freedomheadlines.com Open in urlscan Pro
2606:4700:3030::6815:2278 Public Scan

URL: https://smeagol.revcontent.com/cv/v3/UbjAiffQJMK5qVkgHSByZDdYtEPPy6t8fLFboeGAsLcDNDA2zeSV9VMjCGbYsXrfPyTvMPqAdnpHVzmRGL07Nt9M6BU5PNQ3K_7_ndQbNspO6Jr-EFxe3Vo3v666mWocwF0jaYaBcBG8o2agi60R6Y2IwJ_04pMNkVRE-WvQ_jUrFFjo-Z1QDCOrDIBz-50tmnkRZ1OgjFut_yNsrGQNESOhmzDMvR6ZjwFjfuc23TTXmxMs-Nk_eJQhDZb-Jn5Q6WvrA5v4VKw4_jL0ycTBHjCquXr_K2pgUxLMF2CcfIvCtX_4roAwdOqKyy_gjXrbeBQ9haex7VsNTMYTTxDFtzvFCFUUSub4WXqrxGULaeEL13-opJiP5Th1Zwqv0UlOe95P1Jm92SI-c5IaI5RVFusP336_xvHxTBaPxn2hAHRixlw5Ab5kNXLI2zsoZ1rOkB8-gDX--Ald5K0H1zujRUM_ORZFXbdG4r-tiWuyIw6H-_S-j6Nb64YUTB-h38XH6XulRKyhnN44_aem8U8EBS6Ft1QQWPFLoPMncNndmP0V1p6I2qvnHyuYFnDZedonnFXldmHkvaQjDejGkzcltT9InQvFI4zQriG4t-JXGmm5wEW1I7pEbdT0x3hq1356qQNcHTiCkPmWelatLtTHLm4Qqmqf768klFMdRTZwkyZvvRfdH4v9mKAeohyT_txPWPKYm8_Q?p=GgFDMMOmpq0GOiRmMmFmYWMxYS1lMjllLTRjMTktOWQ4MC1jMmU0ZGQ5OWRlN2RCJGIwMjc0NDA3LTJjNDAtNDhkNS1hYjVkLWYyNTkzYzdjMWYwYUoLd2hpZS13YWxrZXJQ-7ACWI20CGIUZnJlZWRvbWhlYWRsaW5lcy5jb21qB2Rlc2t0b3CQAQHYAbKO8AGRAq5H4XoUruc_qgINMzguMTMyLjExOC43NeoCEQoIZ3JheV9pbXASBWZhbHNl
Title: Break Free from Neuropathy with This Proven MethodHealthbay | Neuro Researches

URL: https://smeagol.revcontent.com/v3/Jr_HMhHZcG_B5x8-gZHGO0Navq0bbjvNRmmDQy3S8slU4BlkinsDpC2sTG8vIJaNBSmdBvh9JoH_nJl-K8PiFhyC4BJYIvdPRptbNpdsBgb4cFBSmwdREyKl1lIfqMFklC3fCDF3dM6JWs0n7NQZIYwezwZDhrdAV9aNZ1VE7sY4VzhgNDZhMQHfLTcV0UCraB59ZMeAkJ0TeyS9rFeTm4OUeSZZ5uI7H5jppXNSJnKZ6Pmy4EW5DI6Kbb1EV_-hrKO9tCXRx6ehyZHulBvYuqWuy5wgtH87hxxoK6TThVJjVOOnOwXQz-ae9pnddIXg6rHsG8VPdpupTkUbm69cWdsX975JQ4TPkYgvrNbjAEBSbfIqCyiHZRe2KkGRDsFk4GLK0KHp6Te--Omas--EPWHObn_k4Ljsp8GQlok_2PNMTNp17r6Ub4XEvOh_eteQ6d1Vq7pUfhqEqr1Br7FpW8FHswti2Lz5KHQON_VEicWZejkhKtxQB6e1ohL3dkGvgfKnD4wYP_7_uUt1uh2HH8MtIFCigAQVZQ4sAr6awOS92amNHSp5ImcBn-IH5Ldr7w8qhXYJ_BqPs6Vuew?p=GgFDMMOmpq0GOiRmMmFmYWMxYS1lMjllLTRjMTktOWQ4MC1jMmU0ZGQ5OWRlN2RCJGIwMjc0NDA3LTJjNDAtNDhkNS1hYjVkLWYyNTkzYzdjMWYwYUoLd2hpZS13YWxrZXJQ-7ACWI20CGIUZnJlZWRvbWhlYWRsaW5lcy5jb21qB2Rlc2t0b3CQAQLYAbKO8AGRAq5H4XoUruc_qgINMzguMTMyLjExOC43NeoCEQoIZ3JheV9pbXASBWZhbHNl
Title: Rogue Dr Reveals Exotic "Rice Method" That Liquifies Fat Cells in Days [Watch]Natural Remedies Map

URL: https://smeagol.revcontent.com/cv/v3/7oQEkncw2nFdJ7us5X-fW7sBInqXfjne--qw0BHTXqGAm2GVa-KanbCffc1hkyB1hCyy1mk6QERJIVpqRgaSL88Ce7yTFGe-uB8iL1Zx6uQ4FUHNS-uCDrmrBZ9jV2hKN0owG4CwBPglyzeZW8BNr_EL5l2PNCOf5j8llTg2G-dz_uEC1hC7BLUEjg-FhmnVdxejh2IpGQTgr6qp4oz3zc1YLpmJxfPECrhCYQNAcrVlwZVWwHDsi8KDflw9aNITqcDyfwUSX-UfmejEIldwexS1_zXFyjoEVhfBYYz2NcHfz3CZPG2h2wm-leQE7HaenYZcd0vjHYkhRzlXz5FWwQ8Gh-dhnXpEBcsO9NxaJ_YJOUnrEZBgrqQ7Bijwgu9YvSFnv89tqhzN2plRNX0XJM8igD1eMemjFonh2TGKZclOXYCEcEYkIN6uVbdlkjDiW9QpSvgzFpoe6g?p=GgFDMMOmpq0GOiRmMmFmYWMxYS1lMjllLTRjMTktOWQ4MC1jMmU0ZGQ5OWRlN2RCJGIwMjc0NDA3LTJjNDAtNDhkNS1hYjVkLWYyNTkzYzdjMWYwYUoLd2hpZS13YWxrZXJQ-7ACWI20CGIUZnJlZWRvbWhlYWRsaW5lcy5jb21qB2Rlc2t0b3CQAQPYAbKO8AGRAq5H4XoUruc_qgINMzguMTMyLjExOC43NeoCEQoIZ3JheV9pbXASBWZhbHNl
Title: Your Dream Car is Around the CornerCar Deals Near You

URL: https://smeagol.revcontent.com/cv/v3/uHdPW0isszuM7Cn67FEXdeC8LYvuQ839CN4PgQUEXMNva67I5XhJoShK1Ptyk1S2-azVpMCwMdxkVrYxfA9RuXB4GVPbi6yKq3M5Xj8NeAk7Ho2PvgdqqZzWTWa78PuXtHwsXrvrmUc2JqeGVwlKp-ZqF0FcwDQw9LJI5eDUDmmzWR5wIXGDopuet-rcQYVU924fGS46yh7fy9Atr9Xb6ejb_QqKUKzQBs4kohWS8TUio1-3AJ7OQSkfuwkz_u95GXTDGI44AH3U-AZ-Dt8uDR1XUuT7feUoe9hxfBnI13Tn4134SPJZDmdQtIBNczWSfN-yOVy2xOfYyaCUjL1MrduBC0_GiXgkVbMTd7i00PY5FGpkdHB-dGxi1Ig1Mt715Q-KH9i73eqoBNqbo3iLi-XWvXuZQW0L5lADWTwwe9tPFNeccE4r9mxv7ycZWq0s2E3DWuKvQfyF-Hg2Rxy5H45JEhE?p=GgFDMMOmpq0GOiRmMmFmYWMxYS1lMjllLTRjMTktOWQ4MC1jMmU0ZGQ5OWRlN2RCJGIwMjc0NDA3LTJjNDAtNDhkNS1hYjVkLWYyNTkzYzdjMWYwYUoLd2hpZS13YWxrZXJQ-7ACWI20CGIUZnJlZWRvbWhlYWRsaW5lcy5jb21qB2Rlc2t0b3CQAQTYAbKO8AGRAq5H4XoUruc_qgINMzguMTMyLjExOC43NeoCEQoIZ3JheV9pbXASBWZhbHNl
Title: The Cheapest Way to Heat Your House This Winter (Genius!)Ultra Air Heater

URL: https://smeagol.revcontent.com/cv/v3/75FE_QEhiMU-o61lQPfAo9i3wNudqdqvZ2wi64sN4zlQVR1pqEChp0zOllF94qrdtWWOxmp6UFheICaUb5xZ8B5zyTSnzQqaEGlxwx7FP9NaTZhao6Dk9mIZtCH4B32nv0WmiqPKNEZHixKT5_Rkc_ul0Gxd-hkd29T1eqRcFx9YSDxVhm9i2HdsdoC-Cv5RVaPn0XDcLt2OgzEOaX5-tt6Xn5Z0dvPZVbzOZJUt9M6eMg2E4zbol7M9Ur6-khz0a4n_jh_WKOXXJlhrw1dqXr8Jhjk-kkc-gd4LE4mqrON_QDfjujgHQHpFXb-WHpSG2cMowcvSFJPCEbIPpzmXvrBmyOQwZVF9T91t1cdebEomHu8rDSpz1rqT7fBNVaIP-tTCaNFnP9KC1xxt7xYEP4gyxWH_no1lsQcmYGFXqawi29CMD5By2jDZQdDfSWS5FJ5VIApuAycwFkJfeHUrAUqn603uq_lyey1J_vJbzvQ9hnnjiY9iUEfTTeCIyMx7nztD30O-GLrDev3BKSWBcgjKJ_9T8AkWKNm-oaHWStKUGveEjpvA7owb7Xvf3Cru90DX7jXTDRXomJIBtab89Q66tpOxtT44guxc?p=GgFDMMOmpq0GOiRmMmFmYWMxYS1lMjllLTRjMTktOWQ4MC1jMmU0ZGQ5OWRlN2RCJGIwMjc0NDA3LTJjNDAtNDhkNS1hYjVkLWYyNTkzYzdjMWYwYUoLd2hpZS13YWxrZXJQ-7ACWI20CGIUZnJlZWRvbWhlYWRsaW5lcy5jb21qB2Rlc2t0b3CQAQXYAbKO8AGRAq5H4XoUruc_qgINMzguMTMyLjExOC43NeoCEQoIZ3JheV9pbXASBWZhbHNl
Title: A 70-year-old Grandmother Designed a Bra for Women That is Popular All overZekear

URL: https://smeagol.revcontent.com/cv/v3/LdpeBfVKDpaRvNPLlyNP3Y0R8vTH4ErvaYKu8KAPkimLe2QOup2v2v7o_va5kau_U1I0yDZ6-ON5pizCC3P1Eoplgpa3GOVpdDn_qhHNhom42XXUTDYMsoBuZsJkbQ-uWhIFdAFFxq_m6PE7E6oOMgyu9zYwIHH-XMAkhp4fe_omIkeVK1h4AmY2I668FbAXVQVJd4ot7-73VrnT6XvZVIQF7vnP-wpnURvxD9HO8X7zx6-RXvyt7Xtl3KYDo1nQLVk5ovXbYBSmKzZVy0wfOQHTe9iFInUqLr23NW0hPPvjUvm6acf3-ZIvQUCpj2_tcFIVvR2tRiMcPeu3wykotyEO56va5eq6h2uXRzwHap6MZ9x4AT3YRRbK_MEe_6FVBn4QzgVzngwStVdmWXAnelsH7iVFFIERCeuIkQK4dQsh7zgVWfGmKykwA5U7Cujiquki18_7xbF6ntihgN7wsEgr7ld2tjGuuwbcfRWTgKDESXxIpoQ8ZtZI_xlUP3OzwS51lCOCHxtowewIst4vLo_lAamtHxpY1q7BrE9YqjdZ9WdjJg?p=GgFDMMOmpq0GOiRmMmFmYWMxYS1lMjllLTRjMTktOWQ4MC1jMmU0ZGQ5OWRlN2RCJGIwMjc0NDA3LTJjNDAtNDhkNS1hYjVkLWYyNTkzYzdjMWYwYUoLd2hpZS13YWxrZXJQ-7ACWI20CGIUZnJlZWRvbWhlYWRsaW5lcy5jb21qB2Rlc2t0b3CQAQbYAbKO8AGRAq5H4XoUruc_qgINMzguMTMyLjExOC43NeoCEQoIZ3JheV9pbXASBWZhbHNl
Title: Never Hate Your Bra AgainZekear

URL: https://smeagol.revcontent.com/cv/v3/R6Yu5IpCu0wbPj6tytL0RpBcgroovq5KFs-3GW1PH_cTcA7au-Cb7kKaP0XpMRmcYvTUs4Zet3kHw3OLfsK7Kd-8SAWwYV_s5i708JBZ8pOPHFSrLntjHit5k3MXKNFKvmOSfRGQskf5KVRCLkPihR7wnbCp8I3ZkxAegZU4ySY6W-BtBKDpbrL7MH6nlbYW0nSdsaX-qh7ikfyeSTP9tTxdEQbcudMm3C9Cv75W9K_sm51fWIaH3DUn6ovVN_NoO0P1J58cB-RMlXdPv2jKxINZJgepCLw6KVudMQ_dHFWn-0RKXhSRJygHRkClDXVHHff5x4CNeQoMZJeUTwDTBgHtPNqDcX6qrs_NpHsgCbZoudu4YpfQQoN1MPXVgfa27IlRv1fncJKwvm3dn1pFtG9mDhnS0WYlgEqWuT3M02_sYrR6WTllTQEUS2N2NmbtceKMD3bzYYqwWB4DfVAWPKzYG2aW4DxQHQoOp11wBrFQ5dfFUf1jkWkUtt-sX8XqqjjlHEOtM-UbvLnM-BYLvs2KXjpXL_D-2_uaAlZkwN7cRWosi0NoIFzWAZvuaLiWeSCByWchenwy1fdPd4OqFszLMCuYwFytb9gVt7NSvCOtFEf0S9rl6ank0_Tivkt02y6G_zbBbFEuLYi3YyvdA3xcNWN7w-nb0eULW1QsMSHVHMkasopvQnAe8PyhD1qMoQQnUmaDRCbb0to0ja8gzCcbtO28JjCD?p=GgFDMMOmpq0GOiRmMmFmYWMxYS1lMjllLTRjMTktOWQ4MC1jMmU0ZGQ5OWRlN2RCJGIwMjc0NDA3LTJjNDAtNDhkNS1hYjVkLWYyNTkzYzdjMWYwYUoLd2hpZS13YWxrZXJQ-7ACWI20CGIUZnJlZWRvbWhlYWRsaW5lcy5jb21qB2Rlc2t0b3CQAQfYAbKO8AGRAq5H4XoUruc_qgINMzguMTMyLjExOC43NeoCEQoIZ3JheV9pbXASBWZhbHNl
Title: 1 Simple Trick to Cut Your Electric Bill by 90% (Try Tonight)GadgetVanguard

URL: https://smeagol.revcontent.com/cv/v3/uduG_sNszwgvfe_SSJmnnQlhX1HS3AKAUH9g8s3R42e6VGqpR3dvX4dLUFyIbPg7LYf2LmE3ywr9uccbLmSZ1AmBdCx4Jup0_AozZwkbk9iz7U9VbcKSsrQ2Ii3jgrsgqghA7Vg-9IvE8KUysnGm5HD6t2Di3jFxZyQarVKhfLgnh5BxmoG_47fQ4BE-6LQvd3k3EHQdJHmoxusCU9MkFNCYRRpH4f3IP-OwEkXIeyjrm3ShuNK6psW4Dr5D6MabbBK-YETonXwaHoepU8fqkTq2FJTSo165l570Q77-CrD9cq7R-omlnNgnhdWRjdOGa8YNpuanPm7HlQ5MXpedyQaZlvC-QI-683TNkwPZrhoGOurG0mkE6lKkSbVjbsHpmvxrHNPQ-YDbjEeCqzytajaYCx99ZcxJF7h-2oTdzPj1aNUnZ9x9r_r2aLSxzvEGWd6_xCQ5vZ84Scr5hxcwpOPUpGLLtbOz48CEkvqD1SEfV9_s2imjyOx7uL0OO4GKv3nt6QGAvVKaj3ej-O5BlBZ8Zkqc3Sh0HGNQJ2k_yeoXNcKW3Q6wPK0CuUYNpAtP5yyT57DXTu5PUT2j9NZykQ8?p=GgFDMMOmpq0GOiRmMmFmYWMxYS1lMjllLTRjMTktOWQ4MC1jMmU0ZGQ5OWRlN2RCJGIwMjc0NDA3LTJjNDAtNDhkNS1hYjVkLWYyNTkzYzdjMWYwYUoLd2hpZS13YWxrZXJQ-7ACWI20CGIUZnJlZWRvbWhlYWRsaW5lcy5jb21qB2Rlc2t0b3CQAQjYAbKO8AGRAq5H4XoUruc_qgINMzguMTMyLjExOC43NeoCEQoIZ3JheV9pbXASBWZhbHNl
Title: Dermatologists Stunned: This Removes Wrinkles Like Crazy! Try It!Neotonics

URL: https://smeagol.revcontent.com/cv/v3/WmvEb9uBuFU6A5hCLMmhr8kt1kvkbMSu960Ibm3rcYVduJEsdkkZZVtOZiROocjR5oijji4Sa7H_OMz28DU1YgklWHqjNRcQi00XHUCCX37SnjS6DLWFFj18Wro7fC21YBo5rFeJD1znIv3K5DzMu56cWPwfxeSdSGs76rYdzUYw5vnmqPudwwZmFEzQYXCps5J1TbZpr0GJI8URXaGneIVCTcb0kt7LJ88gVME6CylQp7jA482Web4o5tyRGQiqUU1v90UzroTFFqbbDVs3DwPOovGIWeyEOiWk2pc9ppAowjzqQgo0r6skXC7JIzwYCsv0uGMcPelG2Sqg8clLS_2nyu0t1oBx0GUZhdy9lXURCWDwCRSq75NCJEc2t4gAmuXkHpgiHnmMVjvV-NrQNQ8jl4gSzXmwZbVOBmvEQgCOJM4ed_efUyloFxcjoY0xc5kyVAW17BM_MKAwmqEklrCu6PAfdjCMBn9OdqQh6pLmOiXE5gA7M4o6LREf0FsBI4rwKpd2j-y8FZWEnXWiDifETksZWvfn7ZLmfv7V6HaT5TYZTAc7XI9IwiJaLpFwFMf1uQ7tdqsOYsfgR5nqZmAWhBfn5B4kPP33grG4x0-F64WrW4_TMMc4OaDWxhQWozLK8mAt?p=GgFDMMOmpq0GOiRmMmFmYWMxYS1lMjllLTRjMTktOWQ4MC1jMmU0ZGQ5OWRlN2RCJGIwMjc0NDA3LTJjNDAtNDhkNS1hYjVkLWYyNTkzYzdjMWYwYUoLd2hpZS13YWxrZXJQ-7ACWI20CGIUZnJlZWRvbWhlYWRsaW5lcy5jb21qB2Rlc2t0b3CQAQnYAbKO8AGRAq5H4XoUruc_qgINMzguMTMyLjExOC43NeoCEQoIZ3JheV9pbXASBWZhbHNl
Title: Want to Stop Your Nerve Pain? Do This Today for NeuropathyNeuropathy MD

URL: https://smeagol.revcontent.com/cv/v3/YGmDoGRjdAYCk5nLYgyGNA-rrL0UI1aypYsg1ZcKzd8C0tVtsgH9lSxvsNaUSGsnspN2DJGlx5pBfW5iRp6RMMt0ItcAd3grPph9UQhoYA88PJ_bc0N8ZAOT1d5itXI3XpvpC8gtAXih9NRsME_uCbLUmyx5zFM3mhRoMC66mGiNwWcdD5N6a0klYYVqqDa-BZY399GweYVOl_eaBUZBIwVD5hWc26REXcBFD8HDjWifV3rqrLc9TSwb5G0RrTTpI3QOZpRAnEkyuXhTGisgtKDYsxwfHRxJDFu0W3x_QJkF3F3LvRqtdrEXGI9lwgVsKChUAii678l6jdhyao7G6tETuV3LP-Dz03a_tw2Dor4OP9Nij1eYYnFX0SWwsqczngkMEwzUqbf56bP5xu8?p=GgFDMMOmpq0GOiRmMmFmYWMxYS1lMjllLTRjMTktOWQ4MC1jMmU0ZGQ5OWRlN2RCJGIwMjc0NDA3LTJjNDAtNDhkNS1hYjVkLWYyNTkzYzdjMWYwYUoLd2hpZS13YWxrZXJQ-7ACWI20CGIUZnJlZWRvbWhlYWRsaW5lcy5jb21qB2Rlc2t0b3CQAQrYAbKO8AGRAq5H4XoUruc_qgINMzguMTMyLjExOC43NeoCEQoIZ3JheV9pbXASBWZhbHNl
Title: High Quality T-shirts Made by Patriots for Patriots Get Yours Now! 10% offPatriot Labs USA

URL: https://smeagol.revcontent.com/cv/v3/NmnPG9SsuUfTFu7AHAEkj0mJsOcPTvXHd0w8CcP9AQGDYsNZwcE6gM7Pi2Fwo-04xYrCA9MtaBOvCaZAH8Za0WjA3WAk6o4TSGsVm2Iq3oZ4dQLV3VLFLHaPUUyQOxklJAup0qFjOQQTDhPW-58OP7c9rbnSStxas1zZMcA0fc3-qDgglrYAUTpPJoNcHOUWSIRQlPG0uermgSciqYksI4uwNMmx07Ww78xsC3LMQEsr27sosW68-r3Co56Nw0Oi2ILIt7aZT7khePoJd_CuC4t4kxKYx-PVPPoRLwFBy2byF4jnAguGycWu3pDaxy69iVYQ5rgqNz79mpDvOXOpGQLwqaorvZaClXZOt2bKwF_dqaXHLWUjm1ys6CUDyKSTQHd_fhPYdi1Jtxvt3hWVT7HyAqUmxEf6YNhvzpb-HN4FNML-YctiD9oBoFYhdhWfFcd2_9jFJNPzGuKvs8US9fYT9sUnYz2p5ri_BHn30qzeoW5vXTnXEuB4UPjJASacJZ4Kp8UmFelYdKzjYq-A-b_3QrKKCgPbmouQ1mcE3tn94QEFeBJmBSCN9ECAWTONwsNJygiSBtsvPdhymxI?p=GgFDMMOmpq0GOiRmMmFmYWMxYS1lMjllLTRjMTktOWQ4MC1jMmU0ZGQ5OWRlN2RCJGIwMjc0NDA3LTJjNDAtNDhkNS1hYjVkLWYyNTkzYzdjMWYwYUoLd2hpZS13YWxrZXJQ-7ACWI20CGIUZnJlZWRvbWhlYWRsaW5lcy5jb21qB2Rlc2t0b3CQAQvYAbKO8AGRAq5H4XoUruc_qgINMzguMTMyLjExOC43NeoCEQoIZ3JheV9pbXASBWZhbHNl
Title: Blood Sugar Above 100? Do This Immediately!Healthy Natural

URL: https://smeagol.revcontent.com/cv/v3/bIUNrN1-8bgypTk8jDvDPtmvqNDgf6QGwT5JaqIDHGIUVZtp9u3GtOazb_0iHEUH-4KIDPyfSirljspk1XDZwXcwMVvHWCo5i1NU-huEbaAR-cthqz2W6o9lrrfQtupHoveDEFKnDfc_QuX3-8peuyD55e-HAdvBbnvkOZM675PVZgGjX1uky8zEMcKzul6_KaLE1WiXPWcbrm5kaQa08l8sX4mewHmMw3CBsIEpxD-1IIy-llmMg4MT2XyIMDtpbyx8tq_epR9I0MI6hXO5E4qBGThpnpbLNDwk4lLSg5VH4vPkjk2DbiH058fSUp5Df4VsiESRLBDYRHC8vv7ymy9zY-H8aIAhRHWOHm_iA9Hw-V3cqsd9k8588lQoLA2dcS_G9Ic3Gy77389nxQonq-dioT676BKRUIKxhe0FnuRRUmW7SxCK58enukH0fuK9yGBNKH14_4CGyM5sepSDAkXxSF_2UdHkrIc_tsuLrNtLqmOE4hc82DKNGSI28zzwRqRGQs-lR-hW9pQZYqbuIO22zysYA88TOEdJc2uBM6YRBlB2GePqYX9CqTSkumOIL6c-lWpxJCeia4rl_5Eqi11XN6Ysg0jfj9gbEHts?p=GgFDMMOmpq0GOiRmMmFmYWMxYS1lMjllLTRjMTktOWQ4MC1jMmU0ZGQ5OWRlN2RCJGIwMjc0NDA3LTJjNDAtNDhkNS1hYjVkLWYyNTkzYzdjMWYwYUoLd2hpZS13YWxrZXJQ-7ACWI20CGIUZnJlZWRvbWhlYWRsaW5lcy5jb21qB2Rlc2t0b3CQAQzYAbKO8AGRAq5H4XoUruc_qgINMzguMTMyLjExOC43NeoCEQoIZ3JheV9pbXASBWZhbHNl
Title: This is What Full Mouth Dental Implants Should Cost You in 2023Dental Implants

URL: https://smeagol.revcontent.com/cv/v3/pfNtOAjCbmiDIW6K-DNEcTJS0eRNHzTdbGidMyhIvHZ61-SsHv9tNFfEWK0xiQP4X4yt6ICl2uDqX9f_MqvRy7KZK9x2N3CR9wcnePrH9j6V21V6j1DhUXCrPngoB_Rtjh-tb2_gSJyrR4aDNtZddAIsE9Xv-dstvoyIvN62cJpdUskDZeyZwWiQK0HXE4_ybs4zeFm3PCbS1yEPeyzmK6uHsR6dHhQwSj3xEmSC0BX8Tb4NAYHfvQd9cc602sMrPyUUYrsyFSQPeKHOANxT_PEWgjdiEbtEO0LbDaNun7d2keF3XeHLdna7aB25-7ivpg_JO3-HI1KnI-18ofB08DvtRltWtuKY6iyB-J37Yk1_KODY3AYzBLBOEhgMwEg4NiDcuf_06Ah30IIKyf-w7NqYTUuXzqZLZZN_4wDSBLLBgla8we5AtdM1LFmLHuaUZ8WymjeYfEFKkIt3WuSyHwx4qJ8uerTldDTXLESxmGrtjoNFg_a1fmdw3gA7OoqqxfKT3j0JDtM4-6Bdq8ZdcgCP1A2VKhjj4Ehs-H8DSDZjD5yt-PSkmKEWL-UvpD9mgZTycNIyQTNorqyUBFjrpHpMAsvZPsKk-yNPOaqUJFjs4Tyl5k_3FY57skH43abL5q2jPVFjjg?p=GgFDMMOmpq0GOiRmMmFmYWMxYS1lMjllLTRjMTktOWQ4MC1jMmU0ZGQ5OWRlN2RCJGIwMjc0NDA3LTJjNDAtNDhkNS1hYjVkLWYyNTkzYzdjMWYwYUoLd2hpZS13YWxrZXJQ-7ACWI20CGIUZnJlZWRvbWhlYWRsaW5lcy5jb21qB2Rlc2t0b3CQAQ3YAbKO8AGRAq5H4XoUruc_qgINMzguMTMyLjExOC43NeoCEQoIZ3JheV9pbXASBWZhbHNl
Title: No More Tingling & Numbness: Neuropathy Breakthrough (Watch)Neuro Research

URL: https://smeagol.revcontent.com/cv/v3/JziVhEWD_G16RZFY_07ky3NwniiBYhxKGdh5kCF7DizhgUedS8T7_cHujXF-UoPXbafFhxw6uGhREL8maVC3zwKqt67qujDETyF0C2b5O39KAWpXzi0BrCwiPiUK-RX069WLb7IcjAMYWTM5spUsgaNysxU0PPsSz24IwNCw0PyM2jLPfGKt_uWSrYshIUxEXz_WE9WpM6vlhHU9OblKb3pjq48-pDGb4axzBJRDqEjSb66woJ0qBaj2516HK1B4sVVdRyHQFr0jo3u2NUbqmtmEgIPpMjEtdcdZiiZgC24pkHQIvkDPhT7GrqaGc3oLm0xQS2C-uU_ENkpk2MypJdxb0MySyS9CUepFAmf4UpPNCL-jurrWC2ulBBtpVBUwvtxw2Kc8f8OEi3F4qQ54b5R81rWs0_rFjJQ8pG-dw4MpndQ8edhINPMVh4kTv8VyI_bJO9obfGDASnaBpQmuzMoYIJzrbgEiV-cIF2ZX79vEoEt6HXXlLlDrX-AmD6IPMBR1N7MXuvYbAe1b5bpuegJwVfH9NvrldbjQiZQeoPvE-2q89TG29Qv1buvECUwFkz7r6Ied2qfDPcahAZ0aDPq7tAf2iek7wJwb6LGyPdqWhW8yIJKz3YzLw3tnNFdh0etT8F7RDA?p=GgFDMMOmpq0GOiRmMmFmYWMxYS1lMjllLTRjMTktOWQ4MC1jMmU0ZGQ5OWRlN2RCJGIwMjc0NDA3LTJjNDAtNDhkNS1hYjVkLWYyNTkzYzdjMWYwYUoLd2hpZS13YWxrZXJQ-7ACWI20CGIUZnJlZWRvbWhlYWRsaW5lcy5jb21qB2Rlc2t0b3CQAQ7YAbKO8AGRAq5H4XoUruc_qgINMzguMTMyLjExOC43NeoCEQoIZ3JheV9pbXASBWZhbHNl
Title: Urologist: Shrink Your Enlarged Prostate Without SurgeryProstate Health Reports

URL: https://smeagol.revcontent.com/cv/v3/88tWwH1R8uE513UYNMAbZzzxKWxdtUV9nmSxDYCx-_KZ-LM2W21HRmYUcJL3PzcX-eM3LPEv7wroJ_blfh3gMW_x9VpodiEHUlszqoyqoSubpRo2anPSTfVljbsvbAaonO40xW_a8sUDv9N5iaFi5efY6G4zqQg6SAp1o9m-Vt5Hmsz3ZaBNztir1yrSGFRuR06J3a9ZhdBl0SmSbuohx1R2pzrmH-_U4T7NZwhwFpwXdvZmpNpSU-BB9TRJVdgi9bJTBNiOIx1qcOCtV_BxK1Eqt8Li2lvCo__Jjzgce-EAy4qMn6qHMfAGRXbu0uYw_WGRxyfNqkWrZhs4SG4nhtSLmxpiRht6i5P_J1X1wFubM650xO_oI-qObsNU9o0HxbuEVPa_k1yaz_YhtqMk4L90v3EnNyRJgXH_rCTk1chyRTD-HH7kF42SMMwopXYKgle8vI1Hi7_lODbPfAPinVh5SEmzHw7YSVqjhe1aGRvA0TrVSLY9VT2SAvcTQ7G6sIwQRrvCezUofQ1EtHIu-s02p8f_bkf1WGEFwsAWPfakh_tmeQgr0Ar-om1YqCObbAUVfptQz9Ct5tfSRoxlvE-OUvd_s9JCjT3pxaxga7CcnQp1mppVVN4nwiQwzkDbyth5qMwNDMs?p=GgFDMMOmpq0GOiRmMmFmYWMxYS1lMjllLTRjMTktOWQ4MC1jMmU0ZGQ5OWRlN2RCJGIwMjc0NDA3LTJjNDAtNDhkNS1hYjVkLWYyNTkzYzdjMWYwYUoLd2hpZS13YWxrZXJQ-7ACWI20CGIUZnJlZWRvbWhlYWRsaW5lcy5jb21qB2Rlc2t0b3CQAQ_YAbKO8AGRAq5H4XoUruc_qgINMzguMTMyLjExOC43NeoCEQoIZ3JheV9pbXASBWZhbHNl
Title: Forget the Dentist: This Will Rebuild Your Rotten Teeth & GumsDental World News

URL: https://smeagol.revcontent.com/cv/v3/SgOR8ANmW3Qk0mnkoWKLUjOlH3wmNenuJRiM9l6xyrJaySc-Rz-CPJQ2Ldq3iIsSrgxZoFMkWSG8-Bt567k2EExHENF-A1zPcolZwZYkY83UoMfojU8y4vRvYUv3ER-hEBQCLzrGj-gcGkvROPVFqerzqzrsPtSrihfIJGTS9IwoV5imWlzXY7HXKE-Y-obxWa3ly3CLkdggIF5AImO3L5LbQfjgiqRd3ws0h9NR73iNEAb_7NeE2MGowyMNUvJmeV1ONtuMQa5qCf65QCb7k9VVUtPhXwpzN_-HuYC1y7WuomTV35pQT9W-P2hK0CGzEO9SMxGTdFG6wtePMJlIo441kii7xIAO8k_4NfaK5fMTGACkKatJ4za_VfxZbcvh-XLUQxWQDxafiHuNeQfjGq8liImRxhJ6lXjL59wQf2vFRWaphRS02OX13qFtO85cLWBnvQDzOtBc91rOvPilJez52Bc6cpSuqw4C5Vjs1U6nPjQPNY1-WFrWXNdmQkjqM5wFXcom_bRHqjCvUtCeBCFYtDaQfEczD3oegoE4do96QR4VRnoNLFGH_xybHEthtA10rY-SHBAesazqtW35gFsxFxP54tLo_gqwCt17SVVfgw?p=GgFDMMOmpq0GOiRmMmFmYWMxYS1lMjllLTRjMTktOWQ4MC1jMmU0ZGQ5OWRlN2RCJGIwMjc0NDA3LTJjNDAtNDhkNS1hYjVkLWYyNTkzYzdjMWYwYUoLd2hpZS13YWxrZXJQ-7ACWI20CGIUZnJlZWRvbWhlYWRsaW5lcy5jb21qB2Rlc2t0b3CQARDYAbKO8AGRAq5H4XoUruc_qgINMzguMTMyLjExOC43NeoCEQoIZ3JheV9pbXASBWZhbHNl
Title: Cold Sores? Try This ImmediatelyHerpesyl

URL: https://smeagol.revcontent.com/cv/v3/4dA4Peunqd01gK66bOy-ht8iuK3NdHvLSf378j69PzXbsPgziqm8QN86SW7292neNgtX3KoTbBtkwWN7bMJXe8QCotWxDSDKxxMv8uLGoyJT5tn38AeznqAwJ7LHjrALfFAEw5cgiIWjdVvh-YZZUjeePn1kd_mGCLihvnEPyi0szKAhENk9qgP51kIa5buxpFyyaKm4_B1mHg9l0zqSOlGAK6H7_AG77QS6hzgpdSdenRWqoS4WsGLPna6HEi7Oh7_V7iqbkVDRALmejZAeoKjmy0MAY1z6KrOUnmoybG2p1MpH-KUcvIDwD5og_O8Ml53ou3X0VRo37e6DPvgE-oGk7II9co-e7P1bvSoYv0w5BdZjTq7Clx6xdSnK2t0bT_ynDaVwa0qPlMc_WZO83SdhPeVljbtjekFHkVHXcRVY7aqpWQa5COs3Ei9lDxJApHMJ19BGRNQN4N5MHcLLmSfWXSG76dLrv227Jlq0oyDN7OxM_mokE0MswbtnOXEc8buXgwCv8sZ8EGLhrqWEqYtw_ajjs8LkoUZewX-xsyNcXBoB8vOjO2YmMgxi6T1ZtONaHMqMY4E6k8mxg1tk-9BOE74qVFD1fUxhBIp-GqcFxDUZqZ6EbUrb2bx43d96FoPOZ3NWIIGShvtp-XjxIn76xQ?p=GgFDMMOmpq0GOiRmMmFmYWMxYS1lMjllLTRjMTktOWQ4MC1jMmU0ZGQ5OWRlN2RCJGIwMjc0NDA3LTJjNDAtNDhkNS1hYjVkLWYyNTkzYzdjMWYwYUoLd2hpZS13YWxrZXJQ-7ACWI20CGIUZnJlZWRvbWhlYWRsaW5lcy5jb21qB2Rlc2t0b3CQARHYAbKO8AGRAq5H4XoUruc_qgINMzguMTMyLjExOC43NeoCEQoIZ3JheV9pbXASBWZhbHNl
Title: These Dirt-cheap Storage Units in Miami Are Being Sold for Next to Nothing!Storage Units | Search Ads

URL: https://smeagol.revcontent.com/cv/v3/G1OvYswKr7rv3I5trNluMVSynlMk1nNNx9DfIl92fKLN-CwpEp4NjJhnrFa8RrF8qxKOQA08Ia4pX8dGRG7iwfvjtgc_a0V1RpgOWAdkG8VLLjLHb2yM-KjoHheQdEn_FbKY3PxkGaiXQoIqACAywNPT_mh7mvWMlxotobWhxjvHuJ7bWO3ZuzNe09GKqh_umcXapHpnWjkEZ_DfnWJ5_dytt0fZS97iWqZkMI5gXmnnNVdhFa6JYOGv09lNsnEdqPeKucM8OCUUoGzmKWkK-0QRHPfjzCmOlO6214BYiFvlXBogwzF_qcspeGef3S0JHxuuNf1HxLhU7TcRwBlf5DF_KjQDvQ9sWizvtpS7eqoQul82DLRGcJAK1H8NEdjQjbcz3vOVXC-05aL1GinBMtr5G8pMbfeBjNGS_4HKU14H8xOfrIZYRKmRhOIsQ8_qPnxTg8qyCQf-t6c0yAQsH-6PMjy5hcHmqfSbL2_5u4eKVJeEJGSt0n_zm9fbL1nH1X9-cN6VAwDZa5x8LBP_JBTmb_qIc_HJjbb0QBGy8cuOyuULX7YHHk9N5X4oFQkJCB-zEakjnrJH-1-DFIV4rWW64wsQjeNsSfPDCp9yEB6Cp78KNWrReEqJfYrVBa_upkdT628v?p=GgFDMMOmpq0GOiRmMmFmYWMxYS1lMjllLTRjMTktOWQ4MC1jMmU0ZGQ5OWRlN2RCJGIwMjc0NDA3LTJjNDAtNDhkNS1hYjVkLWYyNTkzYzdjMWYwYUoLd2hpZS13YWxrZXJQ-7ACWI20CGIUZnJlZWRvbWhlYWRsaW5lcy5jb21qB2Rlc2t0b3CQARLYAbKO8AGRAq5H4XoUruc_qgINMzguMTMyLjExOC43NeoCEQoIZ3JheV9pbXASBWZhbHNl
Title: Early Signals of AML Leukemia You Should Definitely Know About (Take a Look)AML Leukemia Research

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fsuper-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa%2F

URL: https://twitter.com/intent/tweet?text=Super+PAC+Backing+GOP+Candidate+Pulls+Millions+from+TV+Ads%21+Is+His+Campaign+DOA%3F+-+https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fsuper-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa%2F

URL: https://pinterest.com/pin/create/button/?url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fsuper-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa%2F&media=https%3A%2F%2Ffreedomheadlines.com%2Fwp-content%2Fuploads%2F2023%2F10%2Fgop-candidates2-1180x664.jpg&description=Super+PAC+Backing+GOP+Candidate+Pulls+Millions+from+TV+Ads%21+Is+His+Campaign+DOA%3F

URL: https://plus.google.com/share?url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fsuper-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa%2F

ns31533571.ip-162-19-138.eu

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://mailz.leafybranch.com/index.php/campaigns/me963742dk959/track-url/eo6838hvma0bd/52b330b7d87bbbc4f45470de30a4943ecbf5277a HTTP 301
https://mailz.leafybranch.com/index.php/campaigns/me963742dk959/track-url/eo6838hvma0bd/52b330b7d87bbbc4f45470de30a4943ecbf5277a HTTP 301
https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 101

https://oajs.openx.net/esp?url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fsuper-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&rid=esp HTTP 302
https://oajs.openx.net/esp?url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fsuper-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&rid=esp&cc=1

Request Chain 119

https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=e72d5d17-287c-cdb6-00ad-8ffa4bbbdb6a HTTP 302
https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=e72d5d17-287c-cdb6-00ad-8ffa4bbbdb6a&dcc=t

Request Chain 120

https://match.adsrvr.org/track/cmf/openx?oxid=bffb216a-34d6-764c-c0a3-0d6d2388108a&gdpr=0 HTTP 302
https://match.adsrvr.org/track/cmb/openx?oxid=bffb216a-34d6-764c-c0a3-0d6d2388108a&gdpr=0 HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072971&val=85cb6970-04cc-432f-923d-e82232fa0e19&ttd_puid=bffb216a-34d6-764c-c0a3-0d6d2388108a&gdpr=0&gdpr_consent=

Request Chain 121

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=OTM5NGYyYTAtZmRhMS0yOGU4LWQ1NDMtNTdkNGU5NmFkZWVh HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=OTM5NGYyYTAtZmRhMS0yOGU4LWQ1NDMtNTdkNGU5NmFkZWVh&google_tc=

Request Chain 122

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm=&google_sc=&google_tc= HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEMT7iQVtYGswbdo-Sxc4REM&google_cver=1

Request Chain 159

https://tpc.googlesyndication.com/pageadimg/imgad?id=CICAgOC6o_afKhCwCRiwCTIIyPC0mtCeWjM HTTP 301
https://tpc.googlesyndication.com/simgad/7775594092382834397

Request Chain 219

https://tpc.googlesyndication.com/pageadimg/imgad?id=CICAgOC6o_afKhCwCRiwCTIIyPC0mtCeWjM HTTP 301
https://tpc.googlesyndication.com/simgad/7775594092382834397

Request Chain 227

https://tpc.googlesyndication.com/pageadimg/imgad?id=CICAgODq17ONPBCwCRiwCTIIbl7_plN_ucg HTTP 301
https://tpc.googlesyndication.com/simgad/8576945487332838351

Request Chain 235

https://securepubads.g.doubleclick.net/pagead/adview?ai=CSEPPQ5OpZflG9eLT_A-wu6qQCISRsKB11si3koUS3bGoyPwQEAEg-833lQFgyYaAgNyjxBCgAaHAmPEoyAEJqQLwon63o6aCPuACAKgDAcgDywSqBJQDT9AczGdukwf5-5NEgwFuzrhW-AeTJi4AMXvb0YZ3ZRf2ZXnmLbv25FS38o0Dh8rSXNfAg1_YsaNUHkKvSaxajNdo8jr8J0S8zuZ9cRZDJVgun6T-TjzgV2Os8AjDSIqR3Dwwc107IgQGNYMQv_8-igVUqPbjj3vh0tkCUf7MuGZsLPd8BqB1omZpoGPjh18XG1JH25ZuH8gFp3ckI8nYHqCV_x3R13qEh0RBIj86Agufl3-pU5Bcf8s7_ghARvrB-JdSTDOoqw8luxaw6w_oPl5sFLBFGYqso6XSs5KV63MHxHFDnnyXuQaFZxiQnTMCAf1SlDhuZMUrDD47vwIz8AzVrudkgYpXD8Y_6iCCsr1_CtF_9gLvMypbfNqNiVCnffFkerKwoobmoAz9oUUdFturmIi0p_rar3SkSG8LD6PF4n3LYZpXYMnCv33puDjjPHAjgQv9IG5NpUzK8CzMJnvvWhdROhF-rs1PYuaYrlbBqsB4pEwAmzJ-K8kzbePA72133GCB5ZBwsAFQn9B3U_WErNPABNrZp9rUBOAEAYgFseuQ6E2SBQQIBBgBkgUECAUYBKAGLoAH8OrpkgSoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAemvhvYBwDyBwUQw_S3AdIIHwiAYRABGB0yAooCOgSAQIBASL39wTpY_92imuzngwOaCf8BaHR0cHM6Ly93d3cudGVtdS5jb20va3VpcGVyL3VuMS5odG1sP3N1Ymo9ZmVlZC11biZfYmdfZnM9MSZfcF9tYXQxX3R5cGU9MSZfcF9qdW1wX2lkPTcyNSZfeF92c3Rfc2NlbmU9YWRnJmxvY2FsZV9vdmVycmlkZT0yMTF-ZW5-VVNEJmdvb2RzX2lkPTYwMTA5OTUxODk2MzY3NCZfcF9yZnM9MSZfeF9hZHNfY2hhbm5lbD1nb29nbGUmX3hfYWRzX3N1Yl9jaGFubmVsPW90aGVyJl94X2JnX2FkaWQ9Z2QyMzUxNzcyLTImdG9waWNfY2xhc3NpZnk9MTI0gAoByAsBogwIKgYKBKy6sQLaDBEKCxDwmKiGqoz-8YIBEgIBA-INEwjGrqOa7OeDAxV18ZQJHbCdCoLYEwvQFQGAFwGyFx8KHQgAEhRwdWItODg5ODA3NjQyMzYwMDM1Mhi435oBshgFGC4iAQA&sigh=0TZWxqcDGRc&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSTgAvHhf_bGfTHC_L3siB3CzdKh7NxTuv0341l9aWyZJho64XqG54Mqq6DO1kf70qC53KBgjBoCdBHxVLCTsQLDvt-RuJ01SEl9r0ryPxVRgB&template_id=494&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x920443c2673c8d5a0000000000000000%22,%222%22:%220x3883f7b54232b3040000000000000000%22,%223%22:%220x207c57166855b6ea0000000000000000%22,%224%22:%220x2428f6bf94a8d0830000000000000000%22,%225%22:%220xbc04a61ea328efda0000000000000000%22},%22debug_key%22:%228538359352806195950%22,%22debug_reporting%22:true,%22destination%22:%22https://temu.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2210974797857%22],%2222%22:[%22true%22],%224%22:[%2201-18%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%225133120168227222321%22}&andc=true

Request Chain 237

https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fsovrn%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID HTTP 307
https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fsovrn%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID&sovrn_retry=true HTTP 307
https://sync.ex.co/v1/setuid/sovrn/?gdpr=0&gdpr_consent=&uid=IA40cLZHRltLm-IYQQGVLM9E

Request Chain 246

https://securepubads.g.doubleclick.net/pagead/adview?ai=CKw3-Q5OpZbhP9eLT_A-wu6qQCOyy97R19_DBreISrcr93wUQASD7zfeVAWDJhoCA3KPEEKABocCY8SjIAQngAgCoAwHIA8sEqgSaA0_Q0kC09ySQV0ltSiU8aWAE8D8dBNbsvs5rzcDhEvK80FEcXC5hsZ_6MH2G1XaiCEKclSZpEzhooF_6tQ3jry0ji3LWMyhdb0cdJihg_cRzCj7It1U74Hc2LelNUJev8InSLW7JrH-kriOZdPNpNbiv4OwEZQQMharEOtG_tTa35TGPx_o_ocfzvXmSsw28RIttxCQItV8wRme5MBkK45vNnzvMMclkFJURW6CofDoOQ9pO5rLalp4tFTBquYaE2QWwytsxxtQ-vmYcYU3gJU0BopTFmTE4q3ebzw34nQ3-uM_LmACaypbz4s2lOKJQeosQ0QRU4P7oJ--lbcVJXGW1H6YNTXnT9mM7u5HECnNq_8r9F2OpBt18GDY49N742P0GbA5mLLRMcEFW5teWfe_yZhqGtFqVF9N9A7HqeccqOaYygXr6m5fyaHuqT1fND_r6rkvTp5YY9LUvIVMoAxYTQocMfVcpLrKck3bftSHJSqMC20oScVQKQz2Zm8uaDj-S3M6567Ar_uMhfUIJb2qLtCYQPk8v5mpBwAT5ptj4vwTgBAGIBbH27txNkgUECAQYAZIFBAgFGASgBi6AB5fft54EqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpr4b2AcA8gcFEL7riwHSCB8IgGEQARgdMgKKAjoEgECAQEi9_cE6WP_doprs54MDmgn_AWh0dHBzOi8vd3d3LnRlbXUuY29tL2t1aXBlci91bjEuaHRtbD9zdWJqPWZlZWQtdW4mX2JnX2ZzPTEmX3BfbWF0MV90eXBlPTEmX3BfanVtcF9pZD03MjUmX3hfdnN0X3NjZW5lPWFkZyZsb2NhbGVfb3ZlcnJpZGU9MjExfmVuflVTRCZnb29kc19pZD02MDEwOTk1MjMyNzM4NzImX3BfcmZzPTEmX3hfYWRzX2NoYW5uZWw9Z29vZ2xlJl94X2Fkc19zdWJfY2hhbm5lbD1vdGhlciZfeF9iZ19hZGlkPWdkMjI0MzgwNS0zJnRvcGljX2NsYXNzaWZ5PTExM4AKAcgLAaIMCCoGCgSsurEC2gwRCgsQgOKih8-m1pC6ARICAQPiDRMIyq6jmuzngwMVdfGUCR2wnQqC2BML0BUBgBcBshcfCh0IABIUcHViLTg4OTgwNzY0MjM2MDAzNTIYuN-aAbIYBRguIgEA&sigh=f1sRFBjVWIA&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSTgAvHhf_bGfTHC_L3siB3CzdKh7NxTuv0341l9aWyZJho64XqG54Mqq6DO1kf70qC53KBgjBoCdBHxVLCTsQLDvt-RuJ01SEl9r0ryPxVRgB&template_id=494&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x920443c2673c8d5a0000000000000000%22,%222%22:%220x80cd908345ad3f330000000000000000%22,%223%22:%220x357742b1cbdb782a0000000000000000%22,%224%22:%220xac77c84f9c8fcdf30000000000000000%22,%225%22:%220xbc04a61ea328efda0000000000000000%22},%22debug_key%22:%228899304513561123781%22,%22debug_reporting%22:true,%22destination%22:%22https://temu.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2210974797857%22],%2222%22:[%22true%22],%224%22:[%2201-18%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%229449010290402784433%22}&andc=true

Request Chain 250

https://securepubads.g.doubleclick.net/pagead/adview?ai=CPqlTQ5OpZbhN9eLT_A-wu6qQCM7pq7Z11IOqrdgSsJfo6IgVEAEg0_mgoAFgyYaAgNyjxBCgAaHAmPEoyAEJqQLwon63o6aCPuACAKgDAcgDywSqBKUDT9C183OC4hlkH28AJ2nSCPt3p1ssJJcN23KkHawN_BOQOKDsiP_GEyhC6wnXW16b61d5LJnf5_XvtL3qx0F9cxp4-xDLDFigb4-bMKq3WUOW_tR5lwNaUjCl9-vFRd-orc87qkAOrby2ztLdYoBiMlJJukwZu8KMRoKzt9VZcGrgbPvlRMX3go6QObtV2gc2cF2Y3mJXcVE9hLrqIOuyuopySDqBSju9YzhNPenfqhEFI7M0Syx05_-ZUFezsrQif0GevRZW58DVVQW_LOy05jx97asixa5jaDcHAJ06SfNJLeDmueRZ3CKQXaJ1A2LadWJTh8lGRGilWfcKSqBFXqyOidrZTFHniDp0YOeEErZU9NPBRNZb-K54Dxx6dTtNeKDC6_xU0ErSoQgWt48RRyqYwMvuKgb2pt_BVyEubjXBt6bJ6iuotVxr7lzgCh1s6dJT89vwAD7uQ9lduxnAwv4BUTsnGr8gCR3D-4yDhYAr4ZQzT_QZz8iQbnIWQrdZ8fd0dF96gPz1BKQ0Gu_8PSsMPbx7mHb7pNCPsq4jhr5IvQCS6sAE1JGDgN0E4AQBiAX5wqvrTZIFBAgEGAGSBQQIBRgEoAYugAfw6umSBKgH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6a-G9gHAPIHBBDHzlvSCB8IgGEQARgdMgKKAjoEgECAQEi9_cE6WP_doprs54MDmgn_AWh0dHBzOi8vd3d3LnRlbXUuY29tL2t1aXBlci91bjEuaHRtbD9zdWJqPWZlZWQtdW4mX2JnX2ZzPTEmX3BfbWF0MV90eXBlPTEmX3BfanVtcF9pZD03MjUmX3hfdnN0X3NjZW5lPWFkZyZsb2NhbGVfb3ZlcnJpZGU9MjExfmVuflVTRCZnb29kc19pZD02MDEwOTk1MTg5NjM2NzQmX3BfcmZzPTEmX3hfYWRzX2NoYW5uZWw9Z29vZ2xlJl94X2Fkc19zdWJfY2hhbm5lbD1vdGhlciZfeF9iZ19hZGlkPWdkMjM1MjE1OS0yJnRvcGljX2NsYXNzaWZ5PTEyNIAKA8gLAaIMCCoGCgSsurEC2gwRCgsQ8NqCpa7L76qnARICAQPiDRMIya6jmuzngwMVdfGUCR2wnQqC2BML0BUBgBcBshcfCh0IABIUcHViLTg4OTgwNzY0MjM2MDAzNTIYuN-aAbIYBRguIgEA&sigh=UgCIlvK5kD4&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSTgAvHhf_bGfTHC_L3siB3CzdKh7NxTuv0341l9aWyZJho64XqG54Mqq6DO1kf70qC53KBgjBoCdBHxVLCTsQLDvt-RuJ01SEl9r0ryPxVRgB&template_id=494&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x920443c2673c8d5a0000000000000000%22,%222%22:%220x3883f7b54232b3040000000000000000%22,%223%22:%220x48483a8d5ea1870a0000000000000000%22,%224%22:%220xeb56c3816ff6bd60000000000000000%22,%225%22:%220xbc04a61ea328efda0000000000000000%22},%22debug_key%22:%2213341876829041177886%22,%22debug_reporting%22:true,%22destination%22:%22https://temu.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2210974797857%22],%2222%22:[%22true%22],%224%22:[%2201-18%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2210431727977102595537%22}&andc=true

Request Chain 259

https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent= HTTP 302
https://cm.adgrx.com/bridge.gif?AG_PID=pubmatic&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=b649efe2-b645-11ee-b9b5-3fb6d9bdb4d0

Request Chain 260

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent= HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA%3D%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=3183321823485965714&gdpr=0&gdpr_consent=

Request Chain 261

https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent= HTTP 303
https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=&_bee_ppp=1 HTTP 303
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFCeS1rN0xVeWNBQUJNcjNiMEtjZw&gdpr=0&gdpr_consent=&bee_sync_partners=pp%2Csyn%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1 HTTP 302
https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=pp%2Csyn%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1 HTTP 303
https://bh.contextweb.com/bh/rtset?ev=AABy-k7LUycAABMr3b0Kcg&do=add&pid=558502&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dsyn%252Csas%252Cpm%26bee_sync_current_partner%3Dpp%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D2&gdpr=0 HTTP 302
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=syn%2Csas%2Cpm&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=2&ev=AABy-k7LUycAABMr3b0Kcg&pid=558502&do=add&gdpr=0 HTTP 303
https://sync.technoratimedia.com/services?uid=AABy-k7LUycAABMr3b0Kcg&srv=cs&pid=73&cb=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26gdpr%3D0%26bee_sync_partners%3Dsas%252Cpm%26bee_sync_current_partner%3Dsyn%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D3&gdpr=0 HTTP 307
https://match.prod.bidr.io/cookie-sync?gdpr=0&gdpr=0&bee_sync_partners=sas%2Cpm&bee_sync_current_partner=syn&bee_sync_initiator=adx&bee_sync_hop_count=3 HTTP 303
https://rtb-csync.smartadserver.com/redir?partneruserid=AABy-k7LUycAABMr3b0Kcg&partnerid=127&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26gdpr%3D0%26bee_sync_partners%3Dpm%26bee_sync_current_partner%3Dsas%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D4%26userid%3DSMART_USER_ID&gdpr=0 HTTP 302
https://match.prod.bidr.io/cookie-sync?gdpr=0&gdpr=0&bee_sync_partners=pm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=4&userid=7622791417290470442&gdpr=0&gdpr_consent= HTTP 303
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AABy-k7LUycAABMr3b0Kcg&gdpr=0&gdpr_consent=

Request Chain 262

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_consent= HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_consent=&_test=ZamTRQAPfxk-rABd

Request Chain 264

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=&us_privacy= HTTP 302
https://x.bidswitch.net/ul_cb/sync?ssp=pubmatic&gdpr=0&gdpr_consent=&us_privacy= HTTP 302
https://t.pswec.com/bsw_sync?ssp=pubmatic&bsw_user_id=96c6ddf7-513b-4126-9761-4d10cf58e68a HTTP 302
https://t.pswec.com/ul_cb/bsw_sync?ssp=pubmatic&bsw_user_id=96c6ddf7-513b-4126-9761-4d10cf58e68a HTTP 302
https://x.bidswitch.net/sync?dsp_id=2&user_id=f6a766a8-8b7e-4e9f-8d98-3b8edd32e99e&expires=3&user_group=1&ssp=pubmatic HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=96c6ddf7-513b-4126-9761-4d10cf58e68a&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=

Request Chain 265

https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=YAnO028Pm997WZrdZg-C2GcJmtx7CZnbZ1oo9K0v

Request Chain 266

https://pm.w55c.net/ping_match.gif?ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent= HTTP 302
https://pm.w55c.net/ping_match.gif?scc=1&ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:yG5yRhqZ1RqzCB5&gdpr=0&gdpr_consent=

Request Chain 267

https://sync.srv.stackadapt.com/sync?nid=11&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=3jTD0qkQUed0i54S8NXORiaEdks&gdpr=0&gdpr_consent=

Request Chain 268

https://beacon.lynx.cognitivlabs.com/pbmtc.gif?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=$UID HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=593b88aa-248d-49b3-85c6-56fe39b9551f&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=${PUBMATIC_UID} HTTP 302
https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=3323BFF6-3BF3-46A9-ACB9-A9533EF59045

Request Chain 270

https://p.rfihub.com/cm?pub=224&in=1&getuid=https%3A//image2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=2810316570158180787

Request Chain 272

https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID} HTTP 302
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}

Request Chain 274

https://t.adx.opera.com/pub/sync?pubid=pub8730968190912 HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU0fe6fc0761e845e18d8cc9a7ca8e8f05

Request Chain 276

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=MyO_9jvzRqmsualTPvWQRQ%3D%3D&gdpr=0&gdpr_consent= HTTP 302
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=

Request Chain 277

https://pixel.tapad.com/idsync/ex/receive?partner_id=3371&partner_device_id=3323BFF6-3BF3-46A9-ACB9-A9533EF59045 HTTP 302
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3371&partner_device_id=3323BFF6-3BF3-46A9-ACB9-A9533EF59045 HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=80ad5170-913a-4544-8c2b-ffeb4f8a8955%252C%252C&gdpr=0&gdpr_consent= HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=85cb6970-04cc-432f-923d-e82232fa0e19&ttd_puid=80ad5170-913a-4544-8c2b-ffeb4f8a8955%2C%2C

Request Chain 279

https://eb2.3lift.com/xuid?mid=7976&xuid=3323BFF6-3BF3-46A9-ACB9-A9533EF59045&dongle=u6nf&gdpr=0&gdpr_consent= HTTP 302
https://eb2.3lift.com/xuid?ld=1&mid=7976&xuid=3323BFF6-3BF3-46A9-ACB9-A9533EF59045&dongle=u6nf&gdpr=0&cmp_cs=&us_privacy=

Request Chain 280

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=MzMyM0JGRjYtM0JGMy00NkE5LUFDQjktQTk1MzNFRjU5MDQ1&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

Request Chain 281

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESECuTvgqpQVvCr6ZBBCy8RjM&google_cver=1

Request Chain 282

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:3BFEEEE8049E4956B53D0775AA0DD639

Request Chain 283

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=85cb6970-04cc-432f-923d-e82232fa0e19&gdpr=0&gdpr_consent=

Request Chain 285

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=3323BFF6-3BF3-46A9-ACB9-A9533EF59045&redir=true&gdpr=0&gdpr_consent= HTTP 302
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-.EHQ9vNE2uXMFWlfIiwP741gYDxUPGQ-~A&gdpr=0

Request Chain 286

https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=19f197e6-5a08-49e5-93d9-7fe7a7ffde05&gdpr=0&gdpr_consent=

Request Chain 287

https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=3323BFF6-3BF3-46A9-ACB9-A9533EF59045&gdpr=0&gdpr_consent= HTTP 302
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=716154ff815c1296&is_secure=true&networkId=17100&version=1&nuid=3323BFF6-3BF3-46A9-ACB9-A9533EF59045&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAHOTa5k3QR2gNZrorYAAAAAAA&expiration=1705698502&nuid=3323BFF6-3BF3-46A9-ACB9-A9533EF59045&is_secure=true&gdpr_consent=&gdpr=0

Request Chain 288

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent= HTTP 302
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=3&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=e336f68a-0027-4deb-bb36-1251c6812c4f-65a99345-5553&gdpr=0&gdpr_consent=

Request Chain 290

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2468686655663211231&gdpr=0&gdpr_consent=&us_privacy=

Request Chain 291

https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R35CAB_10F800616_70478144&r=https://pmp.mxptint.net/sn.ashx?ak=1 HTTP 302
https://pmp.mxptint.net/sn.ashx?ak=1

Request Chain 292

https://creativecdn.com/cm-notify?pi=pubmatic&gdpr=0&gdpr_consent= HTTP 302
https://creativecdn.com/cm-notify?pi=pubmatic&gdpr=0&gdpr_consent=&tc=1 HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNTQmdGw9NDMyMDA%3D&piggybackCookie=245DhAIUKqZlm1HREIEH4TIRbH-EqAzCkMz9f8UWg58&pi=pubmatic&gdpr=0&gdpr_consent=&tc=1

Request Chain 297

https://sync.adotmob.com/cookie/smart?r=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D66%26partneruserid%3D%7Bamob_user_id%7D&gdpr=0&gdpr_consent= HTTP 302
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=66&partneruserid=0a0d220400e269a3d30ed14c&gdpr=0&gdpr_consent=

Request Chain 298

https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=76&partneruserid=GOOGLE_HOSTED_SI&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmartrtb_dbm%26google_cm%26google_sc%26google_hm%3DSMART_USER_ID_B64&gdpr=0&gdpr_consent= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=smartrtb_dbm&google_cm&google_sc&google_hm=NzYyMjc5MTQxNzI5MDQ3MDQ0Mg==&gdpr=0&gdpr_consent= HTTP 302
https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEDZXyiq9Aye6o_qVtX5OU74&gdpr=0&gdpr_consent=&google_cver=1

Request Chain 299

https://s.ad.smaato.net/c/?adExInit=sas&redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D133%26partneruserid%3D$UID&gdpr=0&gdpr_consent= HTTP 302
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=133&partneruserid=1af97f0f5a

Request Chain 300

https://id5-sync.com/i/102/9.gif?gdpr=0&gdpr_consent= HTTP 302
https://id5-sync.com/c/102/0/9/1.gif?gdpr=0&gdpr_consent=&us_privacy= HTTP 302
https://rtb-csync.smartadserver.com/redir/?partnerid=111&partneruserid=ID5-b0dcRQ_oVyh2sad8exQ8E-2DLitnKH_LmvzglLjvhw&redirurl=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F102%2F8%2F2.gif%3Fpuid%3DSMART_USER_ID%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
https://id5-sync.com/c/102/102/8/2.gif?puid=7622791417290470442&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent= HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://id5-sync.com/k/264.gif?puid=85cb6970-04cc-432f-923d-e82232fa0e19&ttl=%%TTL%% HTTP 302
https://ib.adnxs.com/getuid?https://id5-sync.com/c/102/2/6/4.gif?puid=$UID&gdpr=0&gdpr_consent= HTTP 302
https://id5-sync.com/c/102/2/6/4.gif?puid=3183321823485965714&gdpr=0&gdpr_consent= HTTP 302
https://match.prod.bidr.io/cookie-sync/id5?us_privacy= HTTP 303
https://id5-sync.com/k/155.gif?puid=AABy-k7LUycAABMr3b0Kcg&id5AccountNum=155&numCascadesAllowed=9 HTTP 302
https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&bid=1mpr7m0&r=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F123%2F4%2F6.gif%3Fpuid%3D%7BUUID%7D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
https://ps.eyeota.net/match/bounce/?gdpr=0&gdpr_consent=&bid=1mpr7m0&r=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F123%2F4%2F6.gif%3Fpuid%3D%7BUUID%7D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
https://id5-sync.com/c/102/123/4/6.gif?puid=18d1e675009-40cb0000010a42ac&gdpr=0&gdpr_consent= HTTP 302
https://c1.adform.net/serving/cookie/match?party=1135&callback=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F10%2F3%2F7.gif%3Fpuid%3D%5Badformuid%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr_consent=&gdpr=0 HTTP 302
https://c1.adform.net/serving/cookie/match?CC=1&party=1135&callback=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F10%2F3%2F7.gif%3Fpuid%3D%5Badformuid%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr_consent=&gdpr=0 HTTP 302
https://id5-sync.com/c/102/10/3/7.gif?puid=251529046254713408&gdpr=0&gdpr_consent= HTTP 302
https://uipglob.semasio.net/id5/1/get?gdpr=0&gdpr_consent=&_url=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F112%2F2%2F8.gif%3Fpuid%3D%24%7BUIPID%7D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
https://uipglob.semasio.net/id5/1/get2?gdpr=0&gdpr_consent=&_url=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F112%2F2%2F8.gif%3Fpuid%3D%24%7BUIPID%7D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
https://id5-sync.com/c/102/112/2/8.gif?puid=71A29BC1CD4C1337&gdpr=0&gdpr_consent= HTTP 302
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F104%2F1%2F9.gif%3Fpuid%3D%24%7BBSW_UUID%7D%26gdpr%3D0%26gdpr_consent%3D?gdpr=0&gdpr_consent= HTTP 302
https://id5-sync.com/c/102/104/1/9.gif?puid=96c6ddf7-513b-4126-9761-4d10cf58e68a&gdpr=0&gdpr_consent=

Request Chain 313

https://lexicon.33across.com/v1/envelope?pid=0015a00003EkOH8AAN&gdpr=0&src=pbjs&ver=8.27.0&coppa=0&us_privacy=1--- HTTP 307
https://lexicon.33across.com/v1/envelope?pid=0015a00003EkOH8AAN&gdpr=0&src=pbjs&ver=8.27.0&coppa=0&us_privacy=1---&b=1&g=kNPMTNR9jE9pKn8WCh%2BxyUBnRMi%2FGsRH09BDWVhfNj8%3D

Request Chain 322

https://ums.acuityplatform.com/tum?umid=6 HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=878517624059

Request Chain 323

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%3Duid%3A%5BMM_UUID%5D HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:a57165a9-9348-4500-b1ee-9c1d275bdf71&gdpr=0&gdpr_consent=

Request Chain 324

https://gocm.c.appier.net/pubmatic HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=k4AqdWscDXKfeTi0SZOpZQ

Request Chain 325

https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent= HTTP 302
https://sync.1rx.io/usersync2/pubmatic?zcc=1&cb=1705612104757 HTTP 302
https://ad.turn.com/r/cs?pid=45&rndcb=5579929053 HTTP 302
https://sync.1rx.io/usersync/turn/2468686655663211231?dspret=1&gdpr=&gdpr_consent=&us_privacy= HTTP 302
https://sync.targeting.unrulymedia.com/csync/RX-39daf66e-a751-4b29-b210-c7f2d4eff874-005?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%3D%26piggybackCookie%3DRX-39daf66e-a751-4b29-b210-c7f2d4eff874-005 HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-39daf66e-a751-4b29-b210-c7f2d4eff874-005

Request Chain 329

https://px.owneriq.net/epm?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=$UID HTTP 302
https://px.owneriq.net/ecc?redir=https%3a%2f%2fsimage2.pubmatic.com%2fAdServer%2fPug%3fvcode%3dbz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw%26piggybackCookie%3dQ7588985041424638528&uid=Q7588985041424638528&ref=%2Fepm HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7588985041424638528

Request Chain 330

https://um.simpli.fi/pm_match?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:3BFEEEE8049E4956B53D0775AA0DD639&gdpr=0&gdpr_consent=

Request Chain 332

https://pixel.tapad.com/idsync/ex/receive?partner_id=3371&partner_device_id=3323BFF6-3BF3-46A9-ACB9-A9533EF59045 HTTP 302
https://secure.adnxs.com/getuid?https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DAPPNEXUS%26partner_device_id%3D%24UID%26pt%3D80ad5170-913a-4544-8c2b-ffeb4f8a8955%252C%252C HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=3183321823485965714&pt=80ad5170-913a-4544-8c2b-ffeb4f8a8955%2C%2C

Request Chain 333

https://thrtle.com/insync?vxii_pid=10067&vxii_pdid=3323BFF6-3BF3-46A9-ACB9-A9533EF59045&gdpr=0&gdpr_consent= HTTP 302
https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=3323BFF6-3BF3-46A9-ACB9-A9533EF59045&vxii_pid=12&vxii_pid1=10067&vxii_rcid=39fc32f7-58ba-49b0-a0a4-fd760e31a9ce

Request Chain 336

https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COOKIES%20HERE]&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=251529046254713408

Request Chain 337

https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:adc61289-53ba-4e86-ac30-d450546d86e3&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw

Request Chain 338

https://ssum-sec.casalemedia.com/usermatch?s=190719&cb=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fix%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D HTTP 302
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fix%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D&s=190719&C=1

Request Chain 341

https://i.liadm.com/s/31327?bidder_id=14481&bidder_uuid=ZamTSSAc3vAuHgXs6YjuzgAA%261505&gpdr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid= HTTP 303
https://i.liadm.com/s/31327?gdpr_consent=&bidder_id=14481&gpp=&bidder_uuid=ZamTSSAc3vAuHgXs6YjuzgAA%261505&_li_chk=true&gpp_sid=&us_privacy=&gpdr=&previous_uuid=e9de37b1d06b4e8eb73739706d2a5012 HTTP 303
https://dis.criteo.com/dis/usersync.aspx?r=77&p=311&cp=liveintent&cu=1&url=https://i.liadm.com/s/28292?bidder_id%3D71340%26bidder_uuid%3D@@CRITEO_USERID@@

Request Chain 342

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=ZamTSSAc3vAuHgXs6YjuzgAA HTTP 302
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEBALoZLJJPRtzT23yMJRYLo&google_cver=1

Request Chain 343

https://match.adsrvr.org/track/cmf/casale HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=85cb6970-04cc-432f-923d-e82232fa0e19&expiration=1708204105&gdpr=0&gdpr_consent=

Request Chain 345

https://b1sync.zemanta.com/usersync/index/?us_privacy=&gdpr=&gdpr_consent=&gpp=&gpp_sid= HTTP 302
https://b1sync.zemanta.com/usersync/index/?gdpr=&gdpr_consent=&gpp=&gpp_sid=&s=2&us_privacy= HTTP 302
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=17&external_user_id=D759ryQnEq12gH6gSRSG

Request Chain 346

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZamTSSAc3vAuHgXs6YjuzgAABeEAAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid= HTTP 302
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEPYQl0fPOdXSDiu33NjtQU4&google_cver=1

Request Chain 347

https://pm.w55c.net/ping_match.gif?ei=CASALE&rurl=https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=_wfivefivec_ HTTP 302
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=yG5yRhqZ1RqzCB5

Request Chain 348

https://sync.mathtag.com/sync/img?mt_exid=15&redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D3%26external_user_id%3D%5BMM_UUID%5D&us_privacy=&gdpr=&gdpr_consent= HTTP 302
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=a57165a9-9348-4500-b1ee-9c1d275bdf71&gdpr=&gdpr_consent=

Request Chain 350

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=17136_2&endpoint=us-east HTTP 301
https://eus.rubiconproject.com/usync.html?p=17136_2&endpoint=us-east

Request Chain 353

https://u.openx.net/w/1.0/cm?id=f0686912-7fb3-48f6-be19-4d168ad880c0&r=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fopenx%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D HTTP 302
https://sync.ex.co/v1/setuid/openx/?gdpr=0&gdpr_consent=&uid=ff5dfe1b-5bec-4fe8-b367-cb87cbb9531d

Request Chain 354

https://sync.1rx.io/usersync2/rmpssp?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Funruly%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D%5BRX_UUID%5D HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=6597291732 HTTP 302
https://sync.1rx.io/usersync/tradedesk/85cb6970-04cc-432f-923d-e82232fa0e19 HTTP 302
https://sync.targeting.unrulymedia.com/csync/RX-39daf66e-a751-4b29-b210-c7f2d4eff874-005?redir=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Funruly%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DRX-39daf66e-a751-4b29-b210-c7f2d4eff874-005 HTTP 302
https://sync.ex.co/v1/setuid/unruly/?gdpr=0&gdpr_consent=&uid=RX-39daf66e-a751-4b29-b210-c7f2d4eff874-005

Request Chain 355

https://ads.stickyadstv.com/user-matching?id=3684&gdpr=0&gdpr_consent= HTTP 302
https://sync.ex.co/v1/setuid?bidder=freewheel&gdpr=0&gdpr_consent=&uid=53c5ceda6637e64da370ad898fc18a73

Request Chain 357

https://secure.adnxs.com/getuid?https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fappnexus%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID HTTP 302
https://sync.ex.co/v1/setuid/appnexus/?gdpr=0&gdpr_consent=&uid=3183321823485965714

Request Chain 358

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=17136_2&us_privacy=1---&khaos=LRJPET5D-7-DZFZ HTTP 302
https://sync.ex.co/v1/setuid?bidder=rubicon&gdpr=&gdpr_consent=&uid=LRJPET5D-7-DZFZ&us_privacy=1---

Request Chain 359

https://pixel.rubiconproject.com/exchange/sync.php?p=a9us&us_privacy=1--- HTTP 302
https://s.amazon-adsystem.com/ecm3?id=LRJPET5D-7-DZFZ&ex=d-rubiconproject.com&status=ok&us_privacy=1---

Request Chain 360

https://token.rubiconproject.com/token?pid=36584&us_privacy=1--- HTTP 302
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LRJPET5D-7-DZFZ&us_privacy=1---

Request Chain 361

https://match.adsrvr.org/track/cmf/rubicon?us_privacy=1--- HTTP 302
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=85cb6970-04cc-432f-923d-e82232fa0e19&gdpr=0&gdpr_consent=&expires=30

Request Chain 362

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc&us_privacy=1--- HTTP 302
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEOyQ-lndEBhH4YbdUfcYYgo&google_cver=1

Request Chain 363

https://token.rubiconproject.com/token?pid=2249&pt=n&us_privacy=1--- HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NjhkMGE2OTU1MWNkYzkzODcyOTA2NGFiMTdiZTdjMzg1N2I1NDQxZg&us_privacy=1---

Request Chain 364

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&us_privacy=1--- HTTP 302
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=Bd6BZlbzRQ2shuJTdxeeBg&rk=usync-na

Request Chain 366

https://token.rubiconproject.com/token?pid=25470&us_privacy=1--- HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TFJKUEVUNUQtNy1EWkZa&us_privacy=1--- HTTP 302
https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEG_I1BRsqaJNTjbQ0byg50I&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFJKUEVUNUQtNy1EWkZa&google_push=

Request Chain 368

https://match.prod.bidr.io/cookie-sync/rp?bee_sync_partners=rp&us_privacy=1--- HTTP 303
https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AABy-k7LUycAABMr3b0Kcg&expires=30

Request Chain 369

https://pixel.rubiconproject.com/exchange/sync.php?p=primis&us_privacy=1--- HTTP 302
https://live.primis.tech/live/liveCS.php?source=external&advId=100&advUuid=LRJPET5D-7-DZFZ&us_privacy=1--- HTTP 301
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=LRJPET5D-7-DZFZ HTTP 302
https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=LRJPET5D-7-DZFZ&ckls=true&ci=C502czYG0X&nc=false&trid=-1065313975

Request Chain 370

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-apn&us_privacy=1--- HTTP 302
https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=LRJPET5D-7-DZFZ&us_privacy=1---

Request Chain 371

https://sync.ipredictive.com/d/sync/cookie/generic?https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=${ADELPHIC_CUID}&expires=30&us_privacy=1--- HTTP 302
https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=19f197e6-5a08-49e5-93d9-7fe7a7ffde05&expires=30&us_privacy=1---

Request Chain 372

https://pixel.rubiconproject.com/exchange/sync.php?p=19564&us_privacy=1--- HTTP 302
https://capi.connatix.com/us/pixel?puid=LRJPET5D-7-DZFZ&pId=11&gdpr=&gdpr_consent=&us_privacy=&us_privacy=1--- HTTP 302
https://capi.connatix.com/us/pixel?puid=LRJPET5D-7-DZFZ&pId=11&gdpr=&gdpr_consent=&us_privacy=&us_privacy=1---&final=true

Request Chain 373

https://pixel.rubiconproject.com/exchange/sync.php?p=sovrn&us_privacy=1--- HTTP 302
https://ce.lijit.com/merge?pid=80&3pid=LRJPET5D-7-DZFZ&us_privacy=1---

Request Chain 374

https://pixel.rubiconproject.com/exchange/sync.php?p=18694&us_privacy=1--- HTTP 302
https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=LRJPET5D-7-DZFZ&us_privacy=1---

Request Chain 375

https://vop.sundaysky.com/sync/dmp?redirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fsundaysky%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D%24%7Bssky_uuid%7D HTTP 302
https://vop.sundaysky.com/sync/dmp?redirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fsundaysky%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D%24%7Bssky_uuid%7D&_cvt=t HTTP 302
https://sync.ex.co/v1/setuid/sundaysky/?gdpr=0&gdpr_consent=&uid=d6.e8c4929cd7ff46ee9b53c686734ba682

407 HTTP transactions
16 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/
Redirect Chain

http://mailz.leafybranch.com/index.php/campaigns/me963742dk959/track-url/eo6838hvma0bd/52b330b7d87bbbc4f45470de30a4943ecbf5277a
https://mailz.leafybranch.com/index.php/campaigns/me963742dk959/track-url/eo6838hvma0bd/52b330b7d87bbbc4f45470de30a4943ecbf5277a
https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular

52 KB
14 KB

245ms
145ms

Document
text/html

2606:4700:3030::6815:2278
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3030::6815:2278 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b4225a555536c696681f60b3b8b9417d99b2e3247e5a956f67e8b55a486910af

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8479cff68a3e3712-MIA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Thu, 18 Jan 2024 21:08:17 GMT
fastcgi-cache: BYPASS
link: <https://freedomheadlines.com/wp-json/>; rel="https://api.w.org/" <https://freedomheadlines.com/wp-json/wp/v2/posts/28724>; rel="alternate"; type="application/json" <https://freedomheadlines.com/?p=28724>; rel=shortlink
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CTpq3aorUxolapXnKjWKWLjOgZp32%2FrNuFLfE9yF96%2BfqU%2BkpOZbD3%2FpXTZB0OwLe%2B1W4awtbce6bchkEt6ml7H%2FvaDTOSsRHIFoShXwtCzbGiW4ZfkQ6ZryiZVv3BXw1eHy%2FkxhORv%2FAvsIAm9YRI08sA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block

Redirect headers

Cache-Control: no-store, no-cache, must-revalidate post-check=0, pre-check=0
Connection: Keep-Alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Date: Thu, 18 Jan 2024 21:08:16 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Keep-Alive: timeout=5, max=100
Last-Modified: Thu, 18 Jan 2024 21:08:16 GMT
Location: https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Pragma: no-cache
Referrer-Policy: no-referrer
Server: Apache/2.4.56 (Debian)
X-Content-Type-Options: nosniff
X-Frame-Options: deny
X-Robots-Tag: noindex
X-XSS-Protection: 1; mode=block

GET
H2 200 style.min.css
freedomheadlines.com/wp-includes/css/dist/block-library/ 81 KB
12 KB 113ms
78ms Stylesheet
text/css 2606:4700:3030::6815:2278
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://freedomheadlines.com/wp-includes/css/dist/block-library/style.min.css?ver=5.9.8

Requested by

Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3030::6815:2278 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cdbdaa122823601390c7dcbdd1afde33c2f1a432b8c5ff025c6137ee99ba541a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 643246
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Fri, 21 Oct 2022 02:17:02 GMT
server: cloudflare
etag: W/"6352011e-145db"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3rn9yqUuveujOJNkXNlm6QZwkGcN9ZaNC1SrtS9n58%2FCpGmSpwwvjIK760RAnwOzkS%2BhitRSfjImFBtA7IDwhlf3a0WeA%2FsmlEe5aJUoDZledt0sTJ77Ib%2BS0xZUqJ2HdVNWLYYmioM6Q2MU7oQNnSIv4w%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000
cf-ray: 8479cff7bbb13712-MIA
expires: Sat, 30 Nov 2024 07:47:56 GMT

GET
H2 200 mediaelementplayer-legacy.min.css
freedomheadlines.com/wp-includes/js/mediaelement/ 11 KB
3 KB 109ms
75ms Stylesheet
text/css 2606:4700:3030::6815:2278
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://freedomheadlines.com/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css?ver=4.2.16

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3030::6815:2278 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5908588
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Fri, 21 Oct 2022 02:17:01 GMT
server: cloudflare
etag: W/"6352011d-2bf8"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vJuTokdyM%2BYkMXkiup6u1xlDL53AopAhZm1qvXl%2B2%2FsejzkSOWX00%2BEJu2Z%2Fyt%2FINbbUE8TwEIGhkh3P0DEcNhJmCuMAHvi8AV%2F1eH%2FQbX%2F%2BahssW%2BYSTBhKMzY5LXCM2RJlBrcqi0eHEfhfgGrkY%2FyN4Q%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000
cf-ray: 8479cff7bbb23712-MIA
expires: Thu, 07 Nov 2024 13:02:07 GMT

GET
H2 200 wp-mediaelement.min.css
freedomheadlines.com/wp-includes/js/mediaelement/ 4 KB
1 KB 70ms
36ms Stylesheet
text/css 2606:4700:3030::6815:2278
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://freedomheadlines.com/wp-includes/js/mediaelement/wp-mediaelement.min.css?ver=5.9.8

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3030::6815:2278 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5908588
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Fri, 21 Oct 2022 02:17:02 GMT
server: cloudflare
etag: W/"6352011e-105a"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oYf5G4sYjxc2fcbbo2FNnRDtv9Et206jM0h3X2Jq9ik7tSfx9H3tcZsYZ4PgLo2NFCsnTU3lHUi0j3TaTu5ns5giulcddhHKVCeLufu5QlxHdCKGaIt0tLtc2iPy%2FtrY6MbmJwV4tuHkc5okmbhbf2qyyA%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000
cf-ray: 8479cff7bbb33712-MIA
expires: Wed, 30 Oct 2024 14:37:08 GMT

GET
H2 200 components.css
freedomheadlines.com/wp-content/themes/breena/inc/assets/css/ 52 KB
10 KB 79ms
46ms Stylesheet
text/css 2606:4700:3030::6815:2278
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://freedomheadlines.com/wp-content/themes/breena/inc/assets/css/components.css?ver=5.9.8

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3030::6815:2278 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

76bbe117102ce802cd20b57f9722133d7924bb3395bfe201f8f0b515a81c46dc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4180493
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Fri, 21 Oct 2022 02:17:19 GMT
server: cloudflare
etag: W/"6352012f-cf80"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mR8erYFZVyI4dxPRRp07aYpTM4APFCoQ0aOuwKhNIwUjVABjYcu7dlfvjl5oYPZbuWmkSgWMGivUQqSzAMH%2B6YGclZQyD9HBuI7Jlm8zSe7vC51dSaXQI86wXjgbyrKtcLUHStYNjEW8MqzCMhcHZM1%2FyQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000
cf-ray: 8479cff7bbb53712-MIA
expires: Wed, 27 Nov 2024 08:12:53 GMT

GET
H2 200 style.css
freedomheadlines.com/wp-content/themes/breena/ 106 KB
19 KB 80ms
47ms Stylesheet
text/css 2606:4700:3030::6815:2278
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://freedomheadlines.com/wp-content/themes/breena/style.css?ver=5.9.8

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3030::6815:2278 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f673a8adc98789a6eca1dd65c67fb782787f2571ba2730bb8c5f69bea7b5bc0f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4185293
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Fri, 21 Oct 2022 01:58:37 GMT
server: cloudflare
etag: W/"6351fccd-1a9ae"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LoE%2BRHCgUQT8%2B4BNywiEFhmzDQiRFaYOlKopFyGjVAgGWEh1v0qt36xHbqoly98X76su7cwss6Pt%2Fs8HX%2FSFzTIHcqEfuE5ciG7613Wd9jpYwx1dsBnk73KgBwB%2FA0UGJzDtH6wBiBcvTWc%2BMcH%2FuRRnMg%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000
cf-ray: 8479cff7bbb73712-MIA
expires: Sat, 09 Nov 2024 08:06:12 GMT

GET
H2 200 responsive.css
freedomheadlines.com/wp-content/themes/breena/inc/assets/css/ 15 KB
3 KB 73ms
40ms Stylesheet
text/css 2606:4700:3030::6815:2278
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://freedomheadlines.com/wp-content/themes/breena/inc/assets/css/responsive.css?ver=5.9.8

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3030::6815:2278 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a2e99d9f642cf26e56bad3ff3705fd8ab8ea028ffa302405d1642bb7456d796a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5908588
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Fri, 21 Oct 2022 02:17:19 GMT
server: cloudflare
etag: W/"6352012f-3c33"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=giJCaQSIrGDKbRc3ybZyxZE8Pt5gaEhtj3mYm%2B7L6k4Ild2GKJK8iZlYSnVsykFF%2FXa1kyPdEJQuBfe3veULzWjTx4ibR85FzLpA5fU%2B9XnwhONfU1tpg5X5gd1BS8%2FFgResGlIM4igKjwQ%2FI%2BaO1QZhDQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000
cf-ray: 8479cff7bbb83712-MIA
expires: Sat, 12 Oct 2024 07:41:08 GMT

GET
H2 200 font-awesome.min.css
freedomheadlines.com/wp-content/themes/breena/inc/assets/css/font-awesome/css/ 30 KB
7 KB 111ms
79ms Stylesheet
text/css 2606:4700:3030::6815:2278
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://freedomheadlines.com/wp-content/themes/breena/inc/assets/css/font-awesome/css/font-awesome.min.css?ver=5.9.8

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3030::6815:2278 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4442287
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Fri, 21 Oct 2022 02:17:20 GMT
server: cloudflare
etag: W/"63520130-7918"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zI7d6H9G%2ByRT98ehjFb%2Fyl70QBhGTEXTyaXRAtaKZMTYPzmpp9iTLhwFwSmm7FcA5J6AIZoLAoU81iMy1Th%2FgxCNLyDwajM04Ir4ry374Bv8z5Oy2CpBQBXPKmxSa0aR5hNuiXMHClBex5%2FU5ca8OcPYhA%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000
cf-ray: 8479cff7bbbb3712-MIA
expires: Wed, 13 Nov 2024 10:02:41 GMT

GET
H2 200 css
fonts.googleapis.com/ 58 KB
3 KB 263ms
81ms Stylesheet
text/css 2607:f8b0:4006:823::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans%3A400%2C300%2C300italic%2C400italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%7CLato%3A300%2C300i%2C400%2C700&subset=latin%2Clatin-ext

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::200a Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

253ce4a3cb84db5cb5505c8843c26aebe9d5e4c1bfbd36496e75c5f1964295b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 18 Jan 2024 21:08:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 18 Jan 2024 21:08:17 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 18 Jan 2024 21:08:17 GMT

GET
H2 200 jquery.min.js Show response
freedomheadlines.com/wp-includes/js/jquery/ 87 KB
32 KB 104ms
76ms Script
application/javascript 2606:4700:3030::6815:2278
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://freedomheadlines.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3030::6815:2278 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4173886
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Fri, 21 Oct 2022 02:17:02 GMT
server: cloudflare
etag: W/"6352011e-15db1"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DJ5LZQyZnDjOJVwJbci3eRY1mfNfyDaHCqRZrZBuhWTSsZxplx7JunS0zY2dmqBnn0jJnja8mhEket14wwEr2qOqYdPG%2FlM0b5hukcB5Bx01Ap5Ewbigkn8HdwYlceuPOmBkB%2Fn5Q65ZNtbR6x8hbcfpAQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000
cf-ray: 8479cff7bbbc3712-MIA
expires: Mon, 11 Nov 2024 13:10:50 GMT

GET
H2 200 jquery-migrate.min.js Show response
freedomheadlines.com/wp-includes/js/jquery/ 11 KB
5 KB 73ms
45ms Script
application/javascript 2606:4700:3030::6815:2278
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://freedomheadlines.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3030::6815:2278 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4166876
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Fri, 21 Oct 2022 02:17:04 GMT
server: cloudflare
etag: W/"63520120-2bd8"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nvIAnnn0ImPb3dvlTMONpfTJueXhJkYnMxGg1lRe3%2Frh6cErq%2BnF7dR1uU%2F2JBxHdMfryGgTmenyAXGkt02hWMJwLgjKheKXaGpZvDHpZhjPdMCr7Xa7fx4umei9O4vDnlWAwOgJuXahptN%2Byw8hDtg%2B1g%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000
cf-ray: 8479cff7bbbd3712-MIA
expires: Thu, 28 Nov 2024 12:19:58 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 98 KB
30 KB 275ms
120ms Script
text/javascript 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6a5980687e6ec1aa28eb1dbf3563916cf73aa91d5cdcbdf20c48897329587396

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:17 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29786
x-xss-protection: 0
server: cafe
etag: 866 / 19740 / m202401110101 / config-hash: 592410556507893453
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Thu, 18 Jan 2024 21:08:17 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 188 KB
68 KB 236ms
83ms Script
application/javascript 2607:f8b0:4006:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-32644619-11

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::2008 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

6f6002fc0901355f5d4641724dfbaaff5132108ba021d29b69f9ed9000ea20d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:17 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 69371
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 18 Jan 2024 21:08:17 GMT

GET /
users.api.jeeng.com/users/domains/mO6DXK83XA/sdk/ 0
0

GET
H2 200 FH-2021-sized-1.jpg
freedomheadlines.com/wp-content/uploads/2021/01/ 28 KB
28 KB 65ms
38ms Image
image/jpeg 2606:4700:3030::6815:2278
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://freedomheadlines.com/wp-content/uploads/2021/01/FH-2021-sized-1.jpg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3030::6815:2278 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e5f4f96e32a749a3c07b566aceb9b84a8445c71ca9713a4bfce9b7d28731fc33

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4364064
alt-svc: h3=":443"; ma=86400
content-length: 28587
x-xss-protection: 1; mode=block
last-modified: Fri, 21 Oct 2022 01:55:25 GMT
server: cloudflare
etag: "6351fc0d-6fab"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2QxGAtcS4DUFdl3DnYSOeh8EDQhSJnL9KJPTgrYNFJ1%2F1vaYbgSNefpDOcZsaOZDJdFFaOrSThUlF%2FmkTm1aZTSWga%2F6C85Im24%2BGkvS%2FMLDBg%2FtK4VtQCKkeD9z6a4FFTe0Es9%2F4ja3Lfbgbbd3Vf0XcQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 8479cff7bbbf3712-MIA
expires: Tue, 12 Nov 2024 11:19:06 GMT

GET
H2 200 gop-candidates2-800x450.jpg
freedomheadlines.com/wp-content/uploads/2023/10/ 68 KB
68 KB 210ms
184ms Image
image/jpeg 2606:4700:3030::6815:2278
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://freedomheadlines.com/wp-content/uploads/2023/10/gop-candidates2-800x450.jpg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3030::6815:2278 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

01da0561b2abfe213f4e1a84a6fe3689116613853701c436c3245e6e9bd942c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 69293
x-xss-protection: 1; mode=block
last-modified: Tue, 17 Oct 2023 18:30:20 GMT
server: cloudflare
etag: "652ed2bc-10ead"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h3DK5bBtcUM7eZwYdScRLIqIdE0y0OuDVaE9TWtEe8U9h9mTeY8zJ%2F6B9ObtwWPnIMWxszZthhvdF4fqWoiPPEPB8CVGvw2CDEq1gDctZPdjeUvz8ZPtEs1ViZXM5xDeHAHQS5I5w4P5YLXegAzHJRWoBg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 8479cff7ebef3712-MIA
expires: Mon, 06 Jan 2025 03:48:15 GMT

GET
H2 200 gop-candidates2-650x366.jpg
freedomheadlines.com/wp-content/uploads/2023/10/ 49 KB
49 KB 124ms
113ms Image
image/jpeg 2606:4700:3030::6815:2278
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://freedomheadlines.com/wp-content/uploads/2023/10/gop-candidates2-650x366.jpg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3030::6815:2278 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

66bcd2ce8f253d54f2806a1aa1c696086c74b1a7caf5d8492e4faa1424c62adc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 50193
x-xss-protection: 1; mode=block
last-modified: Tue, 17 Oct 2023 18:30:20 GMT
server: cloudflare
etag: "652ed2bc-c411"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fGlwEQtQlVwVOMdiIm4SyLkMOjtIA7OR8Q9oDJKG4yZ50utPTOzy3kr%2FZWr5ytwaK%2FAIqIghJ4ccTRMAmgcrDD%2FlGDcJLON%2BcC4rPrmGlC%2Bx9gaAA4kTj6e9TpBhWB3%2Bf3yN99DfoxbmfjXmkUi5WWWuUQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 8479cff81c2c3712-MIA
expires: Sun, 12 Jan 2025 01:16:57 GMT

GET
H2 200 widget_v3.js Show response
cdn.whizzco.com/scripts/widget/ 7 KB
3 KB 169ms
38ms Script
application/javascript 2606:4700:e6::ac40:ce23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.whizzco.com/scripts/widget/widget_v3.js
Requested by: Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:ce23 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4d8562efd8364015edd8080e72d8bd98f0a92019058f15df14e03f9951e01876

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:17 GMT
via: 1.1 af68fd87ee6cdda16f897e9bf046dd8e.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: MIA3-P4
age: 1763
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Sun, 05 Mar 2023 13:26:38 GMT
server: cloudflare
etag: W/"af75195749ffac29c536aae88fdbda39"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=t1L0gprvAkpOZKhdxJFzbIVnujjsgVdAl4VlSMLoTD%2FPMLGvvG605iiIQP%2FAvlnXVbuL4VIaAGbA%2BRkF7xikzV9wuAdTDGOBvjXAE31tJBcDMATVAUoHqJLY2XoGuO7xSkjTxGzYnuw79UbDqA8%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 8479cffa38768de5-MIA
x-amz-cf-id: xgqK9dBtEwfwTL_jUlIfhZXmHhhieKTGICPmqERPF74i2PxDqEm-9g==

GET
H3 200 email-decode.min.js Show response
freedomheadlines.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
1 KB 55ms
43ms Script
application/javascript 2606:4700:3030::6815:2278
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://freedomheadlines.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:2278 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 05 Jan 2024 17:29:47 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"65983c8b-4d7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kYUGoU6LfM9tgYl%2BIVGgx0uue6ShJ1BTS%2Fesb7b2x9ZqoIhgA9L%2Fk%2Fnp4NRrp%2FxZ%2BD4r9ySJ88z3LS0SHzC564Di4NiSRAj9tu52VkYlKkD%2Fp5e3KLy4xkColXMOt2cBGXT2JIcDn4r2aSM6cZFa3m22dw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-frame-options: DENY
cache-control: max-age=172800, public
cf-ray: 8479cff91c164c2d-MIA
expires: Sat, 20 Jan 2024 21:08:17 GMT

GET
H2 200 freedomheadlines_freedomheadlines_sticky.js Show response
cdn1.lockerdomecdn.com/embeds/ 1003 B
1 KB 264ms
71ms Script
application/javascript 2600:9000:21dd:0:b:6268:b880:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn1.lockerdomecdn.com/embeds/freedomheadlines_freedomheadlines_sticky.js
Requested by: Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21dd:0:b:6268:b880:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2bcf7c31dad5a7352c5b9750d4e991939473441aef5d9ea22c036a47df0e1dca

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-amz-version-id: 2FslkIyxepjVYcj6UqIyjxnPoJ3KBM3m
date: Thu, 18 Jan 2024 13:34:29 GMT
via: 1.1 4e3df844337032b56b8434990b0f76ca.cloudfront.net (CloudFront)
last-modified: Thu, 05 Jan 2023 17:31:35 GMT
server: AmazonS3
x-amz-cf-pop: EWR53-C2
age: 27229
x-amz-server-side-encryption: AES256
etag: "c33cc7321d972455c359a8bc75ba8455"
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 1003
x-amz-cf-id: wd4Ak9VhxokjXhljR2clBAgc56WHEJ--HzTQsWx_QYsNOaFqO-yMtg==

GET
H3 200 components.js Show response
freedomheadlines.com/wp-content/themes/breena/inc/assets/js/ 241 KB
67 KB 65ms
63ms Script
application/javascript 2606:4700:3030::6815:2278
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://freedomheadlines.com/wp-content/themes/breena/inc/assets/js/components.js?ver=5.9.8

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:2278 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e1bcf2aae786aa72292ec28f330390b1e324f4c273f9ca993150b5163620d862

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5908588
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Fri, 21 Oct 2022 02:17:20 GMT
server: cloudflare
etag: W/"63520130-3c5ec"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NyNDJPH0qUgT1qRDS9X77oyXDUjCXk3hW%2FqHzRqf%2BDcAqo05NIApZxIDz47iGVmqIqR9PyPvgGqUBiB0hdwqLb9e4S8Rp7oy8d4KRvgU9OujizWh95MWzLtM6A1UC%2B2fxUpmCzAhu97Gm%2FgJGOaD0xKXtA%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000
cf-ray: 8479cff91c274c2d-MIA
expires: Sat, 12 Oct 2024 07:41:08 GMT

GET
H3 200 breena.js Show response
freedomheadlines.com/wp-content/themes/breena/inc/assets/js/ 13 KB
5 KB 129ms
125ms Script
application/javascript 2606:4700:3030::6815:2278
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://freedomheadlines.com/wp-content/themes/breena/inc/assets/js/breena.js?ver=5.9.8

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:2278 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f6f14681142e16db6027f013840dc46f68cce2f3c5ccf8814d2361d06b5127d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4185293
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Fri, 21 Oct 2022 02:17:18 GMT
server: cloudflare
etag: W/"6352012e-356e"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=k7tyZvO1%2FVz6YqBEdpdzmYFW5OyVTJmI7wC9U0RF%2FvQoVNC2Tif7bu7OQUXSeaI4RRqC%2FmXbPTRKV%2BKhAX35atjDOCNb8L2gEnPPGfNvjXtQ3gmGyKiQKmQF2wHqmGCVu2lTwGgZTUwQpz8zWRVpYj6iDw%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000
cf-ray: 8479cff97ce04c2d-MIA
expires: Wed, 27 Nov 2024 08:12:54 GMT

GET
H3 200 mediaelement-and-player.min.js Show response
freedomheadlines.com/wp-includes/js/mediaelement/ 154 KB
38 KB 129ms
126ms Script
application/javascript 2606:4700:3030::6815:2278
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://freedomheadlines.com/wp-includes/js/mediaelement/mediaelement-and-player.min.js?ver=4.2.16

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:2278 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

443ba0af7a7ed827223c7fb3c008c02b9ff1d651b6492e9c270378b07d9f6008

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5895489
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Fri, 21 Oct 2022 02:17:04 GMT
server: cloudflare
etag: W/"63520120-267aa"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xuDnd8NMlnQDXxi9q3w3sKBmqPDWtGmje%2BXKJJoWEtFrEPEdH2QQxCEP%2FXuDULbKdR%2BUbK3wyBkncRAQC0uCB1GwdFma4CPXtR0lOzUZVL6CJUrEbeOKiNo%2FlTOXUzJCHEdiBEL8qxjt4c4qs2gYeMOAHg%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000
cf-ray: 8479cff97ce44c2d-MIA
expires: Wed, 30 Oct 2024 09:46:59 GMT

GET
H3 200 mediaelement-migrate.min.js Show response
freedomheadlines.com/wp-includes/js/mediaelement/ 1 KB
1 KB 158ms
155ms Script
application/javascript 2606:4700:3030::6815:2278
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://freedomheadlines.com/wp-includes/js/mediaelement/mediaelement-migrate.min.js?ver=5.9.8

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:2278 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7f34b768792b90cf0b04fced2470e43d8fab7644f6565d5178fbfb49c4859cee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5908588
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Fri, 21 Oct 2022 02:17:04 GMT
server: cloudflare
etag: W/"63520120-4a9"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XjHE%2Bv9ZrZKkJL3X5AvlEyvWoWhbvt31axWouO%2BgEy%2Fv9Tbj68XFHprbC7%2BXb99QqXr6AZZ9ZZPI5ZHSTYqEQhj%2Frn%2FrO5b1ojlPFWrF1XvIXA2jDSK6P8rVWXloJ%2Feuqow%2BRxWPwvr3lYM0grr0onlzlA%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000
cf-ray: 8479cff97ce74c2d-MIA
expires: Sat, 09 Nov 2024 09:10:39 GMT

GET
H3 200 wp-mediaelement.min.js Show response
freedomheadlines.com/wp-includes/js/mediaelement/ 906 B
993 B 158ms
156ms Script
application/javascript 2606:4700:3030::6815:2278
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://freedomheadlines.com/wp-includes/js/mediaelement/wp-mediaelement.min.js?ver=5.9.8

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:2278 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3e6131330963c472b950b8aaf544ba3829735b8ccb103d614ba7793e3a786550

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4435181
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Fri, 21 Oct 2022 02:17:04 GMT
server: cloudflare
etag: W/"63520120-38a"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0s6RJ%2BgOXrecVmYqi7QEscDE%2Bx4%2FduO3qdVaz9NcmcSSrURK5cpHMSkmneGr9YlyLvK2adlGzatVJ963FWNK%2BeaaRnEB7LLpJyBUWrgEchNwv%2B3614Krt509yvDwNJCT8dU7033D37zuHD%2BnSCabx3E7tQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000
cf-ray: 8479cff97ceb4c2d-MIA
expires: Tue, 12 Nov 2024 11:03:38 GMT

GET
H3 200 comment-reply.min.js Show response
freedomheadlines.com/wp-includes/js/ 3 KB
2 KB 159ms
156ms Script
application/javascript 2606:4700:3030::6815:2278
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://freedomheadlines.com/wp-includes/js/comment-reply.min.js?ver=5.9.8

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:2278 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a10b9570a1c7858442b42f1cd48b69a191638269f37e4046607bf5fe188e38bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4185293
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Fri, 21 Oct 2022 02:17:03 GMT
server: cloudflare
etag: W/"6352011f-ba3"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8BMH8RDJUL7Lsozzj8hi9MLq6Vt1Tqn%2BsxAS%2FOcO%2Bv94eAyh7zp81P8eHXmvbjSp8x8mfqPlc321EsWV1%2FhBw78kpztUYGpM%2FRG0P%2BUxJREYBTZsTJSuqgNJQ9Vvtf5Dl36OE1lFUQaDFGO2tuJfOzmzkw%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000
cf-ray: 8479cff97cef4c2d-MIA
expires: Sat, 30 Nov 2024 09:33:13 GMT

GET
H3 200 wp-emoji-release.min.js Show response
freedomheadlines.com/wp-includes/js/ 18 KB
5 KB 158ms
157ms Script
application/javascript 2606:4700:3030::6815:2278
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://freedomheadlines.com/wp-includes/js/wp-emoji-release.min.js?ver=5.9.8

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:2278 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3892293
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Fri, 21 Oct 2022 02:17:04 GMT
server: cloudflare
etag: W/"63520120-4705"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3d2NCIdjlDAR%2FSddoFvbskPU%2FVZleSEcUKi6gIG5eoQ0KDb6mGg75G3jM3RqtpHTW%2BOw1UxpGBKg0UmfvN0YCTkhIWwMjrz4XMkXP8xLnxe3uHoDbdelLqj0LgN1IHaBwU%2BGLJPCAy1oPKuosE3ExoS2Kw%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31536000
cf-ray: 8479cff97cf14c2d-MIA
expires: Sat, 30 Nov 2024 11:52:33 GMT

GET
H2 200 ajs.js Show response
cdn2.decide.dev/_js/ 6 KB
3 KB 265ms
72ms Script
application/javascript 2600:9000:247b:8200:3:7df3:55c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.decide.dev/_js/ajs.js
Requested by: Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:247b:8200:3:7df3:55c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 571b06d1913de139d860b755ded1b677f7bae6a45ddd2c30393fadc8e8720279

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 14:20:59 GMT
content-encoding: gzip
via: 1.1 google, 1.1 43504ac56caa49011c8a16d1cb156142.cloudfront.net (CloudFront)
last-modified: Wed, 17 Jan 2024 06:08:56 GMT
x-amz-cf-pop: JFK52-P2
age: 24438
etag: W/"1675-18d16097b4f"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=86400
accept-ranges: bytes
x-amz-cf-id: Jy2YatKu2wFttHiSlpe-MZPPfj6YqCbtEGth9RrJ7K_bAA2pPYwp9Q==

GET
H2 200 platform.js Show response
cdn.vuukle.com/ 245 KB
63 KB 169ms
47ms Script
application/javascript 2606:4700:10::ac43:1695
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.vuukle.com/platform.js
Requested by: Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1695 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5241f0728079864ee5553634ca3a7b18fdd2cffb9bbdf1697ad083d04e31fb48

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:17 GMT
content-encoding: br
cf-cache-status: HIT
age: 42129
cf-polished: origSize=251477
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Thu, 18 Jan 2024 08:40:16 GMT
server: cloudflare
etag: W/"65a8e3f0-3d655"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Range
cache-control: max-age=7200
cf-ray: 8479cffa2b55743e-MIA
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range

GET
H2 200 S6u9w4BMUTPHh6UVSwiPGQ.woff2
fonts.gstatic.com/s/lato/v24/ 23 KB
23 KB 426ms
200ms Font
font/woff2 2607:f8b0:4006:81e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwiPGQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans%3A400%2C300%2C300italic%2C400italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%7CLato%3A300%2C300i%2C400%2C700&subset=latin%2Clatin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2003 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://freedomheadlines.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 07:11:27 GMT
x-content-type-options: nosniff
age: 50210
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23040
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:07:25 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 17 Jan 2025 07:11:27 GMT

GET
H3 200 fontawesome-webfont.woff2
freedomheadlines.com/wp-content/themes/breena/inc/assets/css/font-awesome/fonts/ 75 KB
76 KB 129ms
123ms Font
font/woff2 2606:4700:3030::6815:2278
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://freedomheadlines.com/wp-content/themes/breena/inc/assets/css/font-awesome/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by: Host: freedomheadlines.com
URL: https://freedomheadlines.com/wp-content/themes/breena/inc/assets/css/font-awesome/css/font-awesome.min.css?ver=5.9.8
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::6815:2278 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Referer: https://freedomheadlines.com/wp-content/themes/breena/inc/assets/css/font-awesome/css/font-awesome.min.css?ver=5.9.8
Origin: https://freedomheadlines.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:17 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 960001
alt-svc: h3=":443"; ma=86400
content-length: 77160
last-modified: Fri, 21 Oct 2022 02:17:20 GMT
server: cloudflare
etag: "63520130-12d68"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NKUkCv1sgZWZKO26AyOsJ7dGQ8u3PkF3tubM5RWSXP3aD5Bej1sCKtTiz2NBOGysVssC%2Bq7PgQ9ZEwTN9vrfETfUma7MucEibQwLyhcf2qcKoNFL9AIGRhbEYTONbC6j52iFjdDHHFGt2S3LR5jJeCaoZw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 8479cff9bd864c2d-MIA
expires: Sat, 04 Jan 2025 00:31:15 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ 47 KB
47 KB 358ms
133ms Font
font/woff2 2607:f8b0:4006:81e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2003 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://freedomheadlines.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 11:28:34 GMT
x-content-type-options: nosniff
age: 34783
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48236
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 17 Jan 2025 11:28:34 GMT

GET
H2 200 S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v24/ 23 KB
24 KB 286ms
62ms Font
font/woff2 2607:f8b0:4006:81e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2003 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://freedomheadlines.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 17 Jan 2024 07:51:30 GMT
x-content-type-options: nosniff
age: 134207
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23580
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:17:22 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 16 Jan 2025 07:51:30 GMT

GET
H3 200 6_SUFvY80G4-HD-150x150.png
freedomheadlines.com/wp-content/uploads/2024/01/ 32 KB
32 KB 80ms
78ms Image
image/png 2606:4700:3030::6815:2278
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://freedomheadlines.com/wp-content/uploads/2024/01/6_SUFvY80G4-HD-150x150.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:2278 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c8c9a974575269cafe00639d9210903c393c2da3866c96e7e25ad1cb2d450358

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 22931
alt-svc: h3=":443"; ma=86400
content-length: 32371
x-xss-protection: 1; mode=block
last-modified: Wed, 17 Jan 2024 20:06:12 GMT
server: cloudflare
etag: "65a83334-7e73"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KLRDYROElPIKo8V0VCsw2u75tZYFc09z%2B7NrFKBi2rkF0QTtcnLTWFel168E3Vuu8HsG8QhKgDBXkVpcwlkQwfJDYloRz3BZ9J%2FcF64OscAKfKSn%2BvtHgJqQ1kXAnjuQ4QPvejWOknlMWTFTkqRm9oCEtQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 8479cffa6ea64c2d-MIA
expires: Fri, 17 Jan 2025 08:58:49 GMT

GET
H3 200 lb0Gb4Hr1kQ-HD-150x150.png
freedomheadlines.com/wp-content/uploads/2024/01/ 43 KB
44 KB 80ms
78ms Image
image/png 2606:4700:3030::6815:2278
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://freedomheadlines.com/wp-content/uploads/2024/01/lb0Gb4Hr1kQ-HD-150x150.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:2278 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9e2a5b98c331b38a3a216b1e5a3748adb293a40a4abe48eb57514b5dcaaf2e6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 22931
alt-svc: h3=":443"; ma=86400
content-length: 44275
x-xss-protection: 1; mode=block
last-modified: Wed, 17 Jan 2024 17:39:01 GMT
server: cloudflare
etag: "65a810b5-acf3"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FCgFMwQgIKXTLvugOhEO%2BK2qV7LUtVcPdCUAJlEymU3pun9%2BBR7BEs96tV5%2BycuOWI1eue17nsoRppKh2iRB6ZB%2BB%2BYCg8STezfUgyMax357LVIl9QyL%2BkwtG6lWW1sN%2FXtyg0eoNNkQgUVMZ10npdD1VA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 8479cffa6ea94c2d-MIA
expires: Fri, 17 Jan 2025 08:58:21 GMT

GET
H3 200 qsp6PikjDOw-HD-150x150.png
freedomheadlines.com/wp-content/uploads/2024/01/ 34 KB
34 KB 108ms
107ms Image
image/png 2606:4700:3030::6815:2278
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://freedomheadlines.com/wp-content/uploads/2024/01/qsp6PikjDOw-HD-150x150.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:2278 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3fa2744da5c3369511fa06da73cd7eae7420bc0b9e4a131ae1d6a6294245a159

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 22931
alt-svc: h3=":443"; ma=86400
content-length: 34559
x-xss-protection: 1; mode=block
last-modified: Wed, 17 Jan 2024 19:49:39 GMT
server: cloudflare
etag: "65a82f53-86ff"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RFgOnQ1bzFO3Cmd03na%2FuvAqVPtWTP7%2FVaHwCYXeEHEwfPTp%2FZPJAx5cFBwNnUMoaK8BSGLfwg5IbX3ybf7slj1nddMllmNL9%2B2NNL5TOUqXCLSWHDIfycB3aa7o%2Fc8JdkZOFj7CdwtUtgoh8ubVcglW7Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
vary: Accept-Encoding
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 8479cffa6eaf4c2d-MIA
expires: Fri, 17 Jan 2025 08:58:21 GMT

POST
H3 200 rtads Show response
api.whizzco.com/demand/v1/ 626 B
821 B 324ms
217ms XHR
application/json 2606:4700:e6::ac40:cf23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.whizzco.com/demand/v1/rtads
Requested by: Host: cdn.whizzco.com
URL: https://cdn.whizzco.com/scripts/widget/widget_v3.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:e6::ac40:cf23 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6bd1b5d0081f2b2bae2c47f811dc304db5f2943b492df8d879b4a463b6cb075e

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-type: application/json; charset=UTF-8

Response headers

date: Thu, 18 Jan 2024 21:08:18 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MQ%2FdX%2FlBLjOcelLGTbLoPKQNMcHlAir%2FLsoyWz5E%2Fy7O0auQR87YDi1gBg3eQd98IXtw%2FxLu05Vfrrenv7tCc1DdqRYIj5YgN6ymfpILQDTOII49foy7XLKf8j2UU4vX3SdBUi23%2FRYDtTOT5yQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://freedomheadlines.com
access-control-allow-credentials: true
cf-ray: 8479cffd9c96129b-MIA
alt-svc: h3=":443"; ma=86400
priority: u=1,i

OPTIONS
H2 200 rtads
api.whizzco.com/demand/v1/ Frame 0
0 317ms
159ms Preflight 2606:4700:e6::ac40:cf23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.whizzco.com/demand/v1/rtads
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:cf23 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://freedomheadlines.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET, POST, HEAD, OPTIONS
access-control-allow-origin: https://freedomheadlines.com
access-control-max-age: 1800
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8479cffbeb0121fd-MIA
content-length: 0
date: Thu, 18 Jan 2024 21:08:18 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Sc%2FyfG7l1UUgfnzFDFdaDTpArFEuKTFDh%2Fg1S1b8edHYwA7JrD6KqWK3L%2B7OAzL43jbJ4XcopKG5TU6GwgA3FSGU0xNzRM0yQa2bD4JRvp97VwlxvkCeE0SnOOr0uN%2BQQk2Nj8gpCU4pC6aDY%2FI%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H2 200 sjs.js Show response
cdn2.decide.dev/_js/ 10 KB
2 KB 106ms
48ms Script
application/javascript 2600:9000:247b:8200:3:7df3:55c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.decide.dev/_js/sjs.js
Requested by: Host: cdn1.lockerdomecdn.com
URL: https://cdn1.lockerdomecdn.com/embeds/freedomheadlines_freedomheadlines_sticky.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:247b:8200:3:7df3:55c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 61773d9a3aa1ba14b2f4ea9a8118c619c460c5acbc8770405530cc5ce31ed7e4

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 05:42:52 GMT
content-encoding: gzip
via: 1.1 google, 1.1 43504ac56caa49011c8a16d1cb156142.cloudfront.net (CloudFront)
last-modified: Wed, 17 Jan 2024 06:08:55 GMT
x-amz-cf-pop: JFK52-P2
age: 55525
etag: W/"26be-18d160977f3"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=86400
accept-ranges: bytes
x-amz-cf-id: ekw0_WZc67yvq3qfQSOSmch5N2KBXkFlxhvnX6d4wi_57tIzsQq8fg==

GET
H2 200 14305626872558694 Show response
decide.dev/lad/ Frame 541F 1 KB
1 KB 442ms
136ms Document
text/html 34.149.139.129
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://decide.dev/lad/14305626872558694?pubid=ld-9377-335&pubo=https%3A%2F%2Ffreedomheadlines.com&rid=&width=780&path=%2Ffreedom-wire%2Fsuper-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa%2F&x=220&y=1435.71875&utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Requested by: Host: cdn2.decide.dev
URL: https://cdn2.decide.dev/_js/ajs.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.139.129 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 129.139.149.34.bc.googleusercontent.com
Software: /
Resource Hash: f670413d2ae1a2ae6adb0f76cf9a23e52e96324d60f3c10658a9bfe558a6513d

Request headers

Referer: https://freedomheadlines.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, max-age=0, must-revalidate, no-store
content-length: 1342
content-type: text/html; charset=utf-8
date: Thu, 18 Jan 2024 21:08:18 GMT
via: 1.1 google

GET
H2 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401110101/ 430 KB
135 KB 66ms
65ms Script
text/javascript 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401110101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8730aafbdb6d03c6d4a37f76ebf8d504d5706fbae56686399a4b198981a0b6be

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 19:28:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6012
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 138464
x-xss-protection: 0
server: cafe
etag: 13337571285874554267
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Fri, 17 Jan 2025 19:28:05 GMT

POST
H2 200 getGeo Show response
vuukle.com/ 113 B
374 B 250ms
46ms XHR
application/json 2606:4700:10::6816:3da8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://vuukle.com/getGeo
Requested by: Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/platform.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3da8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c61aab476e6ae3c05e5eac8a401047cbd6b30e0c16ef5ad14f7bcfec9694e9f2

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 18 Jan 2024 21:08:18 GMT
content-encoding: br
accept-ch: sec-ch-ua,sec-ch-ua-platform,sec-ch-ua-mobile,sec-ch-viewport-width
server: cloudflare
vary: Accept-Encoding
access-control-max-age: 86400
access-control-allow-methods: GET,HEAD,POST,OPTIONS
access-control-allow-origin: *
content-type: application/json;charset=UTF-8
cf-ray: 8479cffdacbf7419-MIA
alt-svc: h3=":443"; ma=86400

GET
H2 200 loadVuukle Show response
api.vuukle.com/api/v1/Comments/ 11 KB
3 KB 591ms
397ms XHR
application/json 2606:4700:10::ac43:1695
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.vuukle.com/api/v1/Comments/loadVuukle?apiKey=92fd8992-dbb2-4d42-9cc3-1b8101c44b9b&articleId=28724&globalRecommendation=false&host=freedomheadlines.com&start=0&uri=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fsuper-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa%2F&quizEnabled=false

Requested by

Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/platform.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:1695 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cc2ca99ba2997884a07b02970a5201f0294766270160bf9cb17deb2db9a91246

Security Headers

Name	Value
X-Xss-Protection	1

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 18 Jan 2024 21:08:18 GMT
via: 1.1 varnish (Varnish/6.2)
content-encoding: br
cf-cache-status: DYNAMIC
age: 0
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1
pragma: no-cache
server: cloudflare
access-control-allow-methods: GET, POST, PUT, DELETE, PATCH, OPTIONS
x-varnish: 474714195
content-type: application/json; charset=utf-8
access-control-allow-origin: https://freedomheadlines.com
cache-control: no-store,no-cache
access-control-allow-credentials: true
access-control-allow-credentiails: true
cf-ray: 8479cffdacfed9a9-MIA
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With

GET
H2 200 freedomheadlines.com.js Show response
cdn.vuukle.com/domain-configs/ 139 B
234 B 47ms
46ms Script
application/javascript 2606:4700:10::ac43:1695
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.vuukle.com/domain-configs/freedomheadlines.com.js
Requested by: Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/platform.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1695 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bdf47e9be1ad651fcad55288d534fbeeba846ce487322a2b8f1f7e0f6dfaab12

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:18 GMT
content-encoding: br
cf-cache-status: HIT
age: 91744
cf-polished: origSize=186
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Mon, 15 Jan 2024 14:37:43 GMT
server: cloudflare
etag: W/"65a54337-ba"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Range
cache-control: max-age=1800
cf-ray: 8479cffc993c743e-MIA
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range

GET
H2 200 index.html Show response
cdn.vuukle.com/widgets/ Frame 05E3 336 KB
108 KB 84ms
74ms Document
text/html 2606:4700:10::ac43:1695
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.vuukle.com/widgets/index.html?version=3.32.2
Requested by: Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1695 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dc1cd94515c5f604d88a866461e199bbee75210441dae76316c74cf7dc34e200

Request headers

Referer: https://freedomheadlines.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Range
age: 44008
alt-svc: h3=":443"; ma=86400
cache-control: max-age=10800
cf-cache-status: HIT
cf-ray: 8479cffd9b62743e-MIA
content-encoding: br
content-security-policy-report-only: script-src 'none'; connect-src 'none'; report-uri https://csp-reporting.cloudflare.com/cdn-cgi/script_monitor/report?m=ohQ6dxFfzDCE_drBayJMYdxqD3r6J.1kFFsvgomoM9I-1705612098-1-AQ0dUAgoDcWKFQz-a2VoIk1FeWasqyvb_QMaG1hq9QpMtc4I9goH5fruExZfg1BnzThPZUi9B8Rcoiiy4hDexoL8iH8cvTiWou5py3U7JwUVQfL9Q4-TNoOq8rSuTZ_MOdZigw25mudi20l9Ty-jUOE; report-to cf-csp-endpoint
content-type: text/html
date: Thu, 18 Jan 2024 21:08:18 GMT
last-modified: Thu, 18 Jan 2024 08:38:12 GMT
report-to: {"endpoints":[{"url":"https:\/\/csp-reporting.cloudflare.com\/cdn-cgi\/script_monitor\/report?m=ohQ6dxFfzDCE_drBayJMYdxqD3r6J.1kFFsvgomoM9I-1705612098-1-AQ0dUAgoDcWKFQz-a2VoIk1FeWasqyvb_QMaG1hq9QpMtc4I9goH5fruExZfg1BnzThPZUi9B8Rcoiiy4hDexoL8iH8cvTiWou5py3U7JwUVQfL9Q4-TNoOq8rSuTZ_MOdZigw25mudi20l9Ty-jUOE"}],"group":"cf-csp-endpoint","max_age":86400}
server: cloudflare
vary: Accept-Encoding

GET
H2 200 emotes.html Show response
cdn.vuukle.com/widgets/ Frame 9A99 88 KB
31 KB 65ms
55ms Document
text/html 2606:4700:10::ac43:1695
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.vuukle.com/widgets/emotes.html?version=3.12.6
Requested by: Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1695 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fd18cb9a4cbfd06f96f96d89fc8079c87141abdc150a9ee6848e7a80383bcd1e

Request headers

Referer: https://freedomheadlines.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Range
age: 364153
alt-svc: h3=":443"; ma=86400
cache-control: max-age=10800
cf-cache-status: HIT
cf-ray: 8479cffd9b71743e-MIA
content-encoding: br
content-type: text/html
date: Thu, 18 Jan 2024 21:08:18 GMT
last-modified: Mon, 13 Nov 2023 11:03:13 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 218 KB
78 KB 87ms
85ms Script
application/javascript 2607:f8b0:4006:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-CP4TF595X7&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-32644619-11

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::2008 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c667baa32c87f64a377121e438dc9b3f2cda5e3b98c3ac5127656eabd75ba532

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:18 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 79506
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 18 Jan 2024 21:08:18 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 187ms
63ms Script
text/javascript 2607:f8b0:4004:c08::65
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-32644619-11

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::65 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 18 Jan 2024 19:08:45 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 7173
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Thu, 18 Jan 2024 21:08:45 GMT

GET
H2 200 14729220068684902 Show response
decide.dev/lad/ Frame 1F9F 1 KB
1 KB 140ms
130ms Document
text/html 34.149.139.129
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://decide.dev/lad/14729220068684902?pubid=ld-14729220068684902&pubo=https%3A%2F%2Ffreedomheadlines.com&rid=&width=1560&path=%2Ffreedom-wire%2Fsuper-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa%2F&x=-100779&y=101199&utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Requested by: Host: cdn2.decide.dev
URL: https://cdn2.decide.dev/_js/ajs.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.139.129 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 129.139.149.34.bc.googleusercontent.com
Software: /
Resource Hash: f670413d2ae1a2ae6adb0f76cf9a23e52e96324d60f3c10658a9bfe558a6513d

Request headers

Referer: https://freedomheadlines.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, max-age=0, must-revalidate, no-store
content-length: 1342
content-type: text/html; charset=utf-8
date: Thu, 18 Jan 2024 21:08:18 GMT
via: 1.1 google

GET
H3 200 prebid3.js Show response
cdn.vuukle.com/static/ 448 KB
145 KB 78ms
77ms Script
application/javascript 2606:4700:10::ac43:1695
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.vuukle.com/static/prebid3.js
Requested by: Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/platform.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:10::ac43:1695 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bbbc1d6d55e90d54956dd8aa41d8edfb36f72f11125b04cdba0efad8fd875ce7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:18 GMT
content-encoding: br
cf-cache-status: HIT
age: 1692784
cf-polished: origSize=608215
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Wed, 29 Nov 2023 18:22:45 GMT
server: cloudflare
etag: W/"65678175-947d7"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Range
cache-control: max-age=43200
cf-ray: 8479cffdbb8c9ae6-MIA
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range

GET
H3 200 freedomheadlines.com.json Show response
cdn.vuukle.com/ads/ 16 KB
1 KB 329ms
291ms XHR
application/json 2606:4700:10::ac43:1695
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.vuukle.com/ads/freedomheadlines.com.json
Requested by: Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/platform.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:10::ac43:1695 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f48bbdaebf4cd06636120162cde7b0394650efbd4b8b44621ad604a8797b5c9e

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 18 Jan 2024 21:08:18 GMT
content-encoding: br
cf-cache-status: DYNAMIC
last-modified: Thu, 18 Jan 2024 19:52:53 GMT
server: cloudflare
etag: W/"65a98195-3eba"
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Range
cf-ray: 8479cffe0a190325-MIA
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
alt-svc: h3=":443"; ma=86400

POST
H2 204 collect
www.google-analytics.com/g/ 0
174 B 78ms
77ms Ping
text/plain 2607:f8b0:4004:c08::65
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-CP4TF595X7&gtm=45je41a0v9116368575&_p=1705612097493&gcd=11l1l1l1l1&dma=0&cid=763368515.1705612098&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AAAI&_s=1&sid=1705612098&sct=1&seg=0&dl=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fsuper-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&dt=Super%20PAC%20Backing%20GOP%20Candidate%20Pulls%20Millions%20from%20TV%20Ads!%20Is%20His%20Campaign%20DOA%3F%20%E2%80%93%20Freedom%20Headlines%20%7C%20Top%20Political%20News%20USA%20%7C%20USA%20Politics&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=2873
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CP4TF595X7&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c08::65 Ashburn, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Jan 2024 21:08:18 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://freedomheadlines.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 emotes.css
cdn.vuukle.com/widgets/ Frame 9A99 8 KB
3 KB 65ms
65ms Stylesheet
text/css 2606:4700:10::ac43:1695
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.vuukle.com/widgets/emotes.css
Requested by: Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/widgets/emotes.html?version=3.12.6
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:10::ac43:1695 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 81ae95bc2154d20fe364863204defe3e2fb799adcce6c69ebb054962c8462fe0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:18 GMT
content-encoding: br
cf-cache-status: HIT
age: 1167543
cf-polished: origSize=8613
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Mon, 13 Nov 2023 11:03:21 GMT
server: cloudflare
etag: W/"65520279-21a5"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Range
cache-control: max-age=10800
cf-ray: 8479cffe9c919ae6-MIA
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range

GET
H3 200 comments.css
cdn.vuukle.com/widgets/ Frame 05E3 38 KB
10 KB 62ms
57ms Stylesheet
text/css 2606:4700:10::ac43:1695
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.vuukle.com/widgets/comments.css
Requested by: Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/widgets/index.html?version=3.32.2
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:10::ac43:1695 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 781702c1783e6e4274fe36a5d88989019e9737fa6893cf57ffeb99f42ab34086

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:18 GMT
content-encoding: br
cf-cache-status: HIT
age: 44968
cf-polished: origSize=39123
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Thu, 18 Jan 2024 08:38:12 GMT
server: cloudflare
etag: W/"65a8e374-98d3"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Range
cache-control: max-age=10800
cf-ray: 8479cffeacab9ae6-MIA
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range

GET
H2 200 bq-publish Show response
publish.vuukle.com/ 27 B
326 B 350ms
326ms XHR
text/plain 2606:4700:10::6816:3da8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://publish.vuukle.com/bq-publish?callback=&{%22action%22:%22view_page%22,%22hashed_email%22:%22$7b1866-a7b1-447b-9e93-4a6bed4e65da%22,%22hostname%22:%2292fd8992-dbb2-4d42-9cc3-1b8101c44b9b%22,%22pubdomain%22:%22freedomheadlines.com%22,%22refDomain%22:%22%22,%22sessionId%22:%22cb41173b-4394-49ea-a744-1170453309a5%22,%22version%22:%224.20%22,%22articleImg%22:%22%22,%22articleTitle%22:%22Super%20PAC%20Backing%20GOP%20Candidate%20Pulls%20Millions%20from%20TV%20Ads!%20Is%20His%20Campaign%20DOA?%22,%22article_id%22:%2228724%22,%22hashed_article_url%22:%22freedomheadlines.com%2Ffreedom-wire%2Fsuper-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa%2F%22,%22referrer%22:%22daniel%22,%22tags%22:%22%22,%22browser%22:%22Chrome%22,%22device%22:%22Desktop%22,%22os%22:%22Windows%22,%22isArticleBrandSafe%22:null}&_=1489139930741

Requested by

Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/platform.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3da8 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cc9dfed4efd5c6056c121c1a612166d68589e9951389178e3d6a84847a015858

Security Headers

Name	Value
X-Xss-Protection	1

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:18 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://freedomheadlines.com
access-control-allow-credentials: true
cf-ray: 8479cffecf117419-MIA
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1

GET
H2 200 213794966 Show response
fundingchoicesmessages.google.com/i/ 182 KB
61 KB 263ms
107ms Script
application/javascript 2607:f8b0:4006:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/213794966?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401110101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::200e Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

bbfb706abba423f5bf4a92d45ebe796aaf83b454aecf52e37ccd172064ddf5b9

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-4rLtJnDnz3y0l0WezVe7Jg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:18 GMT
content-security-policy: script-src 'report-sample' 'nonce-4rLtJnDnz3y0l0WezVe7Jg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 200 tshow
api.whizzco.com/dtracking/v1/ Frame 0
0 124ms
122ms Preflight 2606:4700:e6::ac40:cf23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.whizzco.com/dtracking/v1/tshow
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:cf23 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://freedomheadlines.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET, POST, HEAD, OPTIONS
access-control-allow-origin: https://freedomheadlines.com
access-control-max-age: 1800
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8479cfff796121fd-MIA
content-length: 0
date: Thu, 18 Jan 2024 21:08:18 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h%2FqIfEPGmkPBNzJAFtDIYf%2F7J4o%2FzJ9VvLiolRgezNSpj2H0O%2Ff3zd3AbnOey%2F7UXoeHOdcyLqt%2BT2u%2B98KRJG3I2NmmuWbiEddYJvG7PXoYkP3mDlLfMB55ZkU9rcOcA2aGqdPyyoRkwjWqf6Y%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H2 200 delivery.js Show response
assets.revcontent.com/master/ 162 KB
52 KB 221ms
72ms Script
text/javascript 13.35.93.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.revcontent.com/master/delivery.js
Requested by: Host: cdn.whizzco.com
URL: https://cdn.whizzco.com/scripts/widget/widget_v3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.93.14 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-93-14.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6e439f4364dd180567c3cecd035b4910b8ed12c462a13c8c325fa45449f8d5d1

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 17 Jan 2024 21:58:54 GMT
content-encoding: gzip
via: 1.1 14b9e21ac67dd643dc9e782cb20c49a2.cloudfront.net (CloudFront)
last-modified: Wed, 10 Jan 2024 21:58:45 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P8
age: 83365
x-amz-server-side-encryption: AES256
etag: W/"ea3d76277a470a831440d6bd67973fbe"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public,max-age=60
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: cMRsDG6AhbJt97aJomMoh7kqmCmLaYkjvmfJn4CC8KsvzW728my8GQ==

POST
H3 200 tshow Show response
api.whizzco.com/dtracking/v1/ 15 B
492 B 143ms
142ms XHR
application/json 2606:4700:e6::ac40:cf23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.whizzco.com/dtracking/v1/tshow
Requested by: Host: cdn.whizzco.com
URL: https://cdn.whizzco.com/scripts/widget/widget_v3.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:e6::ac40:cf23 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3d23d39a30bb7323f8ccfd64c52cf286138fba4f83e78f7edcf66703b7c23aaa

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-type: application/json; charset=UTF-8

Response headers

date: Thu, 18 Jan 2024 21:08:18 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uPDve3gO3mWG%2Bvuqr9NufoJrpE0YbOheRZfoqjN%2Bvd3CMNocNXzNdKgnWVg6Oy1H0tM%2FstSA6%2FQpeASMyiblku8aJf6ZZ8hH%2B0mtFYqa%2B24RKir%2FS7AG55NvIMjSapcJ6Rev2I%2FUUv6iz0g13SU%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://freedomheadlines.com
access-control-allow-credentials: true
cf-ray: 8479d0004f1eda9b-MIA
alt-svc: h3=":443"; ma=86400
content-length: 15
priority: u=1,i

GET
H2 200 dc.js Show response
stats.g.doubleclick.net/ Frame 1F9F 45 KB
17 KB 204ms
78ms Script
text/javascript 2607:f8b0:4004:c06::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/dc.js

Requested by

Host: decide.dev
URL: https://decide.dev/lad/14729220068684902?pubid=ld-14729220068684902&pubo=https%3A%2F%2Ffreedomheadlines.com&rid=&width=1560&path=%2Ffreedom-wire%2Fsuper-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa%2F&x=-100779&y=101199&utm_medium=email&utm_source=sparkpost&utm_campaign=regular

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::9a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://decide.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 18 Jan 2024 20:14:37 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 3221
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17093
expires: Thu, 18 Jan 2024 22:14:37 GMT

GET
H2 200 dc.js Show response
stats.g.doubleclick.net/ Frame 541F 45 KB
17 KB 184ms
60ms Script
text/javascript 2607:f8b0:4004:c06::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/dc.js

Requested by

Host: decide.dev
URL: https://decide.dev/lad/14305626872558694?pubid=ld-9377-335&pubo=https%3A%2F%2Ffreedomheadlines.com&rid=&width=780&path=%2Ffreedom-wire%2Fsuper-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa%2F&x=220&y=1435.71875&utm_medium=email&utm_source=sparkpost&utm_campaign=regular

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::9a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://decide.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 18 Jan 2024 20:14:37 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 3221
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17093
expires: Thu, 18 Jan 2024 22:14:37 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 68ms
67ms XHR
text/plain 2607:f8b0:4004:c08::65
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1411495994&t=pageview&_s=1&dl=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fsuper-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&ul=en-us&de=UTF-8&dt=Super%20PAC%20Backing%20GOP%20Candidate%20Pulls%20Millions%20from%20TV%20Ads!%20Is%20His%20Campaign%20DOA%3F%20%E2%80%93%20Freedom%20Headlines%20%7C%20Top%20Political%20News%20USA%20%7C%20USA%20Politics&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAUABAAAAACAAI~&jid=860342511&gjid=1296200020&cid=763368515.1705612098&tid=UA-32644619-11&_gid=271863815.1705612098&_r=1&gtm=457e41a0&gcd=11l1l1l1l1&dma=0&jsscut=1&z=1318521324

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::65 Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 18 Jan 2024 21:08:18 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://freedomheadlines.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 200 rtads
api.whizzco.com/demand/v1/ Frame 0
0 125ms
125ms Preflight 2606:4700:e6::ac40:cf23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.whizzco.com/demand/v1/rtads
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:cf23 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://freedomheadlines.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET, POST, HEAD, OPTIONS
access-control-allow-origin: https://freedomheadlines.com
access-control-max-age: 1800
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8479cfffa9aa21fd-MIA
content-length: 0
date: Thu, 18 Jan 2024 21:08:18 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=x83gaMesj%2BYTH3NXDWl8HyKwkffObR6JHLfMY5j8DdooAO3%2F7R3fKH5PqlrYh93d45DbyobY0YkR%2FjXBZqxes0Jc2XgSYbLfMtX2Adzu3LYHPOZ1G2NjxNzUtI1MVflVf%2BaA96OtCDYfMruWNE0%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

POST
H3 200 rtads Show response
api.whizzco.com/demand/v1/ 501 B
731 B 203ms
202ms XHR
application/json 2606:4700:e6::ac40:cf23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.whizzco.com/demand/v1/rtads
Requested by: Host: cdn.whizzco.com
URL: https://cdn.whizzco.com/scripts/widget/widget_v3.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:e6::ac40:cf23 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6b0a3c0b8aa61a8c556f3e19a2444a4dd2802d3acc6f2c80a92980372f8d49f0

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-type: application/json; charset=UTF-8

Response headers

date: Thu, 18 Jan 2024 21:08:18 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=D51ZxvskFicHuJMGkf5c00fwj1QLfYRLRVmWpDtRjafPLwHuVtiqawwT7h%2FgNeoFVJ8pmyt%2BFSj5wHBbmXft93%2FzfbzU9Smz9koftN73Nl8P6Jv%2FtlKyxVF3J6sGty1ZotUbR80cq2KJgCAUgyQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://freedomheadlines.com
access-control-allow-credentials: true
cf-ray: 8479d000798c129b-MIA
alt-svc: h3=":443"; ma=86400
priority: u=1,i

GET
H3 200 freedomheadlines.com.json Show response
cdn.vuukle.com/ads/ 16 KB
1 KB 316ms
316ms Fetch
application/json 2606:4700:10::ac43:1695
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.vuukle.com/ads/freedomheadlines.com.json
Requested by: Host: cdn.vuukle.com
URL: https://cdn.vuukle.com/static/prebid3.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:10::ac43:1695 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f48bbdaebf4cd06636120162cde7b0394650efbd4b8b44621ad604a8797b5c9e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:18 GMT
content-encoding: br
cf-cache-status: DYNAMIC
last-modified: Thu, 18 Jan 2024 19:52:53 GMT
server: cloudflare
etag: W/"65a98195-3eba"
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Range
cf-ray: 8479d000fed60325-MIA
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
alt-svc: h3=":443"; ma=86400

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
210 B 69ms
68ms XHR
text/plain 2607:f8b0:4004:c06::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-32644619-11&cid=763368515.1705612098&jid=860342511&gjid=1296200020&_gid=271863815.1705612098&_u=YADAAUAAAAAAACAAI~&z=1847446303

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::9a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Thu, 18 Jan 2024 21:08:18 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://freedomheadlines.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 9A99 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3cd72707a6eb0ba2f481bf98476ada929d93c3cc1ccf2fa702f4e237ddbea113

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 9A99 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8da847aa621361c3472c2283b8702e5d25119305aa98931fd18dc43831daaef3

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 9A99 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ed01ba1fa7ade62e77ee0032423f982b85c5707b040d71188ed88e716fd8cbd0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 9A99 5 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f96efa3bffc086940d1a9675afe64d0e6544d8b82fdfa6a4c8e7cd3c7793a382

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 9A99 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a1c7910e18cb0252957c7e629b54d6fd7a90f7de6b3ac599ba4f1f8331313e92

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 9A99 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a440db4a7ca252d08987e6cfd770e55127e13080c9bc856147ee03bfb250845a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 05E3 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ed01ba1fa7ade62e77ee0032423f982b85c5707b040d71188ed88e716fd8cbd0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 05E3 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3cd72707a6eb0ba2f481bf98476ada929d93c3cc1ccf2fa702f4e237ddbea113

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 05E3 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a440db4a7ca252d08987e6cfd770e55127e13080c9bc856147ee03bfb250845a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 05E3 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a1c7910e18cb0252957c7e629b54d6fd7a90f7de6b3ac599ba4f1f8331313e92

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 image-freedomheadlines.com-30058
image.vuukle.com/ Frame 05E3 7 KB
7 KB 85ms
67ms Image
image/jpeg 2606:4700:10::ac43:1695
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image.vuukle.com/image-freedomheadlines.com-30058
Requested by: Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1695 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: df0d225f794cf05b6a73c8444d990d9c94843d7fedf9315852616e06c3fbe853

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:18 GMT
cf-cache-status: HIT
age: 329177
cf-polished: origSize=7398
x-guploader-uploadid: ABPtcPoPDiveY2zxkNxXtLKdLQ6uCQ0vYsXS37mxHp-RAEx4LxTZd7iyC7IJ25XnjLvoJFT02_pMCn5JhQ
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400
content-length: 7306
cf-bgj: imgq:100,h2pri
last-modified: Mon, 15 Jan 2024 00:19:25 GMT
server: cloudflare
etag: "1f0fd7cb32b964c9c86dd5ec986ba271"
vary: Accept-Encoding
x-goog-generation: 1705277965227358
content-type: image/jpeg
x-goog-hash: crc32c=GC28NQ==, md5=Hw/XyzK5ZMnIbdXsmGuicQ==
cache-control: public, max-age=31536000
x-goog-stored-content-length: 7398
accept-ranges: bytes
cf-ray: 8479d001ce0a743e-MIA
expires: Mon, 15 Jan 2024 02:42:01 GMT

GET
H2 200 image-freedomheadlines.com-30007
image.vuukle.com/ Frame 05E3 12 KB
12 KB 74ms
57ms Image
image/jpeg 2606:4700:10::ac43:1695
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image.vuukle.com/image-freedomheadlines.com-30007
Requested by: Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1695 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 48fe012e18f060c43ea6a92d8a17992cd0d091f8b0879480c825d039c02e1456

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:18 GMT
cf-cache-status: HIT
age: 499943
cf-polished: origSize=12693
x-guploader-uploadid: ABPtcPoSlet8LU_eMp39EJgOass9wyI-X1tEGY4Sq77lbKoXsFvEMtMpuL1JC9BcGJEQe79RzPB12WmBVw
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400
content-length: 12018
cf-bgj: imgq:100,h2pri
last-modified: Sat, 13 Jan 2024 01:30:15 GMT
server: cloudflare
etag: "6cc8aa34635cc7a88811eeeff5e047ec"
vary: Accept-Encoding
x-goog-generation: 1705109415049994
content-type: image/jpeg
x-goog-hash: crc32c=1JgDmg==, md5=bMiqNGNcx6iIEe7v9eBH7A==
cache-control: public, max-age=31536000
x-goog-stored-content-length: 12693
accept-ranges: bytes
cf-ray: 8479d001cdeb743e-MIA
expires: Sat, 13 Jan 2024 02:31:43 GMT

GET
H2 200 image-freedomheadlines.com-30082
image.vuukle.com/ Frame 05E3 14 KB
14 KB 66ms
50ms Image
image/jpeg 2606:4700:10::ac43:1695
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image.vuukle.com/image-freedomheadlines.com-30082
Requested by: Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1695 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 463c0d07fa326559d1eb549d5d6169a020791e5f20e7488be3556b093c5e9963

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:18 GMT
cf-cache-status: HIT
age: 266823
cf-polished: origSize=14841
x-guploader-uploadid: ABPtcPp2HK9-b1lQB2u25GR07R-KBYVQp-khyLRxrn5UPNwQaYKmR45t9I-o-X2RDgQ6POg8ndQ
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400
content-length: 14247
cf-bgj: imgq:100,h2pri
last-modified: Mon, 15 Jan 2024 16:28:43 GMT
server: cloudflare
etag: "c075c209a0a132fb0d2f2cecd19d173a"
vary: Accept-Encoding
x-goog-generation: 1705336123975840
content-type: image/jpeg
x-goog-hash: crc32c=rd7fyg==, md5=wHXCCaChMvsNLyzs0Z0XOg==
cache-control: public, max-age=31536000
x-goog-stored-content-length: 14841
accept-ranges: bytes
cf-ray: 8479d001cdf9743e-MIA
expires: Mon, 15 Jan 2024 20:01:15 GMT

GET
H2 200 image-freedomheadlines.com-30112
image.vuukle.com/ Frame 05E3 13 KB
14 KB 77ms
60ms Image
image/jpeg 2606:4700:10::ac43:1695
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image.vuukle.com/image-freedomheadlines.com-30112
Requested by: Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1695 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d47d8023fc6a7ad0bd469632de7b89b993aff76636d3f8730c348a93070311bd

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:18 GMT
cf-cache-status: HIT
age: 167271
cf-polished: origSize=14279
x-guploader-uploadid: ABPtcPpNDgekeAc-HM7YHcD9nxCwW5TW3YdtCx-UmF8HHjJm5ghjCzzkp_-5yzsZzmbpe1srEoQ
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400
content-length: 13693
cf-bgj: imgq:100,h2pri
last-modified: Tue, 16 Jan 2024 14:02:06 GMT
server: cloudflare
etag: "82526e9f9f7522301f576020034c031f"
vary: Accept-Encoding
x-goog-generation: 1705413726750239
content-type: image/jpeg
x-goog-hash: crc32c=R3sbKw==, md5=glJun591IjAfV2AgA0wDHw==
cache-control: public, max-age=31536000
x-goog-stored-content-length: 14279
accept-ranges: bytes
cf-ray: 8479d001ce06743e-MIA
expires: Tue, 16 Jan 2024 23:11:12 GMT

GET
H2 200 image-freedomheadlines.com-30063
image.vuukle.com/ Frame 05E3 9 KB
9 KB 68ms
51ms Image
image/jpeg 2606:4700:10::ac43:1695
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image.vuukle.com/image-freedomheadlines.com-30063
Requested by: Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1695 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6ae9f922e527414cba298757a844d652517d38448217ba3c9f48b64d5c441be3

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:18 GMT
cf-cache-status: HIT
age: 338103
cf-polished: origSize=9098
x-guploader-uploadid: ABPtcPrV5_vcC0j9kXn3XELx0jZ7pMAdjWoyEhwvMyI3Dpm8__k_IUXoDX53dLmGtE9XwDaBEhA
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400
content-length: 8924
cf-bgj: imgq:100,h2pri
last-modified: Sun, 14 Jan 2024 19:42:17 GMT
server: cloudflare
etag: "911be9bd833c3a6bcbc80f9a9873d960"
vary: Accept-Encoding
x-goog-generation: 1705261337219948
content-type: image/jpeg
x-goog-hash: crc32c=Z2LqyQ==, md5=kRvpvYM8OmvLyA+amHPZYA==
cache-control: public, max-age=31536000
x-goog-stored-content-length: 9098
accept-ranges: bytes
cf-ray: 8479d001cdff743e-MIA
expires: Mon, 15 Jan 2024 00:13:15 GMT

GET
H2 200 image-freedomheadlines.com-30241
image.vuukle.com/ Frame 05E3 30 KB
30 KB 68ms
52ms Image
image/webp 2606:4700:10::ac43:1695
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image.vuukle.com/image-freedomheadlines.com-30241
Requested by: Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:1695 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7ed5b6eba825051575d9f77fcd91e16392253f7c632a92c78da67c83c1e9e838

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:18 GMT
cf-cache-status: HIT
age: 5101
cf-polished: origFmt=png, origSize=48534
x-guploader-uploadid: ABPtcPq8L2YYAJDe2ZP4wn3SywqjH87iGsLKpYuk3-8Vet239f1OIlOLmrvm6UKmWVYJgR3dvEg
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-disposition: inline; filename="image-freedomheadlines.webp"
alt-svc: h3=":443"; ma=86400
content-length: 30532
cf-bgj: imgq:100,h2pri
last-modified: Thu, 18 Jan 2024 19:30:29 GMT
server: cloudflare
etag: "f6b4ab02e817d26b1d17c042c15ec96e"
vary: Accept
x-goog-generation: 1705606229349609
content-type: image/webp
x-goog-hash: crc32c=rnuJLQ==, md5=9rSrAugX0msdF8BCwV7Jbg==
cache-control: public, max-age=31536000
x-goog-stored-content-length: 48534
accept-ranges: bytes
cf-ray: 8479d001ce01743e-MIA
expires: Thu, 18 Jan 2024 20:43:17 GMT

GET
H3 200 image-freedomheadlines.com-30185
image.vuukle.com/ Frame 05E3 11 KB
11 KB 68ms
66ms Image
image/jpeg 2606:4700:10::ac43:1695
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image.vuukle.com/image-freedomheadlines.com-30185
Requested by: Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:10::ac43:1695 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fb0fa587fd1e8cf52e1e067a947e07f295672e789627e5ea7a585ab152ef92bf

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:18 GMT
cf-cache-status: HIT
age: 91739
cf-polished: origSize=11179
x-guploader-uploadid: ABPtcPp3wtjyccClOBjh6guVUELKI8O0q1nWdMcS0rT5RGmCQSljKEgDmGkLSdmzgtYkeXtvL0o
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400
content-length: 10800
cf-bgj: imgq:100,h2pri
last-modified: Wed, 17 Jan 2024 19:29:16 GMT
server: cloudflare
etag: "26e50f07bcaad717e273a730b4549fb2"
vary: Accept-Encoding
x-goog-generation: 1705519756031372
content-type: image/jpeg
x-goog-hash: crc32c=dvwNoQ==, md5=JuUPB7yq1xfic6cwtFSfsg==
cache-control: public, max-age=31536000
x-goog-stored-content-length: 11179
accept-ranges: bytes
cf-ray: 8479d00219d99ae6-MIA
expires: Wed, 17 Jan 2024 20:39:19 GMT

GET
H3 200 image-freedomheadlines.com-30177
image.vuukle.com/ Frame 05E3 12 KB
13 KB 69ms
66ms Image
image/jpeg 2606:4700:10::ac43:1695
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image.vuukle.com/image-freedomheadlines.com-30177
Requested by: Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:10::ac43:1695 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 04f2f8d661ea280ea4615e35b5b8f387af59bbb9d13d31071297d3223eb78ef8

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:18 GMT
cf-cache-status: HIT
age: 17213
cf-polished: origSize=12944
x-guploader-uploadid: ABPtcPpG_crzvxUlUWchJsOdzsEvYbL7GcEfEce4_wkh81oczuLRp04PgfO7p54WOk5Pw3ZDiDg
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400
content-length: 12491
cf-bgj: imgq:100,h2pri
last-modified: Thu, 18 Jan 2024 15:58:37 GMT
server: cloudflare
etag: "8ca41c1ce1711834065e90872ef57e0b"
vary: Accept-Encoding
x-goog-generation: 1705593517512252
content-type: image/jpeg
x-goog-hash: crc32c=4M1UVA==, md5=jKQcHOFxGDQGXpCHLvV+Cw==
cache-control: public, max-age=31536000
x-goog-stored-content-length: 12944
accept-ranges: bytes
cf-ray: 8479d00219dc9ae6-MIA
expires: Thu, 18 Jan 2024 17:21:25 GMT

GET
H3 200 image-freedomheadlines.com-30028
image.vuukle.com/ Frame 05E3 7 KB
7 KB 51ms
49ms Image
image/jpeg 2606:4700:10::ac43:1695
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image.vuukle.com/image-freedomheadlines.com-30028
Requested by: Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:10::ac43:1695 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 14fc8927fb0cd2dc795fcd8b74b3fae018e3a56765a9acfb928032415cb2c2f3

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:18 GMT
cf-cache-status: HIT
age: 102818
cf-polished: origSize=6863
x-guploader-uploadid: ABPtcPp11sRUcjMgKFtv-wbSuNJkn2FFLYa0YObsCrVsUJ9yLfZzWvu498lYFIevi-Dmvc1drmQGSScuVQ
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400
content-length: 6818
cf-bgj: imgq:100,h2pri
last-modified: Sat, 13 Jan 2024 01:23:12 GMT
server: cloudflare
etag: "849ccdec4324d27df0c8b77acb676866"
vary: Accept-Encoding
x-goog-generation: 1705108991999188
content-type: image/jpeg
x-goog-hash: crc32c=joQJZQ==, md5=hJzN7EMk0n3wyLd6y2doZg==
cache-control: public, max-age=31536000
x-goog-stored-content-length: 6863
accept-ranges: bytes
cf-ray: 8479d00219dd9ae6-MIA
expires: Wed, 17 Jan 2024 17:34:40 GMT

GET
H3 200 image-freedomheadlines.com-30001
image.vuukle.com/ Frame 05E3 9 KB
10 KB 52ms
51ms Image
image/jpeg 2606:4700:10::ac43:1695
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image.vuukle.com/image-freedomheadlines.com-30001
Requested by: Host: freedomheadlines.com
URL: https://freedomheadlines.com/freedom-wire/super-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa/?utm_medium=email&utm_source=sparkpost&utm_campaign=regular
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:10::ac43:1695 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b01b5edc12693727ddd2bb5706ec199da3555540edb3623479b87948c46215bf

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.vuukle.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:18 GMT
cf-cache-status: HIT
age: 46218
cf-polished: origSize=9753
x-guploader-uploadid: ABPtcPpTZNNUmcr54JV00YeeWWfe_i835a29UkmiqG7bIg6B9XTBbzt-T2xDfPN0vFRQ69SDVjH8MqA_Uw
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400
content-length: 9430
cf-bgj: imgq:100,h2pri
last-modified: Sat, 13 Jan 2024 17:15:26 GMT
server: cloudflare
etag: "cae866853eec8eabd4b343ed47809d44"
vary: Accept-Encoding
x-goog-generation: 1705166126113975
content-type: image/jpeg
x-goog-hash: crc32c=RVttyA==, md5=yuhmhT7sjqvUs0PtR4CdRA==
cache-control: public, max-age=31536000
x-goog-stored-content-length: 9753
accept-ranges: bytes
cf-ray: 8479d00219e09ae6-MIA
expires: Thu, 18 Jan 2024 09:18:00 GMT

GET
H2 200 pwt.js Show response
ads.pubmatic.com/AdServer/js/pwt/160835/4933/ 222 KB
67 KB 225ms
63ms Script
application/javascript 23.56.213.14
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/pwt/160835/4933/pwt.js
Requested by: Host: assets.revcontent.com
URL: https://assets.revcontent.com/master/delivery.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.56.213.14 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-56-213-14.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 6b30722487e92833baf8f01d6b2d2fed4e459d7cd42dc81ac1a80d8d08b9450e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:19 GMT
content-encoding: gzip
last-modified: Sat, 29 Apr 2023 00:25:40 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=49102
accept-ranges: bytes
content-length: 68444
expires: Fri, 19 Jan 2024 10:46:41 GMT

GET
H2 200 AGSKWxVW_T6Jefgy6J5ymxAJospkB5g1hZiJ5cRTajioa6Vb3mBtlzqaU9mBe-tv7SlRUdxgvudSbzFZKNq2zQF1Js4MZBkQ3d-OkNFc3TQd3VZ4y6U2kOZXp21on0Q9QnH9C81GY1gGBQ== Show response
fundingchoicesmessages.google.com/f/ 10 KB
5 KB 102ms
101ms Script
application/javascript 2607:f8b0:4006:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxVW_T6Jefgy6J5ymxAJospkB5g1hZiJ5cRTajioa6Vb3mBtlzqaU9mBe-tv7SlRUdxgvudSbzFZKNq2zQF1Js4MZBkQ3d-OkNFc3TQd3VZ4y6U2kOZXp21on0Q9QnH9C81GY1gGBQ==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzA1NjEyMDk4LDg3MzAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9mcmVlZG9taGVhZGxpbmVzLmNvbS9mcmVlZG9tLXdpcmUvc3VwZXItcGFjLWJhY2tpbmctZ29wLWNhbmRpZGF0ZS1wdWxscy1taWxsaW9ucy1mcm9tLXR2LWFkcy1pcy1oaXMtY2FtcGFpZ24tZG9hLyIsbnVsbCxbWzgsIkxJcWM0MUJKNWEwIl0sWzksImVuLVVTIl0sWzE5LCIyIl1dXQ

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.LIqc41BJ5a0.es5.O/am=wA/d=1/rs=AJlcJMwgqDkzAh6CC5ELYNPvsJo4CceONQ/m=kernel_loader,loader_js_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::200e Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

b028ec0772f1c8ae38afc78b6724eea1c484740c540ceaa67b40253334690a63

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-fhd614s7Nwq1Jnag-i8Qxg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:18 GMT
content-security-policy: script-src 'report-sample' 'nonce-fhd614s7Nwq1Jnag-i8Qxg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 esp.js Show response
cdn.id5-sync.com/api/1.0/ 114 KB
29 KB 151ms
56ms Script
text/javascript 2606:4700:10::6816:3456
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/esp.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401110101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3456 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b7bf4f406f5a9bf165c21dfebea2257eab80882e23e887a24756956daac44373

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:19 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 08 Jan 2024 11:20:59 GMT
server: cloudflare
x-amz-request-id: 8DEZDMXWT7CX5BR8
age: 1812
etag: W/"3732dd6fc229ed015d7d7eddf157953f"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 8479d002ed2c749e-MIA
x-amz-id-2: bZZO9mWAcaJqW26GsYUOCMjLE7C98hFFeH3pjEbzAtVk3n/BEAV9iXyBhtQ/gn35PUt7uuRH/QKl9peRxJ5cTg==

GET
H/1.1 200
OK uid2SecureSignal.js Show response
cdn.prod.uidapi.com/ 3 KB
3 KB 254ms
66ms Script
text/javascript 2600:9000:2511:3e00:a:e047:753:a221
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.prod.uidapi.com/uid2SecureSignal.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401110101/pubads_impl.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2511:3e00:a:e047:753:a221 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 72e960baa80ec819264a604f2f8a8e5c21f81b785ebc17595211ad170d8b1bdc

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-amz-version-id: KP_OVZMS6roEW_XJdOd.KnSEmM8GWiP3
Date: Thu, 18 Jan 2024 14:22:48 GMT
Via: 1.1 f48e3bba7eb119871945c3726fab1888.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: JFK50-P6
Age: 24332
x-amz-server-side-encryption: AES256
X-Cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
Connection: keep-alive
Content-Length: 2776
Last-Modified: Thu, 19 Oct 2023 06:40:11 GMT
Server: AmazonS3
ETag: "a3a9a9ee8e72db69d54e805f0586c651"
Content-Type: text/javascript
Accept-Ranges: bytes
X-Amz-Cf-Id: 4Z2WxDXh13nnnlklyQyl0vh60iJp-JhkkbpK2AIoHjsXOLU2pD61tg==

GET
H2 200 pubcid.min.js Show response
cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/ 732 B
901 B 121ms
31ms Script
application/javascript 2a04:4e42::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/pubcid.min.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401110101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 18 Jan 2024 21:08:19 GMT
x-content-type-options: nosniff
content-encoding: br
age: 5216
x-jsd-version: master
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 439
x-served-by: cache-fra-eddf8230042-FRA, cache-mia-kmia1760079-MIA
x-jsd-version-type: branch
etag: W/"2dc-IrZxm/sP4aqtIfs1EfEw6Dg5q1Y"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16589/ 39 KB
12 KB 210ms
67ms Script
text/javascript 108.138.128.124
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401110101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.124 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-124.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e885badff253144e188588b5657e13cfa1135d4cd682053c9cca02b83baf1ef2

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 14:32:33 GMT
content-encoding: gzip
via: 1.1 177517a7a813d3db43efccb1bf2be96a.cloudfront.net (CloudFront)
last-modified: Wed, 06 Sep 2023 15:56:57 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P4
age: 23747
etag: W/"e073e71ed7a44e6f9cdd72904fda5940"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public, max-age=86400
x-amz-cf-id: FwnpOLbWWVlr9OndlG7J1NSBHH20L7z7gfm546gHPDome4HitYuuVw==

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 1 KB
1 KB 240ms
161ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401110101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: b04a268fbd6ac543dcd653b1c529871767a5b78cb2a2f40e54bcb0bfe2daa154

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:19 GMT
via: 1.1 google, 1.1 google
last-modified: Thu, 03 Aug 2023 03:28:51 GMT
server: Google Frontend
etag: fc4e6bfe266081c4873c6f08c8298e5c
content-type: text/javascript; charset=utf-8
x-cloud-trace-context: 695e223e1c47f54b22c76fdc02b5d05c
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1207

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 124ms
36ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401110101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 29 Dec 2023 17:15:46 GMT
content-encoding: gzip
age: 1741953
x-guploader-uploadid: ABPtcPoifBkFEfafoVMbFEgxRcsHpCemu50VFgi6GwnCFwBZOyjWn7wD9lpNJvw9d2oWO_LCCGo
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7927
last-modified: Thu, 27 May 2021 18:30:51 GMT
server: UploadServer
etag: "df5542b88bc0e368c6999754a5b9e2ba"
x-goog-generation: 1622140251693895
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
content-type: application/javascript
cache-control: no-transform
x-goog-stored-content-length: 7927
accept-ranges: bytes
expires: Sat, 28 Dec 2024 17:15:46 GMT

GET
H2 200 ob.js Show response
cdn-ima.33across.com/ 11 KB
5 KB 169ms
60ms Script
application/javascript 172.64.152.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-ima.33across.com/ob.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401110101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.152.89 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c707d5798e40035ef5aa307db04e295703514d654b1e65fa62b04492c687c255

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:19 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 20 Dec 2023 19:21:40 GMT
server: cloudflare
age: 90174
etag: W/"65833ec4-2d18"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 8479d0030e224958-MIA
expires: Sun, 21 Jan 2024 21:08:19 GMT

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 41 KB
13 KB 228ms
111ms Script
text/javascript 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401110101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

3dd103ba888c627706f31656287652d5fceb9ef7a7099eec5a07aac2f7d397dd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:19 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 10 Jan 2024 15:13:35 GMT
server: nginx
etag: W/"659eb41f-a585"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 19 Jan 2024 21:08:19 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 1010 KB
194 KB 1006ms
1005ms Fetch
text/plain 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=418096261081264&correlator=2039567240676354&eid=31080336%2C31079724&output=ldjh&gdfp_req=1&vrg=202401110101&ptt=17&impl=fifs&gdpr=0&us_privacy=1---&gpp_sid=-1&iu_parts=23020701155%2CFreedomHeadlines%2CAnchor%2CInterstitial%2CLeaderboard%2CIn-Content-1%2CIn-Content-2%2CIn-Content-3%2CIn-Content-4%2CIn-Content-5%2CIn-Content-6&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F3%2C%2F0%2F1%2F4%2C%2F0%2F1%2F5%2C%2F0%2F1%2F6%2C%2F0%2F1%2F7%2C%2F0%2F1%2F8%2C%2F0%2F1%2F9%2C%2F0%2F1%2F10&prev_iu_szs=1x1%2C1x1%2C728x90%2C728x90%2C728x90%2C728x90%2C728x90%2C728x90%2C728x90&ifi=1&didk=1027101085~3112155023~2955458943~1564351762~3681264867~3462200777~1876308405~3127559167~4172343989&sfv=1-0-40&ists=384&fas=1%2C8%2C0%2C0%2C0%2C0%2C0%2C0%2C0&sc=1&cookie_enabled=1&abxe=1&dt=1705612098900&lmt=1705612098&adxs=-9%2C-9%2C-9%2C220%2C220%2C-9%2C-9%2C220%2C-9&adys=-9%2C-9%2C-9%2C486%2C786%2C-9%2C-9%2C2532%2C-9&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1%7C-1%7C-1%7C0%7C0%7C-1%7C-1%7C1%7C-1&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8%7C9&oid=2&tos=~~~~~~~~&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fsuper-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&vis=1&psz=0x-1%7C0x-1%7C0x-1%7C780x0%7C780x0%7C0x-1%7C0x-1%7C780x0%7C0x-1&msz=0x-1%7C0x-1%7C0x-1%7C780x0%7C780x0%7C0x-1%7C0x-1%7C780x0%7C0x-1&fws=2%2C2%2C2%2C4%2C4%2C2%2C2%2C4%2C2&ohw=0%2C0%2C0%2C1600%2C1600%2C0%2C0%2C1600%2C0&ga_vid=763368515.1705612098&ga_sid=1705612099&ga_hid=1411495994&ga_fc=true&dlt=1705612097188&idt=1148&adks=4226562798%2C3375205104%2C3545489242%2C1869983195%2C3340313678%2C2110955564%2C3332767076%2C2984975214%2C3253828981&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401110101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

60c0c43abfe7ebe2946a5af14d74d12f15e1f3931480576fa06bf7f6292d1ecd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:19 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 198340
x-xss-protection: 0
google-lineitem-id: -1,-1,-1,-1,-1,-1,-2,-2,-1
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -1,-1,-1,-1,-1,-1,-2,-2,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://freedomheadlines.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 7CEB 6 KB
3 KB 238ms
80ms Document
text/html 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401110101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://freedomheadlines.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 18 Jan 2024 21:08:19 GMT
expires: Fri, 17 Jan 2025 21:08:19 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pubads_impl_page_level_ads.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401110101/ 40 KB
14 KB 69ms
68ms Script
text/javascript 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401110101/pubads_impl_page_level_ads.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401110101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f3971f682e1cdd324bc639f47ea2efc1e4cd4188f55efe418e3ccfceec44dbf3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 09:01:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 43636
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13834
x-xss-protection: 0
server: cafe
etag: 9405266704092491736
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Fri, 17 Jan 2025 09:01:02 GMT

GET
H2 200 0718ad3a-0b2c-415c-9131-c46be31a6dc2 Show response
player.ex.co/player/ 456 KB
154 KB 121ms
34ms Script
application/javascript 151.101.2.132
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://player.ex.co/player/0718ad3a-0b2c-415c-9131-c46be31a6dc2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.2.132 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

0529dd9e8b0974a74427fc586d1428a367e0d47d21369d3fe9ca755cfbfdf73e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 18 Jan 2024 21:08:19 GMT
via: 1.1 varnish, 1.1 varnish
age: 3207
x-cache: HIT, HIT
content-length: 156601
x-served-by: cache-iad-kcgs7200169-IAD, cache-mia-kmia1760085-MIA
server: nginx
x-timer: S1705612099.044431,VS0,VE1
etag: W/"71f2c-zf/u1f+Rou7gs8kZ7iPp2CHXh4c"
access-control-max-age: 600
access-control-allow-methods: GET, POST, PUT, DELETE, PATCH
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-cache
vary: Accept-Encoding, x-pb-country, x-pb-connection, x-pb-embedid, x-pb-itemid, x-pb-videoid, x-pb-player, x-pb-bot-name, x-pb-is-bot, x-pb-country, x-pb-connection, x-pb-embedid, x-pb-itemid, x-pb-videoid, x-pb-player, x-pb-bot-name, x-pb-is-bot
accept-ranges: bytes
access-control-allow-headers: Accept, Authorization, Content-Type
x-cache-hits: 69, 1

POST
H3 200 tshow Show response
api.whizzco.com/dtracking/v1/ 15 B
460 B 128ms
127ms XHR
application/json 2606:4700:e6::ac40:cf23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.whizzco.com/dtracking/v1/tshow
Requested by: Host: cdn.whizzco.com
URL: https://cdn.whizzco.com/scripts/widget/widget_v3.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:e6::ac40:cf23 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3d23d39a30bb7323f8ccfd64c52cf286138fba4f83e78f7edcf66703b7c23aaa

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-type: application/json; charset=UTF-8

Response headers

date: Thu, 18 Jan 2024 21:08:19 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v6%2BykIa85ML0iFcVly4JBTh%2F%2B9QobTnA05It4LGCeJRxBTPsKYgEy%2Fbz0mr04cZs5W5N%2FnKlW%2F1tIUav6D%2B%2FjUgD%2BzgULcAjDUhvN%2FMhu2kRgI5k2JtZUY4tkcb9ndZdXpNC5tlCzkUoSkcLSAk%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://freedomheadlines.com
access-control-allow-credentials: true
cf-ray: 8479d0034c2bda9b-MIA
alt-svc: h3=":443"; ma=86400
content-length: 15
priority: u=1,i

OPTIONS
H3 200 tshow
api.whizzco.com/dtracking/v1/ Frame 0
0 122ms
120ms Preflight 2606:4700:e6::ac40:cf23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.whizzco.com/dtracking/v1/tshow
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:e6::ac40:cf23 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://freedomheadlines.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET, POST, HEAD, OPTIONS
access-control-allow-origin: https://freedomheadlines.com
access-control-max-age: 1800
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8479d0027ac8da9b-MIA
content-length: 0
date: Thu, 18 Jan 2024 21:08:19 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority: u=1,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HUBKGkIksotmGOEYTVJHSiPL2nT3BMRFRQGJEqXKG%2BjpPZ0MBsLhcMj5bfGUxVGp5VCHNq6K%2F3hjG8UUrUpHEytJQJgIbd0dB2IYEIgQ8Gb2dIwL%2B%2BpBK%2FW23n%2F4NwRo9w%2FWU82zXy65FOKXwxM%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H2

200

esp Show response
oajs.openx.net/
Redirect Chain

https://oajs.openx.net/esp?url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fsuper-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa%2F%3Futm_medium%3Demail%26utm_sourc...
https://oajs.openx.net/esp?url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fsuper-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa%2F%3Futm_medium%3Demail%26utm_sourc...

85 B
194 B

72ms
71ms

Fetch
application/json

34.120.107.143
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oajs.openx.net/esp?url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fsuper-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&rid=esp&cc=1
Protocol: H2
Server: 34.120.107.143 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 143.107.120.34.bc.googleusercontent.com
Software: / Express
Resource Hash: f15722846671654682a626d8c960f8064c31ef33d9a25cddc67baebc015836a9

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:19 GMT
via: 1.1 google
x-powered-by: Express
etag: W/"55-ZlmPqN12YDo7KKexRfGhvfyxBVQ"
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://freedomheadlines.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85

Redirect headers

date: Thu, 18 Jan 2024 21:08:19 GMT
via: 1.1 google
x-powered-by: Express
vary: Origin
access-control-allow-origin: https://freedomheadlines.com
location: /esp?url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fsuper-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&rid=esp&cc=1
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 204 increment Show response
id5-sync.com/api/esp/ 0
236 B 440ms
142ms XHR
text/plain 162.19.138.120
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/esp/increment?counter=no-config

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/esp.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.120 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://freedomheadlines.com
date: Thu, 18 Jan 2024 21:08:18 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 156 B
615 B 273ms
70ms XHR
application/json 52.201.6.220
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.201.6.220 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-201-6-220.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 1ebd32166d1bba200778f9f830276129167c637c351993dbd5860e6e0f031d9b

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 18 Jan 2024 21:08:19 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://freedomheadlines.com
cache-control: no-cache
x-server: 10.40.0.91
access-control-allow-credentials: true
content-length: 156
expires: 0

GET
H2 200 config Show response
player.ex.co/ 2 KB
2 KB 119ms
33ms Fetch
application/javascript 151.101.2.132
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://player.ex.co/config?sfid=0010J00002G2BxCQAV

Requested by

Host: player.ex.co
URL: https://player.ex.co/player/0718ad3a-0b2c-415c-9131-c46be31a6dc2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.2.132 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

7d97e296a99b99180897bbf9760f13f1946dcfe526c02cd57593ce6c8906ebe2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 18 Jan 2024 21:08:19 GMT
via: 1.1 varnish, 1.1 varnish
age: 9080
x-cache: HIT, HIT
content-length: 1705
x-served-by: cache-iad-kiad7000027-IAD, cache-mia-kmia1760055-MIA
server: nginx
x-timer: S1705612099.270481,VS0,VE0
etag: W/"7d1-0wB3yZiC4SETHjfjHmVNH2O1ljo"
access-control-max-age: 600
access-control-allow-methods: GET, POST, PUT, DELETE, PATCH
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-cache
vary: x-pb-domain
accept-ranges: bytes
access-control-allow-headers: Accept, Authorization, Content-Type
x-cache-hits: 117, 2

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 276ms
132ms XHR
application/json 2607:f8b0:4006:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202401110101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401110101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

55c33d023086b0fa2cc902dc827513873cda6879d1be5421c241bf8def1ffd14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:19 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12127
x-xss-protection: 0

POST
H2 200 events Show response
collector.ex.co/main/ 17 B
155 B 207ms
60ms XHR
application/json 3.211.184.30
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://collector.ex.co/main/events
Requested by: Host: player.ex.co
URL: https://player.ex.co/player/0718ad3a-0b2c-415c-9131-c46be31a6dc2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.211.184.30 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-211-184-30.compute-1.amazonaws.com
Software: /
Resource Hash: cebe87559cf861d01e9c6b1cefd38ab1db9e13c8fe316b85a296b6cf220f883e

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 18 Jan 2024 21:08:19 GMT
etag: W/"11-MaL8I3MaqLPWbOrdrabTmSWS9PM"
content-length: 17
content-type: application/json; charset=utf-8

GET
H2 200 css2
fonts.googleapis.com/ 2 KB
681 B 83ms
79ms Stylesheet
text/css 2607:f8b0:4006:823::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto&display=swap

Requested by

Host: client
URL: about:client

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::200a Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c87b7f745cfb4a994801488584e6e0e78d6c4f0ad567e985a781fc0b86074724

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 18 Jan 2024 21:08:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 18 Jan 2024 20:03:54 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 18 Jan 2024 21:08:19 GMT

GET
H/1.1 200
OK landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.webp
mcd.ex.co/video/upload/w_800,so_4/v1490095101/ 14 KB
15 KB 450ms
67ms Image
image/webp 23.48.224.68
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mcd.ex.co/video/upload/w_800,so_4/v1490095101/landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.webp
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.48.224.68 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-48-224-68.deploy.static.akamaitechnologies.com
Software: cloudinary /
Resource Hash: 06ebe1954427c09d4400e7e77e9c651b2eb3953e798ba97971d536f4bb398c89

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date: Thu, 18 Jan 2024 21:08:19 GMT
Cache-Tag: 502941132783428480281542933415069772301,473281262405526930053610213462331028430,c8ca5d8e4a43f8ef61d39b48fd5ffa31
Content-Disposition: inline; filename="landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.webp"
Connection: keep-alive
Content-Length: 14352
X-Served-By: cache-lga21926-LGA
Last-Modified: Mon, 13 Feb 2023 08:42:01 GMT
Server: cloudinary
X-Timer: S1692208188.633880,VS0,VE99
ETag: "cea3d109186db580c1bb2c32d1905228"
Content-Type: image/webp
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31557600
Accept-Ranges: bytes
Timing-Allow-Origin: *
Access-Control-Allow-Headers: X-Requested-With
X-Cache-Hits: 0

GET
H2 200 player.js Show response
cdn.ex.co/player/ap/p/4.15.2-a91a6d5/ 325 KB
90 KB 288ms
63ms Script
application/javascript 23.48.224.80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ex.co/player/ap/p/4.15.2-a91a6d5/player.js
Requested by: Host: player.ex.co
URL: https://player.ex.co/player/0718ad3a-0b2c-415c-9131-c46be31a6dc2
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.48.224.80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-48-224-80.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: fb75433c79ecf5e35da5d564aa954380657320ccd5cb7f663b99b0d0709b8cce

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:19 GMT
content-encoding: gzip
x-amz-server-side-encryption: AES256
content-length: 91230
last-modified: Thu, 18 Jan 2024 08:40:21 GMT
server: AmazonS3
etag: "fd21468858c7cdc3b14eabd77a5b7921"
vary: Accept-Encoding
access-control-max-age: 86400
access-control-allow-methods: GET,POST
access-control-allow-origin: *
content-type: application/javascript
cache-control: must-revalidate, proxy-revalidate, max-age=604800, s-maxage=31536000
access-control-allow-credentials: false
accept-ranges: bytes
access-control-allow-headers: *
expires: Thu, 25 Jan 2024 21:08:19 GMT

GET
H2 200 / Show response
trends.revcontent.com/api/demand/ 54 B
317 B 188ms
63ms Fetch
application/json 3.232.254.109
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trends.revcontent.com/api/demand/?w=137741&gdpr=0&gdpr_consent=undefined&us_privacy=1---

Requested by

Host: assets.revcontent.com
URL: https://assets.revcontent.com/master/delivery.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.232.254.109 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-232-254-109.compute-1.amazonaws.com

Software

envoy /

Resource Hash

47b726fd18aa3355c7f0277952419c5e1b33d3347ee2e4eff5e9b9be73040549

Security Headers

Name	Value
Strict-Transport-Security	max-age=931536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-rc-region: us-east-1a
date: Thu, 18 Jan 2024 21:08:19 GMT
strict-transport-security: max-age=931536000; includeSubDomains
server: envoy
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://freedomheadlines.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 4
content-length: 54

GET
H2 200 sync Show response
trends.revcontent.com/ 62 B
567 B 186ms
62ms Fetch
application/json 3.232.254.109
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://trends.revcontent.com/sync?gdpr=0&gdpr_consent=undefined&us_privacy=1---
Requested by: Host: assets.revcontent.com
URL: https://assets.revcontent.com/master/delivery.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.232.254.109 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-232-254-109.compute-1.amazonaws.com
Software: envoy /
Resource Hash: 47701cc75a4da828541d20dc1fc3ac204ebfa821d0cb4ae183192c3e959431bb

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-rc-region: us-east-1a
date: Thu, 18 Jan 2024 21:08:19 GMT
server: envoy
etag: "3d2effa2-4d23-4201-93f6-477cfa596550"
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
content-type: application/json
access-control-allow-origin: https://freedomheadlines.com
p3p: CP="NOI DSP COR NID ADM DEV OUR NOR CNT"
cache-control: max-age=600, private, s-maxage=0, stale-while-revalidate=1800
access-control-allow-credentials: true
x-envoy-upstream-service-time: 4
content-length: 62

GET
H2 200 pd Show response
google-bidout-d.openx.net/w/1.0/ Frame 38EE 725 B
871 B 155ms
59ms Document
text/html 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Requested by: Host: oa.openxcdn.net
URL: https://oa.openxcdn.net/esp.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: cf792513e220b0fd134781277d42a99b460509208d1821d91f94d2764c8263f3

Request headers

Referer: https://freedomheadlines.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 453
content-type: text/html
date: Thu, 18 Jan 2024 21:08:19 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H3 200 ads160. Show response
fundingchoicesmessages.google.com/f/AGSKWxX3SkA_0m0HEny71I5LuIvoiehhtKH3Xl8ehtnlpitz8HlOaELORCutmpj90ogZ8CxcTHz4ZUTUq12GF2ao04eHfPcJ0caOSGXyGSwxPefRrQPb4BBgphcwQxonUOks1qSzFLtrjv4CKw-Zvey5KO046o6ea... 54 B
109 B 95ms
93ms Script
application/javascript 2607:f8b0:4006:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxX3SkA_0m0HEny71I5LuIvoiehhtKH3Xl8ehtnlpitz8HlOaELORCutmpj90ogZ8CxcTHz4ZUTUq12GF2ao04eHfPcJ0caOSGXyGSwxPefRrQPb4BBgphcwQxonUOks1qSzFLtrjv4CKw-Zvey5KO046o6eao-rE0dcNByNcdyvQ9cR5Aq-YTi0QTE0/_/adv/topbanner._adcount=/adsbyfalcon./ad-position-/ads160.

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.LIqc41BJ5a0.es5.O/d=1/exm=kernel_loader,loader_js_executable/ed=1/rs=AJlcJMykiRoNlXxpNjyKSui2lVj5QN6bXQ/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::200e Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

26b0c9b6326947c0449c6f899fbd291f424c7a24faee8e1dcfda85b5ae3f7b2a

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-EAAawq8nGiusp84wXai2Og' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:19 GMT
content-security-policy: script-src 'report-sample' 'nonce-EAAawq8nGiusp84wXai2Og' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 146 KB
50 KB 242ms
108ms Script
text/javascript 2607:f8b0:4006:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?fcd=true

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

306be6ea85822c81337627de7c7cac75249bf8f45568d2c27d8f21e1f354d184

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:19 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51130
x-xss-protection: 0
server: cafe
etag: 4486151672078642936
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
link: <https://googleads.g.doubleclick.net>; rel="preconnect"; crossorigin
expires: Thu, 18 Jan 2024 21:08:19 GMT

POST
H3 204 AGSKWxWk5dLp5LnUiqkCN2dwlR1k_xta93uQ3wikgTqm27DDdD18Pq3fDao-jBmeRTYFRaIUSayJpvT_zlOv7evXYc_rsi-JSGOcSuehIW9_vh5W4Wk3PQCHuOOtw0rSKkzGyFhvS8S6KA== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 220ms
87ms XHR
text/html 2607:f8b0:4006:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWk5dLp5LnUiqkCN2dwlR1k_xta93uQ3wikgTqm27DDdD18Pq3fDao-jBmeRTYFRaIUSayJpvT_zlOv7evXYc_rsi-JSGOcSuehIW9_vh5W4Wk3PQCHuOOtw0rSKkzGyFhvS8S6KA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::200e Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-Ph5RFRWiegIzgf4AWeZsZw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 18 Jan 2024 21:08:19 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-Ph5RFRWiegIzgf4AWeZsZw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://freedomheadlines.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 246ms
102ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401110101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 18 Jan 2024 21:08:19 GMT

GET
H2 200 / Show response
trends.revcontent.com/api/delivery/ 39 KB
20 KB 262ms
261ms Fetch
application/json 3.232.254.109
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trends.revcontent.com/api/delivery/?is_blocked=undefined&w=137741&width=1600&gdpr=0&gdpr_consent=undefined&us_privacy=1---&rev_allow_cookies=0&site_url=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fsuper-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa%2F%3Futm_medium%3Demail%26utm_source%3Dsparkpost%26utm_campaign%3Dregular&icr_url=&va=0&user_uuid=3d2effa2-4d23-4201-93f6-477cfa596550&time=1705612099647&up=pc&bn=chrome&bv=120&widget_width=780&style_id=0&an=false

Requested by

Host: assets.revcontent.com
URL: https://assets.revcontent.com/master/delivery.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.232.254.109 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-232-254-109.compute-1.amazonaws.com

Software

envoy /

Resource Hash

3dac7dc01cbd84b4f138f42033d88aaeb1378b087505d956346b8577682c21bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=931536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-rc-region: us-east-1a
date: Thu, 18 Jan 2024 21:08:19 GMT
strict-transport-security: max-age=931536000; includeSubDomains
content-encoding: gzip
server: envoy
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://freedomheadlines.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 202

GET
H2 200 2b3c472e-a47a-e405-f174-1b98dcdfddc3
pr-bh.ybp.yahoo.com/sync/openx/ Frame 38EE 43 B
604 B 183ms
62ms Image
image/gif 2600:1f18:4e9:5a01:75af:f069:585e:f21
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/openx/2b3c472e-a47a-e405-f174-1b98dcdfddc3?gdpr=0

Requested by

Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a01:75af:f069:585e:f21 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://google-bidout-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:19 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame 38EE
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=e72d5d17-287c-cdb6-00ad-8ffa4bbbdb6a
https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=e72d5d17-287c-cdb6-00ad-8ffa4bbbdb6a&dcc=t

43 B
855 B

86ms
85ms

Image
image/gif

52.46.151.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=e72d5d17-287c-cdb6-00ad-8ffa4bbbdb6a&dcc=t

Requested by

Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5

Protocol

HTTP/1.1

Server

52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://google-bidout-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 18 Jan 2024 21:08:19 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: J860Q2S25JHFP33ZP1JS
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 18 Jan 2024 21:08:19 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: KWJMAYFBZWXABT72JETS
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=e72d5d17-287c-cdb6-00ad-8ffa4bbbdb6a&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 38EE
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=bffb216a-34d6-764c-c0a3-0d6d2388108a&gdpr=0
https://match.adsrvr.org/track/cmb/openx?oxid=bffb216a-34d6-764c-c0a3-0d6d2388108a&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=85cb6970-04cc-432f-923d-e82232fa0e19&ttd_puid=bffb216a-34d6-764c-c0a3-0d6d2388108a&gdpr=0&gdpr_consent=

43 B
313 B

72ms
69ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=85cb6970-04cc-432f-923d-e82232fa0e19&ttd_puid=bffb216a-34d6-764c-c0a3-0d6d2388108a&gdpr=0&gdpr_consent=
Requested by: Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://google-bidout-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Jan 2024 21:08:19 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=85cb6970-04cc-432f-923d-e82232fa0e19&ttd_puid=bffb216a-34d6-764c-c0a3-0d6d2388108a&gdpr=0&gdpr_consent=
date: Thu, 18 Jan 2024 21:08:19 GMT
server: Kestrel
content-length: 335

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 38EE
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=OTM5NGYyYTAtZmRhMS0yOGU4LWQ1NDMtNTdkNGU5NmFkZWVh
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=OTM5NGYyYTAtZmRhMS0yOGU4LWQ1NDMtNTdkNGU5NmFkZWVh&google_tc=

170 B
243 B

83ms
80ms

Image
image/png

142.250.65.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=OTM5NGYyYTAtZmRhMS0yOGU4LWQ1NDMtNTdkNGU5NmFkZWVh&google_tc=

Requested by

Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5

Protocol

Server

142.250.65.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s73-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://google-bidout-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Jan 2024 21:08:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 18 Jan 2024 21:08:19 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=OTM5NGYyYTAtZmRhMS0yOGU4LWQ1NDMtNTdkNGU5NmFkZWVh&google_tc=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 38EE
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm=&google_sc=&google_tc=
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEMT7iQVtYGswbdo-Sxc4REM&google_cver=1

43 B
97 B

61ms
59ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEMT7iQVtYGswbdo-Sxc4REM&google_cver=1
Requested by: Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://google-bidout-d.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Jan 2024 21:08:20 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 18 Jan 2024 21:08:19 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEMT7iQVtYGswbdo-Sxc4REM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxWk5dLp5LnUiqkCN2dwlR1k_xta93uQ3wikgTqm27DDdD18Pq3fDao-jBmeRTYFRaIUSayJpvT_zlOv7evXYc_rsi-JSGOcSuehIW9_vh5W4Wk3PQCHuOOtw0rSKkzGyFhvS8S6KA== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 127ms
91ms XHR
text/html 2607:f8b0:4006:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWk5dLp5LnUiqkCN2dwlR1k_xta93uQ3wikgTqm27DDdD18Pq3fDao-jBmeRTYFRaIUSayJpvT_zlOv7evXYc_rsi-JSGOcSuehIW9_vh5W4Wk3PQCHuOOtw0rSKkzGyFhvS8S6KA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::200e Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-yOyrIhwGhk4gjGOnqvHpiA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 18 Jan 2024 21:08:19 GMT
content-security-policy: script-src 'report-sample' 'nonce-yOyrIhwGhk4gjGOnqvHpiA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://freedomheadlines.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cookie_sync.html Show response
cdn.ex.co/sync/0.0.1-7abf705/ Frame AFBA 399 B
621 B 63ms
62ms Document
text/html 23.48.224.80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ex.co/sync/0.0.1-7abf705/cookie_sync.html?network=368531133%2C1841615463&gdpr=0&gdpr_consent=
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/ap/p/4.15.2-a91a6d5/player.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.48.224.80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-48-224-80.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 82456a999e1a765cd03fac635e93544b0eded4a493db45cd8c7173c8d8ffb245

Request headers

Referer: https://freedomheadlines.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-credentials: false
access-control-allow-headers: *
access-control-allow-methods: GET,POST
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: must-revalidate, proxy-revalidate, max-age=56856, s-maxage=31536000
content-encoding: gzip
content-length: 269
content-type: text/html;charset=utf-8
date: Thu, 18 Jan 2024 21:08:19 GMT
etag: "c0ea3371cad482736b0000f33ed6816b"
last-modified: Tue, 19 Dec 2023 08:56:00 GMT
server: AmazonS3
vary: Accept-Encoding
x-amz-server-side-encryption: AES256

POST
H2 200 events Show response
collector.ex.co/main/ 17 B
154 B 58ms
56ms XHR
application/json 3.211.184.30
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://collector.ex.co/main/events
Requested by: Host: player.ex.co
URL: https://player.ex.co/player/0718ad3a-0b2c-415c-9131-c46be31a6dc2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.211.184.30 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-211-184-30.compute-1.amazonaws.com
Software: /
Resource Hash: cebe87559cf861d01e9c6b1cefd38ab1db9e13c8fe316b85a296b6cf220f883e

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 18 Jan 2024 21:08:19 GMT
etag: W/"11-MaL8I3MaqLPWbOrdrabTmSWS9PM"
content-length: 17
content-type: application/json; charset=utf-8

GET
H2 200 player.js Show response
p.channelexco.com/player/ 31 KB
19 KB 399ms
234ms Script
application/x-javascript 108.59.7.241
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to

Full URL: https://p.channelexco.com/player/player.js?pv=117.59&p=779297768&cb=f07b076e-eb04-4e0e-b15b-dc33c02d1055&d=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fsuper-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa%2F&schain=1.0%2C1%21playbuzz.com%2C0010J00002G2BxCQAV%2C1%2C%2C%2Cfreedomheadlines.com&w=780&h=438.8&asr=1&impDetail=1&auction=1&auctionFast=5&publisherType=publisher&gdpr=-GPV_GDPR-&gdpr_consent=-GPV_GDPR_CONSENT-&us_privacy=-GPV_US_PRIVACY-&rv=true&sid=&sid2=default&sid4=p%2F4.15.2-a91a6d5&utm_source=sparkpost&utm_medium=email&utm_campaign=regular&pub=1&pageLoadUid=048e8b9a-8a0e-4fb4-bedf-824bbd1d3936
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/ap/p/4.15.2-a91a6d5/player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.59.7.241 , United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: openresty /
Resource Hash: 639b2a5541437e31e40fb7e99db49a6412c8ceeae5954577a879fa1e960d9478

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

content-type: application/x-javascript
date: Thu, 18 Jan 2024 21:08:20 GMT
cache-control: no-cache
content-encoding: gzip
server: openresty
vary: Accept-Encoding
expires: Thu, 18 Jan 2024 21:08:19 GMT

GET
H2 200 d Show response
gpv.ex.co/player/ 2 KB
2 KB 259ms
79ms Fetch
text/plain 3.213.98.162
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://gpv.ex.co/player/d?v=2&b={%22pageLoadUid%22:%22048e8b9a-8a0e-4fb4-bedf%C4%9824bbd1d3936%22,%22country%C4%8D%22US%C4%B3%22browser%C4%BDch%C5%84me%C5%81os%C4%BDwind%C5%85%C5%92%C4%B4networkI%C4%8C%C4%8E1841615463%C5%81hu%C4%8D%C4%BAue%C4%B4p%C4%BD77929%C5%B968%C5%81%C5%A3%22https://fre%C4%A4omhe%C4%88l%C5%95es.%C4%B6m%C6%8B%C6%8D%C6%8Fm-%C5%94%C6%8D/sup%C5%88-%C4%82c%C4%A2ack%C5%95g-gop-ca%C5%96%C4%8Bat%C4%9Cpulls-mi%C6%BFion%C7%81%C6%8C%C6%90-tv-%C4%88%C7%81i%C7%81h%C7%92%C6%B5am%C4%82ign-%C5%97a/%C5%81u%C5%87r%C5%A2%C4%BDfem6zh%C6%A4ahgpnb74%22}

Requested by

Host: cdn.ex.co
URL: https://cdn.ex.co/player/ap/p/4.15.2-a91a6d5/player.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.213.98.162 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-213-98-162.compute-1.amazonaws.com

Software

Resource Hash

75613fb68ed2cf8ef516016ebb4820a3da894fad40008b884fca7c022f149a7f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:20 GMT
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
etag: W/"695-5Kmfu/3JW15Zvjq3JhQW1A"
access-control-max-age: 600
access-control-allow-methods: GET, POST, PUT, DELETE, PATCH
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
access-control-allow-headers: Accept, Authorization, Content-Type
content-length: 1685

GET
H2 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 0A8A 13 KB
5 KB 70ms
66ms Document
text/html 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://freedomheadlines.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 3560
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 18 Jan 2024 20:08:59 GMT
expires: Fri, 17 Jan 2025 20:08:59 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame ABCC 829 B
1 KB 313ms
88ms Document
text/html 2607:f8b0:4006:816::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::2004 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

c24295fdba4dcc9fec3a1685a2e5cd0a736e1d9ff8e8fb0eac8dd5d702e7fd8b

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-ULGTeqRzzKIlDiDcdupRag' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://freedomheadlines.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-ULGTeqRzzKIlDiDcdupRag' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 18 Jan 2024 21:08:20 GMT
expires: Thu, 18 Jan 2024 21:08:20 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

POST
H2 204 impression
trends.revcontent.com/event/ 0
0 240ms
123ms Fetch 3.232.254.109
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trends.revcontent.com/event/impression

Requested by

Host: assets.revcontent.com
URL: https://assets.revcontent.com/master/delivery.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.232.254.109 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-232-254-109.compute-1.amazonaws.com

Software

envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=931536000; includeSubDomains

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

x-rc-region: us-east-1a
date: Thu, 18 Jan 2024 21:08:20 GMT
strict-transport-security: max-age=931536000; includeSubDomains
server: envoy
vary: Origin
access-control-allow-origin: https://freedomheadlines.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 5

GET
H2 200 brandWidget~feedWidget.delivery.js Show response
assets.revcontent.com/master/ 65 KB
17 KB 75ms
68ms Script
text/javascript 13.35.93.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.revcontent.com/master/brandWidget~feedWidget.delivery.js
Requested by: Host: assets.revcontent.com
URL: https://assets.revcontent.com/master/delivery.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.93.14 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-93-14.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b814c8ae9e7f69027025f94e86c5cb363fcad9e3aa8037264756ebb6ea9b2dcc

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 17 Jan 2024 21:58:54 GMT
content-encoding: gzip
via: 1.1 14b9e21ac67dd643dc9e782cb20c49a2.cloudfront.net (CloudFront)
last-modified: Wed, 10 Jan 2024 21:58:45 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P8
age: 83366
x-amz-server-side-encryption: AES256
etag: W/"5c39e5eaccb99cd368db2d83b6734fda"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public,max-age=60
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: _CNsT8_Jky64-m6xTYyxpkloOmRMifi0CiV_LYpZDpcD31aQrHring==

GET
H2 200 defaultWidget~feedWidget.delivery.js Show response
assets.revcontent.com/master/ 30 KB
9 KB 79ms
74ms Script
text/javascript 13.35.93.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.revcontent.com/master/defaultWidget~feedWidget.delivery.js
Requested by: Host: assets.revcontent.com
URL: https://assets.revcontent.com/master/delivery.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.93.14 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-93-14.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 90de9677946cdd4a4ebe716bb66bc32334d831cccdbcc08cdb1f45c6ccd740f0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 18:50:18 GMT
content-encoding: gzip
via: 1.1 14b9e21ac67dd643dc9e782cb20c49a2.cloudfront.net (CloudFront)
last-modified: Wed, 10 Jan 2024 21:58:46 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P8
age: 8282
x-amz-server-side-encryption: AES256
etag: W/"9e34ac7391612bee652333d6b7b04ce9"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public,max-age=60
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: AhxPdE_tQmXiHRE3HqWmhHd5FgI9j6G0zVma8xYBhmkNfiqETkXaAQ==

GET
H2 200 feedWidget.delivery.js Show response
assets.revcontent.com/master/ 34 KB
10 KB 83ms
77ms Script
text/javascript 13.35.93.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.revcontent.com/master/feedWidget.delivery.js
Requested by: Host: assets.revcontent.com
URL: https://assets.revcontent.com/master/delivery.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.93.14 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-93-14.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 20be76da594eb57fc3e1df6da75b13f951baef9c62bf03fe5c359958005c9560

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 10:19:20 GMT
content-encoding: br
via: 1.1 14b9e21ac67dd643dc9e782cb20c49a2.cloudfront.net (CloudFront)
last-modified: Wed, 10 Jan 2024 21:58:45 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P8
age: 38940
x-amz-server-side-encryption: AES256
etag: W/"d6fb1a87f8ef251b746846b658decdd4"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public,max-age=60
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: jhQBQcGAwp_oR56RRHBKajAVOrjAM0LwCiwHZm3pdHUUaLfZrBfrGQ==

GET
H2 200 /
img.revcontent.com/ 1 KB
2 KB 252ms
61ms Image
image/png 13.225.63.4
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.revcontent.com/?url=https://cdn.revcontent.com/assets/img/full_color.png&static=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.63.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-63-4.ewr53.r.cloudfront.net
Software: envoy /
Resource Hash: 94d3b3f21c82e9004e1a95aba77f256573a3406d0782d451d50ac8e4bb4df7c5

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-rc-region: us-east-1a
date: Tue, 03 Oct 2023 17:55:57 GMT
via: 1.1 33d20e5c1d4642e72bf534aef6869c58.cloudfront.net (CloudFront)
last-modified: Thu, 01 Jun 2023 15:43:57 GMT
server: envoy
x-amz-cf-pop: EWR53-C1
age: 9256343
etag: "a798d6ed9b193888fbc8a4a5bd7b51c236f8aa33"
x-cache: Hit from cloudfront
content-type: image/png
x-envoy-upstream-service-time: 22
alt-svc: h3=":443"; ma=86400
content-length: 1351
x-amz-cf-id: 5Y3__KZeibrcgBIV7rtKFU96J8zUPC1FPRzN6lYqEmK8oZDVq435-Q==

GET
H2 200 sync-2435d567.js Show response
cdn.ex.co/sync/0.0.1-7abf705/ Frame AFBA 7 KB
3 KB 64ms
63ms Script
application/javascript 23.48.224.80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ex.co/sync/0.0.1-7abf705/sync-2435d567.js
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/sync/0.0.1-7abf705/cookie_sync.html?network=368531133%2C1841615463&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.48.224.80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-48-224-80.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 8bf2c5d28ba5403debe4799fb6519d1541ce1f17e900acf33557b56f766f2a8a

Request headers

Referer: https://cdn.ex.co/sync/0.0.1-7abf705/cookie_sync.html?network=368531133%2C1841615463&gdpr=0&gdpr_consent=
Origin: https://cdn.ex.co
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:19 GMT
content-encoding: gzip
x-amz-server-side-encryption: AES256
content-length: 2918
last-modified: Tue, 19 Dec 2023 08:56:00 GMT
server: AmazonS3
etag: "b21713c7c85a6c6949322d5c2a99a056"
vary: Accept-Encoding
access-control-max-age: 86400
access-control-allow-methods: GET,POST
access-control-allow-origin: *
content-type: application/javascript
cache-control: must-revalidate, proxy-revalidate, max-age=604800, s-maxage=31536000
access-control-allow-credentials: false
accept-ranges: bytes
access-control-allow-headers: *
expires: Thu, 25 Jan 2024 21:08:19 GMT

GET
H2 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20240117/r20190131/ Frame CF56 9 KB
4 KB 72ms
65ms Document
text/html 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20240117/r20190131/zrt_lookup_fy2021.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?fcd=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e93b8c0ae5b5910b7107c8b455eda029935c56efa8de0be2443d8eabba207197

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://freedomheadlines.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 17360
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4173
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 18 Jan 2024 16:19:00 GMT
etag: 9219409622527106327
expires: Thu, 01 Feb 2024 16:19:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 AGSKWxWk5dLp5LnUiqkCN2dwlR1k_xta93uQ3wikgTqm27DDdD18Pq3fDao-jBmeRTYFRaIUSayJpvT_zlOv7evXYc_rsi-JSGOcSuehIW9_vh5W4Wk3PQCHuOOtw0rSKkzGyFhvS8S6KA== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 97ms
94ms XHR
text/html 2607:f8b0:4006:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWk5dLp5LnUiqkCN2dwlR1k_xta93uQ3wikgTqm27DDdD18Pq3fDao-jBmeRTYFRaIUSayJpvT_zlOv7evXYc_rsi-JSGOcSuehIW9_vh5W4Wk3PQCHuOOtw0rSKkzGyFhvS8S6KA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::200e Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-H1RO_q9fK7mvfIlzxauJPA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 18 Jan 2024 21:08:20 GMT
content-security-policy: script-src 'report-sample' 'nonce-H1RO_q9fK7mvfIlzxauJPA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://freedomheadlines.com
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxWk5dLp5LnUiqkCN2dwlR1k_xta93uQ3wikgTqm27DDdD18Pq3fDao-jBmeRTYFRaIUSayJpvT_zlOv7evXYc_rsi-JSGOcSuehIW9_vh5W4Wk3PQCHuOOtw0rSKkzGyFhvS8S6KA== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 89ms
88ms XHR
text/html 2607:f8b0:4006:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWk5dLp5LnUiqkCN2dwlR1k_xta93uQ3wikgTqm27DDdD18Pq3fDao-jBmeRTYFRaIUSayJpvT_zlOv7evXYc_rsi-JSGOcSuehIW9_vh5W4Wk3PQCHuOOtw0rSKkzGyFhvS8S6KA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::200e Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-679dlmZsaFWbxbA7tX8ARQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 18 Jan 2024 21:08:20 GMT
content-security-policy: script-src 'report-sample' 'nonce-679dlmZsaFWbxbA7tX8ARQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://freedomheadlines.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 AGSKWxXoKpZBpiW60ahPSMLocucLE8X6cr9GJSPh65vbftzuqe8MuauRzPIu5jVoXZDrKJgxRQ4zeSsQvQsMrPRA5awgBJefny1cNkNT_iqaOUdLpsztH_jfi87fhdRfkekNALeMmftF6w== Show response
fundingchoicesmessages.google.com/f/ 5 KB
2 KB 106ms
106ms Script
application/javascript 2607:f8b0:4006:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXoKpZBpiW60ahPSMLocucLE8X6cr9GJSPh65vbftzuqe8MuauRzPIu5jVoXZDrKJgxRQ4zeSsQvQsMrPRA5awgBJefny1cNkNT_iqaOUdLpsztH_jfi87fhdRfkekNALeMmftF6w==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzA1NjEyMTAwLDMyMDAwMDAwXSxudWxsLG51bGwsbnVsbCxbbnVsbCxbNyw2XSxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly9mcmVlZG9taGVhZGxpbmVzLmNvbS9mcmVlZG9tLXdpcmUvc3VwZXItcGFjLWJhY2tpbmctZ29wLWNhbmRpZGF0ZS1wdWxscy1taWxsaW9ucy1mcm9tLXR2LWFkcy1pcy1oaXMtY2FtcGFpZ24tZG9hLyIsbnVsbCxbWzgsIkxJcWM0MUJKNWEwIl0sWzksImVuLVVTIl0sWzE5LCIyIl1dXQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::200e Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

5f77540041532a080f3c79b50f5319546533291fa40475550536508c1725257d

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-CHS1qM1lzHEQKriePOxYRA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:20 GMT
content-security-policy: script-src 'report-sample' 'nonce-CHS1qM1lzHEQKriePOxYRA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame E5A9 6 KB
3 KB 70ms
68ms Document
text/html 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401110101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://freedomheadlines.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 18 Jan 2024 21:08:19 GMT
expires: Fri, 17 Jan 2025 21:08:19 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame E43C 6 KB
3 KB 69ms
68ms Document
text/html 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401110101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://freedomheadlines.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 18 Jan 2024 21:08:19 GMT
expires: Fri, 17 Jan 2025 21:08:19 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 14B1 6 KB
3 KB 70ms
68ms Document
text/html 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401110101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://freedomheadlines.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 18 Jan 2024 21:08:19 GMT
expires: Fri, 17 Jan 2025 21:08:19 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 18E7 6 KB
3 KB 78ms
70ms Document
text/html 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202401110101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://freedomheadlines.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 18 Jan 2024 21:08:19 GMT
expires: Fri, 17 Jan 2025 21:08:19 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 cookie_sync Show response
sync.ex.co/v1/ Frame AFBA 2 KB
2 KB 188ms
59ms Fetch
application/json 18.233.238.248
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.ex.co/v1/cookie_sync?network=368531133%2C1841615463&gdpr=0&gdpr_consent=
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/sync/0.0.1-7abf705/sync-2435d567.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.233.238.248 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-233-238-248.compute-1.amazonaws.com
Software: /
Resource Hash: ec4b9eafb0647fb378c36a118ee0265ca915d9186968c6221e7d515e6b513515

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.ex.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

access-control-allow-origin: https://cdn.ex.co
date: Thu, 18 Jan 2024 21:08:20 GMT
access-control-allow-credentials: true
content-length: 1770
vary: Origin
content-type: application/json

GET
H3 200 css
fonts.googleapis.com/ Frame E5A9 4 KB
632 B 90ms
90ms Stylesheet
text/css 2607:f8b0:4006:823::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%20Display%3A400%2C500

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::200a Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4681d619f677c1b314814309a6f00a5e0ec3f12968e807ee71def1cf42bd7808

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 18 Jan 2024 21:08:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 18 Jan 2024 20:08:31 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 18 Jan 2024 21:08:20 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240117/r20110914/client/ Frame E5A9 2 KB
822 B 68ms
67ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240117/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 09:53:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40520
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 01 Feb 2024 09:53:00 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240117/r20110914/ Frame E5A9 23 KB
9 KB 67ms
66ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240117/r20110914/abg_lite_fy2021.js

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

428f4d59e61cdf9887ad4cd7c4592a24b214d2d9c0ba09db01c4cfde66a3cd11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 09:53:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40520
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9276
x-xss-protection: 0
server: cafe
etag: 3558958386372919956
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 01 Feb 2024 09:53:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240117/r20110914/client/ Frame E5A9 3 KB
1 KB 80ms
80ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240117/r20110914/client/window_focus_fy2021.js

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 09:52:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40526
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 01 Feb 2024 09:52:54 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240117/r20110914/client/ Frame E5A9 20 KB
8 KB 74ms
74ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240117/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d58acf16b5e4521c9eb24fe9fd97308e5f8be1297e4b63a547e5b610611799ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 09:52:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40526
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8492
x-xss-protection: 0
server: cafe
etag: 9878124937798820110
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 01 Feb 2024 09:52:54 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame E5A9 206 KB
66 KB 262ms
92ms Script
text/javascript 2607:f8b0:4006:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

69c32d8650b1e5f0bcb76d787972b68a1ba327ea5bd8da7ab8ca1a04336735c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66453
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1705495733332172"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 18 Jan 2024 21:08:20 GMT

GET
H2 200 4cee352c918c506f58256258d534a665.js Show response
www.gstatic.com/mysidia/ Frame E5A9 37 KB
16 KB 212ms
65ms Script
text/javascript 2607:f8b0:4006:80d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/4cee352c918c506f58256258d534a665.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::2003 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e6b20a1535a6d3ca3d7a611ae199a6f4b464e0b67b450379ed43a7ef3e66957c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 16 Jan 2024 20:48:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 173994
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15452
x-xss-protection: 0
last-modified: Sat, 13 Jan 2024 00:04:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 15 Apr 2024 20:48:26 GMT

GET
H2 200 shopping
encrypted-tbn0.gstatic.com/ Frame E5A9 16 KB
17 KB 229ms
66ms Image
image/jpeg 2607:f8b0:4006:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn0.gstatic.com/shopping?q=tbn:ANd9GcQN5n2KjT1veay6OglAcKTgDuDzleQ6DIVcrVkkn0QtEAxubZcLW_YTk5RSsC0&usqp=CAI

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::200e Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3a49dc2c53f1e29c0f73dd1c42a7903e2a5f48d69d40bef456c339d23bda507f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 18:19:14 GMT
x-content-type-options: nosniff
age: 10146
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16602
x-xss-protection: 0
last-modified: Sat, 16 Mar 2024 04:02:50 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Fri, 17 Jan 2025 18:19:14 GMT

GET
H2 200 shopping
encrypted-tbn0.gstatic.com/ Frame E5A9 15 KB
15 KB 247ms
85ms Image
image/jpeg 2607:f8b0:4006:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn0.gstatic.com/shopping?q=tbn:ANd9GcSoB42hdqzOskk9VBC3JiCCATjSfC58bcbNC5OOso9qLy-CMGvP1C5syvyaEjQ&usqp=CAI

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::200e Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6f21826c23f68874833acef55930fa83c5bcec95d6c3742895418ff5949d6b27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 17:08:21 GMT
x-content-type-options: nosniff
age: 14399
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15491
x-xss-protection: 0
last-modified: Tue, 06 Feb 2024 03:41:50 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Fri, 17 Jan 2025 17:08:21 GMT

GET
H2 200 shopping
encrypted-tbn1.gstatic.com/ Frame E5A9 22 KB
22 KB 305ms
143ms Image
image/jpeg 2607:f8b0:4006:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn1.gstatic.com/shopping?q=tbn:ANd9GcQT8nezInkYay0q4w6HUjtcgjgR2v6QgrJmUdolQrzYpNzCPxMvOiksoj7aH90&usqp=CAI

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::200e Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b16f986aaf9dab680dfe6b55a504a3b627ef1ccf8c980e3b5fc061b95147aeb4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 12:50:13 GMT
x-content-type-options: nosniff
age: 29887
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 22525
x-xss-protection: 0
last-modified: Mon, 10 Apr 2023 06:15:20 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Fri, 17 Jan 2025 12:50:13 GMT

GET
H2 200 shopping
encrypted-tbn1.gstatic.com/ Frame E5A9 27 KB
27 KB 228ms
67ms Image
image/jpeg 2607:f8b0:4006:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn1.gstatic.com/shopping?q=tbn:ANd9GcTzykwMdc3RC2vn4dih4ulzA2yTNG7keXhUXBGuaIDK64mPzk6QkBoInZhUPA&usqp=CAI

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::200e Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2c2d04d768816d54eb8f871184209eb915ebc14ea51ff257d92065cef5001491

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 18:23:43 GMT
x-content-type-options: nosniff
age: 9877
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27339
x-xss-protection: 0
last-modified: Sat, 24 Feb 2024 09:17:31 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Fri, 17 Jan 2025 18:23:43 GMT

GET
H2 200 shopping
encrypted-tbn3.gstatic.com/ Frame E5A9 15 KB
16 KB 227ms
65ms Image
image/jpeg 2607:f8b0:4006:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn3.gstatic.com/shopping?q=tbn:ANd9GcQTN-5gJKh7lOhZ2klbOIwJWKq0prfCdbRTN48FFCVNp6jYMrPoN9Hh4UrHZaE&usqp=CAI

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::200e Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

98c4885ad71e32b871390c90290ae6b5fe903a76172a4596b0a387877b4c7e2b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 19:03:12 GMT
x-content-type-options: nosniff
age: 7508
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15552
x-xss-protection: 0
last-modified: Tue, 17 Jan 2023 00:48:34 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Fri, 17 Jan 2025 19:03:12 GMT

GET
H2 200 shopping
encrypted-tbn2.gstatic.com/ Frame E5A9 14 KB
15 KB 225ms
64ms Image
image/jpeg 2607:f8b0:4006:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn2.gstatic.com/shopping?q=tbn:ANd9GcTU5dz1f1tzBGpWVvgJA-SNlLOGlOqySv9I76JzRVYpSjWb3TOh8IcjVieHZA&usqp=CAI

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::200e Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9d27ef092766e98ab751cdfffb0cb645bc6cf5a2d96b8b700c041b3ca5feb839

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 16:07:06 GMT
x-content-type-options: nosniff
age: 18074
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14825
x-xss-protection: 0
last-modified: Sat, 24 Feb 2024 09:30:38 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Fri, 17 Jan 2025 16:07:06 GMT

GET
H2 200 shopping
encrypted-tbn3.gstatic.com/ Frame E5A9 20 KB
21 KB 243ms
83ms Image
image/jpeg 2607:f8b0:4006:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn3.gstatic.com/shopping?q=tbn:ANd9GcR6VJsC9exvDZ3LVxcI6uOaIrrtUCItkgU-8hlKl4P2LpWNgiQ5w-7qIE_8Bw&usqp=CAI

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::200e Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

362c94a55c31e3e1b906253037be83ade83d3740d2aa5503526a3870e101e153

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 16 Jan 2024 17:01:39 GMT
x-content-type-options: nosniff
age: 187601
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20906
x-xss-protection: 0
last-modified: Wed, 03 Jan 2024 02:24:01 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Wed, 15 Jan 2025 17:01:39 GMT

GET
H3

200

7775594092382834397
tpc.googlesyndication.com/simgad/ Frame E5A9
Redirect Chain

https://tpc.googlesyndication.com/pageadimg/imgad?id=CICAgOC6o_afKhCwCRiwCTIIyPC0mtCeWjM
https://tpc.googlesyndication.com/simgad/7775594092382834397

77 KB
77 KB

142ms
142ms

Image
image/png

2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/7775594092382834397

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

2607:f8b0:4006:81c::2001 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87a92e159459b46d503d7ca9301e076e886bf1eb91abaae349f8b6a69deb2571

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Fri, 17 Jan 2025 02:46:52 GMT
date: Thu, 18 Jan 2024 02:46:52 GMT
x-content-type-options: nosniff
age: 66088
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 79088
x-xss-protection: 0
last-modified: Thu, 25 May 2023 12:39:34 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

Redirect headers

date: Thu, 18 Jan 2024 12:35:39 GMT
x-content-type-options: nosniff
server: cafe
age: 30761
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://tpc.googlesyndication.com/simgad/7775594092382834397
content-type: text/html; charset=UTF-8
cache-control: public, max-age=2592000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 17 Feb 2024 12:35:39 GMT

GET
H2 200 64e384f25e04c9-37125463.jpeg
images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/ 4 KB
5 KB 264ms
77ms Image
image/jpeg 18.238.55.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/64e384f25e04c9-37125463.jpeg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.238.55.39 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

cd4ebc8c4a299dd4095709026fb23d4ee23de8d1648e2b2e0d0a2f4386ab28d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sat, 13 Jan 2024 15:08:01 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
via: 1.1 f52a6d89da5cd85d46c2c4e4af9acf1e.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK52-P4
age: 453619
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 4267
last-modified: Mon, 21 Aug 2023 16:49:16 GMT
server: Cloudinary
etag: "a2b0d086b13263d44fefd988781838f0"
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Disposition,Content-Range,Etag,Server-Timing,Vary,X-Cld-Error,X-Content-Type-Options
cache-control: public, no-transform, max-age=604800
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: n6aZhvdgCLGDiJ8_vExsNQjwefuLfdTZxk2bPmVQorUPPGeWC3hJIw==

GET
H2 200 65a500126851e6-27896943.jpeg
images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/ 5 KB
6 KB 313ms
132ms Image
image/jpeg 18.238.55.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/65a500126851e6-27896943.jpeg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.238.55.39 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1b2092c98fc8132c1a9618b3e3e4cfd587e45789b4cf01c2c16b3a6fcf593089

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 16 Jan 2024 11:12:15 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
via: 1.1 f52a6d89da5cd85d46c2c4e4af9acf1e.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK52-P4
age: 208565
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 5609
last-modified: Tue, 16 Jan 2024 08:41:23 GMT
server: cloudflare
etag: "6a456c699fcb2e57b5c648e5bf07eb52"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length,ETag,Server-Timing,Vary,x-content-type-options
cache-control: public, no-transform, max-age=604800
accept-ranges: bytes
cf-ray: 8465ec20f88681b5-IAD
timing-allow-origin: *
x-amz-cf-id: hN495L3UZxh25KdaZ_cpYelNIMj13Lbnft4yTX7fUDePa4-CLDXX8g==

GET
H2 200 64e50d753e96e7-01731875.png
images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/ 15 KB
15 KB 294ms
118ms Image
image/jpeg 18.238.55.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/64e50d753e96e7-01731875.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.238.55.39 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0e21d79676d15b53075c6bfbf39e4a91600e3ca31d247ad6c7982420337fabd1

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 16 Jan 2024 07:53:41 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
via: 1.1 f52a6d89da5cd85d46c2c4e4af9acf1e.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK52-P4
age: 220479
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 14866
last-modified: Tue, 22 Aug 2023 21:26:55 GMT
server: cloudflare
etag: "3b6647c449024ab09e620974cbd794d0"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length,ETag,Server-Timing,Vary,x-content-type-options
cache-control: public, no-transform, max-age=604800
accept-ranges: bytes
cf-ray: 8464c941bc3b8296-IAD
timing-allow-origin: *
x-amz-cf-id: nEVAnzlbibXVsJ_ggX8kKmlY5zBCiv0_DRi4_cz71pQHuYIt1qDQ1g==

GET
H2 200 65981d4c2ab8e8-20933992.jpeg
images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_212,w_425,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/ 12 KB
13 KB 246ms
73ms Image
image/jpeg 18.238.55.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_212,w_425,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/65981d4c2ab8e8-20933992.jpeg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.238.55.39 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

60fad944a38997197866183ef4b17213d058b218d8e7cf5110b5b146832436df

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=604800
date: Sat, 13 Jan 2024 12:16:57 GMT
x-content-type-options: nosniff
via: 1.1 f52a6d89da5cd85d46c2c4e4af9acf1e.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK52-P4
age: 464100
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 12706
x-request-id: c52290581373ed929e6446aa62afa8fa
last-modified: Sat, 06 Jan 2024 12:00:53 GMT
server: Cloudinary
etag: "76ca009e4947503a23aad2d8712a5649"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Disposition,Content-Range,Etag,Server-Timing,Vary,X-Cld-Error,X-Content-Type-Options
cache-control: public, no-transform, max-age=604800
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: bdJWOcwhcNIM3hOnjmWj2iT0gns5QjGVECpQXTJz_iG2MY8Va3HOSw==

GET
H2 200 659d1bd4785114-07451948.jpg
images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_212,w_425,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/ 13 KB
13 KB 298ms
129ms Image
image/jpeg 18.238.55.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_212,w_425,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/659d1bd4785114-07451948.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.238.55.39 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6584f577f984177589fb4d4096fcbfb43f00399a071bb4bedac9c0dc08ead3c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 11:23:31 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
via: 1.1 f52a6d89da5cd85d46c2c4e4af9acf1e.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK52-P4
age: 35089
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 13065
last-modified: Tue, 09 Jan 2024 17:11:35 GMT
server: cloudflare
etag: "42311311d82460cee6ce36779ad0921a"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length,ETag,Server-Timing,Vary,x-content-type-options
cache-control: public, no-transform, max-age=604800
accept-ranges: bytes
cf-ray: 8476775faf093b96-IAD
timing-allow-origin: *
x-amz-cf-id: kAi5qsnFBZdmLGCmZ7hN9eriQP9XlQt-KYInBX46j5wQNsvm8r8YCA==

GET
H2 200 65a4ba8a4e2b12-61614673.jpg
images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/ 5 KB
5 KB 231ms
65ms Image
image/jpeg 18.238.55.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/65a4ba8a4e2b12-61614673.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.238.55.39 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

53d3d476ed6d1fea13480c74793580a525e3c8591af56760af1ba7dd279bc70f

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Mon, 15 Jan 2024 11:39:12 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
via: 1.1 f52a6d89da5cd85d46c2c4e4af9acf1e.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK52-P4
age: 293348
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 4950
x-request-id: d5304be927fe70bc02650cefbee4fb67
last-modified: Mon, 15 Jan 2024 11:36:00 GMT
server: Cloudinary
etag: "2a353608fc171a72e624ffd9ae06aa27"
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Disposition,Content-Range,Etag,Server-Timing,Vary,X-Cld-Error,X-Content-Type-Options
cache-control: public, no-transform, max-age=604800
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: aOfOF_xPcMjxZz_CNntOvgVhdRuXsJb-2W8m95swH0imOvf8xXz86Q==

GET
H2 200 6548ba4e574d78-48688773.png
images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/ 10 KB
11 KB 78ms
71ms Image
image/jpeg 18.238.55.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/6548ba4e574d78-48688773.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.238.55.39 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

2fd5d0a1742dcc77b965ec5031ee5bc206f158c48e75afa1386c8007565ecc02

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=604800
date: Tue, 16 Jan 2024 04:44:44 GMT
x-content-type-options: nosniff
via: 1.1 f52a6d89da5cd85d46c2c4e4af9acf1e.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK52-P4
age: 231829
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 10705
last-modified: Tue, 07 Nov 2023 01:08:25 GMT
server: Cloudinary
etag: "08729cfc07931b8dd474b5914897daf3"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Disposition,Content-Range,Etag,Server-Timing,Vary,X-Cld-Error,X-Content-Type-Options
cache-control: public, no-transform, max-age=604800
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: Kge7o_7qYnwnpAJIHFNXHx9tocRE8g6mwOycGj2bBSqTE609EKSTQQ==

GET
H2 200 65a4bf42ad3185-80723989.png
images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/ 6 KB
6 KB 113ms
107ms Image
image/jpeg 18.238.55.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/65a4bf42ad3185-80723989.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.238.55.39 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

cloudflare /

Resource Hash

61f9a08983c7c411d377c94fe36cd96bdb3ba426892683c8e0b355db7a193796

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Mon, 15 Jan 2024 18:21:56 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
via: 1.1 f52a6d89da5cd85d46c2c4e4af9acf1e.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK52-P4
age: 269184
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 6029
x-request-id: 6080263c3bd7125abab60df7f184f50f
last-modified: Mon, 15 Jan 2024 15:23:30 GMT
server: cloudflare
etag: "f1a0a4e5e309be040c76e358e968820d"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length,ETag,Server-Timing,Vary,x-content-type-options
cache-control: public, no-transform, max-age=604800
accept-ranges: bytes
cf-ray: 846024293e3007d7-IAD
timing-allow-origin: *
x-amz-cf-id: yn6XP8lZrQrdzcuuzvRNMJ_Ym-_ldMzlBEOtl7XGzXDZ-D8-YsEwuA==

GET
H2 200 659be9a234b370-24054616.png
images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_212,w_425,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/ 19 KB
19 KB 87ms
81ms Image
image/jpeg 18.238.55.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_212,w_425,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/659be9a234b370-24054616.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.238.55.39 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

fde85a2bab49992e33850ddc8958074b9d1ae8a9d4388a2ec073eb27747589b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=604800
date: Tue, 16 Jan 2024 04:32:54 GMT
x-content-type-options: nosniff
via: 1.1 f52a6d89da5cd85d46c2c4e4af9acf1e.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK52-P4
age: 232526
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 18957
last-modified: Mon, 08 Jan 2024 22:19:34 GMT
server: Cloudinary
etag: "638fbf90df525542fef240789eaed7bc"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Disposition,Content-Range,Etag,Server-Timing,Vary,X-Cld-Error,X-Content-Type-Options
cache-control: public, no-transform, max-age=604800
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: 7UsPkRcWcKUIyfRDuBqfR_cNjmMzu34qml477EfRUdgDUPcZHZoVrQ==

GET
H2 200 64f0aa928c0db1-25472502.png
images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_212,w_425,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/ 16 KB
16 KB 120ms
114ms Image
image/jpeg 18.238.55.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_212,w_425,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/64f0aa928c0db1-25472502.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.238.55.39 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3ba2f1fa64155d6b66f060989139c7a8b20fa452c8b43cafe53a004197c9a86c

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 16 Jan 2024 15:47:44 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
via: 1.1 f52a6d89da5cd85d46c2c4e4af9acf1e.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK52-P4
age: 192036
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 16271
last-modified: Fri, 01 Sep 2023 12:48:18 GMT
server: cloudflare
etag: "06a4dbd3a3459c3856fb02ebc65b1f84"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length,ETag,Server-Timing,Vary,x-content-type-options
cache-control: public, no-transform, max-age=604800
accept-ranges: bytes
cf-ray: 84677fa718627ffa-IAD
timing-allow-origin: *
x-amz-cf-id: GmCGQg2qUs9TUl1OraFs4pvtzjSThA_mBlAF1LFsc_RQ1By2aku5tg==

GET
H2 200 659dbd97bd7856-38298841.png
images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/ 7 KB
7 KB 90ms
85ms Image
image/jpeg 18.238.55.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/659dbd97bd7856-38298841.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.238.55.39 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cafc8b5969076f36378ddb7439cdbc7e4025df90a0963f2df3b934b4121efc18

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=604800
date: Wed, 17 Jan 2024 03:37:47 GMT
x-content-type-options: nosniff
via: 1.1 f52a6d89da5cd85d46c2c4e4af9acf1e.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK52-P4
age: 149433
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 6659
last-modified: Tue, 09 Jan 2024 22:44:06 GMT
server: cloudflare
etag: "74334aa04b3ba31ef1265c80bb0bb2b0"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length,ETag,Server-Timing,Vary,x-content-type-options
cache-control: public, no-transform, max-age=604800
accept-ranges: bytes
cf-ray: 8430e9084b2d056f-IAD
timing-allow-origin: *
x-amz-cf-id: GI7tjUumrJAW3urJYPIMHAFJydwpTpcIlzIr4huPXSdecjGCxNQFsw==

GET
H2 200 908376ac348fe18c3c0fedd906128fc2.png
images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/ 4 KB
5 KB 121ms
117ms Image
image/jpeg 18.238.55.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/908376ac348fe18c3c0fedd906128fc2.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.238.55.39 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f442917b6f77458db9ac9d4c5a4a653c228cd28d650fec4a39a07b8eb04258f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 12 Jan 2024 02:01:41 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
via: 1.1 f52a6d89da5cd85d46c2c4e4af9acf1e.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK52-P4
age: 587199
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 4502
last-modified: Tue, 21 Nov 2023 23:04:26 GMT
server: cloudflare
etag: "b03af76c51373227f4efebd7d6546c06"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length,ETag,Server-Timing,Vary,x-content-type-options
cache-control: public, no-transform, max-age=604800
accept-ranges: bytes
cf-ray: 8441d02009355a39-IAD
timing-allow-origin: *
x-amz-cf-id: ACp2gXjgJP2cGBrFRy7swOhwxtY1XLrivkuq_A_Fjey3NtU8LJz1PA==

GET
H2 200 6591a4acc18a77-50651550.jpg
images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/ 5 KB
6 KB 128ms
124ms Image
image/jpeg 18.238.55.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/6591a4acc18a77-50651550.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.238.55.39 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

f0e6c99cc3fe333dfe465a34c1526b2b72dac4016783c14d034c1252ca257aa1

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 11 Jan 2024 23:05:56 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
via: 1.1 f52a6d89da5cd85d46c2c4e4af9acf1e.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK52-P4
age: 597744
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 5475
last-modified: Tue, 02 Jan 2024 12:12:38 GMT
server: Cloudinary
etag: "c8b609114636a13781e64aa0d81b7a0c"
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Disposition,Content-Range,Etag,Server-Timing,Vary,X-Cld-Error,X-Content-Type-Options
cache-control: public, no-transform, max-age=604800
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: EaGlV56OHxSXJ8vzr4omTtLmvY5SeOPfWe64_eMTl-qlWLiJIPrUzw==

GET
H2 200 6593ec3d70e8d2-52515122.jpg
images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_212,w_425,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/ 6 KB
7 KB 123ms
120ms Image
image/jpeg 18.238.55.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_212,w_425,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/6593ec3d70e8d2-52515122.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.238.55.39 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bb0d9628749c229ae2b8c8d125f03d0d77595e270a7126b1bafe4c20e0dfae56

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sun, 14 Jan 2024 22:47:46 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
via: 1.1 f52a6d89da5cd85d46c2c4e4af9acf1e.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK52-P4
age: 339634
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 6647
last-modified: Tue, 02 Jan 2024 16:51:42 GMT
server: cloudflare
etag: "5e7d454ceac9638e4393c5a60188700f"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length,ETag,Server-Timing,Vary,x-content-type-options
cache-control: public, no-transform, max-age=604800
accept-ranges: bytes
cf-ray: 84596c3239911753-IAD
timing-allow-origin: *
x-amz-cf-id: i9FoufByFkiEeXfjOTvff3CWmq5ZgyMWv5ms8U-koihe12YadpIRdw==

GET
H2 200 6593ed19efaba7-07900435.jpg
images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_212,w_425,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/ 7 KB
7 KB 133ms
130ms Image
image/jpeg 18.238.55.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_212,w_425,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/6593ed19efaba7-07900435.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.238.55.39 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

cloudflare /

Resource Hash

85d1831563ab9c83acd9ceb4698f1ab6d21e914b37c98aabb13d6098b94ad959

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sun, 14 Jan 2024 14:30:50 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
via: 1.1 f52a6d89da5cd85d46c2c4e4af9acf1e.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK52-P4
age: 369450
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 7083
last-modified: Tue, 02 Jan 2024 11:28:18 GMT
server: cloudflare
etag: "a90fd9a340099b913f5b8daeddf20748"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length,ETag,Server-Timing,Vary,x-content-type-options
cache-control: public, no-transform, max-age=604800
accept-ranges: bytes
cf-ray: 845694427a032058-IAD
timing-allow-origin: *
x-amz-cf-id: DS2he9sD872xBloNhQmOy935YQWaJKdp9UhBp5Vkx8taLj_TdmU-nA==

GET
H2 200 659da08b56ae54-73642258.jpg
images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/ 9 KB
10 KB 138ms
136ms Image
image/jpeg 18.238.55.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/659da08b56ae54-73642258.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.238.55.39 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c78dc566f0407d6dcf2b1bd44a2055a91d80263778a66f61e9efefc6054c0ffd

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=604800
date: Wed, 17 Jan 2024 15:57:35 GMT
x-content-type-options: nosniff
via: 1.1 f52a6d89da5cd85d46c2c4e4af9acf1e.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK52-P4
age: 105457
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 9301
last-modified: Wed, 10 Jan 2024 15:01:03 GMT
server: cloudflare
etag: "61b46950d1af32ed1a11e13f4e636657"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length,ETag,Server-Timing,Vary,x-content-type-options
cache-control: public, no-transform, max-age=604800
accept-ranges: bytes
cf-ray: 843612e40fc63982-IAD
timing-allow-origin: *
x-amz-cf-id: 1WE0ICT0PXPKBdMAOFOG7dRVNGbu-T3oBwVcIRxXZ7YAcAzQoBbYoA==

GET
H2 200 b421c61dd1de2d349581d91ce2123625.jpeg
images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/ 8 KB
8 KB 141ms
139ms Image
image/jpeg 18.238.55.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/b421c61dd1de2d349581d91ce2123625.jpeg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.238.55.39 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ade6ac163bcc2b7068d3e9bd81acfb5940687a22057cb7b234c2e2b950ff0744

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sat, 13 Jan 2024 19:04:15 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
via: 1.1 f52a6d89da5cd85d46c2c4e4af9acf1e.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK52-P4
age: 439445
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 7835
last-modified: Sat, 22 Jul 2023 12:32:16 GMT
server: cloudflare
etag: "59100ad5d0b858aef61f686edf2aa58b"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length,ETag,Server-Timing,Vary,x-content-type-options
cache-control: public, no-transform, max-age=604800
accept-ranges: bytes
cf-ray: 844fe76ac8541fd0-IAD
timing-allow-origin: *
x-amz-cf-id: e6AUGBpED9wRj6wj5CX4U6tAbjrMWdqEnVpOKTm3COLPjX7VC1VLTA==

GET
H2 200 ba3d480667006f2e9391a1e0097ae4fc.png
images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/ 5 KB
6 KB 143ms
141ms Image
image/jpeg 18.238.55.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.revcontent.com/revcontent/image/fetch/f_jpg,q_auto:eco,h_162,w_325,c_fill,g_faces:auto/pg_1/https://media.revcontent.com/content/images/ba3d480667006f2e9391a1e0097ae4fc.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.238.55.39 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

172f2e3528ce88aa0592ea302f95557164e78c8c137566d9c6ebdc2180233390

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=604800
date: Mon, 15 Jan 2024 21:40:56 GMT
x-content-type-options: nosniff
via: 1.1 f52a6d89da5cd85d46c2c4e4af9acf1e.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK52-P4
age: 257244
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 5551
last-modified: Mon, 08 Jan 2024 13:01:33 GMT
server: Cloudinary
etag: "34cba645df67223ed82edb11e03007a2"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Disposition,Content-Range,Etag,Server-Timing,Vary,X-Cld-Error,X-Content-Type-Options
cache-control: public, no-transform, max-age=604800
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: qQx-0pt5qaaBEKFqk60yeJMU6v958h-KDy8TPomrdLRgqqG88ywahA==

GET
H3 200 AGSKWxVefVHW7BI5tVPVNdFqJwnwVmeJwU8rPDEi85jRjJ_gI7WbDjLdHn_mHbuyBklNluzajuZp82yULr8ZqEnPAB61DDXYuQBfCgy_Uo_XYAr6hhCxTsE-FXOnx0K23MVCTphzY6yqtg== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 113ms
102ms Script
application/javascript 2607:f8b0:4006:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxVefVHW7BI5tVPVNdFqJwnwVmeJwU8rPDEi85jRjJ_gI7WbDjLdHn_mHbuyBklNluzajuZp82yULr8ZqEnPAB61DDXYuQBfCgy_Uo_XYAr6hhCxTsE-FXOnx0K23MVCTphzY6yqtg==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzA1NjEyMTAwLDQ5MDAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNiwxMF0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMV0sImh0dHBzOi8vZnJlZWRvbWhlYWRsaW5lcy5jb20vZnJlZWRvbS13aXJlL3N1cGVyLXBhYy1iYWNraW5nLWdvcC1jYW5kaWRhdGUtcHVsbHMtbWlsbGlvbnMtZnJvbS10di1hZHMtaXMtaGlzLWNhbXBhaWduLWRvYS8iLG51bGwsW1s4LCJMSXFjNDFCSjVhMCJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdXV0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::200e Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

065fb70f5cad0947f02ea1683149d9daf784d006b3fc5c3116a243c461eb249d

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-AtlJBAdViWiITHCVu8cAcw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:20 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-AtlJBAdViWiITHCVu8cAcw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 css2
fonts.googleapis.com/ Frame E43C 4 KB
671 B 83ms
82ms Stylesheet
text/css 2607:f8b0:4006:823::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::200a Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 18 Jan 2024 21:08:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 18 Jan 2024 20:01:43 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 18 Jan 2024 21:08:20 GMT

GET
H2 200 4b0ef9dfa83525e0607f42119c034d23.js Show response
www.gstatic.com/mysidia/ Frame 75A3 9 KB
4 KB 109ms
108ms Script
text/javascript 2607:f8b0:4006:80d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/4b0ef9dfa83525e0607f42119c034d23.js?tag=client_fast_engine_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::2003 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

97c530c44249746307c2b01b37eed0f53757d139bc4243798f468c71da9844da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 16:35:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 16350
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4079
x-xss-protection: 0
last-modified: Sat, 13 Jan 2024 00:04:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 17 Apr 2024 16:35:50 GMT

GET
H2 200 54c2f3dd7fd22235ce59d6b86bfa2f62.js Show response
www.gstatic.com/mysidia/ Frame 75A3 146 KB
54 KB 67ms
66ms Script
text/javascript 2607:f8b0:4006:80d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/54c2f3dd7fd22235ce59d6b86bfa2f62.js?tag=video_mra/web_interstitial_raspberry_ms

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::2003 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

258aa8f1699516e8cae1190d7d19c1a434d7c52813aa5d11cdaea2becd0b86c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 06:05:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 54181
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 54702
x-xss-protection: 0
last-modified: Sat, 13 Jan 2024 00:04:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 17 Apr 2024 06:05:19 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 75A3 21 KB
1 KB 85ms
84ms Stylesheet
text/css 2607:f8b0:4006:823::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500%2C600

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::200a Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

76740b2a7b0a35eed6ceb509cefd8ddd6955bd5c656b0581f2dcdb48040ced8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 18 Jan 2024 21:08:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 18 Jan 2024 20:05:20 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 18 Jan 2024 21:08:20 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240117/r20110914/client/ Frame 75A3 2 KB
822 B 80ms
76ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240117/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 09:53:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40520
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 01 Feb 2024 09:53:00 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240117/r20110914/ Frame 75A3 23 KB
9 KB 80ms
77ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240117/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

428f4d59e61cdf9887ad4cd7c4592a24b214d2d9c0ba09db01c4cfde66a3cd11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 09:53:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40520
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9276
x-xss-protection: 0
server: cafe
etag: 3558958386372919956
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 01 Feb 2024 09:53:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240117/r20110914/client/ Frame 75A3 3 KB
1 KB 87ms
84ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240117/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 09:52:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40526
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 01 Feb 2024 09:52:54 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240117/r20110914/client/ Frame 75A3 20 KB
8 KB 77ms
75ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240117/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d58acf16b5e4521c9eb24fe9fd97308e5f8be1297e4b63a547e5b610611799ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 09:52:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40526
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8492
x-xss-protection: 0
server: cafe
etag: 9878124937798820110
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 01 Feb 2024 09:52:54 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 75A3 206 KB
65 KB 94ms
92ms Script
text/javascript 2607:f8b0:4006:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

69c32d8650b1e5f0bcb76d787972b68a1ba327ea5bd8da7ab8ca1a04336735c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66453
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1705495733332172"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 18 Jan 2024 21:08:20 GMT

GET
H2 200 4cee352c918c506f58256258d534a665.js Show response
www.gstatic.com/mysidia/ Frame 75A3 37 KB
15 KB 144ms
143ms Script
text/javascript 2607:f8b0:4006:80d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/4cee352c918c506f58256258d534a665.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::2003 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e6b20a1535a6d3ca3d7a611ae199a6f4b464e0b67b450379ed43a7ef3e66957c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 16 Jan 2024 20:48:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 173994
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15452
x-xss-protection: 0
last-modified: Sat, 13 Jan 2024 00:04:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 15 Apr 2024 20:48:26 GMT

GET
H3 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240117/r20110914/elements/html/ Frame E43C 22 KB
9 KB 78ms
77ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240117/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a519c62e734157227e61ce5209158e1b7b484b5f2b68e3ccaed1ffe444de36d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 11:59:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 32938
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9422
x-xss-protection: 0
server: cafe
etag: 10624764489894593518
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 01 Feb 2024 11:59:22 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame E43C 205 B
519 B 162ms
161ms Image
image/png 2607:f8b0:4006:80d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::2003 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 03:56:50 GMT
x-content-type-options: nosniff
age: 61890
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Fri, 17 Jan 2025 03:56:50 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame E43C 604 B
695 B 163ms
162ms Image
image/png 2607:f8b0:4006:80d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::2003 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 17 Jan 2024 06:13:40 GMT
x-content-type-options: nosniff
age: 140080
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Thu, 16 Jan 2025 06:13:40 GMT

POST
H2 204 page-view
yeet.revcontent.com/yeet/events/ 0
0 70ms
63ms Fetch 3.232.254.109
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://yeet.revcontent.com/yeet/events/page-view
Requested by: Host: assets.revcontent.com
URL: https://assets.revcontent.com/master/delivery.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.232.254.109 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-232-254-109.compute-1.amazonaws.com
Software: envoy /
Resource Hash

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/json

Response headers

x-rc-region: us-east-1a
access-control-allow-origin: https://freedomheadlines.com
date: Thu, 18 Jan 2024 21:08:20 GMT
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
server: envoy
vary: Origin

POST
H2 204 widget-loaded
yeet.revcontent.com/yeet/events/ 0
0 73ms
65ms Fetch 3.232.254.109
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://yeet.revcontent.com/yeet/events/widget-loaded
Requested by: Host: assets.revcontent.com
URL: https://assets.revcontent.com/master/delivery.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.232.254.109 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-232-254-109.compute-1.amazonaws.com
Software: envoy /
Resource Hash

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/json

Response headers

x-rc-region: us-east-1a
access-control-allow-origin: https://freedomheadlines.com
date: Thu, 18 Jan 2024 21:08:20 GMT
access-control-allow-credentials: true
x-envoy-upstream-service-time: 5
server: envoy
vary: Origin

GET
H3 200 IHSjRKKj3q_1Pt3c2sGWHmUCy_Bw5n5yhKh9CWyZSw4.js Show response
pagead2.googlesyndication.com/bg/ Frame 0A8A 39 KB
15 KB 76ms
74ms Script
text/javascript 2607:f8b0:4006:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/IHSjRKKj3q_1Pt3c2sGWHmUCy_Bw5n5yhKh9CWyZSw4.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2074a344a2a3deaff53edddcdac1961e6502cbf070e67e7284a87d096c994b0e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 20:09:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3560
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15219
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 09:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 17 Jan 2025 20:09:00 GMT

GET
H2 200 hls.min.js Show response
cdn.ex.co/player/hls/1.4.10-exco/ 267 KB
81 KB 65ms
63ms Script
application/javascript 23.48.224.80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ex.co/player/hls/1.4.10-exco/hls.min.js
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/ap/p/4.15.2-a91a6d5/player.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.48.224.80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-48-224-80.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 97fb107f26dfa81080591d1afd85f1f5a9b681a91b98f22e65ad6b2111766fbe

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:20 GMT
content-encoding: gzip
x-amz-server-side-encryption: AES256
content-length: 82759
last-modified: Tue, 31 Oct 2023 13:17:42 GMT
server: AmazonS3
etag: "60aaafdd4d62415ba39125b40f38575c"
vary: Accept-Encoding
access-control-max-age: 86400
access-control-allow-methods: GET,POST
access-control-allow-origin: *
content-type: application/javascript
cache-control: max-age=604800
access-control-allow-credentials: false
accept-ranges: bytes
access-control-allow-headers: *
expires: Thu, 25 Jan 2024 21:08:20 GMT

GET
H2 204 starti
s-13.channelexco.com/ppx/ 0
109 B 83ms
57ms Image
text/plain 108.59.7.241
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s-13.channelexco.com/ppx/starti?sid=&domain=https%3A%2F%2Ffreedomheadlines.com%2Ffreedom-wire%2Fsuper-pac-backing-gop-candidate-pulls-millions-from-tv-ads-is-his-campaign-doa%2F&se=61d80548-72e4-4040-9dae-e512cafd1ea0&pv=117.59&dd=freedomheadlines.com&gpvck=v022842686__780x438______DEF__nil__432&sa=shd&s=0.0&p=779297768&cb=1705612100697
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.59.7.241 , United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: openresty /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Jan 2024 21:08:20 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
server: openresty

GET
H3 200 css
fonts.googleapis.com/ Frame 14B1 4 KB
632 B 81ms
80ms Stylesheet
text/css 2607:f8b0:4006:823::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%20Display%3A400%2C500

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::200a Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4681d619f677c1b314814309a6f00a5e0ec3f12968e807ee71def1cf42bd7808

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 18 Jan 2024 21:08:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 18 Jan 2024 19:24:41 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 18 Jan 2024 21:08:20 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240117/r20110914/client/ Frame 14B1 2 KB
822 B 66ms
65ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240117/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 09:53:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40520
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 01 Feb 2024 09:53:00 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240117/r20110914/ Frame 14B1 23 KB
9 KB 72ms
69ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240117/r20110914/abg_lite_fy2021.js

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

428f4d59e61cdf9887ad4cd7c4592a24b214d2d9c0ba09db01c4cfde66a3cd11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 09:53:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40520
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9276
x-xss-protection: 0
server: cafe
etag: 3558958386372919956
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 01 Feb 2024 09:53:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240117/r20110914/client/ Frame 14B1 3 KB
1 KB 75ms
73ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240117/r20110914/client/window_focus_fy2021.js

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 09:52:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40526
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 01 Feb 2024 09:52:54 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240117/r20110914/client/ Frame 14B1 20 KB
8 KB 72ms
70ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240117/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d58acf16b5e4521c9eb24fe9fd97308e5f8be1297e4b63a547e5b610611799ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 09:52:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40526
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8492
x-xss-protection: 0
server: cafe
etag: 9878124937798820110
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 01 Feb 2024 09:52:54 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 14B1 206 KB
65 KB 80ms
79ms Script
text/javascript 2607:f8b0:4006:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

69c32d8650b1e5f0bcb76d787972b68a1ba327ea5bd8da7ab8ca1a04336735c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66453
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1705495733332172"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 18 Jan 2024 21:08:20 GMT

GET
H2 200 4cee352c918c506f58256258d534a665.js Show response
www.gstatic.com/mysidia/ Frame 14B1 37 KB
15 KB 69ms
68ms Script
text/javascript 2607:f8b0:4006:80d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/4cee352c918c506f58256258d534a665.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::2003 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e6b20a1535a6d3ca3d7a611ae199a6f4b464e0b67b450379ed43a7ef3e66957c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 16 Jan 2024 20:48:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 173994
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15452
x-xss-protection: 0
last-modified: Sat, 13 Jan 2024 00:04:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 15 Apr 2024 20:48:26 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240117/r20110914/client/ Frame 18E7 2 KB
822 B 67ms
66ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240117/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 09:53:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40520
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 01 Feb 2024 09:53:00 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240117/r20110914/ Frame 18E7 23 KB
9 KB 75ms
66ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240117/r20110914/abg_lite_fy2021.js

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

428f4d59e61cdf9887ad4cd7c4592a24b214d2d9c0ba09db01c4cfde66a3cd11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 09:53:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40520
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9276
x-xss-protection: 0
server: cafe
etag: 3558958386372919956
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 01 Feb 2024 09:53:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240117/r20110914/client/ Frame 18E7 3 KB
1 KB 81ms
73ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240117/r20110914/client/window_focus_fy2021.js

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 09:52:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40526
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 01 Feb 2024 09:52:54 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240117/r20110914/client/ Frame 18E7 20 KB
8 KB 75ms
67ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240117/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d58acf16b5e4521c9eb24fe9fd97308e5f8be1297e4b63a547e5b610611799ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 09:52:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40526
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8492
x-xss-protection: 0
server: cafe
etag: 9878124937798820110
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 01 Feb 2024 09:52:54 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 18E7 206 KB
65 KB 99ms
90ms Script
text/javascript 2607:f8b0:4006:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

69c32d8650b1e5f0bcb76d787972b68a1ba327ea5bd8da7ab8ca1a04336735c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66453
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1705495733332172"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 18 Jan 2024 21:08:20 GMT

GET
H2 200 4cee352c918c506f58256258d534a665.js Show response
www.gstatic.com/mysidia/ Frame 18E7 37 KB
15 KB 74ms
66ms Script
text/javascript 2607:f8b0:4006:80d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/4cee352c918c506f58256258d534a665.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::2003 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e6b20a1535a6d3ca3d7a611ae199a6f4b464e0b67b450379ed43a7ef3e66957c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 16 Jan 2024 20:48:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 173994
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15452
x-xss-protection: 0
last-modified: Sat, 13 Jan 2024 00:04:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 15 Apr 2024 20:48:26 GMT

OPTIONS
H2 200 page-view
yeet.revcontent.com/yeet/events/ Frame 0
0 91ms
62ms Preflight 3.232.254.109
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://yeet.revcontent.com/yeet/events/page-view
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.232.254.109 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-232-254-109.compute-1.amazonaws.com
Software: envoy /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://freedomheadlines.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type
access-control-allow-methods: POST
access-control-allow-origin: https://freedomheadlines.com
content-length: 0
date: Thu, 18 Jan 2024 21:08:20 GMT
server: envoy
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
x-envoy-upstream-service-time: 2
x-rc-region: us-east-1a

OPTIONS
H2 200 widget-loaded
yeet.revcontent.com/yeet/events/ Frame 0
0 89ms
62ms Preflight 3.232.254.109
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://yeet.revcontent.com/yeet/events/widget-loaded
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.232.254.109 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-232-254-109.compute-1.amazonaws.com
Software: envoy /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://freedomheadlines.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type
access-control-allow-methods: POST
access-control-allow-origin: https://freedomheadlines.com
content-length: 0
date: Thu, 18 Jan 2024 21:08:20 GMT
server: envoy
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
x-envoy-upstream-service-time: 2
x-rc-region: us-east-1a

GET
H2 200 shopping
encrypted-tbn3.gstatic.com/ Frame 14B1 17 KB
17 KB 138ms
129ms Image
image/jpeg 2607:f8b0:4006:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn3.gstatic.com/shopping?q=tbn:ANd9GcQu0dEEq13NlVi5El6Yfk9Y0jtcpP33p_S_QCp_Wyhe6ecYUgbiYmXsLajCvho&usqp=CAI

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::200e Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b600bd8e70c4a95368d37f12da05d5bab17ae23bdabe71b44d553731f3e9d178

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 18:08:34 GMT
x-content-type-options: nosniff
age: 10786
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17120
x-xss-protection: 0
last-modified: Sat, 10 Feb 2024 05:30:26 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Fri, 17 Jan 2025 18:08:34 GMT

GET
H2 200 shopping
encrypted-tbn3.gstatic.com/ Frame 14B1 16 KB
16 KB 202ms
195ms Image
image/jpeg 2607:f8b0:4006:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn3.gstatic.com/shopping?q=tbn:ANd9GcTaR0C5_of-0EJAp3PkZePmkgP5Jgt4M3Q3ca9meUt0_3_x5yWQ-yyIxx9YWmI&usqp=CAI

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::200e Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

801e3957980fd58052e1aef7e54390c4053ccfbc551e729a0da54589c16dd762

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 09:58:36 GMT
x-content-type-options: nosniff
age: 40184
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16130
x-xss-protection: 0
last-modified: Fri, 16 Feb 2024 07:05:44 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Fri, 17 Jan 2025 09:58:36 GMT

GET
H2 200 shopping
encrypted-tbn3.gstatic.com/ Frame 14B1 17 KB
17 KB 207ms
200ms Image
image/jpeg 2607:f8b0:4006:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn3.gstatic.com/shopping?q=tbn:ANd9GcSBqs-Fah7kSEsQwVt5SMIF4XdRB_9yIbJIGOmGjIytnWV8ZIJNMkYhvUm0aCQ&usqp=CAI

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::200e Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cd6d664ca8a75f4a2f1345e81f8468a5cb64dcda4a0adc7f04421d7c15e2b29f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 10:20:29 GMT
x-content-type-options: nosniff
age: 38871
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17541
x-xss-protection: 0
last-modified: Tue, 06 Feb 2024 04:54:46 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Fri, 17 Jan 2025 10:20:29 GMT

GET
H2 200 shopping
encrypted-tbn3.gstatic.com/ Frame 14B1 12 KB
12 KB 205ms
197ms Image
image/jpeg 2607:f8b0:4006:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn3.gstatic.com/shopping?q=tbn:ANd9GcS1ChUeDMA_gK4ErdJ5g1tixbJT_KgMUcZSLX7n5TUK_g_qzHIf6VSLcTcsnw&usqp=CAI

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::200e Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cb95d47cacd125b3526f5acebe60e70bf2fc2f07c47d23e48ada8efb136d9d6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 16:56:20 GMT
x-content-type-options: nosniff
age: 15120
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12454
x-xss-protection: 0
last-modified: Tue, 31 Oct 2023 05:40:42 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Fri, 17 Jan 2025 16:56:20 GMT

GET
H2 200 shopping
encrypted-tbn1.gstatic.com/ Frame 14B1 27 KB
27 KB 72ms
63ms Image
image/jpeg 2607:f8b0:4006:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn1.gstatic.com/shopping?q=tbn:ANd9GcS5_cyUy2svtB58BBgAYXHWeI6yz8sY33KbTYp9t7tKzndJ7vviy5DMEAmsco8&usqp=CAI

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::200e Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6b32193c637a7db4cba81117a299d7fc414415f404cb42e6d44ddac5aa465c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 02:39:17 GMT
x-content-type-options: nosniff
age: 66543
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27373
x-xss-protection: 0
last-modified: Mon, 26 Feb 2024 05:38:53 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Fri, 17 Jan 2025 02:39:17 GMT

GET
H2 200 shopping
encrypted-tbn1.gstatic.com/ Frame 14B1 22 KB
22 KB 161ms
153ms Image
image/jpeg 2607:f8b0:4006:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn1.gstatic.com/shopping?q=tbn:ANd9GcS8NdT1O23AOBcYzxXgINn9pn4Y-RGOKiejdsNzmmo7gspAscL6M834kT8Daus&usqp=CAI

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::200e Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

62922f478d3b19cd35d7a2853735ca07fe099d4625cf2daf98b5b921ac52d54a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 16:24:33 GMT
x-content-type-options: nosniff
age: 17027
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 22452
x-xss-protection: 0
last-modified: Thu, 14 Mar 2024 03:24:42 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Fri, 17 Jan 2025 16:24:33 GMT

GET
H2 200 shopping
encrypted-tbn3.gstatic.com/ Frame 14B1 13 KB
13 KB 208ms
200ms Image
image/jpeg 2607:f8b0:4006:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn3.gstatic.com/shopping?q=tbn:ANd9GcSaP5mhr1_CLjjgUv5Qvjulciq7w9XMqgYPZxt1wd4YD_8vQWwYlPk_L3do&usqp=CAI

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::200e Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

810e1a4e53ae44eb0e6b981d4bab181b9a7dec13fb8623d4c87586e4b1615512

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 08:37:58 GMT
x-content-type-options: nosniff
age: 45022
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12920
x-xss-protection: 0
last-modified: Fri, 19 Apr 2024 10:05:55 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Fri, 17 Jan 2025 08:37:58 GMT

GET
H3

200

7775594092382834397
tpc.googlesyndication.com/simgad/ Frame 14B1
Redirect Chain

https://tpc.googlesyndication.com/pageadimg/imgad?id=CICAgOC6o_afKhCwCRiwCTIIyPC0mtCeWjM
https://tpc.googlesyndication.com/simgad/7775594092382834397

77 KB
77 KB

69ms
68ms

Image
image/png

2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/7775594092382834397

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

2607:f8b0:4006:81c::2001 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87a92e159459b46d503d7ca9301e076e886bf1eb91abaae349f8b6a69deb2571

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Fri, 17 Jan 2025 02:46:52 GMT
date: Thu, 18 Jan 2024 02:46:52 GMT
x-content-type-options: nosniff
age: 66088
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 79088
x-xss-protection: 0
last-modified: Thu, 25 May 2023 12:39:34 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

Redirect headers

date: Thu, 18 Jan 2024 12:35:39 GMT
x-content-type-options: nosniff
server: cafe
age: 30761
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://tpc.googlesyndication.com/simgad/7775594092382834397
content-type: text/html; charset=UTF-8
cache-control: public, max-age=2592000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 17 Feb 2024 12:35:39 GMT

GET
H2 200 shopping
encrypted-tbn0.gstatic.com/ Frame 18E7 23 KB
23 KB 114ms
107ms Image
image/jpeg 2607:f8b0:4006:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn0.gstatic.com/shopping?q=tbn:ANd9GcQXign_OAedZjed2H1X51UdsPOeZ_HOhsw3kGBoM0CEYTVCvobq6xhIseQBlfM&usqp=CAI

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::200e Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a8b253843f1e195ff61c41acbac5045ea9c28003c43f15c168f5ada04bfd58e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 18:35:05 GMT
x-content-type-options: nosniff
age: 9195
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23115
x-xss-protection: 0
last-modified: Tue, 21 Nov 2023 06:12:55 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Fri, 17 Jan 2025 18:35:05 GMT

GET
H2 200 shopping
encrypted-tbn0.gstatic.com/ Frame 18E7 14 KB
14 KB 71ms
65ms Image
image/jpeg 2607:f8b0:4006:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn0.gstatic.com/shopping?q=tbn:ANd9GcSqGphJkYMy2dbPX3M_u8HB0Qg9TQzQPdP0lQn6-PqMRMsfpQTCUMQmEDDKhQ&usqp=CAI

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::200e Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bf5d627ac3c0d574c9015cfb7fe8ec408948f2de29405dc76bd495209611e74

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 19:32:56 GMT
x-content-type-options: nosniff
age: 5724
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13892
x-xss-protection: 0
last-modified: Sat, 18 May 2024 13:42:33 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Fri, 17 Jan 2025 19:32:56 GMT

GET
H2 200 shopping
encrypted-tbn3.gstatic.com/ Frame 18E7 20 KB
20 KB 209ms
203ms Image
image/jpeg 2607:f8b0:4006:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn3.gstatic.com/shopping?q=tbn:ANd9GcTLiJ5WoedLmwcxHvEKucJuyd_Idr1wYz8kR_tj6PZffFzt_8gqChTVmXp38vw&usqp=CAI

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::200e Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cd7c0b36ae71d44691b1e69afe471b2617fbef6514525d92e96de992c16b57ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 17 Jan 2024 22:49:00 GMT
x-content-type-options: nosniff
age: 80360
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20590
x-xss-protection: 0
last-modified: Thu, 27 Jul 2023 08:07:46 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Thu, 16 Jan 2025 22:49:00 GMT

GET
H2 200 shopping
encrypted-tbn3.gstatic.com/ Frame 18E7 18 KB
18 KB 210ms
205ms Image
image/jpeg 2607:f8b0:4006:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn3.gstatic.com/shopping?q=tbn:ANd9GcT9yIh0vA7AjoeB4vj8RSGcYkm-t5ZfkliSabZkYyTmPJjq7eSFl3kI1HNt8A&usqp=CAI

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::200e Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

117a50d6517c9e3dd3be75282f22d5f239e4f02f66816ff8939c5b9a694f8feb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 03:29:55 GMT
x-content-type-options: nosniff
age: 63505
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18718
x-xss-protection: 0
last-modified: Sat, 24 Feb 2024 10:13:05 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Fri, 17 Jan 2025 03:29:55 GMT

GET
H2 200 shopping
encrypted-tbn0.gstatic.com/ Frame 18E7 44 KB
44 KB 82ms
77ms Image
image/jpeg 2607:f8b0:4006:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn0.gstatic.com/shopping?q=tbn:ANd9GcR5hZMxtCslGhdns5LayffhTHHi1w9OrwnpLQhmc8J3WLYyHAdOpj3IYpAOLw&usqp=CAI

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::200e Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d3ae6aa8e6319dcae128ed428942aaed5f9d8c565ff03fa72a71bccf326ca485

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 05:25:43 GMT
x-content-type-options: nosniff
age: 56557
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44654
x-xss-protection: 0
last-modified: Tue, 02 Jan 2024 07:02:19 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Fri, 17 Jan 2025 05:25:43 GMT

GET
H2 200 shopping
encrypted-tbn0.gstatic.com/ Frame 18E7 14 KB
14 KB 143ms
138ms Image
image/jpeg 2607:f8b0:4006:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn0.gstatic.com/shopping?q=tbn:ANd9GcSfa11LAEZcxRlTyJMrDnwENxAJf2O_s6tsCQzLiid3fsZDrJmNvXEdMLZ9VAw&usqp=CAI

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::200e Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6783259d0c3ae248a277a5e5d5be4d92dc1511ed66ee78d0546bafb1bf721087

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 17 Jan 2024 23:55:09 GMT
x-content-type-options: nosniff
age: 76391
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14058
x-xss-protection: 0
last-modified: Tue, 02 Jan 2024 04:29:31 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Thu, 16 Jan 2025 23:55:09 GMT

GET
H2 200 shopping
encrypted-tbn1.gstatic.com/ Frame 18E7 21 KB
21 KB 173ms
169ms Image
image/jpeg 2607:f8b0:4006:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn1.gstatic.com/shopping?q=tbn:ANd9GcRwJMJ-bjZ82LYlrOJP-0Q60g4ldvuTy_MckdRJL1NNy5-lFjrPn5aOxRqIKA&usqp=CAI

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::200e Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1d2a17b3c2f73030640d8a35c8a95d94f8aa056de8dd9a5bda058bd99f1830a7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 04:14:50 GMT
x-content-type-options: nosniff
age: 60810
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 21331
x-xss-protection: 0
last-modified: Wed, 28 Feb 2024 05:38:06 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Fri, 17 Jan 2025 04:14:50 GMT

GET
H3

200

8576945487332838351
tpc.googlesyndication.com/simgad/ Frame 18E7
Redirect Chain

https://tpc.googlesyndication.com/pageadimg/imgad?id=CICAgODq17ONPBCwCRiwCTIIbl7_plN_ucg
https://tpc.googlesyndication.com/simgad/8576945487332838351

77 KB
77 KB

78ms
78ms

Image
image/png

2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/8576945487332838351

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

2607:f8b0:4006:81c::2001 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87a92e159459b46d503d7ca9301e076e886bf1eb91abaae349f8b6a69deb2571

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Fri, 17 Jan 2025 10:46:07 GMT
date: Thu, 18 Jan 2024 10:46:07 GMT
x-content-type-options: nosniff
age: 37333
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 79088
x-xss-protection: 0
last-modified: Mon, 10 Apr 2023 10:03:14 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

Redirect headers

date: Wed, 17 Jan 2024 22:55:22 GMT
x-content-type-options: nosniff
server: cafe
age: 79978
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://tpc.googlesyndication.com/simgad/8576945487332838351
content-type: text/html; charset=UTF-8
cache-control: public, max-age=2592000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 16 Feb 2024 22:55:22 GMT

GET
H2 200 expb.js Show response
cdn.ex.co/player/pb/2.4.0/ Frame 3C44 591 KB
196 KB 67ms
63ms Script
application/javascript 23.48.224.80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ex.co/player/pb/2.4.0/expb.js
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/ap/p/4.15.2-a91a6d5/player.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.48.224.80 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-48-224-80.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 40b56b106e3ca36cd66a7fd7558f9ebfb83b6368cc296a57505becdc2a8cc940

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:20 GMT
content-encoding: gzip
x-amz-server-side-encryption: AES256
content-length: 200048
last-modified: Mon, 08 Jan 2024 09:20:04 GMT
server: AmazonS3
etag: "2521af7c09dc033c042767affaabf227"
vary: Accept-Encoding
access-control-max-age: 86400
access-control-allow-methods: GET,POST
access-control-allow-origin: *
content-type: application/javascript
cache-control: must-revalidate, proxy-revalidate, max-age=604800, s-maxage=31536000
access-control-allow-credentials: false
accept-ranges: bytes
access-control-allow-headers: *
expires: Thu, 25 Jan 2024 21:08:20 GMT

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 832B 16 KB
6 KB 66ms
66ms Document
text/html 23.56.213.14
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/sync/0.0.1-7abf705/sync-2435d567.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.56.213.14 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-56-213-14.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 8e53e50181b7a9e2caa94173c37fcd9de8fa75750764a2ad8ad02fac3306d652

Request headers

Referer: https://cdn.ex.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=136225
content-encoding: gzip
content-length: 5622
content-type: text/html
date: Thu, 18 Jan 2024 21:08:20 GMT
expires: Sat, 20 Jan 2024 10:58:45 GMT
last-modified: Thu, 16 Nov 2023 09:11:44 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame ABCC 0
0 96ms
95ms Image
text/html 2607:f8b0:4006:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202401110101&jk=418096261081264&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:81d::2002 Colchester, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame E5A9 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6f60a1064a34b0008d2c4a86381d75df72e634a9562ec9f76b8e6e6b1f02d9d3

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 AGSKWxXpwePl1YglvfmpGePZMhy8nhcXpFl03wgdT6Xjnohn4UMdCRyoU0h69S0uy9iW_XmNe5FdMRgXRWwCdANdi3EezC3S9g_7a9o0vBCC2CMXenq9WvtyJljZ_P9Wxvkbr0vfyXqb5g== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 108ms
106ms Script
application/javascript 2607:f8b0:4006:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXpwePl1YglvfmpGePZMhy8nhcXpFl03wgdT6Xjnohn4UMdCRyoU0h69S0uy9iW_XmNe5FdMRgXRWwCdANdi3EezC3S9g_7a9o0vBCC2CMXenq9WvtyJljZ_P9Wxvkbr0vfyXqb5g==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzA1NjEyMTAwLDg3ODAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNiwxMCw5XSxudWxsLDIsbnVsbCwiZW4iLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly9mcmVlZG9taGVhZGxpbmVzLmNvbS9mcmVlZG9tLXdpcmUvc3VwZXItcGFjLWJhY2tpbmctZ29wLWNhbmRpZGF0ZS1wdWxscy1taWxsaW9ucy1mcm9tLXR2LWFkcy1pcy1oaXMtY2FtcGFpZ24tZG9hLyIsbnVsbCxbWzgsIkxJcWM0MUJKNWEwIl0sWzksImVuLVVTIl0sWzE5LCIyIl1dXQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::200e Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f073d47e43d0e3674a6decf90029ca8e4bd61d2f64ca859e9f52dfdac898ec76

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-GodtghvCoKgBLyMegNhG5Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:20 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport, script-src 'report-sample' 'nonce-GodtghvCoKgBLyMegNhG5Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ea8IacM9Wef3EJPWRrHjgE4B6CnlZxHVBg3etBD7TA.woff2
fonts.gstatic.com/s/googlesansdisplay/v21/ Frame E5A9 21 KB
21 KB 67ms
66ms Font
font/woff2 2607:f8b0:4006:81e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesansdisplay/v21/ea8IacM9Wef3EJPWRrHjgE4B6CnlZxHVBg3etBD7TA.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%20Display%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2003 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92a7f8224a1ba2ccfa92d3e1fc55ee5aa7ae20a0fcd80d3331bd660878a090f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 16 Jan 2024 13:54:25 GMT
x-content-type-options: nosniff
age: 198835
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 21428
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 19:32:46 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 15 Jan 2025 13:54:25 GMT

GET
H/1.1 200
OK landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.m3u8 Show response
mcd.ex.co/video/upload/sp_hd/v1490095101/ 1 KB
2 KB 263ms
67ms XHR
application/x-mpegurl 23.48.224.68
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://mcd.ex.co/video/upload/sp_hd/v1490095101/landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.m3u8
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/hls/1.4.10-exco/hls.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.48.224.68 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-48-224-68.deploy.static.akamaitechnologies.com
Software: cloudinary /
Resource Hash: a56f5f7194ef81e280190cdf70a6d1289942afaf52231e7900474b312f5c48cf

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date: Thu, 18 Jan 2024 21:08:21 GMT
Cache-Tag: 502941132783428480281542933415069772301,394554537382471183304184472313687845759,c8ca5d8e4a43f8ef61d39b48fd5ffa31
Connection: keep-alive
Content-Length: 1127
X-Served-By: cache-bwi5061-BWI
Last-Modified: Wed, 09 Jun 2021 12:31:44 GMT
Server: cloudinary
X-Timer: S1638940479.929676,VS0,VE104
ETag: "43c49c5a38361beb99c8bf3dd60047f4"
Content-Type: application/x-mpegURL
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=29423292
Accept-Ranges: bytes
Timing-Allow-Origin: *
Access-Control-Allow-Headers: X-Requested-With
X-Cache-Hits: 0

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame E5A9
Redirect Chain

https://securepubads.g.doubleclick.net/pagead/adview?ai=CSEPPQ5OpZflG9eLT_A-wu6qQCISRsKB11si3koUS3bGoyPwQEAEg-833lQFgyYaAgNyjxBCgAaHAmPEoyAEJqQLwon63o6aCPuACAKgDAcgDywSqBJQDT9AczGdukwf5-5NEgwFuzrhW...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x920443c2673c8d5a0000000000000000%22,%222%22:%220x3883f7b54232b3040000000000000000%22,%223%22:%220x207c57...

0
0

424ms
102ms

Fetch
text/css

142.251.40.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x920443c2673c8d5a0000000000000000%22,%222%22:%220x3883f7b54232b3040000000000000000%22,%223%22:%220x207c57166855b6ea0000000000000000%22,%224%22:%220x2428f6bf94a8d0830000000000000000%22,%225%22:%220xbc04a61ea328efda0000000000000000%22},%22debug_key%22:%228538359352806195950%22,%22debug_reporting%22:true,%22destination%22:%22https://temu.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2210974797857%22],%2222%22:[%22true%22],%224%22:[%2201-18%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%225133120168227222321%22}&andc=true

Protocol

Server

142.251.40.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:22 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"1":"0x920443c2673c8d5a0000000000000000","2":"0x3883f7b54232b3040000000000000000","3":"0x207c57166855b6ea0000000000000000","4":"0x2428f6bf94a8d0830000000000000000","5":"0xbc04a61ea328efda0000000000000000"},"debug_key":"8538359352806195950","debug_reporting":true,"destination":"https://temu.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["10974797857"],"22":["true"],"4":["01-18"],"6":["true"]},"priority":"500","source_event_id":"5133120168227222321"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: null
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 18 Jan 2024 21:08:22 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 18 Jan 2024 21:08:21 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"aggregation_keys":{"1":"0x920443c2673c8d5a0000000000000000","2":"0x3883f7b54232b3040000000000000000","3":"0x207c57166855b6ea0000000000000000","4":"0x2428f6bf94a8d0830000000000000000","5":"0xbc04a61ea328efda0000000000000000"},"debug_key":"8538359352806195950","debug_reporting":true,"destination":"https://temu.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["10974797857"],"22":["true"],"4":["01-18"],"6":["true"]},"priority":"500","source_event_id":"5133120168227222321"}&andc=true
access-control-allow-origin: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 14B1 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2af35539c7d6af4e7aeb34600eb06f60ca9d8f4851f0069027cd57d75db65427

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

/
sync.ex.co/v1/setuid/sovrn/ Frame AFBA
Redirect Chain

https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fsovrn%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID
https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fsovrn%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID&sovrn_retry=true
https://sync.ex.co/v1/setuid/sovrn/?gdpr=0&gdpr_consent=&uid=IA40cLZHRltLm-IYQQGVLM9E

86 B
392 B

60ms
58ms

Image
image/png

18.233.238.248
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.ex.co/v1/setuid/sovrn/?gdpr=0&gdpr_consent=&uid=IA40cLZHRltLm-IYQQGVLM9E
Protocol: H2
Server: 18.233.238.248 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-233-238-248.compute-1.amazonaws.com
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

accept-language: en-US,en;q=0.9
Referer: https://cdn.ex.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

access-control-allow-origin
date: Thu, 18 Jan 2024 21:08:21 GMT
access-control-allow-credentials: true
content-length: 86
vary: Origin
content-type: image/png

Redirect headers

Date: Thu, 18 Jan 2024 21:08:21 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://sync.ex.co/v1/setuid/sovrn/?gdpr=0&gdpr_consent=&uid=IA40cLZHRltLm-IYQQGVLM9E
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap4ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H3 200 WihAbdPmEAuwNNTtrWjgEsQMZ632wtWEawfwOklMupQ.js Show response
pagead2.googlesyndication.com/bg/ Frame 7A0C 50 KB
19 KB 70ms
69ms Script
text/javascript 2607:f8b0:4006:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/WihAbdPmEAuwNNTtrWjgEsQMZ632wtWEawfwOklMupQ.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a28406dd3e6100bb034d4edad68e012c40c67adf6c2d5846b07f03a494cba94

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 12:54:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 29655
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19644
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 09:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 17 Jan 2025 12:54:06 GMT

GET
DATA 200
OK truncated
/ Frame 18E7 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d4a9897fb2623755e66424daada719db0ee6b8017737498df9cc3ba70c4b2d39

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/png

OPTIONS
H3 204 adview
securepubads.g.doubleclick.net/pagead/ Frame 0
0 241ms
99ms Preflight
text/html 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/adview?ai=CSEPPQ5OpZflG9eLT_A-wu6qQCISRsKB11si3koUS3bGoyPwQEAEg-833lQFgyYaAgNyjxBCgAaHAmPEoyAEJqQLwon63o6aCPuACAKgDAcgDywSqBJQDT9AczGdukwf5-5NEgwFuzrhW-AeTJi4AMXvb0YZ3ZRf2ZXnmLbv25FS38o0Dh8rSXNfAg1_YsaNUHkKvSaxajNdo8jr8J0S8zuZ9cRZDJVgun6T-TjzgV2Os8AjDSIqR3Dwwc107IgQGNYMQv_8-igVUqPbjj3vh0tkCUf7MuGZsLPd8BqB1omZpoGPjh18XG1JH25ZuH8gFp3ckI8nYHqCV_x3R13qEh0RBIj86Agufl3-pU5Bcf8s7_ghARvrB-JdSTDOoqw8luxaw6w_oPl5sFLBFGYqso6XSs5KV63MHxHFDnnyXuQaFZxiQnTMCAf1SlDhuZMUrDD47vwIz8AzVrudkgYpXD8Y_6iCCsr1_CtF_9gLvMypbfNqNiVCnffFkerKwoobmoAz9oUUdFturmIi0p_rar3SkSG8LD6PF4n3LYZpXYMnCv33puDjjPHAjgQv9IG5NpUzK8CzMJnvvWhdROhF-rs1PYuaYrlbBqsB4pEwAmzJ-K8kzbePA72133GCB5ZBwsAFQn9B3U_WErNPABNrZp9rUBOAEAYgFseuQ6E2SBQQIBBgBkgUECAUYBKAGLoAH8OrpkgSoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAemvhvYBwDyBwUQw_S3AdIIHwiAYRABGB0yAooCOgSAQIBASL39wTpY_92imuzngwOaCf8BaHR0cHM6Ly93d3cudGVtdS5jb20va3VpcGVyL3VuMS5odG1sP3N1Ymo9ZmVlZC11biZfYmdfZnM9MSZfcF9tYXQxX3R5cGU9MSZfcF9qdW1wX2lkPTcyNSZfeF92c3Rfc2NlbmU9YWRnJmxvY2FsZV9vdmVycmlkZT0yMTF-ZW5-VVNEJmdvb2RzX2lkPTYwMTA5OTUxODk2MzY3NCZfcF9yZnM9MSZfeF9hZHNfY2hhbm5lbD1nb29nbGUmX3hfYWRzX3N1Yl9jaGFubmVsPW90aGVyJl94X2JnX2FkaWQ9Z2QyMzUxNzcyLTImdG9waWNfY2xhc3NpZnk9MTI0gAoByAsBogwIKgYKBKy6sQLaDBEKCxDwmKiGqoz-8YIBEgIBA-INEwjGrqOa7OeDAxV18ZQJHbCdCoLYEwvQFQGAFwGyFx8KHQgAEhRwdWItODg5ODA3NjQyMzYwMDM1Mhi435oBshgFGC4iAQA&sigh=0TZWxqcDGRc&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSTgAvHhf_bGfTHC_L3siB3CzdKh7NxTuv0341l9aWyZJho64XqG54Mqq6DO1kf70qC53KBgjBoCdBHxVLCTsQLDvt-RuJ01SEl9r0ryPxVRgB&template_id=494&cbvp=2&vis=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 18 Jan 2024 21:08:21 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 events
e.channelexco.com/ 0
247 B 220ms
56ms Ping
text/plain 23.82.15.162
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to

Full URL: https://e.channelexco.com/events
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/ap/p/4.15.2-a91a6d5/player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.82.15.162 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: openresty /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 18 Jan 2024 21:08:21 GMT
access-control-request-method: GET, POST
server: openresty
access-control-allow-methods: GET, POST
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
access-control-allow-credentials: true
access-control-allow-headers: *

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 832B 5 KB
6 KB 201ms
59ms Script
text/html 8.28.7.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=61749258&p=158554&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 3c6d61af81adfd251d21b1c3706db8135278fab4da1e7adc233154f3e2d4928e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

content-type: text/html; charset=UTF-8
date: Wed, 17 Jan 2024 20:32:02 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

POST
H3 204 AGSKWxXmVXtKzujzlWiovTOjUnOAYVtLZBoX1U7op3kmV2mi7itnb1Zm_y8Hhy615EUxUd57IHXU6e45LKfhmc9SWfvpuzTZjNwyv1-7X98OzWiTW-He9e7vlb_nxlyHCBKDzv-WIiF4HQ== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 90ms
89ms XHR
text/html 2607:f8b0:4006:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXmVXtKzujzlWiovTOjUnOAYVtLZBoX1U7op3kmV2mi7itnb1Zm_y8Hhy615EUxUd57IHXU6e45LKfhmc9SWfvpuzTZjNwyv1-7X98OzWiTW-He9e7vlb_nxlyHCBKDzv-WIiF4HQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::200e Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-eOLoZPPuL3gLB-ZiFUocEQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 18 Jan 2024 21:08:21 GMT
content-security-policy: script-src 'report-sample' 'nonce-eOLoZPPuL3gLB-ZiFUocEQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://freedomheadlines.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 WihAbdPmEAuwNNTtrWjgEsQMZ632wtWEawfwOklMupQ.js Show response
pagead2.googlesyndication.com/bg/ Frame D409 50 KB
19 KB 66ms
65ms Script
text/javascript 2607:f8b0:4006:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/WihAbdPmEAuwNNTtrWjgEsQMZ632wtWEawfwOklMupQ.js

Requested by

Host: 94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
URL: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a28406dd3e6100bb034d4edad68e012c40c67adf6c2d5846b07f03a494cba94

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 12:54:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 29655
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19644
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 09:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 17 Jan 2025 12:54:06 GMT

GET
H3 200 ea8IacM9Wef3EJPWRrHjgE4B6CnlZxHVBg3etBD7TA.woff2
fonts.gstatic.com/s/googlesansdisplay/v21/ Frame 14B1 21 KB
21 KB 68ms
68ms Font
font/woff2 2607:f8b0:4006:81e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesansdisplay/v21/ea8IacM9Wef3EJPWRrHjgE4B6CnlZxHVBg3etBD7TA.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%20Display%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2003 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92a7f8224a1ba2ccfa92d3e1fc55ee5aa7ae20a0fcd80d3331bd660878a090f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 16 Jan 2024 13:54:25 GMT
x-content-type-options: nosniff
age: 198836
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 21428
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 19:32:46 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 15 Jan 2025 13:54:25 GMT

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 18E7
Redirect Chain

https://securepubads.g.doubleclick.net/pagead/adview?ai=CKw3-Q5OpZbhP9eLT_A-wu6qQCOyy97R19_DBreISrcr93wUQASD7zfeVAWDJhoCA3KPEEKABocCY8SjIAQngAgCoAwHIA8sEqgSaA0_Q0kC09ySQV0ltSiU8aWAE8D8dBNbsvs5rzcDh...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x920443c2673c8d5a0000000000000000%22,%222%22:%220x80cd908345ad3f330000000000000000%22,%223%22:%220x357742...

0
0

421ms
102ms

Fetch
text/css

142.251.40.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x920443c2673c8d5a0000000000000000%22,%222%22:%220x80cd908345ad3f330000000000000000%22,%223%22:%220x357742b1cbdb782a0000000000000000%22,%224%22:%220xac77c84f9c8fcdf30000000000000000%22,%225%22:%220xbc04a61ea328efda0000000000000000%22},%22debug_key%22:%228899304513561123781%22,%22debug_reporting%22:true,%22destination%22:%22https://temu.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2210974797857%22],%2222%22:[%22true%22],%224%22:[%2201-18%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%229449010290402784433%22}&andc=true

Protocol

Server

142.251.40.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:22 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"1":"0x920443c2673c8d5a0000000000000000","2":"0x80cd908345ad3f330000000000000000","3":"0x357742b1cbdb782a0000000000000000","4":"0xac77c84f9c8fcdf30000000000000000","5":"0xbc04a61ea328efda0000000000000000"},"debug_key":"8899304513561123781","debug_reporting":true,"destination":"https://temu.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["10974797857"],"22":["true"],"4":["01-18"],"6":["true"]},"priority":"500","source_event_id":"9449010290402784433"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: null
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 18 Jan 2024 21:08:22 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 18 Jan 2024 21:08:21 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"aggregation_keys":{"1":"0x920443c2673c8d5a0000000000000000","2":"0x80cd908345ad3f330000000000000000","3":"0x357742b1cbdb782a0000000000000000","4":"0xac77c84f9c8fcdf30000000000000000","5":"0xbc04a61ea328efda0000000000000000"},"debug_key":"8899304513561123781","debug_reporting":true,"destination":"https://temu.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["10974797857"],"22":["true"],"4":["01-18"],"6":["true"]},"priority":"500","source_event_id":"9449010290402784433"}&andc=true
access-control-allow-origin: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

OPTIONS
H3 204 adview
securepubads.g.doubleclick.net/pagead/ Frame 0
0 100ms
100ms Preflight
text/html 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/adview?ai=CKw3-Q5OpZbhP9eLT_A-wu6qQCOyy97R19_DBreISrcr93wUQASD7zfeVAWDJhoCA3KPEEKABocCY8SjIAQngAgCoAwHIA8sEqgSaA0_Q0kC09ySQV0ltSiU8aWAE8D8dBNbsvs5rzcDhEvK80FEcXC5hsZ_6MH2G1XaiCEKclSZpEzhooF_6tQ3jry0ji3LWMyhdb0cdJihg_cRzCj7It1U74Hc2LelNUJev8InSLW7JrH-kriOZdPNpNbiv4OwEZQQMharEOtG_tTa35TGPx_o_ocfzvXmSsw28RIttxCQItV8wRme5MBkK45vNnzvMMclkFJURW6CofDoOQ9pO5rLalp4tFTBquYaE2QWwytsxxtQ-vmYcYU3gJU0BopTFmTE4q3ebzw34nQ3-uM_LmACaypbz4s2lOKJQeosQ0QRU4P7oJ--lbcVJXGW1H6YNTXnT9mM7u5HECnNq_8r9F2OpBt18GDY49N742P0GbA5mLLRMcEFW5teWfe_yZhqGtFqVF9N9A7HqeccqOaYygXr6m5fyaHuqT1fND_r6rkvTp5YY9LUvIVMoAxYTQocMfVcpLrKck3bftSHJSqMC20oScVQKQz2Zm8uaDj-S3M6567Ar_uMhfUIJb2qLtCYQPk8v5mpBwAT5ptj4vwTgBAGIBbH27txNkgUECAQYAZIFBAgFGASgBi6AB5fft54EqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpr4b2AcA8gcFEL7riwHSCB8IgGEQARgdMgKKAjoEgECAQEi9_cE6WP_doprs54MDmgn_AWh0dHBzOi8vd3d3LnRlbXUuY29tL2t1aXBlci91bjEuaHRtbD9zdWJqPWZlZWQtdW4mX2JnX2ZzPTEmX3BfbWF0MV90eXBlPTEmX3BfanVtcF9pZD03MjUmX3hfdnN0X3NjZW5lPWFkZyZsb2NhbGVfb3ZlcnJpZGU9MjExfmVuflVTRCZnb29kc19pZD02MDEwOTk1MjMyNzM4NzImX3BfcmZzPTEmX3hfYWRzX2NoYW5uZWw9Z29vZ2xlJl94X2Fkc19zdWJfY2hhbm5lbD1vdGhlciZfeF9iZ19hZGlkPWdkMjI0MzgwNS0zJnRvcGljX2NsYXNzaWZ5PTExM4AKAcgLAaIMCCoGCgSsurEC2gwRCgsQgOKih8-m1pC6ARICAQPiDRMIyq6jmuzngwMVdfGUCR2wnQqC2BML0BUBgBcBshcfCh0IABIUcHViLTg4OTgwNzY0MjM2MDAzNTIYuN-aAbIYBRguIgEA&sigh=f1sRFBjVWIA&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSTgAvHhf_bGfTHC_L3siB3CzdKh7NxTuv0341l9aWyZJho64XqG54Mqq6DO1kf70qC53KBgjBoCdBHxVLCTsQLDvt-RuJ01SEl9r0ryPxVRgB&template_id=494&cbvp=2&vis=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 18 Jan 2024 21:08:21 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 WihAbdPmEAuwNNTtrWjgEsQMZ632wtWEawfwOklMupQ.js Show response
pagead2.googlesyndication.com/bg/ Frame 4080 50 KB
19 KB 66ms
65ms Script
text/javascript 2607:f8b0:4006:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/WihAbdPmEAuwNNTtrWjgEsQMZ632wtWEawfwOklMupQ.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a28406dd3e6100bb034d4edad68e012c40c67adf6c2d5846b07f03a494cba94

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 12:54:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 29655
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19644
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 09:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 17 Jan 2025 12:54:06 GMT

GET
H/1.1 200
OK landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.m3u8 Show response
mcd.ex.co/video/upload/c_limit,w_320,h_240,vc_h264:baseline:3.0,br_192k/v1600072622/ 2 KB
2 KB 73ms
72ms XHR
application/x-mpegurl 23.48.224.68
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://mcd.ex.co/video/upload/c_limit,w_320,h_240,vc_h264:baseline:3.0,br_192k/v1600072622/landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.m3u8
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/hls/1.4.10-exco/hls.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.48.224.68 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-48-224-68.deploy.static.akamaitechnologies.com
Software: cloudinary /
Resource Hash: 363a2228f397c87b3aeb0e7fc9926e5438c3de511242c5849d0da3d2c76037fd

Request headers

accept-language: en-US,en;q=0.9
Referer: https://freedomheadlines.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date: Thu, 18 Jan 2024 21:08:21 GMT
Cache-Tag: 502941132783428480281542933415069772301,484104238383510269782950376486441993307,c8ca5d8e4a43f8ef61d39b48fd5ffa31
Connection: keep-alive
Content-Length: 1890
X-Served-By: cache-wdc5553-WDC
Last-Modified: Wed, 09 Jun 2021 12:31:21 GMT
Server: cloudinary
X-Timer: S1638943640.481049,VS0,VE1
ETag: "e3a4d3e4cf55264cd80d76705e1125b3"
Content-Type: application/x-mpegURL
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31291288
Accept-Ranges: bytes
Timing-Allow-Origin: *
Access-Control-Allow-Headers: X-Requested-With
X-Cache-Hits: 1

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 14B1
Redirect Chain

https://securepubads.g.doubleclick.net/pagead/adview?ai=CPqlTQ5OpZbhN9eLT_A-wu6qQCM7pq7Z11IOqrdgSsJfo6IgVEAEg0_mgoAFgyYaAgNyjxBCgAaHAmPEoyAEJqQLwon63o6aCPuACAKgDAcgDywSqBKUDT9C183OC4hlkH28AJ2nSCPt3...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x920443c2673c8d5a0000000000000000%22,%222%22:%220x3883f7b54232b3040000000000000000%22,%223%22:%220x48483a...

0
0

364ms
103ms

Fetch
text/css

142.251.40.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x920443c2673c8d5a0000000000000000%22,%222%22:%220x3883f7b54232b3040000000000000000%22,%223%22:%220x48483a8d5ea1870a0000000000000000%22,%224%22:%220xeb56c3816ff6bd60000000000000000%22,%225%22:%220xbc04a61ea328efda0000000000000000%22},%22debug_key%22:%2213341876829041177886%22,%22debug_reporting%22:true,%22destination%22:%22https://temu.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2210974797857%22],%2222%22:[%22true%22],%224%22:[%2201-18%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2210431727977102595537%22}&andc=true

Protocol

Server

142.251.40.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:22 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"1":"0x920443c2673c8d5a0000000000000000","2":"0x3883f7b54232b3040000000000000000","3":"0x48483a8d5ea1870a0000000000000000","4":"0xeb56c3816ff6bd60000000000000000","5":"0xbc04a61ea328efda0000000000000000"},"debug_key":"13341876829041177886","debug_reporting":true,"destination":"https://temu.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["10974797857"],"22":["true"],"4":["01-18"],"6":["true"]},"priority":"500","source_event_id":"10431727977102595537"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: null
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 18 Jan 2024 21:08:22 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 18 Jan 2024 21:08:21 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"aggregation_keys":{"1":"0x920443c2673c8d5a0000000000000000","2":"0x3883f7b54232b3040000000000000000","3":"0x48483a8d5ea1870a0000000000000000","4":"0xeb56c3816ff6bd60000000000000000","5":"0xbc04a61ea328efda0000000000000000"},"debug_key":"13341876829041177886","debug_reporting":true,"destination":"https://temu.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["10974797857"],"22":["true"],"4":["01-18"],"6":["true"]},"priority":"500","source_event_id":"10431727977102595537"}&andc=true
access-control-allow-origin: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

OPTIONS
H3 204 adview
securepubads.g.doubleclick.net/pagead/ Frame 0
0 98ms
98ms Preflight
text/html 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/adview?ai=CPqlTQ5OpZbhN9eLT_A-wu6qQCM7pq7Z11IOqrdgSsJfo6IgVEAEg0_mgoAFgyYaAgNyjxBCgAaHAmPEoyAEJqQLwon63o6aCPuACAKgDAcgDywSqBKUDT9C183OC4hlkH28AJ2nSCPt3p1ssJJcN23KkHawN_BOQOKDsiP_GEyhC6wnXW16b61d5LJnf5_XvtL3qx0F9cxp4-xDLDFigb4-bMKq3WUOW_tR5lwNaUjCl9-vFRd-orc87qkAOrby2ztLdYoBiMlJJukwZu8KMRoKzt9VZcGrgbPvlRMX3go6QObtV2gc2cF2Y3mJXcVE9hLrqIOuyuopySDqBSju9YzhNPenfqhEFI7M0Syx05_-ZUFezsrQif0GevRZW58DVVQW_LOy05jx97asixa5jaDcHAJ06SfNJLeDmueRZ3CKQXaJ1A2LadWJTh8lGRGilWfcKSqBFXqyOidrZTFHniDp0YOeEErZU9NPBRNZb-K54Dxx6dTtNeKDC6_xU0ErSoQgWt48RRyqYwMvuKgb2pt_BVyEubjXBt6bJ6iuotVxr7lzgCh1s6dJT89vwAD7uQ9lduxnAwv4BUTsnGr8gCR3D-4yDhYAr4ZQzT_QZz8iQbnIWQrdZ8fd0dF96gPz1BKQ0Gu_8PSsMPbx7mHb7pNCPsq4jhr5IvQCS6sAE1JGDgN0E4AQBiAX5wqvrTZIFBAgEGAGSBQQIBRgEoAYugAfw6umSBKgH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6a-G9gHAPIHBBDHzlvSCB8IgGEQARgdMgKKAjoEgECAQEi9_cE6WP_doprs54MDmgn_AWh0dHBzOi8vd3d3LnRlbXUuY29tL2t1aXBlci91bjEuaHRtbD9zdWJqPWZlZWQtdW4mX2JnX2ZzPTEmX3BfbWF0MV90eXBlPTEmX3BfanVtcF9pZD03MjUmX3hfdnN0X3NjZW5lPWFkZyZsb2NhbGVfb3ZlcnJpZGU9MjExfmVuflVTRCZnb29kc19pZD02MDEwOTk1MTg5NjM2NzQmX3BfcmZzPTEmX3hfYWRzX2NoYW5uZWw9Z29vZ2xlJl94X2Fkc19zdWJfY2hhbm5lbD1vdGhlciZfeF9iZ19hZGlkPWdkMjM1MjE1OS0yJnRvcGljX2NsYXNzaWZ5PTEyNIAKA8gLAaIMCCoGCgSsurEC2gwRCgsQ8NqCpa7L76qnARICAQPiDRMIya6jmuzngwMVdfGUCR2wnQqC2BML0BUBgBcBshcfCh0IABIUcHViLTg4OTgwNzY0MjM2MDAzNTIYuN-aAbIYBRguIgEA&sigh=UgCIlvK5kD4&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSTgAvHhf_bGfTHC_L3siB3CzdKh7NxTuv0341l9aWyZJho64XqG54Mqq6DO1kf70qC53KBgjBoCdBHxVLCTsQLDvt-RuJ01SEl9r0ryPxVRgB&template_id=494&cbvp=2&vis=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 18 Jan 2024 21:08:21 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 206
Partial Content landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.ts Show response
mcd.ex.co/video/upload/c_limit,w_320,h_240,vc_h264:baseline:3.0,br_192k/v1600072622/ 88 KB
89 KB 80ms
79ms XHR
video/mp2t 23.48.224.68
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://mcd.ex.co/video/upload/c_limit,w_320,h_240,vc_h264:baseline:3.0,br_192k/v1600072622/landscaped687b3b1-f6a9-47a1-bc7d-ab4d3a1da017_1600072453318.ts
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/player/hls/1.4.10-exco/hls.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.48.224.68 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-48-224-68.deploy.static.akamaitechnologies.com
Software: cloudinary /
Resource Hash: f164b39a16618e24f0fd121a274768bc24760f8778d4a3b5457a5e03ddd0c53f

Request headers

Referer: https://freedomheadlines.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Range: bytes=0-90239

Response headers

Date: Thu, 18 Jan 2024 21:08:21 GMT
Cache-Tag: 502941132783428480281542933415069772301,201691703795562271966273117828695354966,c8ca5d8e4a43f8ef61d39b48fd5ffa31
Content-Range: bytes 0-90239/1475048
Connection: keep-alive
Content-Length: 90240
X-Served-By: cache-wdc5558-WDC
Last-Modified: Wed, 09 Jun 2021 07:23:15 GMT
Server: cloudinary
X-Timer: S1638943722.002762,VS0,VE0
ETag: "bc1d05ae5b7f824a9cd6a30d8f4abbc9"
Content-Type: video/mp2t
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31291288
Accept-Ranges: bytes
Timing-Allow-Origin: *
Access-Control-Allow-Headers: X-Requested-With
X-Cache-Hits: 1

GET
H3 200 WihAbdPmEAuwNNTtrWjgEsQMZ632wtWEawfwOklMupQ.js Show response
pagead2.googlesyndication.com/bg/ Frame 8B69 50 KB
19 KB 71ms
68ms Script
text/javascript 2607:f8b0:4006:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/WihAbdPmEAuwNNTtrWjgEsQMZ632wtWEawfwOklMupQ.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2002 Colchester, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a28406dd3e6100bb034d4edad68e012c40c67adf6c2d5846b07f03a494cba94

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://94b735f4bb5d87ba24655f61bdf02cd0.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 12:54:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 29655
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19644
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 09:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 17 Jan 2025 12:54:06 GMT

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 360ms
97ms Preflight
text/html 142.251.40.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: null
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 18 Jan 2024 21:08:21 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 195ms
98ms Preflight
text/html 142.251.40.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: null
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 18 Jan 2024 21:08:21 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 0A8A 0
10 B 66ms
66ms Image
text/plain 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?zRgXDQ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:81c::2001 Colchester, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:21 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 sync Show response
ssbsync-global.smartadserver.com/api/ Frame 953B 849 B
1 KB 209ms
57ms Document
text/html 23.105.12.143
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to

Full URL: https://ssbsync-global.smartadserver.com/api/sync?callerId=35&redirectUri=sync.ex.co%2Fv1%2Fsetuid%2Fsmartadserver%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3D%5Bssb_sync_pid%5D
Requested by: Host: cdn.ex.co
URL: https://cdn.ex.co/sync/0.0.1-7abf705/sync-2435d567.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.105.12.143 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: 6ecc9936fa2f9a4efc391a09130b1ce1e41b387d1614ed59960d834986b05c1d

Request headers

Referer: https://cdn.ex.co/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

content-length: 849
content-type: text/html
date: Thu, 18 Jan 2024 21:08:21 GMT

GET
H/1.1 200
OK dcm Show response
s.amazon-adsystem.com/ Frame 3D4D 43 B
855 B 65ms
65ms Document
image/gif 52.46.151.131
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=3323BFF6-3BF3-46A9-ACB9-A9533EF59045&redir=true&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Thu, 18 Jan 2024 21:08:21 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: H96G58VNXAD90SACHW68

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame F8EA
Redirect Chain

https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
https://cm.adgrx.com/bridge.gif?AG_PID=pubmatic&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=b649efe2-b645-11ee-b9b5-3fb6d9bdb4d0

42 B
245 B

59ms
58ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=b649efe2-b645-11ee-b9b5-3fb6d9bdb4d0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 18 Jan 2024 21:08:21 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, proxy-revalidate
content-length: 0
content-type: image/gif
date: Thu, 18 Jan 2024 21:08:22 GMT
expires: Thu, 23 Sep 2004 17:42:04 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=b649efe2-b645-11ee-b9b5-3fb6d9bdb4d0
p3p: CP="NOI OTC OTP OUR NOR"
pragma: no-cache
server: Cowboy
x-realserver-nx: lga-delivery-9

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 29E6
Redirect Chain

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA%3D%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=3183321823485965714&gdpr=0&gdpr_consent=

42 B
297 B

59ms
58ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=3183321823485965714&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 18 Jan 2024 09:42:34 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
access-control-allow-origin: *
an-x-request-uuid: 7819414a-ce50-44be-ad56-d76c931033da
cache-control: no-store, no-cache, private
content-length: 0
content-type: text/html; charset=utf-8
date: Thu, 18 Jan 2024 21:08:22 GMT
expires: Sat, 15 Nov 2008 16:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=3183321823485965714&gdpr=0&gdpr_consent=
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
pragma: no-cache
server: nginx/1.23.4
x-proxy-origin: 38.132.118.75; 38.132.118.75; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
x-xss-protection: 0

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame A774
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=&_bee_ppp=1
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFCeS1rN0xVeWNBQUJNcjNiMEtjZw&gdpr=0&gdpr_consent=&bee_sync_partners=pp%2Csyn%2Csas%2Cpm&bee_sync_current_partner=adx&b...
https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=pp%2Csyn%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
https://bh.contextweb.com/bh/rtset?ev=AABy-k7LUycAABMr3b0Kcg&do=add&pid=558502&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dsyn%252Csas%252Cpm%26bee_sync_cur...
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=syn%2Csas%2Cpm&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=2&ev=AABy-k7LUycAABMr3b0Kcg&pid=558502&do=add&gd...
https://sync.technoratimedia.com/services?uid=AABy-k7LUycAABMr3b0Kcg&srv=cs&pid=73&cb=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26gdpr%3D0%26bee_sync_partners%3Dsas%252Cpm%26bee_syn...
https://match.prod.bidr.io/cookie-sync?gdpr=0&gdpr=0&bee_sync_partners=sas%2Cpm&bee_sync_current_partner=syn&bee_sync_initiator=adx&bee_sync_hop_count=3
https://rtb-csync.smartadserver.com/redir?partneruserid=AABy-k7LUycAABMr3b0Kcg&partnerid=127&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26gdpr%3D0%26bee_sync_partners%3Dpm%2...
https://match.prod.bidr.io/cookie-sync?gdpr=0&gdpr=0&bee_sync_partners=pm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=4&userid=7622791417290470442&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AABy-k7LUycAABMr3b0Kcg&gdpr=0&gdpr_consent=

42 B
278 B

58ms
57ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AABy-k7LUycAABMr3b0Kcg&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 18 Jan 2024 09:56:26 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Connection: keep-alive
Content-Length: 0
Date: Thu, 18 Jan 2024 21:08:23 GMT
Server: gunicorn
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AABy-k7LUycAABMr3b0Kcg&gdpr=0&gdpr_consent=
strict-transport-security: max-age=2592000; includeSubDomains

GET
H2

200

b9pj45k4 Show response
sync-tm.everesttech.net/ct/upi/pid/ Frame D37D
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_con...
https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_...

85 B
235 B

60ms
60ms

Document
image/png

151.101.66.49
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_consent=&_test=ZamTRQAPfxk-rABd
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.66.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: no-cache
content-length: 85
content-type: image/png
date: Thu, 18 Jan 2024 21:08:21 GMT
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-served-by: cache-mia-kmia1760079-MIA
x-timer: S1705612102.918691,VS0,VE27

Redirect headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: no-cache
content-length: 0
date: Thu, 18 Jan 2024 21:08:21 GMT
location: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_consent=&_test=ZamTRQAPfxk-rABd
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-served-by: cache-mia-kmia1760079-MIA
x-timer: S1705612102.858602,VS0,VE26

GET
H2 200 141 Show response
match.deepintent.com/usersync/ Frame CCC4 0
338 B 201ms
56ms Document
image/gif 38.91.45.7
DEEPINTENT

General

Check archive.org

Show headers Download Go to

Full URL: https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 38.91.45.7 Ashburn, United States, ASN398989 (DEEPINTENT, US),
Reverse DNS
Software: b /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

content-length: 0
content-type: image/gif
date: Thu, 18 Jan 2024 21:08:21 GMT
p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'
server: b

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 2993
Redirect Chain

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=&us_privacy=
https://x.bidswitch.net/ul_cb/sync?ssp=pubmatic&gdpr=0&gdpr_consent=&us_privacy=
https://t.pswec.com/bsw_sync?ssp=pubmatic&bsw_user_id=96c6ddf7-513b-4126-9761-4d10cf58e68a
https://t.pswec.com/ul_cb/bsw_sync?ssp=pubmatic&bsw_user_id=96c6ddf7-513b-4126-9761-4d10cf58e68a
https://x.bidswitch.net/sync?dsp_id=2&user_id=f6a766a8-8b7e-4e9f-8d98-3b8edd32e99e&expires=3&user_group=1&ssp=pubmatic
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=96c6ddf7-513b-4126-9761-4d10cf58e68a&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=

1 B
165 B

58ms
58ms

Document
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=96c6ddf7-513b-4126-9761-4d10cf58e68a&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 1
content-type: text/html; charset=utf-8
date: Thu, 18 Jan 2024 21:08:21 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
Date: Thu, 18 Jan 2024 21:08:22 GMT
Location: //simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=96c6ddf7-513b-4126-9761-4d10cf58e68a&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
Server: nginx

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 30A0
Redirect Chain

https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=YAnO028Pm997WZrdZg-C2GcJmtx7CZnbZ1oo9K0v

42 B
336 B

76ms
62ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=YAnO028Pm997WZrdZg-C2GcJmtx7CZnbZ1oo9K0v
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 18 Jan 2024 21:08:20 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
date: Thu, 18 Jan 2024 21:08:21 GMT
expires: Fri, 04 Aug 1978 12:00:00 GMT
location: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=YAnO028Pm997WZrdZg-C2GcJmtx7CZnbZ1oo9K0v
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
pragma: no-cache
strict-transport-security: max-age=86400

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 8ED9
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent=
https://pm.w55c.net/ping_match.gif?scc=1&ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:yG5yRhqZ1RqzCB5&gdpr=0&gdpr_consent=

42 B
222 B

58ms
57ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:yG5yRhqZ1RqzCB5&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 18 Jan 2024 21:07:01 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Date: Thu, 18 Jan 2024 21:08:21 GMT
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:yG5yRhqZ1RqzCB5&gdpr=0&gdpr_consent=
Pragma: no-cache
Server: PingMatch/v2.0.30-795-gb641a57#rel-ec2-master i-0506f03cfdc2dfe11@us-east-1d@dxedge-app-us-east-1-prod-asg
Strict-Transport-Security: max-age=2592000; includeSubDomains

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 04A4
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=11&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=3jTD0qkQUed0i54S8NXORiaEdks&gdpr=0&gdpr_consent=

42 B
297 B

60ms
58ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=3jTD0qkQUed0i54S8NXORiaEdks&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 18 Jan 2024 21:08:22 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Connection: keep-alive
Content-Length: 188
Content-Type: text/html; charset=utf-8
Date: Thu, 18 Jan 2024 21:08:21 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=3jTD0qkQUed0i54S8NXORiaEdks&gdpr=0&gdpr_consent=

GET
H/1.1

200
OK

pbmtc.gif Show response
beacon.lynx.cognitivlabs.com/ Frame 18F0
Redirect Chain

https://beacon.lynx.cognitivlabs.com/pbmtc.gif?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=$UID
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=593b88aa-248d-49b3-85c6-56fe39b9551f&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=$...
https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=3323BFF6-3BF3-46A9-ACB9-A9533EF59045

42 B
495 B

59ms
59ms

Document
image/gif

54.211.17.237
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=3323BFF6-3BF3-46A9-ACB9-A9533EF59045
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.211.17.237 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-211-17-237.compute-1.amazonaws.com
Software: Kestrel /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Connection: keep-alive
Content-Length: 42
Content-Type: image/gif
Date: Thu, 18 Jan 2024 21:08:22 GMT
Server: Kestrel

Redirect headers

cache-control: no-store, no-cache, private
date: Thu, 18 Jan 2024 21:08:22 GMT
location: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=3323BFF6-3BF3-46A9-ACB9-A9533EF59045
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2 200 usersync.aspx Show response
dis.criteo.com/dis/ Frame 8D72 43 B
363 B 186ms
58ms Document
image/gif 74.119.119.150
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.150 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-cache
content-type: image/gif
cross-origin-resource-policy: cross-origin
date: Thu, 18 Jan 2024 21:08:21 GMT
expires: Thu, 18 Jan 2024 00:00:00 GMT
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 422213
strict-transport-security: max-age=31536000; preload;
x-errorlevel: 0

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 452D
Redirect Chain

https://p.rfihub.com/cm?pub=224&in=1&getuid=https%3A//image2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=2810316570158180787

42 B
422 B

70ms
57ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=2810316570158180787
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 18 Jan 2024 21:08:20 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Content-Length: 0
Date: Thu, 18 Jan 2024 21:08:21 GMT
Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=2810316570158180787
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.4.51.v20230217)

GET pubmatic
ad.mrtnsvr.com/sync/ Frame 433C 0
0

GET
H2

200

i.match Show response
s.tribalfusion.com/z/ Frame 48DF
Redirect Chain

https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATI...
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMA...

43 B
451 B

143ms
125ms

Document
image/gif

2606:4700::6812:19ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:19ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache private
cf-cache-status: DYNAMIC
cf-ray: 8479d0158a7f31cc-MIA
content-length: 43
content-type: image/gif; charset=utf-8
date: Thu, 18 Jan 2024 21:08:22 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
p3p: CP="NOI DEVo TAIa OUR BUS"
pragma: no-cache
server: cloudflare
x-function: 302

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache private
cf-cache-status: DYNAMIC
cf-ray: 8479d014b8c731cc-MIA
content-type: text/html
date: Thu, 18 Jan 2024 21:08:21 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
p3p: CP="NOI DEVo TAIa OUR BUS"
pragma: no-cache
server: cloudflare
x-function: 206
x-reuse-index: 11

GET /
csync.loopme.me/ Frame 88F4 0
0

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 3EE1
Redirect Chain

https://t.adx.opera.com/pub/sync?pubid=pub8730968190912
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU0fe6fc0761e845e18d8cc9a7ca8e8f05

42 B
358 B

58ms
57ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU0fe6fc0761e845e18d8cc9a7ca8e8f05
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 18 Jan 2024 09:53:53 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
access-control-allow-methods: POST, GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-length: 166
content-type: text/html; charset=utf-8
date: Thu, 18 Jan 2024 21:08:22 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU0fe6fc0761e845e18d8cc9a7ca8e8f05
pragma: no-cache
server: Tengine

GET
H2 200 / Show response
sync.ex.co/v1/setuid/pubmatic/ Frame 7313 0
369 B 62ms
57ms Document
text/html 18.233.238.248
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.ex.co/v1/setuid/pubmatic/?gdpr=0&gdpr_consent=&uid=3323BFF6-3BF3-46A9-ACB9-A9533EF59045
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=158554&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fsync.ex.co%2Fv1%2Fsetuid%2Fpubmatic%2F%3Fgdpr%3D0%26gdpr_consent%3D%26uid%3DPM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.233.238.248 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-233-238-248.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin
content-length: 0
content-type: text/html
date: Thu, 18 Jan 2024 21:08:21 GMT
vary: Origin

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 832B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=MyO_9jvzRqmsualTPvWQRQ%3D%3D&gdpr=0&gdpr_consent=
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=

16 KB
16 KB

66ms
65ms

Image
text/html

23.56.213.14
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
Protocol: H2
Server: 23.56.213.14 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-56-213-14.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:21 GMT
content-encoding: gzip
last-modified: Thu, 16 Nov 2023 09:11:44 GMT
server: Apache
vary: Accept-Encoding
content-type: text/html
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=136224
accept-ranges: bytes
content-length: 5622
expires: Sat, 20 Jan 2024 10:58:45 GMT

Redirect headers

pragma: no-cache
date: Thu, 18 Jan 2024 21:08:21 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame 832B
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3371&partner_device_id=3323BFF6-3BF3-46A9-ACB9-A9533EF59045
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3371&partner_device_id=3323BFF6-3BF3-46A9-ACB9-A9533EF59045
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=80ad5170-913a-4544-8c2b-ffeb4f8a8955%252C%252C&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=85cb6970-04cc-432f-923d-e82232fa0e19&ttd_puid=80ad5170-913a-4544-8c2b-ffeb4f8a8955%2C%2C

95 B
124 B

65ms
64ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=85cb6970-04cc-432f-923d-e82232fa0e19&ttd_puid=80ad5170-913a-4544-8c2b-ffeb4f8a8955%2C%2C

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:22 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

Redirect headers

location: https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=85cb6970-04cc-432f-923d-e82232fa0e19&ttd_puid=80ad5170-913a-4544-8c2b-ffeb4f8a8955%2C%2C
date: Thu, 18 Jan 2024 21:08:22 GMT
server: Kestrel
content-length: 359

GET
H2 403 FZt5psomz79DGe~O1V5PkX7S8-NVJIdw0INR-k~Duu9c36GyIDyElf4y8fa2~-9InNSq4BCadyu-8tQSiIkaVleT~Yh8GI4ocNSeo4~API4DJEsYNIMg2sPMMXvjcckTUFy53ZYw3gzv35jSAchydRkSr2XFgqe-kzzlKTlv1VT7-TlAc0PcX7nFzbKlHypwbpU3A...
us01.z.antigena.com/l/ Frame 832B 0
0 208ms
62ms Image
text/html 40.76.134.238
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us01.z.antigena.com/l/FZt5psomz79DGe~O1V5PkX7S8-NVJIdw0INR-k~Duu9c36GyIDyElf4y8fa2~-9InNSq4BCadyu-8tQSiIkaVleT~Yh8GI4ocNSeo4~API4DJEsYNIMg2sPMMXvjcckTUFy53ZYw3gzv35jSAchydRkSr2XFgqe-kzzlKTlv1VT7-TlAc0PcX7nFzbKlHypwbpU3AWUAJgUx%203323BFF6-3BF3-46A9-ACB9-A9533EF59045&rnd=RND
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 40.76.134.238 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

GET
H2

200

xuid
eb2.3lift.com/ Frame 832B
Redirect Chain

https://eb2.3lift.com/xuid?mid=7976&xuid=3323BFF6-3BF3-46A9-ACB9-A9533EF59045&dongle=u6nf&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?ld=1&mid=7976&xuid=3323BFF6-3BF3-46A9-ACB9-A9533EF59045&dongle=u6nf&gdpr=0&cmp_cs=&us_privacy=

37 B
354 B

61ms
60ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?ld=1&mid=7976&xuid=3323BFF6-3BF3-46A9-ACB9-A9533EF59045&dongle=u6nf&gdpr=0&cmp_cs=&us_privacy=
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

content-type: image/gif
date: Thu, 18 Jan 2024 21:08:21 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location: /xuid?ld=1&mid=7976&xuid=3323BFF6-3BF3-46A9-ACB9-A9533EF59045&dongle=u6nf&gdpr=0&cmp_cs=&us_privacy=
date: Thu, 18 Jan 2024 21:08:21 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 832B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=MzMyM0JGRjYtM0JGMy00NkE5LUFDQjktQTk1MzNFRjU5MDQ1&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

42 B
95 B

190ms
59ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Thu, 18 Jan 2024 21:08:20 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Thu, 18 Jan 2024 21:08:21 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 832B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESECuTvgqpQVvCr6ZBBCy8RjM&google_cver=1

42 B
270 B

190ms
58ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESECuTvgqpQVvCr6ZBBCy8RjM&google_cver=1
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Thu, 18 Jan 2024 21:08:20 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Thu, 18 Jan 2024 21:08:21 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESECuTvgqpQVvCr6ZBBCy8RjM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 379
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 832B
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:3BFEEEE8049E4956B53D0775AA0DD639

42 B
324 B

82ms
63ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:3BFEEEE8049E4956B53D0775AA0DD639
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Thu, 18 Jan 2024 21:08:20 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

date: Thu, 18 Jan 2024 21:08:21 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:3BFEEEE8049E4956B53D0775AA0DD639
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Wed, 17 Jan 2024 21:08:21 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 832B
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=85cb6970-04cc-432f-923d-e82232fa0e19&gdpr=0&gdpr_consent=

42 B
407 B

215ms
64ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=85cb6970-04cc-432f-923d-e82232fa0e19&gdpr=0&gdpr_consent=
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Thu, 18 Jan 2024 21:08:22 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=85cb6970-04cc-432f-923d-e82232fa0e19&gdpr=0&gdpr_consent=
date: Thu, 18 Jan 2024 21:08:21 GMT
server: Kestrel
content-length: 355

GET
H2 200 3323BFF6-3BF3-46A9-ACB9-A9533EF59045
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame 832B 43 B
603 B 73ms
60ms Image
image/gif 2600:1f18:4e9:5a01:75af:f069:585e:f21
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/3323BFF6-3BF3-46A9-ACB9-A9533EF59045?gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a01:75af:f069:585e:f21 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:21 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame 832B
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=3323BFF6-3BF3-46A9-ACB9-A9533EF59045&redir=true&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-.EHQ9vNE2uXMFWlfIiwP741gYDxUPGQ-~A&gdpr=0

0
259 B

288ms
60ms

Image
text/plain

8.28.7.84
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-.EHQ9vNE2uXMFWlfIiwP741gYDxUPGQ-~A&gdpr=0
Protocol: H2
Server: 8.28.7.84 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:21 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-.EHQ9vNE2uXMFWlfIiwP741gYDxUPGQ-~A&gdpr=0
date: Thu, 18 Jan 2024 21:08:21 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.94
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 832B
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_cons...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=19f197e6-5a08-49e5-93d9-7fe7a7ffde05&gdpr=0&gdpr_consent=

1 B
315 B

57ms
57ms

Image
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=19f197e6-5a08-49e5-93d9-7fe7a7ffde05&gdpr=0&gdpr_consent=
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Thu, 18 Jan 2024 21:07:01 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=19f197e6-5a08-49e5-93d9-7fe7a7ffde05&gdpr=0&gdpr_consent=
Date: Thu, 18 Jan 2024 21:08:21 GMT
Connection: keep-alive
X-CI-RTID: 4009785f-91e3-4721-876c-a62173423d92
Content-Length: 205
Content-Type: text/html; charset=utf-8

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 832B
Redirect Chain

https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=3323BFF6-3BF3-46A9-ACB9-A9533EF59045&gdpr=0&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=716154ff815c1296&is_secure=true&networkId=17100&version=1&nuid=3323BFF6-3BF3-46A9-ACB9-A9533EF59045&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAHOTa5k3QR2gNZrorYAAAAAAA&expiration=1705698502&nuid=3323BFF6-3BF3-46A9-ACB9-A9533EF59045&...

42 B
296 B

59ms
58ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAHOTa5k3QR2gNZrorYAAAAAAA&expiration=1705698502&nuid=3323BFF6-3BF3-46A9-ACB9-A9533EF59045&is_secure=true&gdpr_consent=&gdpr=0
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Thu, 18 Jan 2024 21:07:01 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Thu, 18 Jan 2024 21:08:22 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAHOTa5k3QR2gNZrorYAAAAAAA&expiration=1705698502&nuid=3323BFF6-3BF3-46A9-ACB9-A9533EF59045&is_secure=true&gdpr_consent=&gdpr=0
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 832B
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=3&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=e336f68a-0027-4deb-bb36-1251c6812c4f-65a99345-5553&gdpr=0&gdpr_consent=

42 B
343 B

57ms
57ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=e336f68a-0027-4deb-bb36-1251c6812c4f-65a99345-5553&gdpr=0&gdpr_consent=
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Thu, 18 Jan 2024 09:56:25 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Thu, 18 Jan 2024 21:08:21 GMT
server: A
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=e336f68a-0027-4deb-bb36-1251c6812c4f-65a99345-5553&gdpr=0&gdpr_consent=
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H2 204 CookieSyncPubMatic&gdpr=0&gdpr_consent=
rtb.adentifi.com/ Frame 832B 0
287 B 200ms
57ms Image
text/plain 3.213.62.40
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.213.62.40 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-213-62-40.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 18 Jan 2024 21:08:21 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 832B
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2468686655663211231&gdpr=0&gdpr_consent=&us_privacy=

1 B
428 B

120ms
56ms

Image
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2468686655663211231&gdpr=0&gdpr_consent=&us_privacy=
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Thu, 18 Jan 2024 21:08:21 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2468686655663211231&gdpr=0&gdpr_consent=&us_privacy=
pragma: no-cache
date: Thu, 18 Jan 2024 21:08:20 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H/1.1

200
OK

sn.ashx
pmp.mxptint.net/ Frame 832B
Redirect Chain

https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R35CAB_10F800616_70478144&r=https://pmp.mxptint.net/sn.ashx?ak=1
https://pmp.mxptint.net/sn.ashx?ak=1

43 B
266 B

64ms
64ms

Image
image/gif

38.68.201.140
COGENT-174

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pmp.mxptint.net/sn.ashx?ak=1

Protocol

HTTP/1.1

Server

38.68.201.140 Ashburn, United States, ASN174 (COGENT-174, US),

Reverse DNS

Software

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=-388616902; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Expires: -1
Pragma: no-cache
Date: Thu, 18 Jan 2024 21:08:21 GMT
Cache-Control: no-cache
Strict-Transport-Security: max-age=-388616902; includeSubDomains
Content-Length: 43
Content-Type: image/gif

Redirect headers

location: https://pmp.mxptint.net/sn.ashx?ak=1
date: Thu, 18 Jan 2024 09:57:38 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 832B
Redirect Chain

https://creativecdn.com/cm-notify?pi=pubmatic&gdpr=0&gdpr_consent=
https://creativecdn.com/cm-notify?pi=pubmatic&gdpr=0&gdpr_consent=&tc=1
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNTQmdGw9NDMyMDA%3D&piggybackCookie=245DhAIUKqZlm1HREIEH4TIRbH-EqAzCkMz9f8UWg58&pi=pubmatic&gdpr=0&gdpr_consent=&tc=1

42 B
353 B

58ms
57ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNTQmdGw9NDMyMDA%3D&piggybackCookie=245DhAIUKqZlm1HREIEH4TIRbH-EqAzCkMz9f8UWg58&pi=pubmatic&gdpr=0&gdpr_consent=&tc=1
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Thu, 18 Jan 2024 21:08:22 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNTQmdGw9NDMyMDA%3D&piggybackCookie=245DhAIUKqZlm1HREIEH4TIRbH-EqAzCkMz9f8UWg58&pi=pubmatic&gdpr=0&gdpr_consent=&tc=1
pragma: no-cache
date: Thu, 18 Jan 2024 21:08:22 GMT, Thu, 18 Jan 2024 21:08:22 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 100ms
96ms Preflight
text/html 142.251.40.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x920443c2673c8d5a0000000000000000%22,%222%22:%220x3883f7b54232b3040000000000000000%22,%223%22:%220x48483a8d5ea1870a0000000000000000%22,%224%22:%220xeb56c3816ff6bd60000000000000000%22,%225%22:%220xbc04a61ea328efda0000000000000000%22},%22debug_key%22:%2213341876829041177886%22,%22debug_reporting%22:true,%22destination%22:%22https://temu.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2210974797857%22],%2222%22:[%22true%22],%224%22:[%2201-18%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2210431727977102595537%22}&andc=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS