgBAw~CCgQChgBIL8EKL8EMIUFOEVQwARY5wRgwARo5wRw-wR437oBgAGzuAGIAZz3A7ABAbgBAw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400b:803::2003 Highland Park, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:42 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 189A 6 KB
672 B 36ms
35ms Stylesheet
text/css 2607:f8b0:4006:823::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4569349609&adk=2326741806&adf=3494845914&pi=t.ma~as.4569349609&w=640&lmt=1665370584&format=640x300&url=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F%3Futm_source%3Diref%26utm_placement%3DRWnewsletter%26utm_medium%3Demail&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665410861731&bpp=1&bdt=1429&idt=1&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D867106d61160b6c9-22b4b0dda6d70054%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MbyADlkn0RlwRTMZcKMKfzwuHe6Uw&gpic=UID%3D0000057649a3ca06%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MYih3xMQ1vc46x04ozbfApuVR_C2w&prev_fmts=0x0%2C1600x1200&nras=2&correlator=3409364873373&rume=1&frm=20&pv=1&ga_vid=1820485934.1665410861&ga_sid=1665410861&ga_hid=1530091123&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=294&ady=616&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531706%2C21066428%2C44772928%2C31061691%2C31061693&oid=2&pvsid=2143541351964157&tmod=1384303463&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=4mXr6XsNci&p=https%3A//www.rightwing.org&dtd=9

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::200a Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e0be1d222e2e367ac5106f4aee4830c3de18af1d266f8cde53915e11e8b01bfd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 10 Oct 2022 14:07:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 10 Oct 2022 12:07:43 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 10 Oct 2022 14:07:42 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/ Frame 189A 2 KB
902 B 20ms
19ms Script
text/javascript 2607:f8b0:4006:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2001 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

981c0bff12cb03203363a70e8ffe9b7fdf4af3b0b10c7a02a639eb13327574c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:02:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 314
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 875
x-xss-protection: 0
server: cafe
etag: 16974406330603315520
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Oct 2022 14:02:28 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221003/r20110914/ Frame 189A 23 KB
9 KB 20ms
19ms Script
text/javascript 2607:f8b0:4006:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221003/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2001 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a2c6856e8437c3183ec517c59fc9724eb82cac59f685970113a7fb15ecd272c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:02:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 341
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9540
x-xss-protection: 0
server: cafe
etag: 6580860447119072478
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Oct 2022 14:02:01 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/ Frame 189A 3 KB
1 KB 21ms
20ms Script
text/javascript 2607:f8b0:4006:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2001 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 13:59:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 507
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Oct 2022 13:59:15 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/ Frame 189A 17 KB
7 KB 21ms
21ms Script
text/javascript 2607:f8b0:4006:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2001 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

65f4e452b96ef3e5e3a4631d99c63dd7239dcbcb88de679ac74ac30d3d4988cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 13:54:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 784
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7528
x-xss-protection: 0
server: cafe
etag: 13775775994264215463
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Oct 2022 13:54:38 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 189A 0
0 37ms
37ms Image
text/html 2607:f8b0:4006:821::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSflCIhQhx832TSguuj_fcLIHUuMOGtSrsUBZ7Mfr4pAAVy9dAa0VsLXBwdj-rosGImAOdUJ9sAt0esOisuzDBLWYObcg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4569349609&adk=2326741806&adf=3494845914&pi=t.ma~as.4569349609&w=640&lmt=1665370584&format=640x300&url=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F%3Futm_source%3Diref%26utm_placement%3DRWnewsletter%26utm_medium%3Demail&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665410861731&bpp=1&bdt=1429&idt=1&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D867106d61160b6c9-22b4b0dda6d70054%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MbyADlkn0RlwRTMZcKMKfzwuHe6Uw&gpic=UID%3D0000057649a3ca06%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MYih3xMQ1vc46x04ozbfApuVR_C2w&prev_fmts=0x0%2C1600x1200&nras=2&correlator=3409364873373&rume=1&frm=20&pv=1&ga_vid=1820485934.1665410861&ga_sid=1665410861&ga_hid=1530091123&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=294&ady=616&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531706%2C21066428%2C44772928%2C31061691%2C31061693&oid=2&pvsid=2143541351964157&tmod=1384303463&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=4mXr6XsNci&p=https%3A//www.rightwing.org&dtd=9
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:821::2004 Rockville, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 189A 142 KB
44 KB 37ms
36ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ba29faf5efe544ed157bbf56aafd0555a22103b36514708d7fcd196fc361c2f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 45072
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1664970042070988"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 10 Oct 2022 14:07:42 GMT

GET
H3 200 ff28bd887d5918000d85a256eb9567a4.js Show response
www.gstatic.com/mysidia/ Frame 189A 32 KB
13 KB 19ms
18ms Script
text/javascript 2607:f8b0:4006:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/ff28bd887d5918000d85a256eb9567a4.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:809::2003 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9a61fe6e2743a18f977ac18a2f805735e8dccf115b16dbbbd2e3864ae98d4c33

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 21:03:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 320669
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13740
x-xss-protection: 0
last-modified: Tue, 04 Oct 2022 19:51:47 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 04 Jan 2023 21:03:13 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 189A 0
0 136ms
135ms Fetch
text/html 2607:f8b0:4006:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CVewlLSdEY4q4L5OmhAWsuYCoBqGr1-xrxdvdvYMNwKTCvNghEAEg84aaAmD96KKB8AOgAda_9L4CyAEJqAMByAPLBKoE2AJP0BHxqpLp6C4Hn1lTSGhz8B3UOGZC91YZEMasAf_jq5mYOTSUL6DXz7Z6mqHO_32SQq5-Chy2BvlIFnSc0AIiz4uuny0NmB5l04I8oPtLKHi_Z4HtBisJXIgEZJ67Ou_UagXnI8KCVhPPWkTz_3k3TpE7L4gWi8XOMwGXsoGjm4ubydibF_jSoH4WuQiOjzCj8VWRb2RL_ZmDEoHURSQ77CI4Uraox_O4lMPicLP3CAu5dkKrl60i6nOfyygTf2fcmNv418m5Wc0O0OeA-fFu7eVg5aOU1kdzhVgAWa5R4VUVjJj-qZS3jCZULz5PwkAdVgctZVem5rBQYqPja0p3Fm8xoOfwdKJlTzmwWSRLQV8mGdb03hZVsqmUxAa6IA7e9yMj2QkMShj6uGj6ap36X4_2G_WH3-TgMgkQYhseeaeiEqNdQW8QSwivECahokF5ofJhvZaXmsAElb7ugrQDkgUECAQYAZIFBAgFGASSBQQIBRgYkgUFCAUYqAGgBi6AB5LAi8EBqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwDyBwQQuItP0ggPCIBhEAEYHzICigI6AoBAgAoByAsBuBPkA9gTDNAVAZgWAYAXAbIXHAoaCAASFHB1Yi0xMTA5NDAxOTY0NjIzNjY0GAA&sigh=kYhRwxDmz4I&uach_m=[UACH]&template_id=484

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:806::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4569349609&adk=2326741806&adf=3494845914&pi=t.ma~as.4569349609&w=640&lmt=1665370584&format=640x300&url=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F%3Futm_source%3Diref%26utm_placement%3DRWnewsletter%26utm_medium%3Demail&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665410861731&bpp=1&bdt=1429&idt=1&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D867106d61160b6c9-22b4b0dda6d70054%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MbyADlkn0RlwRTMZcKMKfzwuHe6Uw&gpic=UID%3D0000057649a3ca06%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MYih3xMQ1vc46x04ozbfApuVR_C2w&prev_fmts=0x0%2C1600x1200&nras=2&correlator=3409364873373&rume=1&frm=20&pv=1&ga_vid=1820485934.1665410861&ga_sid=1665410861&ga_hid=1530091123&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=294&ady=616&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531706%2C21066428%2C44772928%2C31061691%2C31061693&oid=2&pvsid=2143541351964157&tmod=1384303463&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=4mXr6XsNci&p=https%3A//www.rightwing.org&dtd=9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Mon, 10 Oct 2022 14:07:42 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/13368489184056897600/ Frame 189A 25 KB
25 KB 20ms
19ms Image
image/jpeg 2607:f8b0:4006:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/13368489184056897600/downsize_200k_v1?w=600&h=314

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2001 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6f02f78c5994cd9ff52295d804ad9061b91dbe07c27c719db05e294a0331dbc0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 03 Oct 2022 22:57:05 GMT
x-content-type-options: nosniff
age: 573037
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25843
x-xss-protection: 0
last-modified: Wed, 15 Jul 2020 22:48:18 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 03 Oct 2023 22:57:05 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 0DF1 1 KB
643 B 20ms
19ms Document
text/html 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 70812
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 09 Oct 2022 18:27:30 GMT
etag: 48472445140208031
expires: Mon, 10 Oct 2022 18:27:30 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 189A 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 17305d5998d98b01e352360f235f9a9f7c573adeedb30815b1ad82d0baef0c6f

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0DF1
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEEKI31cTEg8T4iW3LCEATYo&google_cver=1&google_push=AZmPxg-Q4wgdXWpk_ByTZfF1iB0DnmwP2591vMr0h0AYIqcUXVFjwebl8B...
https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=AZmPxg-Q4wgdXWpk_ByTZfF1iB0DnmwP2591vMr0h0AYIqcUXVFjwebl8Bwd88R3lJAxlI2GmqyklEUNX3cFB49hmGn_Luczypyd4ZbE1sQ1uhhYfANlK...

170 B
188 B

40ms
39ms

Image
image/png

142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=AZmPxg-Q4wgdXWpk_ByTZfF1iB0DnmwP2591vMr0h0AYIqcUXVFjwebl8Bwd88R3lJAxlI2GmqyklEUNX3cFB49hmGn_Luczypyd4ZbE1sQ1uhhYfANlKQh1MES2kvfaxnCgIoqP0c3KXSBxenYaAui25Q&google_hm=4ir_IUCUhSE8N-GnDH80vA

Protocol

Server

142.250.72.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=AZmPxg-Q4wgdXWpk_ByTZfF1iB0DnmwP2591vMr0h0AYIqcUXVFjwebl8Bwd88R3lJAxlI2GmqyklEUNX3cFB49hmGn_Luczypyd4ZbE1sQ1uhhYfANlKQh1MES2kvfaxnCgIoqP0c3KXSBxenYaAui25Q&google_hm=4ir_IUCUhSE8N-GnDH80vA
pragma: no-cache
date: Mon, 10 Oct 2022 14:07:42 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0DF1
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAZmPxg_5CC5D...
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAZmPxg_5CC5D...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjEwMTAxNDA3NDIwMDAyODMyMTkxODQ5MQ%3D%3D&google_push=AZmPxg_5CC5DffqCsAhbHBN38P_QX2shTRTx-Bt-Fxx2i0deQ1Nka2xrQm7XleEADN5bwA...

170 B
188 B

38ms
38ms

Image
image/png

142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjEwMTAxNDA3NDIwMDAyODMyMTkxODQ5MQ%3D%3D&google_push=AZmPxg_5CC5DffqCsAhbHBN38P_QX2shTRTx-Bt-Fxx2i0deQ1Nka2xrQm7XleEADN5bwAeyqljaz0Yh9zOPb63q4pf2bxpLhx9aex7LYaP-O-3PHIvy0VHSMl5FBlbiZBniaJzWMoaQiRYtauhCnLLQJA

Protocol

Server

142.250.72.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjEwMTAxNDA3NDIwMDAyODMyMTkxODQ5MQ%3D%3D&google_push=AZmPxg_5CC5DffqCsAhbHBN38P_QX2shTRTx-Bt-Fxx2i0deQ1Nka2xrQm7XleEADN5bwAeyqljaz0Yh9zOPb63q4pf2bxpLhx9aex7LYaP-O-3PHIvy0VHSMl5FBlbiZBniaJzWMoaQiRYtauhCnLLQJA
pragma: no-cache
date: Mon, 10 Oct 2022 14:07:42 GMT
cache-control: max-age=0, no-cache, no-store
strict-transport-security: max-age=2628000
content-length: 0
expires: Mon, 10 Oct 2022 14:07:42 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0DF1
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEOlfIXv7HpksIcZCH-4oCSI&google_cver=1&google_push=AZmPxg-6bpdSXK6bJvX-QfeajyM0gHL-r5GcV-8fdoGN22qvDSWOZV58VNzjXhVfMjWUTZibrT2gLH-STkg8gLJ6QP_gdlOP1QwMl...
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AZmPxg-6bpdSXK6bJvX-QfeajyM0gHL-r5GcV-8fdoGN22qvDSWOZV58VNzjXhVfMjWUTZibrT2gLH-STkg8gLJ6QP_gdlOP1QwMllb-frxt1e4kUdREB7n7xb3oBhc-WL1wR1...

170 B
188 B

35ms
35ms

Image
image/png

142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AZmPxg-6bpdSXK6bJvX-QfeajyM0gHL-r5GcV-8fdoGN22qvDSWOZV58VNzjXhVfMjWUTZibrT2gLH-STkg8gLJ6QP_gdlOP1QwMllb-frxt1e4kUdREB7n7xb3oBhc-WL1wR1JB8ALWvB9BiVVf1S5JR5g&google_hm=feZ7ZFTKyR0dhTrXI77Ewg==

Protocol

Server

142.250.72.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:42 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AZmPxg-6bpdSXK6bJvX-QfeajyM0gHL-r5GcV-8fdoGN22qvDSWOZV58VNzjXhVfMjWUTZibrT2gLH-STkg8gLJ6QP_gdlOP1QwMllb-frxt1e4kUdREB7n7xb3oBhc-WL1wR1JB8ALWvB9BiVVf1S5JR5g&google_hm=feZ7ZFTKyR0dhTrXI77Ewg==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-request-id: u7cd95gop98osbrpqjg0pb77jh28aabg

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0DF1
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=48g7gr1pSWuwHETgJ278kA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

110ms
110ms

Image
image/png

142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=48g7gr1pSWuwHETgJ278kA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AZmPxg8RY2k9_vkrR_e4jacMIW9OnE4C19EZ1ruWY86cpqAUrbQX4IIzac3NmJs4OSFe-PmPQmV-lLWXDBd8gIMADFkfLrXUOJAZ2A6n_uHjE6DyZJq-5dA0nEEJLm7CQ_yXQEli8iJs6pRlJHkoeAmws-4

Protocol

Server

142.250.72.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=48g7gr1pSWuwHETgJ278kA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AZmPxg8RY2k9_vkrR_e4jacMIW9OnE4C19EZ1ruWY86cpqAUrbQX4IIzac3NmJs4OSFe-PmPQmV-lLWXDBd8gIMADFkfLrXUOJAZ2A6n_uHjE6DyZJq-5dA0nEEJLm7CQ_yXQEli8iJs6pRlJHkoeAmws-4
date: Mon, 10 Oct 2022 14:07:41 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0DF1
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESELDcDdK0OQPiuta7ZBt1yxU&google_cver=1&google_push=AZmPxg9lNHQdMR98pbQ-JddmKJBoJHMoLYuY62ZEJnLjvwQCGjLGDxuTE2sxV5rqu66PeB2sf75...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDkyVU1MVFEtMVQtQ0lRVQ==&google_push=AZmPxg9lNHQdMR98pbQ-JddmKJBoJHMoLYuY62ZEJnLjvwQCGjLGDxuTE2sxV5rqu66PeB2sf75slqnoXYFUfWFD9NSZoDir3YmGv...

170 B
188 B

37ms
37ms

Image
image/png

142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDkyVU1MVFEtMVQtQ0lRVQ==&google_push=AZmPxg9lNHQdMR98pbQ-JddmKJBoJHMoLYuY62ZEJnLjvwQCGjLGDxuTE2sxV5rqu66PeB2sf75slqnoXYFUfWFD9NSZoDir3YmGv7uM43Yyqp65uqpBQ8z0tvR7PysazVJ6pr34gpysGrPYP4YXcSsMGE8

Protocol

Server

142.250.72.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDkyVU1MVFEtMVQtQ0lRVQ==&google_push=AZmPxg9lNHQdMR98pbQ-JddmKJBoJHMoLYuY62ZEJnLjvwQCGjLGDxuTE2sxV5rqu66PeB2sf75slqnoXYFUfWFD9NSZoDir3YmGv7uM43Yyqp65uqpBQ8z0tvR7PysazVJ6pr34gpysGrPYP4YXcSsMGE8
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 9ef75ea4f1dd62e53c52f84d8070c378
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0DF1
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEALzr-Ks5MZVye7Os6ya2sQ&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEALzr-Ks5MZVye7Os6ya2sQ&google_hm=Y0QnLmu47UNT52BpOxFZWAAAALYAAAAB&google_nid=index&google_push=AZmPxg_YkGXH6MxGULHVJabtqa3YZNSP8FJfF...

170 B
188 B

35ms
35ms

Image
image/png

142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEALzr-Ks5MZVye7Os6ya2sQ&google_hm=Y0QnLmu47UNT52BpOxFZWAAAALYAAAAB&google_nid=index&google_push=AZmPxg_YkGXH6MxGULHVJabtqa3YZNSP8FJfFj452KrNDwzeAHEJUVbnTHgQoAdYmF2NfVx1MP95-uIPE08uKqWTxAJwMYT1bRmU2VY-nYnLczmhsk6KJ8dQcqO94AmDPKgVPdiJi6Rr4G0_uxqMLQUbyTg

Protocol

Server

142.250.72.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:42 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Fazes9jy6q3elN1DdDaFkrQtY3RA4rCIuZgPlRC%2B9uNPGQRwda5BNufbsPbFcZqpf5VB7PVfji0gIXnFRDEaYCF3nhD4Tbiqthn5nX40qPW%2F6ZmDg1icmmeQ%2Bz4XcgyLyCj%2BAOYszacIGg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEALzr-Ks5MZVye7Os6ya2sQ&google_hm=Y0QnLmu47UNT52BpOxFZWAAAALYAAAAB&google_nid=index&google_push=AZmPxg_YkGXH6MxGULHVJabtqa3YZNSP8FJfFj452KrNDwzeAHEJUVbnTHgQoAdYmF2NfVx1MP95-uIPE08uKqWTxAJwMYT1bRmU2VY-nYnLczmhsk6KJ8dQcqO94AmDPKgVPdiJi6Rr4G0_uxqMLQUbyTg
cache-control: no-cache
cf-ray: 757fec832818a220-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0DF1
Redirect Chain

https://cc.adingo.jp/adx/push/?google_gid=CAESEB6TTgQV7EpdaTx_KJzFupY&google_cver=1&google_push=AZmPxg8enzFH2bLvhf1D05YHLPdAT0-nhpvP5VeC6hAdkozp0N4_TO9ujKzj2zNA687CexejAB6y-80SpxKlxEqT0jTQd9kPOrsA_...
https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AZmPxg8enzFH2bLvhf1D05YHLPdAT0-nhpvP5VeC6hAdkozp0N4_TO9ujKzj2zNA687CexejAB6y-80SpxKlxEqT0jTQd9kPOrsA_FDbNc42RQM0NNv6adthcTZab9uNXH...

170 B
188 B

36ms
36ms

Image
image/png

142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AZmPxg8enzFH2bLvhf1D05YHLPdAT0-nhpvP5VeC6hAdkozp0N4_TO9ujKzj2zNA687CexejAB6y-80SpxKlxEqT0jTQd9kPOrsA_FDbNc42RQM0NNv6adthcTZab9uNXHacCNUvH-g9TLXh_dV1xHkcwnw&google_hm=f628fcef6bf2442b7322e0350d92ff60

Protocol

Server

142.250.72.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AZmPxg8enzFH2bLvhf1D05YHLPdAT0-nhpvP5VeC6hAdkozp0N4_TO9ujKzj2zNA687CexejAB6y-80SpxKlxEqT0jTQd9kPOrsA_FDbNc42RQM0NNv6adthcTZab9uNXHacCNUvH-g9TLXh_dV1xHkcwnw&google_hm=f628fcef6bf2442b7322e0350d92ff60
date: Mon, 10 Oct 2022 14:07:42 GMT
content-type: text/html; charset=UTF-8
server: nginx
p3p: CP=NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa HISa OUR SAMa OTRa STP UNI STA

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 0DF1 0
12 B 37ms
36ms Image
text/html 142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KY1Y-u9viDh9YC9ZWhHANWHO6dq24jjle3iaFY_fgYaTeo7R2n8Eb3Ds3O8ZiO4OzNhz7j

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.72.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:42 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 189A 15 KB
16 KB 67ms
18ms Font
font/woff2 2607:f8b0:4006:80a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80a::2003 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Wed, 05 Oct 2022 19:31:57 GMT
x-content-type-options: nosniff
age: 412545
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 05 Oct 2023 19:31:57 GMT

GET
H2 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 189A 15 KB
15 KB 85ms
39ms Font
font/woff2 2607:f8b0:4006:80a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80a::2003 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Wed, 05 Oct 2022 19:33:19 GMT
x-content-type-options: nosniff
age: 412463
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15740
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 05 Oct 2023 19:33:19 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 189A 15 KB
15 KB 68ms
23ms Font
font/woff2 2607:f8b0:4006:80a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80a::2003 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Sat, 08 Oct 2022 05:47:40 GMT
x-content-type-options: nosniff
age: 202802
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 08 Oct 2023 05:47:40 GMT

GET
H3 200 gnLtmcL-mn53pq-EJRMXOCFACjpZd0iqiIv80oTeKas.js Show response
pagead2.googlesyndication.com/bg/ Frame 1CD4 36 KB
16 KB 19ms
19ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/gnLtmcL-mn53pq-EJRMXOCFACjpZd0iqiIv80oTeKas.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8272ed99c2fe9a7e77a6af842513173821400a3a597748aa888bfcd284de29ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 21:41:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 318347
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16010
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 16:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 06 Oct 2023 21:41:55 GMT

GET
H3 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame 189A 63 KB
23 KB 20ms
20ms Script
text/javascript 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

920b3418bd27c0a767e254c03fe306e969e631a33a871793ad7691e666983980

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 13:13:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3272
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23603
x-xss-protection: 0
server: cafe
etag: 16686504336640218216
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Mon, 10 Oct 2022 14:13:10 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 107ms
105ms Image
text/html 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20221003&jk=2143541351964157&bg=!Dg2lDUnNAAYQgTJdMIE7ACkAdvg8WrfI7u2VpQHsrz6MpWg1oXjWnsP_ANnZfEavBezVDJFoNq0GpgIAAABwUgAAAAJoAQeZAuWqAzw555-3xnB1vlWgYdmeK0EO6WUcBSrilNaQgPs3wRiO1IoQaR0KZpTYTOkHXi7cJPLUE5IHUBFzaTzDy8LpmvR3xZsKRQefMKqEvof6Vsx13r4LbL7xWN6dmVSlEqH5JHj4ZvPOCKW4Tv_-kVhEwrxaodm6G5V3m3abuSVAOPjkt3Tf4s-jtiMeGCBIJd0ciGviHfF7UPO8vdZ56D4Q2Hvt-0GC0TYAlEojQEm3mPhqEE2DbdG-8M3yFOA4I6AKN4qjdex6FHQ0yL7y-Jqao49gdls2GPivqyZjjfa-L-lTAv5BdPHD6fnc_rPA2UmuPmunaVNKujBaEfE2ige8o0pWNLFx-438YU4gVriy0tTWmsbSAX1a6SJErefyY5vESyWS7bPF0SJX2CcdIWGC3q1EkVz07-gBTvz5yxvXDWJkoEDuqpK1o4nm9NrZJaLpfGAwgVkRtOsBkT5wblvuEBswi-Qi76WKlnsVlOCyznK2_C1wEN1j8us_MZR-O5CA6j1ixmFzTBb_wsr03OZz6B-EFu7EJWrcoO-4CwmU-M7OHIUkwVoDnzvwHImAL5XdpIUp7U0UlnAa-Pm_5tVOd5fyHT5PqbZyo4itb7mwKOFNO4baK9zCxkjNA8lLyosLNhjXHBo8clTOyIy210akQsAse8cuq4sSBYmRnHUmnufbiPzJFZSDYm9nlBW3pqmX9hf7NK3N24xPl4LvdLH-3shyHHoY5ZuZzT8UDi6YLL4kMA0OEueBuUKND4h_Q23Vk8zSyTpOtvJwM8JAPuQeZV_dRM-e2sC8q-nSlY7W5Fcof6Xm7DeRiViZ7L95RGqILKykcJuxmUPlUi6oBmT85qIctWdvJNVP64zLRaiciLGDq-W3gkHcHoVae5Jx1vg5Uxk8Gv5m9RD_dyOtiw961l68dja3bSWLBbyrSt09GluZ2MGxVduk-Jnff0dU9qBMPkeguBBx0XdRfPIk5zrxVFQe0U4
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:80d::2002 Rockville, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

GET
H3 200 css
fonts.googleapis.com/ Frame CB97 4 KB
621 B 35ms
34ms Stylesheet
text/css 2607:f8b0:4006:823::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A400%2C700

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4569349609&adk=2326741806&adf=3205953851&pi=t.ma~as.4569349609&w=640&lmt=1665370584&format=640x300&url=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F%3Futm_source%3Diref%26utm_placement%3DRWnewsletter%26utm_medium%3Demail&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665410861742&bpp=1&bdt=1440&idt=1&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D867106d61160b6c9-22b4b0dda6d70054%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MbyADlkn0RlwRTMZcKMKfzwuHe6Uw&gpic=UID%3D0000057649a3ca06%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MYih3xMQ1vc46x04ozbfApuVR_C2w&prev_fmts=0x0%2C1600x1200%2C640x300&nras=2&correlator=3409364873373&rume=1&frm=20&pv=1&ga_vid=1820485934.1665410861&ga_sid=1665410861&ga_hid=1530091123&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=294&ady=2693&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531706%2C21066428%2C44772928%2C31061691%2C31061693&oid=2&pvsid=2143541351964157&tmod=1384303463&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=j1fUCfNGgG&p=https%3A//www.rightwing.org&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::200a Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

099f342bcdd01d03cacd2d665bb82ed11b7110f74768ec40774de44140481a38

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 10 Oct 2022 14:07:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 10 Oct 2022 14:00:27 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 10 Oct 2022 14:07:42 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/ Frame CB97 2 KB
902 B 21ms
19ms Script
text/javascript 2607:f8b0:4006:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4569349609&adk=2326741806&adf=3205953851&pi=t.ma~as.4569349609&w=640&lmt=1665370584&format=640x300&url=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F%3Futm_source%3Diref%26utm_placement%3DRWnewsletter%26utm_medium%3Demail&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665410861742&bpp=1&bdt=1440&idt=1&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D867106d61160b6c9-22b4b0dda6d70054%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MbyADlkn0RlwRTMZcKMKfzwuHe6Uw&gpic=UID%3D0000057649a3ca06%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MYih3xMQ1vc46x04ozbfApuVR_C2w&prev_fmts=0x0%2C1600x1200%2C640x300&nras=2&correlator=3409364873373&rume=1&frm=20&pv=1&ga_vid=1820485934.1665410861&ga_sid=1665410861&ga_hid=1530091123&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=294&ady=2693&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531706%2C21066428%2C44772928%2C31061691%2C31061693&oid=2&pvsid=2143541351964157&tmod=1384303463&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=j1fUCfNGgG&p=https%3A//www.rightwing.org&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2001 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

981c0bff12cb03203363a70e8ffe9b7fdf4af3b0b10c7a02a639eb13327574c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:02:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 314
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 875
x-xss-protection: 0
server: cafe
etag: 16974406330603315520
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Oct 2022 14:02:28 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221003/r20110914/ Frame CB97 23 KB
9 KB 22ms
20ms Script
text/javascript 2607:f8b0:4006:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221003/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4569349609&adk=2326741806&adf=3205953851&pi=t.ma~as.4569349609&w=640&lmt=1665370584&format=640x300&url=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F%3Futm_source%3Diref%26utm_placement%3DRWnewsletter%26utm_medium%3Demail&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665410861742&bpp=1&bdt=1440&idt=1&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D867106d61160b6c9-22b4b0dda6d70054%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MbyADlkn0RlwRTMZcKMKfzwuHe6Uw&gpic=UID%3D0000057649a3ca06%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MYih3xMQ1vc46x04ozbfApuVR_C2w&prev_fmts=0x0%2C1600x1200%2C640x300&nras=2&correlator=3409364873373&rume=1&frm=20&pv=1&ga_vid=1820485934.1665410861&ga_sid=1665410861&ga_hid=1530091123&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=294&ady=2693&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531706%2C21066428%2C44772928%2C31061691%2C31061693&oid=2&pvsid=2143541351964157&tmod=1384303463&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=j1fUCfNGgG&p=https%3A//www.rightwing.org&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2001 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a2c6856e8437c3183ec517c59fc9724eb82cac59f685970113a7fb15ecd272c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:02:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 341
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9540
x-xss-protection: 0
server: cafe
etag: 6580860447119072478
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Oct 2022 14:02:01 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/ Frame CB97 3 KB
1 KB 19ms
19ms Script
text/javascript 2607:f8b0:4006:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4569349609&adk=2326741806&adf=3205953851&pi=t.ma~as.4569349609&w=640&lmt=1665370584&format=640x300&url=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F%3Futm_source%3Diref%26utm_placement%3DRWnewsletter%26utm_medium%3Demail&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665410861742&bpp=1&bdt=1440&idt=1&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D867106d61160b6c9-22b4b0dda6d70054%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MbyADlkn0RlwRTMZcKMKfzwuHe6Uw&gpic=UID%3D0000057649a3ca06%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MYih3xMQ1vc46x04ozbfApuVR_C2w&prev_fmts=0x0%2C1600x1200%2C640x300&nras=2&correlator=3409364873373&rume=1&frm=20&pv=1&ga_vid=1820485934.1665410861&ga_sid=1665410861&ga_hid=1530091123&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=294&ady=2693&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531706%2C21066428%2C44772928%2C31061691%2C31061693&oid=2&pvsid=2143541351964157&tmod=1384303463&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=j1fUCfNGgG&p=https%3A//www.rightwing.org&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2001 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 13:59:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 507
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Oct 2022 13:59:15 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/ Frame CB97 17 KB
7 KB 22ms
20ms Script
text/javascript 2607:f8b0:4006:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4569349609&adk=2326741806&adf=3205953851&pi=t.ma~as.4569349609&w=640&lmt=1665370584&format=640x300&url=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F%3Futm_source%3Diref%26utm_placement%3DRWnewsletter%26utm_medium%3Demail&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665410861742&bpp=1&bdt=1440&idt=1&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D867106d61160b6c9-22b4b0dda6d70054%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MbyADlkn0RlwRTMZcKMKfzwuHe6Uw&gpic=UID%3D0000057649a3ca06%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MYih3xMQ1vc46x04ozbfApuVR_C2w&prev_fmts=0x0%2C1600x1200%2C640x300&nras=2&correlator=3409364873373&rume=1&frm=20&pv=1&ga_vid=1820485934.1665410861&ga_sid=1665410861&ga_hid=1530091123&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=294&ady=2693&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531706%2C21066428%2C44772928%2C31061691%2C31061693&oid=2&pvsid=2143541351964157&tmod=1384303463&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=j1fUCfNGgG&p=https%3A//www.rightwing.org&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2001 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

65f4e452b96ef3e5e3a4631d99c63dd7239dcbcb88de679ac74ac30d3d4988cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 13:54:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 784
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7528
x-xss-protection: 0
server: cafe
etag: 13775775994264215463
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Oct 2022 13:54:38 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame CB97 0
0 36ms
36ms Image
text/html 2607:f8b0:4006:821::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRa6jYRw2MD06Q3cWIK81hYmjxArYk8mw72yeHKRaIUi8FI9YNeF2F2qEBKRHkByCORmPmn0pqPcBZVAC3F6ZjKBfnmXQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4569349609&adk=2326741806&adf=3205953851&pi=t.ma~as.4569349609&w=640&lmt=1665370584&format=640x300&url=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F%3Futm_source%3Diref%26utm_placement%3DRWnewsletter%26utm_medium%3Demail&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665410861742&bpp=1&bdt=1440&idt=1&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D867106d61160b6c9-22b4b0dda6d70054%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MbyADlkn0RlwRTMZcKMKfzwuHe6Uw&gpic=UID%3D0000057649a3ca06%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MYih3xMQ1vc46x04ozbfApuVR_C2w&prev_fmts=0x0%2C1600x1200%2C640x300&nras=2&correlator=3409364873373&rume=1&frm=20&pv=1&ga_vid=1820485934.1665410861&ga_sid=1665410861&ga_hid=1530091123&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=294&ady=2693&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531706%2C21066428%2C44772928%2C31061691%2C31061693&oid=2&pvsid=2143541351964157&tmod=1384303463&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=j1fUCfNGgG&p=https%3A//www.rightwing.org&dtd=4
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:821::2004 Rockville, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame CB97 142 KB
44 KB 69ms
68ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4569349609&adk=2326741806&adf=3205953851&pi=t.ma~as.4569349609&w=640&lmt=1665370584&format=640x300&url=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F%3Futm_source%3Diref%26utm_placement%3DRWnewsletter%26utm_medium%3Demail&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665410861742&bpp=1&bdt=1440&idt=1&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D867106d61160b6c9-22b4b0dda6d70054%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MbyADlkn0RlwRTMZcKMKfzwuHe6Uw&gpic=UID%3D0000057649a3ca06%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MYih3xMQ1vc46x04ozbfApuVR_C2w&prev_fmts=0x0%2C1600x1200%2C640x300&nras=2&correlator=3409364873373&rume=1&frm=20&pv=1&ga_vid=1820485934.1665410861&ga_sid=1665410861&ga_hid=1530091123&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=294&ady=2693&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531706%2C21066428%2C44772928%2C31061691%2C31061693&oid=2&pvsid=2143541351964157&tmod=1384303463&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=j1fUCfNGgG&p=https%3A//www.rightwing.org&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ba29faf5efe544ed157bbf56aafd0555a22103b36514708d7fcd196fc361c2f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 45072
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1664970042070988"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 10 Oct 2022 14:07:42 GMT

GET
H3 200 ff28bd887d5918000d85a256eb9567a4.js Show response
www.gstatic.com/mysidia/ Frame CB97 32 KB
13 KB 20ms
19ms Script
text/javascript 2607:f8b0:4006:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/ff28bd887d5918000d85a256eb9567a4.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4569349609&adk=2326741806&adf=3205953851&pi=t.ma~as.4569349609&w=640&lmt=1665370584&format=640x300&url=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F%3Futm_source%3Diref%26utm_placement%3DRWnewsletter%26utm_medium%3Demail&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665410861742&bpp=1&bdt=1440&idt=1&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D867106d61160b6c9-22b4b0dda6d70054%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MbyADlkn0RlwRTMZcKMKfzwuHe6Uw&gpic=UID%3D0000057649a3ca06%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MYih3xMQ1vc46x04ozbfApuVR_C2w&prev_fmts=0x0%2C1600x1200%2C640x300&nras=2&correlator=3409364873373&rume=1&frm=20&pv=1&ga_vid=1820485934.1665410861&ga_sid=1665410861&ga_hid=1530091123&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=294&ady=2693&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531706%2C21066428%2C44772928%2C31061691%2C31061693&oid=2&pvsid=2143541351964157&tmod=1384303463&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=j1fUCfNGgG&p=https%3A//www.rightwing.org&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:809::2003 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9a61fe6e2743a18f977ac18a2f805735e8dccf115b16dbbbd2e3864ae98d4c33

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 21:03:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 320669
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13740
x-xss-protection: 0
last-modified: Tue, 04 Oct 2022 19:51:47 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 04 Jan 2023 21:03:13 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame CB97 0
0 155ms
154ms Fetch
text/html 2607:f8b0:4006:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CTC61LSdEY6-YMI_-hQaev7OgBbX_putsvrqun8QQ8t3S4LIBEAEg84aaAmD96KKB8AOgAen99c8DyAEJqAMByAPLBKoE1gJP0Dk6h5gF_hfZZdOVQd-dv7I8m3WjZivkUldayQizpaSNVdqBjjmKvCjvpIhXMroxF-QVxaDW_G9dCo9EU2BE5Hptjmq4z8ZUMcMnwXPCEpq87otYG9gqevXjXKnSqHZaxNjLVPHetGOwR9VOwcptUIXzHiQusNbGAA99njFb9JA_7Hn10L0nVaFkiuPnJdOjhn5orVwU8sA6PhzkuMKtvXedC788rT3L9UbzyJMLllJKfdc3wXSmQTiowrx6zooIEBiVlSst-IroNLsUCszcWmyE9-yMohhNX_BFrskIACq2vhZME-rLOSzTOt18p7UPzRDlgZ07yjXVgVEsvvX0Y0TWXL66G4JDHc9Mf2A0v-AXHPeWdTyqeB2OkjDkJlTfISEfQcDpMfNpXqE6N-agdhPThs3gnqv0JfBFKkI0Ye26rHjUx3W08pcpgolanU8lgZkpEhXABL7lr6iGBJIFBAgEGAGSBQQIBRgEoAYugAfB-ImmA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcA8gcFEPz3hAHSCA8IgGEQARgfMgKKAjoCgECACgHICwG4E-QD2BMM0BUBgBcBshccChoIABIUcHViLTExMDk0MDE5NjQ2MjM2NjQYAA&sigh=dVQgABBcgyc&uach_m=[UACH]&template_id=484

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4569349609&adk=2326741806&adf=3205953851&pi=t.ma~as.4569349609&w=640&lmt=1665370584&format=640x300&url=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F%3Futm_source%3Diref%26utm_placement%3DRWnewsletter%26utm_medium%3Demail&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665410861742&bpp=1&bdt=1440&idt=1&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D867106d61160b6c9-22b4b0dda6d70054%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MbyADlkn0RlwRTMZcKMKfzwuHe6Uw&gpic=UID%3D0000057649a3ca06%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MYih3xMQ1vc46x04ozbfApuVR_C2w&prev_fmts=0x0%2C1600x1200%2C640x300&nras=2&correlator=3409364873373&rume=1&frm=20&pv=1&ga_vid=1820485934.1665410861&ga_sid=1665410861&ga_hid=1530091123&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=294&ady=2693&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531706%2C21066428%2C44772928%2C31061691%2C31061693&oid=2&pvsid=2143541351964157&tmod=1384303463&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=j1fUCfNGgG&p=https%3A//www.rightwing.org&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:806::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4569349609&adk=2326741806&adf=3205953851&pi=t.ma~as.4569349609&w=640&lmt=1665370584&format=640x300&url=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F%3Futm_source%3Diref%26utm_placement%3DRWnewsletter%26utm_medium%3Demail&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665410861742&bpp=1&bdt=1440&idt=1&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D867106d61160b6c9-22b4b0dda6d70054%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MbyADlkn0RlwRTMZcKMKfzwuHe6Uw&gpic=UID%3D0000057649a3ca06%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MYih3xMQ1vc46x04ozbfApuVR_C2w&prev_fmts=0x0%2C1600x1200%2C640x300&nras=2&correlator=3409364873373&rume=1&frm=20&pv=1&ga_vid=1820485934.1665410861&ga_sid=1665410861&ga_hid=1530091123&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=294&ady=2693&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531706%2C21066428%2C44772928%2C31061691%2C31061693&oid=2&pvsid=2143541351964157&tmod=1384303463&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=j1fUCfNGgG&p=https%3A//www.rightwing.org&dtd=4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Mon, 10 Oct 2022 14:07:42 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/5648561895701671135/ Frame CB97 9 KB
9 KB 20ms
19ms Image
image/jpeg 2607:f8b0:4006:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/5648561895701671135/downsize_200k_v1?w=200&h=200

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4569349609&adk=2326741806&adf=3205953851&pi=t.ma~as.4569349609&w=640&lmt=1665370584&format=640x300&url=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F%3Futm_source%3Diref%26utm_placement%3DRWnewsletter%26utm_medium%3Demail&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665410861742&bpp=1&bdt=1440&idt=1&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D867106d61160b6c9-22b4b0dda6d70054%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MbyADlkn0RlwRTMZcKMKfzwuHe6Uw&gpic=UID%3D0000057649a3ca06%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MYih3xMQ1vc46x04ozbfApuVR_C2w&prev_fmts=0x0%2C1600x1200%2C640x300&nras=2&correlator=3409364873373&rume=1&frm=20&pv=1&ga_vid=1820485934.1665410861&ga_sid=1665410861&ga_hid=1530091123&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=294&ady=2693&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531706%2C21066428%2C44772928%2C31061691%2C31061693&oid=2&pvsid=2143541351964157&tmod=1384303463&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=j1fUCfNGgG&p=https%3A//www.rightwing.org&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2001 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8ec3479d60996e43e57f2461d66180358dd5002391964b536c249c0835038533

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 10:35:01 GMT
x-content-type-options: nosniff
age: 358361
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9629
x-xss-protection: 0
last-modified: Thu, 14 Apr 2022 21:00:12 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 06 Oct 2023 10:35:01 GMT

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/12158002242740447626/ Frame CB97 37 KB
37 KB 20ms
20ms Image
image/jpeg 2607:f8b0:4006:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/12158002242740447626/downsize_200k_v1?w=600&h=314

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4569349609&adk=2326741806&adf=3205953851&pi=t.ma~as.4569349609&w=640&lmt=1665370584&format=640x300&url=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F%3Futm_source%3Diref%26utm_placement%3DRWnewsletter%26utm_medium%3Demail&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665410861742&bpp=1&bdt=1440&idt=1&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D867106d61160b6c9-22b4b0dda6d70054%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MbyADlkn0RlwRTMZcKMKfzwuHe6Uw&gpic=UID%3D0000057649a3ca06%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MYih3xMQ1vc46x04ozbfApuVR_C2w&prev_fmts=0x0%2C1600x1200%2C640x300&nras=2&correlator=3409364873373&rume=1&frm=20&pv=1&ga_vid=1820485934.1665410861&ga_sid=1665410861&ga_hid=1530091123&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=294&ady=2693&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531706%2C21066428%2C44772928%2C31061691%2C31061693&oid=2&pvsid=2143541351964157&tmod=1384303463&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=j1fUCfNGgG&p=https%3A//www.rightwing.org&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2001 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

72ab9860f43eab12a69343d3dd75781e9d41aa2239da9a468f026b1c4b32bdbe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Fri, 07 Oct 2022 11:21:27 GMT
x-content-type-options: nosniff
age: 269175
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37891
x-xss-protection: 0
last-modified: Thu, 14 Apr 2022 21:00:15 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 07 Oct 2023 11:21:27 GMT

GET
DATA 200
OK truncated
/ Frame CB97 221 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 613603afe8c5203c59d7f9df1cbac87109df7ffdf245fd20becfa6bd95b92155

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type: image/svg+xml

POST
H3 204 csi
csi.gstatic.com/ 0
17 B 38ms
38ms Ping
image/gif 2607:f8b0:400b:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&top=1&puid=5~l92umlos&c=2143541351964157&e=42531706%2C21066428%2C44772928%2C31061691%2C31061693&ctx=1&met.6=6.1_CgsYhBQgOCoECAgSAA
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20221003/r20110914/rum_fy2021.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400b:803::2003 Highland Park, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:42 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame 189A 0
17 B 39ms
39ms Ping
image/gif 2607:f8b0:400b:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~l92umlx1&chm=1&ctx=2&gqid=LSdEY--5Lo-boPMPh8Sz6AU&qqid=CMqCyfbq1foCFRMToQodrBwAZQ&met.4=fb.kw~lb.lk~cmrload.n2~ol.nq~bdt.-13z~bpp.-9~idt.-9~dtd.-1~dt.-a&met.3=733.mg~742.mg~748.mo~555.n5~739.n5~556.n5_2~738.nn~749.nn_2~736.nq~735.nv_1~113.qw_2~112.qw_2&met.1=1.l92uml65~6.0~7.0~8.0~9.0~10.0~12.1~13.kh~14.km~15.kk~16.n5~17.n5~18.n7~19.n8~20.n8~21.np~22.la~23.la&met.7=CAUQCBgBMOYFONYGaAFw4QV4mYYCgAHtgwKIAZfOBbABAbgBAw~CBIQBxgBIO0FKO0FMJIGOCVo7gVwkQZ4sAeAAYQFiAGWL6oBFAoSUm9ib3RvOjMwMCw0MDAsNzAwsAEBuAED~CBwQChgBIO0FKO0FMIIGOBVo7gVwgQZ4lwmAAesGiAHBDLABAbgBAw~CAkQChgBIO0FKO0FMIMGOBZo7gVwggZ48EyAAcRKiAHStwGwAQG4AQM~CB4QChgBIO0FKO0FMIkGOBxo9AVwiAZ4-wyAAc8KiAGxFbABAbgBAw~CBwQChgBIO4FKO4FMIQGOBZo7gVwgwZ4lD2AAeg6iAG7iQGwAQG4AQM~CBsQBhgBIO4FKO4FMJsGOC0~CCoQChgBIO4FKO4FMJ4GODA~CBsQChgBIO4FKO4FMIkGOBs~CBcQAhgBIPgFKPgFMI8GOBdo-AVwiwZ4n8wBgAHzyQGIAfPJAbABAbgBAw~CBwQBRgBIIcGKIcGMJ0GOBZoigZwnAZ4lgeAAeoEiAGWCbABAbgBAw~CCgQChgBINkGKNkGMPEGOBho2gZw7gZ437oBgAGzuAGIAZz3A7ABAbgBAw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400b:803::2003 Highland Park, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:42 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame FF46 1 KB
643 B 18ms
18ms Document
text/html 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4569349609&adk=2326741806&adf=3205953851&pi=t.ma~as.4569349609&w=640&lmt=1665370584&format=640x300&url=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F%3Futm_source%3Diref%26utm_placement%3DRWnewsletter%26utm_medium%3Demail&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665410861742&bpp=1&bdt=1440&idt=1&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D867106d61160b6c9-22b4b0dda6d70054%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MbyADlkn0RlwRTMZcKMKfzwuHe6Uw&gpic=UID%3D0000057649a3ca06%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MYih3xMQ1vc46x04ozbfApuVR_C2w&prev_fmts=0x0%2C1600x1200%2C640x300&nras=2&correlator=3409364873373&rume=1&frm=20&pv=1&ga_vid=1820485934.1665410861&ga_sid=1665410861&ga_hid=1530091123&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=294&ady=2693&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531706%2C21066428%2C44772928%2C31061691%2C31061693&oid=2&pvsid=2143541351964157&tmod=1384303463&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=j1fUCfNGgG&p=https%3A//www.rightwing.org&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 70812
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 09 Oct 2022 18:27:30 GMT
etag: 48472445140208031
expires: Mon, 10 Oct 2022 18:27:30 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame CB97 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dc4e8ab02c726abb1135463c594f24f5707a1ff7c8ecd71581ea5549ddcbdcc1

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame CB97 15 KB
16 KB 60ms
20ms Font
font/woff2 2607:f8b0:4006:80a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C700

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80a::2003 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Wed, 05 Oct 2022 19:31:57 GMT
x-content-type-options: nosniff
age: 412545
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 05 Oct 2023 19:31:57 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FF46
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEERVxQGVfBktotJXhtYKKGY&google_cver=1&google_push=AZmPxg-up8sSkWV594hMlMGqXA6WTbCgNh2ORLntq5V1h4UMci6q4CveoP...
https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=AZmPxg-up8sSkWV594hMlMGqXA6WTbCgNh2ORLntq5V1h4UMci6q4CveoPKjuF77_3NILKWwrUSI9tBQVFuigaO6dsNPu0PsLzO1&google_hm=4ir_IU...

170 B
188 B

62ms
61ms

Image
image/png

142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=AZmPxg-up8sSkWV594hMlMGqXA6WTbCgNh2ORLntq5V1h4UMci6q4CveoPKjuF77_3NILKWwrUSI9tBQVFuigaO6dsNPu0PsLzO1&google_hm=4ir_IUCUhSE8N-GnDH80vA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4569349609&adk=2326741806&adf=3205953851&pi=t.ma~as.4569349609&w=640&lmt=1665370584&format=640x300&url=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F%3Futm_source%3Diref%26utm_placement%3DRWnewsletter%26utm_medium%3Demail&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665410861742&bpp=1&bdt=1440&idt=1&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D867106d61160b6c9-22b4b0dda6d70054%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MbyADlkn0RlwRTMZcKMKfzwuHe6Uw&gpic=UID%3D0000057649a3ca06%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MYih3xMQ1vc46x04ozbfApuVR_C2w&prev_fmts=0x0%2C1600x1200%2C640x300&nras=2&correlator=3409364873373&rume=1&frm=20&pv=1&ga_vid=1820485934.1665410861&ga_sid=1665410861&ga_hid=1530091123&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=294&ady=2693&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531706%2C21066428%2C44772928%2C31061691%2C31061693&oid=2&pvsid=2143541351964157&tmod=1384303463&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=j1fUCfNGgG&p=https%3A//www.rightwing.org&dtd=4

Protocol

Server

142.250.72.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=0&google_nid=B765081F39B1F7&google_push=AZmPxg-up8sSkWV594hMlMGqXA6WTbCgNh2ORLntq5V1h4UMci6q4CveoPKjuF77_3NILKWwrUSI9tBQVFuigaO6dsNPu0PsLzO1&google_hm=4ir_IUCUhSE8N-GnDH80vA
pragma: no-cache
date: Mon, 10 Oct 2022 14:07:42 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FF46
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAZmPxg9dUQJa...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjEwMTAxNDA3NDIwMDAxMjgyODk3ODgxNA%3D%3D&google_push=AZmPxg9dUQJa-fX_zhEbjMtxFFg2L-HKF2jHeandf47o5Tp1AjzLOls6n4m-wAHoVk88WH...

170 B
188 B

37ms
36ms

Image
image/png

142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjEwMTAxNDA3NDIwMDAxMjgyODk3ODgxNA%3D%3D&google_push=AZmPxg9dUQJa-fX_zhEbjMtxFFg2L-HKF2jHeandf47o5Tp1AjzLOls6n4m-wAHoVk88WHoaO9uVBz-mH-SWNEbY5Q-HBUrEiBhReQ

Protocol

Server

142.250.72.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjEwMTAxNDA3NDIwMDAxMjgyODk3ODgxNA%3D%3D&google_push=AZmPxg9dUQJa-fX_zhEbjMtxFFg2L-HKF2jHeandf47o5Tp1AjzLOls6n4m-wAHoVk88WHoaO9uVBz-mH-SWNEbY5Q-HBUrEiBhReQ
pragma: no-cache
date: Mon, 10 Oct 2022 14:07:42 GMT
cache-control: max-age=0, no-cache, no-store
strict-transport-security: max-age=2628000
content-length: 0
expires: Mon, 10 Oct 2022 14:07:42 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FF46
Redirect Chain

https://odr.mookie1.com/t/v2/sync?tagid=V2_4530&src.visitorid=CAESEF6wA06EsRb-Vrg6KCYcB0Y&google_cver=1&google_push=AZmPxg89UbpMZOz1kJlyaGkLo90cPivMIiNDzJs2bpQ6btbGdyZ3iKSKbC837M0CPpj1TOo79bfuZJ6nz...
https://cm.g.doubleclick.net/pixel?google_nid=xaxis_dev_dmp&google_push=AZmPxg89UbpMZOz1kJlyaGkLo90cPivMIiNDzJs2bpQ6btbGdyZ3iKSKbC837M0CPpj1TOo79bfuZJ6nzKLoCA1YfH_NPuoCiJ2O&google_hm=MTA1OTY4MjkxOD...

170 B
188 B

109ms
109ms

Image
image/png

142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=xaxis_dev_dmp&google_push=AZmPxg89UbpMZOz1kJlyaGkLo90cPivMIiNDzJs2bpQ6btbGdyZ3iKSKbC837M0CPpj1TOo79bfuZJ6nzKLoCA1YfH_NPuoCiJ2O&google_hm=MTA1OTY4MjkxODk4MjY0NTYyMjE

Protocol

Server

142.250.72.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:42 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
location: https://cm.g.doubleclick.net/pixel?google_nid=xaxis_dev_dmp&google_push=AZmPxg89UbpMZOz1kJlyaGkLo90cPivMIiNDzJs2bpQ6btbGdyZ3iKSKbC837M0CPpj1TOo79bfuZJ6nzKLoCA1YfH_NPuoCiJ2O&google_hm=MTA1OTY4MjkxODk4MjY0NTYyMjE
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FF46
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=48g7gr1pSWuwHETgJ278kA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

60ms
60ms

Image
image/png

142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=48g7gr1pSWuwHETgJ278kA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AZmPxg_MRT0TUwX1nMcCQZuz7M2w0sbJDwYV_lTLUEKIakXRFSBFStB2iNoQrbvm3VuEIWr8WWdCWRMM3yaMlfDvJ4QQer3QMnd1rA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4569349609&adk=2326741806&adf=3205953851&pi=t.ma~as.4569349609&w=640&lmt=1665370584&format=640x300&url=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F%3Futm_source%3Diref%26utm_placement%3DRWnewsletter%26utm_medium%3Demail&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665410861742&bpp=1&bdt=1440&idt=1&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D867106d61160b6c9-22b4b0dda6d70054%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MbyADlkn0RlwRTMZcKMKfzwuHe6Uw&gpic=UID%3D0000057649a3ca06%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MYih3xMQ1vc46x04ozbfApuVR_C2w&prev_fmts=0x0%2C1600x1200%2C640x300&nras=2&correlator=3409364873373&rume=1&frm=20&pv=1&ga_vid=1820485934.1665410861&ga_sid=1665410861&ga_hid=1530091123&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=294&ady=2693&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531706%2C21066428%2C44772928%2C31061691%2C31061693&oid=2&pvsid=2143541351964157&tmod=1384303463&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=j1fUCfNGgG&p=https%3A//www.rightwing.org&dtd=4

Protocol

Server

142.250.72.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=48g7gr1pSWuwHETgJ278kA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AZmPxg_MRT0TUwX1nMcCQZuz7M2w0sbJDwYV_lTLUEKIakXRFSBFStB2iNoQrbvm3VuEIWr8WWdCWRMM3yaMlfDvJ4QQer3QMnd1rA
date: Mon, 10 Oct 2022 14:07:41 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FF46
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESENazlA3jzWsIGUx6POxzhbw&google_cver=1&google_push=AZmPxg_UrSFzylIy2-kDEs9jlKvUPk-4yAnpkcLVAHkbhVkedjD--FAhq5oU4IYYaMqP4xEWeUC...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDkyVU1NNUUtMVMtNVBOOA==&google_push=AZmPxg_UrSFzylIy2-kDEs9jlKvUPk-4yAnpkcLVAHkbhVkedjD--FAhq5oU4IYYaMqP4xEWeUCAQYgF02LISWAWgoPDVbD7iqh45w

170 B
188 B

36ms
36ms

Image
image/png

142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDkyVU1NNUUtMVMtNVBOOA==&google_push=AZmPxg_UrSFzylIy2-kDEs9jlKvUPk-4yAnpkcLVAHkbhVkedjD--FAhq5oU4IYYaMqP4xEWeUCAQYgF02LISWAWgoPDVbD7iqh45w

Protocol

Server

142.250.72.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:43 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDkyVU1NNUUtMVMtNVBOOA==&google_push=AZmPxg_UrSFzylIy2-kDEs9jlKvUPk-4yAnpkcLVAHkbhVkedjD--FAhq5oU4IYYaMqP4xEWeUCAQYgF02LISWAWgoPDVbD7iqh45w
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 9ef75ea4f1dd62e53c52f84d8070c378
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FF46
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESENROOsPCvcMEm2BqQc5ahv4&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESENROOsPCvcMEm2BqQc5ahv4&google_hm=Y0QnLmu47UNT52BpOxFZWAAAALYAAAAB&google_nid=index&google_push=AZmPxg8plRrBjXLnic_b5A_zSqeHrFBxohfGF...

170 B
188 B

37ms
37ms

Image
image/png

142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESENROOsPCvcMEm2BqQc5ahv4&google_hm=Y0QnLmu47UNT52BpOxFZWAAAALYAAAAB&google_nid=index&google_push=AZmPxg8plRrBjXLnic_b5A_zSqeHrFBxohfGFHfKl-ctUrt-TlyXcWOTTx0vc015mBEteXr8Zb5206KpelmZCyTYsU1iqXsXadTy

Protocol

Server

142.250.72.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:42 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rBxRpzdKPDNMoIIv5nboqj0MevR0kq82ipQthcfMFIiHgqd4mZaLpDXdV66bbBt7Wjzu3NYW79YEKV2tkileczAI5nj4qZxUNB5lPz2NhKq12sjzBM95BdsXycszCExSyTz8OnTkYOUyPQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESENROOsPCvcMEm2BqQc5ahv4&google_hm=Y0QnLmu47UNT52BpOxFZWAAAALYAAAAB&google_nid=index&google_push=AZmPxg8plRrBjXLnic_b5A_zSqeHrFBxohfGFHfKl-ctUrt-TlyXcWOTTx0vc015mBEteXr8Zb5206KpelmZCyTYsU1iqXsXadTy
cache-control: no-cache
cf-ray: 757fec845a5fa220-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FF46
Redirect Chain

https://cc.adingo.jp/adx/push/?google_gid=CAESEDW2xwOFl2H1UqFJmWbU4a0&google_cver=1&google_push=AZmPxg8Xu3yAVnA3GVuRoLKEnvrGa4SWZ8oob6zdzKd93p0Wo0CIm8aUMMnZFsyUshJ5FCctkBQ5OHJsLs1omLlpJnEl78IjVTdR9Q
https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AZmPxg8Xu3yAVnA3GVuRoLKEnvrGa4SWZ8oob6zdzKd93p0Wo0CIm8aUMMnZFsyUshJ5FCctkBQ5OHJsLs1omLlpJnEl78IjVTdR9Q&google_hm=f628fcef6bf2442b7...

170 B
188 B

135ms
135ms

Image
image/png

142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AZmPxg8Xu3yAVnA3GVuRoLKEnvrGa4SWZ8oob6zdzKd93p0Wo0CIm8aUMMnZFsyUshJ5FCctkBQ5OHJsLs1omLlpJnEl78IjVTdR9Q&google_hm=f628fcef6bf2442b7322e0350d92ff60

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4569349609&adk=2326741806&adf=3205953851&pi=t.ma~as.4569349609&w=640&lmt=1665370584&format=640x300&url=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F%3Futm_source%3Diref%26utm_placement%3DRWnewsletter%26utm_medium%3Demail&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665410861742&bpp=1&bdt=1440&idt=1&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D867106d61160b6c9-22b4b0dda6d70054%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MbyADlkn0RlwRTMZcKMKfzwuHe6Uw&gpic=UID%3D0000057649a3ca06%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MYih3xMQ1vc46x04ozbfApuVR_C2w&prev_fmts=0x0%2C1600x1200%2C640x300&nras=2&correlator=3409364873373&rume=1&frm=20&pv=1&ga_vid=1820485934.1665410861&ga_sid=1665410861&ga_hid=1530091123&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=294&ady=2693&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531706%2C21066428%2C44772928%2C31061691%2C31061693&oid=2&pvsid=2143541351964157&tmod=1384303463&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=j1fUCfNGgG&p=https%3A//www.rightwing.org&dtd=4

Protocol

Server

142.250.72.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=fluct_eb&google_push=AZmPxg8Xu3yAVnA3GVuRoLKEnvrGa4SWZ8oob6zdzKd93p0Wo0CIm8aUMMnZFsyUshJ5FCctkBQ5OHJsLs1omLlpJnEl78IjVTdR9Q&google_hm=f628fcef6bf2442b7322e0350d92ff60
date: Mon, 10 Oct 2022 14:07:42 GMT
content-type: text/html; charset=UTF-8
server: nginx
p3p: CP=NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa HISa OUR SAMa OTRa STP UNI STA

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame FF46 0
12 B 35ms
34ms Image
text/html 142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13I9wPCuMHruoQW457SGjB0MGMUTGKCKREApyxW4mCDihx9DXKh1UZ2o1y68EghmcBmovLC6

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4569349609&adk=2326741806&adf=3205953851&pi=t.ma~as.4569349609&w=640&lmt=1665370584&format=640x300&url=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F%3Futm_source%3Diref%26utm_placement%3DRWnewsletter%26utm_medium%3Demail&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665410861742&bpp=1&bdt=1440&idt=1&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D867106d61160b6c9-22b4b0dda6d70054%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MbyADlkn0RlwRTMZcKMKfzwuHe6Uw&gpic=UID%3D0000057649a3ca06%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MYih3xMQ1vc46x04ozbfApuVR_C2w&prev_fmts=0x0%2C1600x1200%2C640x300&nras=2&correlator=3409364873373&rume=1&frm=20&pv=1&ga_vid=1820485934.1665410861&ga_sid=1665410861&ga_hid=1530091123&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=294&ady=2693&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531706%2C21066428%2C44772928%2C31061691%2C31061693&oid=2&pvsid=2143541351964157&tmod=1384303463&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=j1fUCfNGgG&p=https%3A//www.rightwing.org&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.72.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 14:07:42 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 gnLtmcL-mn53pq-EJRMXOCFACjpZd0iqiIv80oTeKas.js Show response
pagead2.googlesyndication.com/bg/ Frame 072F 36 KB
16 KB 18ms
18ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/gnLtmcL-mn53pq-EJRMXOCFACjpZd0iqiIv80oTeKas.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4569349609&adk=2326741806&adf=3205953851&pi=t.ma~as.4569349609&w=640&lmt=1665370584&format=640x300&url=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F%3Futm_source%3Diref%26utm_placement%3DRWnewsletter%26utm_medium%3Demail&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665410861742&bpp=1&bdt=1440&idt=1&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D867106d61160b6c9-22b4b0dda6d70054%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MbyADlkn0RlwRTMZcKMKfzwuHe6Uw&gpic=UID%3D0000057649a3ca06%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MYih3xMQ1vc46x04ozbfApuVR_C2w&prev_fmts=0x0%2C1600x1200%2C640x300&nras=2&correlator=3409364873373&rume=1&frm=20&pv=1&ga_vid=1820485934.1665410861&ga_sid=1665410861&ga_hid=1530091123&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=294&ady=2693&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531706%2C21066428%2C44772928%2C31061691%2C31061693&oid=2&pvsid=2143541351964157&tmod=1384303463&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=j1fUCfNGgG&p=https%3A//www.rightwing.org&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8272ed99c2fe9a7e77a6af842513173821400a3a597748aa888bfcd284de29ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 21:41:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 318347
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16010
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 16:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 06 Oct 2023 21:41:55 GMT

GET
H3 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame CB97 63 KB
23 KB 19ms
19ms Script
text/javascript 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1109401964623664&output=html&h=300&slotname=4569349609&adk=2326741806&adf=3205953851&pi=t.ma~as.4569349609&w=640&lmt=1665370584&format=640x300&url=https%3A%2F%2Fwww.rightwing.org%2Fbiden-sends-thank-you-message-to-man-before-firing-him%2F%3Futm_source%3Diref%26utm_placement%3DRWnewsletter%26utm_medium%3Demail&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665410861742&bpp=1&bdt=1440&idt=1&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D867106d61160b6c9-22b4b0dda6d70054%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MbyADlkn0RlwRTMZcKMKfzwuHe6Uw&gpic=UID%3D0000057649a3ca06%3AT%3D1665410860%3ART%3D1665410860%3AS%3DALNI_MYih3xMQ1vc46x04ozbfApuVR_C2w&prev_fmts=0x0%2C1600x1200%2C640x300&nras=2&correlator=3409364873373&rume=1&frm=20&pv=1&ga_vid=1820485934.1665410861&ga_sid=1665410861&ga_hid=1530091123&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=294&ady=2693&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531706%2C21066428%2C44772928%2C31061691%2C31061693&oid=2&pvsid=2143541351964157&tmod=1384303463&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=j1fUCfNGgG&p=https%3A//www.rightwing.org&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

920b3418bd27c0a767e254c03fe306e969e631a33a871793ad7691e666983980

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 13:13:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3272
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23603
x-xss-protection: 0
server: cafe
etag: 16686504336640218216
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Mon, 10 Oct 2022 14:13:10 GMT

POST
H3 204 csi
csi.gstatic.com/ 0
17 B 41ms
41ms Ping
image/gif 2607:f8b0:400b:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&top=1&puid=6~l92umlww&c=2143541351964157&e=42531706%2C21066428%2C44772928%2C31061691%2C31061693&ctx=1&met.3=779.et~782.ex~1001.ew_1__1~164.ey~165.ev_4~166.el_p~779.fd~166.fc_3~779.fg~166.ff_2~779.fk~166.fk_2~1032.k4~326.k7_2~832.ka~868.ka~216.k3_7~215.k3_7~843.k3_8~889.km_1~639.kr~914.kr~112.ms_2~246.n5_2~629.nw_1~246.sk_1~429.yw_1~210.119_1~1032.11d~326.11d~832.11e~868.11e~164.11c_2~165.11b_4~466.11a_4~522.119_5~525.11j_5~639.11p~914.11p~168.197~168.197~168.197_1~168.197_1~168.19z~168.19z~168.19z~168.19z~1032.1ab~326.1ac~832.1ac~868.1ac~164.1ab_2~165.1aa_3~889.1af~639.1ak~914.1ak~1032.1al~326.1am~832.1am~868.1am~164.1al_1~165.1al_2~889.1ao~639.1aq~914.1aq~1032.1ar~326.1as~832.1as~868.1as~164.1ar_1~165.1ar_2~889.1at~639.1aw~914.1aw~113.1bd_4~246.1dd~168.1mi~168.1mi~168.1mj~168.1mj~168.1mj~168.1mj~168.1mj~168.1mj~168.1mj~168.1mj~168.1mj~168.1mj_1~168.1mj_1~246.1t6_1~168.1w5~168.1w5~168.1w5~168.1w5~168.1w5~168.1w5~168.1w5~168.1w5~168.1w5~168.1w5~168.1w5~168.1w5~168.1w5~246.21a_1~168.22a~168.22a~168.22a~168.22a~168.22a~168.22a~168.22a~168.22a~168.22a~168.22a~168.22a~168.22a~168.22a&met.7=CBsQCMABlIroww0~CBsQByDyATgfwAHWn-RN~CBsQByDyATgdwAHg-rWNCw~CBsQByDyATgcwAHQ65nvCg~CBsQByDyATghwAGGqMOoDw~CBsQByDyATgxwAGOurjPDQ~CBsQByDyATgywAGh1rTkDA~CBsQCiDyATgfwAHVh_GBDQ~CBsQCiDyATgzwAHi56WUDQ~CBsQCiDyATgzwAG0wKqfBw~CBsQCiDzATgzwAGXhaKqBw~CAEQChgBIPMBKPMBMN0DOOoBQNYCSNgCUNgCWIwDYO0CaIwDcMADePatA4AByqsDiAGZkwqwAQG4AQPAAd6Ov5sB~CBsQBiDzATiCAcAB0ub30wk~CBsQBiDzATiJAcAB9_rMsQM~CBsQBiDzATiPAcABirTJyg0~CAEQChgBIPMBKPMBMOIDOO8BQNcCSNkCUNkCWIwDYO0CaI0DcMQDeIWuA4AB2asDiAG8kwqwAQG4AQPAAd6Ov5sB~CBsQCiDzATi7AcAB3dLLkgQ~CBsQBiDzATiEAcABw4iHhw4~CBsQBiDzATiDAcABjNzysww~CBsQBiDzATiFAcAB2PqZtQQ~CBsQBiDzATiTAcAB3vTSyAQ~CBsQBiDzATiDAcABi4Sz8gw~CBsQBiDzATiGAcABpY_Mogs~CBsQBiDzATiVAcABkc6iqwU~CBsQBiDzATiWAcAB1d2O0Qw~CBsQBiDzATiGAcABgt7Pmgg~CBsQBiDzATiJAcAB4Lvaow4~CBsQBiDzATiRAcAB_8PAzQU~CBsQBiDzATiUAcABt8bw2gI~CBsQBiD0ATiRAcABo-SJ1Qg~CBsQBiD0ATiRAcABy4nFpQI~CBsQBiD0ATiSAcAB277e8Qs~CBsQBiD0ATiUAcABoa-j6A4~CBsQBiD0ATiKAcABhZLH1wM~CBsQBiD0ATiQAcAB_aKKrgw~CBsQBiD0ATiQAcAB34Ldjw8~CBsQBiD0ATiWAcABzPjd0AE~CBsQCiD0AThWwAHR8sGNCw~CBsQCiD0AThcwAHhlarfBQ~CBsQCiD0ATiNAcAB6oG2ugQ~CBsQCiCRAjhtwAG5gZWGBA~CBsQChgBINACKNACMMsDOHvAAdWe06YM~CBsQAiDaAjgnwAH1nriSCw~CBsQCiDnAjhBwAGMr9bEDA~CBsQBSDeAzjYAcABkJ6ycA~CBsQBSDhAziMAsAByZy3sgw~CBsQBSDyAzgrwAGsk_-2Bg~CAMQChgBIJgEKJgEMLsFOKIBaJkEcPQEeJ3ZB4AB8dYHiAGc5BWwAQG4AQPAAY_P4YQK~CAwQBRgBIKYEKKYEMO4EOEhApwRIpwRQpwRY1QRgugRo1gRw7QR48CSAAcQiiAH5TLABAbgBA8AB8disxgo~CBsQCiDOBDhSwAH0sr-_BA~CBsQCiDQBDhJwAHZ67DzCg~CBsQCiDRBDhDwAHC-6OYDQ~CBsQCiCpBThRwAGT3PGuAw~CBwQChgBINgFKNgFMIkGODFo2QVw_wV4260BgAGvqwGIAZ-4A7ABAbgBA8AB0YPkhQo~CBsQChgBIN0FKN0FMK4GOFFA3gVI3gVQ3gVYiwZg8AVoiwZwrQZ4pwSAAfsBiAGJA7ABAbgBA8AB5Krg8AI~CBsQBiCYBjg8wAGy5M_6Cw~CC8QBxgBIOMFKOMFML4GOFtA4wVI5AVQ5AVYkQZg9gVokQZwvQZ4kAOAAWSIAWuwAQG4AQPAAfGR6JoJ~CC8QBxgBIOMFKOMFML0GOFpA5AVI5QVQ5QVYkwZg9wVokwZwvQZ4kAOAAWSIAWuwAQG4AQPAAZv_iccH~CBsQCiCvBjgTwAHjoOz0Aw~CBsQBSDtBjgUwAHmyuX9Ag~CBsQDSCmBjisAcABpv3b2gM~CBsQARgBIMMGKMMGMMgHOIUBwAGkoPylBw~CBsQDSCzBTjQAsABgJHyhwg~CBsQARgBIIQIKIQIMPsIOHfAAaSg_KUH~CCgQDRgBIIwIKIwIMN0IOFHAAeKygLkD~CBsQBhgBIIUJKIUJMN0JOFhAhQlIhglQhglYtQlgmAlotQlw3Al41gKAASqIASqwAQG4AQPAAYHhjLgJ~CAUQBRgBIOoFKOoFMOAJOPUDQO0FSO0FUO0FWJUGYO0FaJcGcNIJeNLXAoABptUCiAGIqwmwAQG4AQPAAZDHsvAI~CBsQBhgBIIUJKIUJMOEJOFxAhQlIhglQhglYtQlgmAlotQlw4Al41gKAASqIASqwAQG4AQPAAf_m6MwL~CBwQChgBIOkJKOkJMLQKOEto6Qlwnwp4lbADgAHprQOIAaC0CbABAbgBA8AB6ry1wQw~CBsQBSCYCjgrwAGy5M_6Cw~CAwQBRgBIMgKKMgKMOEKOBloygpw4Ap48CSAAcQiiAH5TLABAbgBA8ABjYzjzww~CC8QBxgBIMUKKMUKMKMLOF1QxgpY8wpgxgpo8wpwoQt4kAOAAWSIAWuwAQG4AQPAAfGR6JoJ~CC8QBxgBIMYKKMYKMKILOF1QxwpY8Qpgxwpo8QpwoQt4kAOAAWSIAWuwAQG4AQPAAZv_iccH~CBsQCDibDcABlIroww0~CC8QBxgBIIUNKIUNMLANOCtohg1wrw14kAOAAWSIAWuwAQG4AQPAAfGR6JoJ~CC8QBxgBIIYNKIYNMK0NOCdohg1wrA14kAOAAWSIAWuwAQG4AQPAAZv_iccH~CCcQDRgBIJsNKJsNMPgNOF1Qmw1Yww1gmw1oww1w8w14nlqAAfJXiAHpc7ABAbgBA8AB8_LLrgs~CBsQARgBIPENKPENMJkOOCjAAaSg_KUH~CCcQChgBIPkNKPkNMLUOOD3AAeLBm9oF~CCcQBRgBILsOKLsOMNAOOBXAAZmVn6AL~CBsQBRgBILwOKLwOMJAPOFTAAc_G2uIB~CAUQBRgBIJcNKJcNMJYQOP8CaJkNcJEQeI34AYAB4fUBiAGD4gSwAQG4AQPAAZDHsvAI~CBsQARgBIKoSKKoSMNISOCjAAaSg_KUH~CAUQBRgBIIsNKIsNMPESOOYFaI0NcOwSeJmGAoAB7YMCiAGXzgWwAQG4AQPAAZDHsvAI~CAUQBRgBIJINKJINMPATON4GaJMNcOwTeKOFAoAB94ICiAGmuQWwAQG4AQPAAZDHsvAI~CBwQBhgBIO4TKO4TMNkUOGzAAaHZ1rIJ~CBsQARgBIM8UKM8UMPYUOCfAAaSg_KUH&met.1=1.l92umjvm~6.46~7.47~8.47~9.47~10.52~11.4h~12.52~13.6i~14.6k~15.6l~16.cz~17.cz~18.d4~19.1a9~20.1a9~21.1ay~22.a1~23.c2
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20221003/r20110914/rum_fy2021.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400b:803::2003 Highland Park, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.rightwing.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:42 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame CB97 0
17 B 61ms
60ms Ping
image/gif 2607:f8b0:400b:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~l92umm2d&chm=1&ctx=2&gqid=LSdEY8zqLvSYoPMPgeaM6A8&qqid=CO_iyfbq1foCFQ9_wQodnt8MVA&met.4=fb.o7~lb.r3~cmrload.s8~ol.ty~bdt.-145~bpp.-4~idt.-4~dtd.-1~dt.-5&met.3=733.r6~742.r6~748.rg~739.rl~555.ru~556.ru_1~738.tw~749.tw_2~735.u3_1~113.w2_1~112.w1_2&met.1=1.l92uml6b~6.1~7.1~8.1~9.1~10.1~12.2~13.nv~14.ny~15.ny~16.rl~17.rl~18.rm~19.to~20.to~21.tz&met.7=CAUQCBgBMN4GOLYIaAFw2wZ4o4UCgAH3ggKIAaa5BbABAbgBAw~CBIQBxgBIOQGKOQGMIgHOCRo5AZwhwd4_QaAAdEEiAGwH6oBEAoOUm9ib3RvOjQwMCw3MDCwAQG4AQM~CBwQChgBIOQGKOQGMPoGOBZo5gZw-QZ4lwmAAesGiAHBDLABAbgBAw~CAkQChgBIOQGKOQGMPwGOBho5wZw-gZ48EyAAcRKiAHStwGwAQG4AQM~CB4QChgBIOQGKOQGMIEHOB1o7AZw_gZ4-wyAAc8KiAGxFbABAbgBAw~CBwQChgBIOQGKOQGMPwGOBho5wZw-wZ4lD2AAeg6iAG7iQGwAQG4AQM~CBsQBhgBIOQGKOQGMJAHOCw~CCoQChgBIOQGKOQGMLUHOFA~CBsQChgBIOUGKOUGMIEHOBw~CCEQBBgBIO0GKO0GMIkIOJwBaO0GcIgIeKwCsAEBuAED~CBcQAhgBIKwHKKwHMMAHOBVorAdwvwd4yU2AAZ1LiAGdS7ABAbgBAw~CBcQAhgBIKwHKKwHMMUHOBlorQdwwQd4r6oCgAGDqAKIAYOoArABAbgBAw~CBwQBRgBIM0HKM0HMOEHOBRozgdw4Ad4lgeAAeoEiAGWCbABAbgBAw~CCgQChgBILgIKLgIMM8IOBdouAhwzAh437oBgAGzuAGIAZz3A7ABAbgBAw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400b:803::2003 Highland Park, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:42 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame CB97 0
17 B 59ms
59ms Ping
image/gif 2607:f8b0:400b:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=2~l92umm2f&chm=1&ctx=2&gqid=LSdEY8zqLvSYoPMPgeaM6A8&qqid=CO_iyfbq1foCFQ9_wQodnt8MVA&met.6=6.1_CgsY8gYgOCoECAgSAA
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:400b:803::2003 Highland Park, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:42 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 2168 42 B
64 B 43ms
43ms Fetch
image/gif 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstrtd8pa3N1ihsCy5BQjXJrUGdBLxAfFaY-zotLo_P1a0NdPjxDwty6tVHpQ4B0ErkVT_18yjsZREDEpj4iTqWTdeelon7a_h6bpG6f93epdzitxxEdZYBRsn4aAXph1xK7ZbM&sai=AMfl-YRl2IVOBG0XT6XSk3_YI70uWD2X9MgDu8wj8urk9V2ydLTTVG__eHyAklJMXaZDYhbrd0DTxFeRWj51dO2pntTitW0K7yez4EXRIabyIOiWG6QMXuEpkhSl9OZxCEg&sig=Cg0ArKJSzP3q5uNY6IKtEAE&cid=CAASFeRonesK2BlZ6_MSa7ItPB2oFd0npQ&id=lidar2&mcvt=1000&p=0,0,250,300&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20221005&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=4&adk=642246285&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1665410861753&rpt=471&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:43 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 189A 42 B
64 B 45ms
44ms Fetch
image/gif 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsveaK2Jh1Zt_INhkiXYGQCG0dSfpXY59AO0n901AkYZV0vLHyOUh703RDGwGH6WXbUcqGAEpEDhwZenvayfY1U3n9GzlB-EMq6_rJkz-UT1NTEFSTELUDmnbB7I8atjoPQmdUI&sai=AMfl-YSXCQy9XM_V2PX-C31tL_ZQCgvn9tv1gOAnDWAEESpQtiwwUbCgzu-NDnWNUSqbuyl3GA2EdaM9aeOAoh-2dVt5Pel5eUmHUmcWrP-PVfBtu37SMCWr7LJV438OtIs&sig=Cg0ArKJSzI_tfiCoKJmCEAE&cid=CAASFeRoe4AKwriQ2KNLmfrWUt7rgsK1LQ&id=lidar2&mcvt=1000&p=0,0,300,640&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20221005&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=2326741806&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1665410861741&rpt=851&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 14:07:43 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

202 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

37 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.rightwing.org/	1970-01-20 08:46:26	Name: _gcl_au Value: 1.1.97209975.1665410861
.rightwing.org/	1969-12-31 23:59:59	Name: _li_dcdm_c Value: .rightwing.org
.rightwing.org/	1970-01-20 16:12:50	Name: _lc2_fpi Value: 21abd367d78b--01gf13j1nzcd00z72dfv47taer
.rightwing.org/	1970-01-20 16:12:50	Name: _ga Value: GA1.2.1820485934.1665410861
.rightwing.org/	1970-01-20 06:38:17	Name: _gid Value: GA1.2.242077969.1665410861
.rightwing.org/	1970-01-20 06:36:50	Name: _gat_UA-129295169-1 Value: 1
.lockerdome.com/	1970-01-20 15:22:26	Name: account_id Value: 15499806089101824
.lockerdome.com/	1969-12-31 23:59:59	Name: ldrid Value: bqGRk1ybS4Nn30Y%2FVqJHN4yapaiCX341LJX6ZOqShU8CSF8kA5%2FFuoDvuKmjXHDfNFL%2BtpeKK3ulyYvlc3DEIXVKN4TtZS%2FGuljmXMwrP%2F65tEqK7ftieH6ahK7RFupV
.lockerdome.com/	1970-01-20 15:22:26	Name: login_token Value: %2215499806089101824%7C1673186860699%3A%7Call%7CcmAdshuLvc8Qr1Bw8vzO1XyfpYZMyGvDhXdXr5kKD5mJ4QoZx3yBqz6hQ44U4SqsRHqi7fV3GiRwRbxPwo%2FSoQ%3D%3D%22
.rightwing.org/	1970-01-20 08:46:26	Name: _fbp Value: fb.1.1665410860856.543017217
.rightwing.org/	1970-01-20 15:58:26	Name: __gads Value: ID=867106d61160b6c9-22b4b0dda6d70054:T=1665410860:RT=1665410860:S=ALNI_MbyADlkn0RlwRTMZcKMKfzwuHe6Uw
.rightwing.org/	1970-01-20 15:58:26	Name: __gpi Value: UID=0000057649a3ca06:T=1665410860:RT=1665410860:S=ALNI_MYih3xMQ1vc46x04ozbfApuVR_C2w
.liadm.com/	1970-01-20 16:12:50	Name: lidid Value: ad6a49d1-90fa-4587-be12-81ae98089e97
.openx.net/	1970-01-20 15:22:26	Name: i Value: 711cce01-54cb-4fc4-a127-be889480cd85\|1665410862
.mookie1.com/	1970-01-20 16:05:38	Name: id Value: 10596829189826456221
.mookie1.com/	1970-01-20 16:05:38	Name: mdata Value: 1\|10596829189826456221\|1665410862263
.mookie1.com/	1970-01-20 16:05:38	Name: ov Value: 10642ad45ea39a8b3b306564c002a1d0
.pubmatic.com/	1970-01-20 06:38:17	Name: KTPCACOOKIE Value: YES
.adingo.jp/	1970-01-20 07:20:02	Name: ID Value: f628fcef6bf2442b7322e0350d92ff60
.quantserve.com/	1970-01-20 08:46:26	Name: d Value: EBkBCQGmJ4EA
.quantserve.com/	1970-01-20 16:07:05	Name: mc Value: 6344272e-48a38-72982-95cf4
.pubmatic.com/	1970-01-20 08:46:26	Name: KADUSERCOOKIE Value: E3C83B82-BD69-496B-B01C-44E0276EFC90
.doubleclick.net/	1970-01-20 06:36:54	Name: DSID Value: NO_DATA
.casalemedia.com/	1970-01-20 15:22:26	Name: CMID Value: Y0QnLmu47UNT52BpOxFZWAAA
.casalemedia.com/	1970-01-20 08:46:26	Name: CMPS Value: 182
.casalemedia.com/	1970-01-20 08:46:26	Name: CMPRO Value: 182
.doubleclick.net/	1970-01-20 16:12:50	Name: IDE Value: AHWqTUkrNYYuqnE7aaEZTJo0KSyv7zzZ9JN7B2mXxGXE0T-78z_LuqnrP6WuhNEDYM8
.e.dlx.addthis.com/	1970-01-20 16:07:05	Name: na_tc Value: Y
.casalemedia.com/	1970-01-20 08:46:26	Name: CMTS Value: 101
.addthis.com/	1970-01-20 16:07:05	Name: na_tc Value: Y
.dlx.addthis.com/	1970-01-20 07:20:02	Name: na_rn Value: 0
.dlx.addthis.com/	1970-01-20 07:20:02	Name: na_sr Value: 20221010
.dlx.addthis.com/	1970-01-20 06:36:50	Name: na_srp Value: 3614
.dlx.addthis.com/	1970-01-20 07:20:02	Name: na_sc_e Value: 0
.addthis.com/	1970-01-20 16:07:05	Name: na_id Value: 2022101014074200012828978814
.addthis.com/	1970-01-20 16:07:05	Name: uid Value: 6344272eee5c1b22
.addthis.com/	1970-01-20 16:07:05	Name: ouid Value: 6344272e000116e4968f5cfd86f5488677be9e188867f948671b

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.ca
adservice.google.com
b-code.liadm.com
cc.adingo.jp
cdn.syndication.twimg.com
cdn1.lockerdomecdn.com
cdn2.lockerdomecdn.com
cm.g.doubleclick.net
cms.quantserve.com
connect.facebook.net
csi.gstatic.com
e.dlx.addthis.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
image6.pubmatic.com
lockerdome.com
odr.mookie1.com
pagead2.googlesyndication.com
partner.googleadservices.com
pbs.twimg.com
pixel.rubiconproject.com
platform.twitter.com
rp.liadm.com
rp4.liadm.com
rtb.openx.net
securepubads.g.doubleclick.net
ssum-sec.casalemedia.com
stats.g.doubleclick.net
syndication.twitter.com
tpc.googlesyndication.com
trk.cp20.com
www.facebook.com
www.google-analytics.com
www.google.ca
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.rightwing.org
104.154.142.214
104.18.18.126
104.244.42.136
142.250.72.98
184.50.205.90
199.232.36.157
216.24.224.100
2600:1f18:730:b140:e92e:bb73:a654:a315
2600:9000:20ed:c000:8:8845:1500:93a1
2600:9000:21dd:9600:b:6268:b880:93a1
2600:9000:2512:f000:a:cbb7:a940:93a1
2606:2800:220:13d:2176:94a:948:148e
2606:4700:10::ac43:1c08
2607:f8b0:4004:c1b::9a
2607:f8b0:4006:806::2002
2607:f8b0:4006:809::2002
2607:f8b0:4006:809::2003
2607:f8b0:4006:80a::2003
2607:f8b0:4006:80b::2008
2607:f8b0:4006:80d::2002
2607:f8b0:4006:816::2002
2607:f8b0:4006:816::2003
2607:f8b0:4006:81d::200e
2607:f8b0:4006:81f::2001
2607:f8b0:4006:820::2002
2607:f8b0:4006:821::2004
2607:f8b0:4006:823::200a
2607:f8b0:400b:803::2003
2620:116:800b:21:a021:b886:81cc:55cf
2a03:2880:f012:8:face:b00c:0:1
2a03:2880:f112:83:face:b00c:0:25de
3.225.218.147
35.186.253.211
35.190.90.30
52.207.19.117
8.28.7.81
8.43.72.98
00a92494627ed8f758972b7dc47b3af186497c0637ea867a33fdb604c1548674
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
03f4b4c697512d4338998beaa499614dc197d44ab12eb74fabad7fab5a9ebfbe
099f342bcdd01d03cacd2d665bb82ed11b7110f74768ec40774de44140481a38
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
1008e0fea1bcea71d721ce0187eba5979aee7626901ea11940898b0db51320c0
1270f79e995bae3e90354d46e3d809106d82090ec50c8a7a391ec50d24774a8d
17305d5998d98b01e352360f235f9a9f7c573adeedb30815b1ad82d0baef0c6f
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1a746b0004e187b2874ed7f3fcbb6d6468fd02fdcb1e70292faa45c07d150e01
1c31106f082313d65105d241541d5924743c4ef0edc6ae0ef3b71535af68a5f4
240fa12b094a1a37ff12b65e724a086c4e615f45f41a29617d7293ab0d58a540
251feee5dacd7cd6acb23ff9f266b3a4a5407369b24a56b97dc041ccf918adc6
2995089b59d69bc45f3a246e92b58fca37ccac9927db931374132d67da6b6856
2c838363a436edd65ce14a47a13b01410ed28828744717be7f94bec77e09d7f9
3507a0fdbd185a707bae36b35022393bae7c170083ecb9df30cd00abc9853ee7
368c875fab543097349c9ed14e93c6c41ed2b26b72ba01d1ecd75ea4acd243df
37249fb532fc1e5cbace0e818a6269ed1258c628c2bfdaa86382b9092d8451b7
37cd36086f28dca56d9b2346fc97a4138568e1b0ddf1f2c035bbeecd1cb33b42
38e07eea34e6d29147f6995c529cb6e0c9b988373b953e2e0fc72a9021a29a9e
38f200a6187e70ab6a45089eb0d4154f6e94e680c5f178e42c7955c9a4feb39e
39ea310e86ee5d4b745f48121268b8848ebbc92d2b9a1a791c36c7a03512b101
3a759e23c654a2e7137251caab80927cd535d1b6154b11b931d0b3b1f084069c
3c308940af700950ec8a9ac2fb2bd1de8d3a426531446e3cbc3d5d51f2dd3b9c
3ed2e42d3ce5e24dcb11cddde4126e4f07c3afc590f708ad2cfbf7669002f92e
3f4574cb0add24e704e9a6fa7f6ccf890b3ed7fa9d689486700dfab8c61e1666
4135c004ce36152b8f49f88b21366d7b589b906390a8cb78d38f41e357f88709
478f453884226671699bb70c45c8a93551d353066b6613f5d6934fd083c8f849
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
4fbc0c4def1cd0b37241266c7a7c30169fb96388d3eadd055031a5f14670695f
53d87ed8b9dea593a1d49c88373b68f9212b739588e032d5d070687c854984a4
55460e7a9b69d3b241020d790d2d51ef396008c58d0a2e1530382f4e85503e75
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5a1d53c953f6cb274ab08d0b4f72060a87585df1c3b362b8e3018353b7fb6546
5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
5f241a6bf75de189509c53e4dd8c397a986fbc8500d1411432107e760bef96da
613603afe8c5203c59d7f9df1cbac87109df7ffdf245fd20becfa6bd95b92155
6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8
61b919b6ebdf51ec13f26134d27ade8102b80dcd9ed6cffcbd38662884a184ca
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
64fd144b959afc9171b54d6de20c92633b709a9f7bc715140995ab26356b7268
65f4e452b96ef3e5e3a4631d99c63dd7239dcbcb88de679ac74ac30d3d4988cd
67f13e8ba805fe8e31f17be59f8b9660d78a248476eda21ab6216552cae3a080
6910bddbfe9281f7f9834a4dffc8ab07227b2dad41eca04d91d6c790adf56244
6c673e591d9884911d15476ef26e0000b08437accd19238873d5ca9bb3341cc9
6efff8ce63d77eba89e9cc15af6dbccc657068130e89225fc662a0c580cea9b7
6f02f78c5994cd9ff52295d804ad9061b91dbe07c27c719db05e294a0331dbc0
72ab9860f43eab12a69343d3dd75781e9d41aa2239da9a468f026b1c4b32bdbe
743f65b0622a16c8d51e6d35c9d7a4e058efd02fe7bceb4baa86a87abe05b01f
7a2c6856e8437c3183ec517c59fc9724eb82cac59f685970113a7fb15ecd272c
810faff3965c7e15bffa14a46c643567f11f9212cc892d9dca35b0bd07df1a60
817275171bafe3a2f1046c0db2c8c225548bc2062f91861415d6d6298eae18a3
8272ed99c2fe9a7e77a6af842513173821400a3a597748aa888bfcd284de29ab
839d9a5cdab0e1c33d50a6998a2255ad3886c49fbd34515402d7ce51e01899ad
83d6011f32c94b8f44addd3fbb5c66a8107626fe9bf82faab0f6091b0016c3a6
843ce787c060f04c0334bb78db17bbea63a9f9c5b99466b3998be06be0d64305
847f5d63ddcb0763f753afd3ce867d9b0aee9ce18eb86590365d9206a14d7aff
858a810d10e72c46e613ef996356319b7c2ca8f186091895d165a7a99a38b4f6
865b8ce84206cb17c13c05f6f769151fe9f8a51a2aa66577434916d835efe992
8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50
887880bbd37c109dca66464d026c316a5747e607b6c70cfd8addbf047ef42e95
8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14
8acb2c63af9378ee91f6f4ac4e398c3810755f5d25993833417bf21cc1a19743
8ada2a7ece980220cebf1c7580372e5ff56417e02b6f5def8fb715d057427b36
8b9774324602b235e08d18591065c8debab9a64762d990be1e08e8334ea2ecb7
8c0531412c543b9bd978e29acb8f5cf330db9891115d1e9924519d9a675b7b74
8c21de3b659aaa30693e28670ce6526645a4af8ce4d49c38f9fe410552d36e4a
8ec3479d60996e43e57f2461d66180358dd5002391964b536c249c0835038533
91d44223446a76d41931c43f6e693a4518ffeca65412451cdefff8e9dda43391
920b3418bd27c0a767e254c03fe306e969e631a33a871793ad7691e666983980
942635f66fd7fbfcb36341add770dd34ee62126993b74ae08aca14f35b3dc35c
981c0bff12cb03203363a70e8ffe9b7fdf4af3b0b10c7a02a639eb13327574c0
9a61fe6e2743a18f977ac18a2f805735e8dccf115b16dbbbd2e3864ae98d4c33
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9ab404cb176787bb58cb49507d311a2a76fc8288eb2e7d1cbe3df517b3e2a1da
9bd8dcc115a0e9fce94520cecad5254352b86d55bca2506833057bb52e87ee1a
a0afb8074484b63a4167543d75d5b89396465cd27cb561521f11b1c80ad31b01
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a2960bcda61e057bc08ccd3ca3f1f52febd9308faa39e28151f03978d8768b95
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a5b8e9a55b7a45a82d2263f777f7299973e376b2c7d631198561719bae1d58f5
a84415c4ebfb14e3e3e1c198fdac4bb4ced59c3da29495b7b048eb75f099e0eb
a84fb0803620acdf77c0f41d652eb5538002ed610424bd0be051203ee50cf940
a90d839af4aa27ae1d91568e5b633c2e607611d789f52acab32028598b3af187
aae3a0f48cc7e5812adf9de07ee38b2d8fc549a608eaa08f1968c505af8895a5
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
adae09db1e4eec81817f4a7131ccbae5de55937ae712b370e35a3a427bc345cb
afe2c4d44f6a91b4d2ecbaf61d91e90f61cf159467b4a3fac9e51ed9b1e2920d
b12fd2368eeda5cf09fe595adde491622d408a95daad0dfd4070fb7103108b84
b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719
b4cfe579c43da0984d14c5c8fcb573ee8b4a93af437659ab104b506da3060ed4
b58a0072c69e0c38ba92247bf44992ba450fdd97689770a39829813f9c2254d3
b732714708d8501ed2fb66876e6e68f7ee98c728408dead9b1364dc61587faea
ba29faf5efe544ed157bbf56aafd0555a22103b36514708d7fcd196fc361c2f5
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
be826a42960c2537c8fee4fcece922ebf0f834ce89cb0036de8e81f8c56030d3
c21a4f4dea997c97bf301a6d477a7968fabb123e8e00f99ae6fac7f4767324d6
c2777526a216d9692dd29697ebee7836fe8ae65f3a290faa20b75b64c0625205
c58eb93005d09e7485d3960dbaad514527ed100b67dabe61d0076033dfc986ab
c69ac85c56bbddf6691357a0d0456f5ddff140b221c388d526f3f19c5f5a4fb9
c7a1f721f6581b9badc1c775d6493a5f7729c470ce7ccbe84823ac44e0ba89e7
c85cfc4f5e29e2391d35c6c805b4146448d23cb99d2d7053456a558bbde1112d
ca704f6fd04a7cbcffe1c503bf3e7aa34034f984b73646b5cb76c812cd7634c9
ceb8444cb437d3f16ad2590f8b9d764c4f143a6301c54cc297d72ec737ad1959
d1978246c579ad24ed45077436af671efcbe10c49c0f8101289e0f847e340011
d234d0084ff13555f7cee9211dc834356cae63b833c6c217dc81d87f6835ca6c
d2fcc0c54dc21211f0c3a83aa556d3c7b3564ddf94d6cf6acbd130899cac1936
d7705700d24d5919255576642ad2c28bfc790390b7183a369038ff5c1e814d51
dc4e8ab02c726abb1135463c594f24f5707a1ff7c8ecd71581ea5549ddcbdcc1
dd1f0617a8729030cfd68cb8c6c4fcba450691b06b267237fe03cbf6e27e293b
dd65086c8a088883a3b0b8e81a72a4d4d5cc50f47bab0687c94be466ebd5c6e7
dd694be126b3523950b0fea5c037a4f417022a72e111381687e5d45f19f8a4b9
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e0be1d222e2e367ac5106f4aee4830c3de18af1d266f8cde53915e11e8b01bfd
e174a58a503ab84b3d1b9de12fd3895788204485170f1289e445f7b5b98ec789
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5462ee06f133a8c1692d4017edfff86d7f98c0ec037914d21d59bb77ef71395
e6b2f14124b01d5c1d881a1497577a41194823cdbd53b6766cbfe2a4816098bc
e79487b8f0a88e4751bb35370c943229fda617736d43b606831865c33b5e171c
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9
f583c324daf6d4fd4399694b042e2a822117a05263ef59ef3b895c14c4c388cd
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f65814fc7ae77179647df580b3569537de80903be7313f643165fc2b3adc1d61
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f7408c25067cd0a9d9fe835cb4c05e394a50751d3fcde0c461db19a309abb02a
f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef
f783786aeb477992608a1b3e43e0ce53316c76d2b00d14b9f3557724cf7d5916
f790baf0f92372fc3c701fb574a9c5d2df3540a772bca2eb192985267d7bb420
f8943d6b18e8375293e87f22631581e81161cf3a328db2043acf50dcbb9945f2
f8beaa4df0dc4c9587752057d48a977aa3a6b615f44e6dba2ecfc062e4fb5951
f8c4fdb5d5d285dc8316d90b5f924e13abb66c4ec75d273f2f5b1f5bd91c3d92
fba481fab20272ef7a48caf00ada54029f59dcbfafcaaf934d2a6477531c2a81
fd3bbcd4377b397d238cc9eabac9dfbeac05b0b4762efaccc73fbb5d627b467e
ffb39ba508f9f38f71af158f8be5cec977594bdd9ff2a87aaa3c9c9087e2cdb1

www.rightwing.org Open in urlscan Pro 2606:4700:10::ac43:1c08 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

204 Requests

90 %HTTPS

65 %IPv6

27 Domains

40 Subdomains

29 IPs

2 Countries

2624 kBTransfer

7657 kBSize

37 Cookies

5 Outgoing links

Page URL History

Redirected requests

204 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 12 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.rightwing.org Open in urlscan Pro
2606:4700:10::ac43:1c08 Public Scan

Screenshot
Live screenshot

Full Image

204
Requests

90 %
HTTPS

65 %
IPv6

27
Domains

40
Subdomains

29
IPs

2
Countries

2624 kB
Transfer

7657 kB
Size

37
Cookies

204 HTTP transactions
12 data transactions