www.benefitscanada.com Open in urlscan Pro
18.165.25.35 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.benefitscanada.com/canadian-investment-review/
Submission: On September 02 via api (September 2nd 2023, 1:32:23 am UTC) from CA — Scanned from CA

Summary HTTP 217 Redirects Links 10 Behaviour Indicators

Summary

This website contacted 32 IPs in 4 countries across 20 domains to perform 217 HTTP transactions. The main IP is 18.165.25.35, located in United States and belongs to AMAZON-02, US. The main domain is www.benefitscanada.com. The Cisco Umbrella rank of the primary domain is 773922.
TLS certificate: Issued by Amazon RSA 2048 M01 on February 8th 2023. Valid for: a year.

This is the only time www.benefitscanada.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
31	18.165.25.35 18.165.25.35	16509 (AMAZON-02) (AMAZON-02)
4	172.217.13.196 172.217.13.196	15169 (GOOGLE) (GOOGLE)
1	18.165.9.115 18.165.9.115	16509 (AMAZON-02) (AMAZON-02)
4	172.217.13.138 172.217.13.138	15169 (GOOGLE) (GOOGLE)
8	172.217.13.168 172.217.13.168	15169 (GOOGLE) (GOOGLE)
2	23.215.130.171 23.215.130.171	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	172.217.13.163 172.217.13.163	15169 (GOOGLE) (GOOGLE)
1	172.217.13.195 172.217.13.195	15169 (GOOGLE) (GOOGLE)
1	34.195.71.162 34.195.71.162	14618 (AMAZON-AES) (AMAZON-AES)
1	18.165.25.91 18.165.25.91	16509 (AMAZON-02) (AMAZON-02)
3 4	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
4	172.217.13.142 172.217.13.142	15169 (GOOGLE) (GOOGLE)
4	151.101.194.132 151.101.194.132	54113 (FASTLY) (FASTLY)
27	172.217.13.130 172.217.13.130	15169 (GOOGLE) (GOOGLE)
3	172.253.63.155 172.253.63.155	15169 (GOOGLE) (GOOGLE)
3	172.217.13.131 172.217.13.131	15169 (GOOGLE) (GOOGLE)
1	216.239.34.181 216.239.34.181	15169 (GOOGLE) (GOOGLE)
3	35.203.92.254 35.203.92.254	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	104.22.53.86 104.22.53.86	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	162.19.138.120 162.19.138.120	16276 (OVH) (OVH)
1 2	68.67.160.137 68.67.160.137	29990 (ASN-APPNEX) (ASN-APPNEX)
17	172.217.13.162 172.217.13.162	15169 (GOOGLE) (GOOGLE)
4	172.217.13.161 172.217.13.161	15169 (GOOGLE) (GOOGLE)
18	172.217.13.193 172.217.13.193	15169 (GOOGLE) (GOOGLE)
12	172.217.13.194 172.217.13.194	15169 (GOOGLE) (GOOGLE)
3	172.217.13.102 172.217.13.102	15169 (GOOGLE) (GOOGLE)
34	172.217.13.198 172.217.13.198	15169 (GOOGLE) (GOOGLE)
2 4	3.211.247.215 3.211.247.215	14618 (AMAZON-AES) (AMAZON-AES)
6	18.165.9.12 18.165.9.12	16509 (AMAZON-02) (AMAZON-02)
4	151.139.128.10 151.139.128.10	20446 (STACKPATH...) (STACKPATH-CDN)
12	52.40.92.86 52.40.92.86	16509 (AMAZON-02) (AMAZON-02)
217	32

31 18.165.25.35 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-165-25-35.pit50.r.cloudfront.net

www.benefitscanada.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.217.13.196 (United States)

ASN15169 (GOOGLE, US)
PTR: yul03s05-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.165.9.115 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-165-9-115.pit50.r.cloudfront.net

static.freeskreen.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.217.13.138 (United States)

ASN15169 (GOOGLE, US)
PTR: yul02s05-in-f10.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 172.217.13.168 (United States)

ASN15169 (GOOGLE, US)
PTR: yul03s04-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.215.130.171 (Secaucus, United States)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-215-130-171.deploy.static.akamaitechnologies.com

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.217.13.163 (United States)

ASN15169 (GOOGLE, US)
PTR: yul03s04-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.13.195 (United States)

ASN15169 (GOOGLE, US)
PTR: yul03s05-in-f3.1e100.net

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.195.71.162 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-195-71-162.compute-1.amazonaws.com

sb.freeskreen.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.165.25.91 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-165-25-91.pit50.r.cloudfront.net

cdn.linkedin.oribi.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 13.107.42.14 (United States) 3 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.217.13.142 (United States)

ASN15169 (GOOGLE, US)
PTR: yul02s05-in-f14.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 151.101.194.132 (United States)

ASN54113 (FASTLY, US)

rdc.m32.media	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fastlygeo.m32.media	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

27 172.217.13.130 (United States)

ASN15169 (GOOGLE, US)
PTR: yul02s05-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.253.63.155 (United States)

ASN15169 (GOOGLE, US)
PTR: bi-in-f155.1e100.net

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.217.13.131 (United States)

ASN15169 (GOOGLE, US)
PTR: yul02s05-in-f3.1e100.net

www.google.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.239.34.181 (United States)

ASN15169 (GOOGLE, US)

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.203.92.254 (Montreal, Canada)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 254.92.203.35.bc.googleusercontent.com

seg.m32.media	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.22.53.86 (None, )

ASN13335 (CLOUDFLARENET, US)

cdn.id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.19.138.120 (Frankfurt am Main, Germany)

ASN16276 (OVH, FR)
PTR: ns31533571.ip-162-19-138.eu

id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 68.67.160.137 (New York, United States) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 639.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 172.217.13.162 (United States)

ASN15169 (GOOGLE, US)
PTR: yul03s04-in-f2.1e100.net

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.217.13.161 (United States)

ASN15169 (GOOGLE, US)
PTR: yul03s04-in-f1.1e100.net

4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 172.217.13.193 (United States)

ASN15169 (GOOGLE, US)
PTR: yul03s05-in-f1.1e100.net

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 172.217.13.194 (United States)

ASN15169 (GOOGLE, US)
PTR: yul03s05-in-f2.1e100.net

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.217.13.102 (United States)

ASN15169 (GOOGLE, US)
PTR: yul02s04-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

34 172.217.13.198 (United States)

ASN15169 (GOOGLE, US)
PTR: yul03s05-in-f6.1e100.net

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 3.211.247.215 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-211-247-215.compute-1.amazonaws.com

fw.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 18.165.9.12 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-165-9-12.pit50.r.cloudfront.net

static.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 151.139.128.10 (United States)

ASN20446 (STACKPATH-CDN, US)
PTR: map3.hwcdn.net

tqe36.flx10.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 52.40.92.86 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-40-92-86.us-west-2.compute.amazonaws.com

dt.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
39	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 107 4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 150	339 KB
34	2mdn.net s0.2mdn.net — Cisco Umbrella Rank: 311	424 KB
33	doubleclick.net securepubads.g.doubleclick.net — Cisco Umbrella Rank: 203 stats.g.doubleclick.net — Cisco Umbrella Rank: 87 ad.doubleclick.net — Cisco Umbrella Rank: 173 googleads4.g.doubleclick.net — Cisco Umbrella Rank: 371	342 KB
31	benefitscanada.com www.benefitscanada.com — Cisco Umbrella Rank: 773922	3 MB
22	adsafeprotected.com 2 redirects fw.adsafeprotected.com — Cisco Umbrella Rank: 884 static.adsafeprotected.com — Cisco Umbrella Rank: 607 dt.adsafeprotected.com — Cisco Umbrella Rank: 579	203 KB
12	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 214	419 KB
8	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 47	485 KB
7	m32.media rdc.m32.media — Cisco Umbrella Rank: 33594 fastlygeo.m32.media — Cisco Umbrella Rank: 138190 seg.m32.media — Cisco Umbrella Rank: 257046	37 KB
5	google.com www.google.com — Cisco Umbrella Rank: 2 analytics.google.com — Cisco Umbrella Rank: 164	2 KB
4	flx10.com tqe36.flx10.com — Cisco Umbrella Rank: 41742	553 KB
4	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 35	21 KB
4	linkedin.com 3 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 365 www.linkedin.com — Cisco Umbrella Rank: 625	4 KB
4	gstatic.com fonts.gstatic.com www.gstatic.com	239 KB
4	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 41	3 KB
3	google.ca www.google.ca — Cisco Umbrella Rank: 9197	578 B
2	adnxs.com 1 redirects ib.adnxs.com — Cisco Umbrella Rank: 239	1 KB
2	id5-sync.com cdn.id5-sync.com — Cisco Umbrella Rank: 755 id5-sync.com — Cisco Umbrella Rank: 400	27 KB
2	licdn.com snap.licdn.com — Cisco Umbrella Rank: 760	6 KB
2	freeskreen.com static.freeskreen.com — Cisco Umbrella Rank: 69776 sb.freeskreen.com — Cisco Umbrella Rank: 53979	29 KB
1	oribi.io cdn.linkedin.oribi.io — Cisco Umbrella Rank: 881	375 B
217	20

	Domain	Requested by
34	s0.2mdn.net	www.benefitscanada.com s0.2mdn.net
31	www.benefitscanada.com	www.benefitscanada.com
21	securepubads.g.doubleclick.net	rdc.m32.media securepubads.g.doubleclick.net www.benefitscanada.com 4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com www.googletagservices.com
18	tpc.googlesyndication.com	securepubads.g.doubleclick.net 4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com tpc.googlesyndication.com www.benefitscanada.com
17	pagead2.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com ad.doubleclick.net 4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com www.googletagservices.com
12	dt.adsafeprotected.com	4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com
12	www.googletagservices.com	securepubads.g.doubleclick.net 4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com www.googletagservices.com
8	www.googletagmanager.com	www.benefitscanada.com www.googletagmanager.com www.google-analytics.com
6	static.adsafeprotected.com	fw.adsafeprotected.com 4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com
6	googleads4.g.doubleclick.net	www.benefitscanada.com
4	tqe36.flx10.com	s0.2mdn.net
4	fw.adsafeprotected.com	2 redirects www.benefitscanada.com
4	4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
4	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
4	fonts.googleapis.com	www.benefitscanada.com
4	www.google.com	www.benefitscanada.com tpc.googlesyndication.com
3	ad.doubleclick.net	www.googletagservices.com
3	seg.m32.media	rdc.m32.media
3	www.google.ca	www.benefitscanada.com
3	stats.g.doubleclick.net	www.google-analytics.com www.googletagmanager.com
3	rdc.m32.media	www.benefitscanada.com rdc.m32.media www.googletagmanager.com
3	px.ads.linkedin.com	2 redirects www.benefitscanada.com
3	fonts.gstatic.com	fonts.googleapis.com
2	ib.adnxs.com	1 redirects
2	snap.licdn.com	www.benefitscanada.com snap.licdn.com
1	id5-sync.com	cdn.id5-sync.com
1	cdn.id5-sync.com	securepubads.g.doubleclick.net
1	fastlygeo.m32.media	rdc.m32.media
1	analytics.google.com	www.googletagmanager.com
1	www.linkedin.com	1 redirects
1	cdn.linkedin.oribi.io	snap.licdn.com
1	sb.freeskreen.com	static.freeskreen.com
1	www.gstatic.com	www.google.com
1	static.freeskreen.com	www.benefitscanada.com
217	34

This site contains links to these domains. Also see Links.

Domain
www.avantages.ca
www.ciin.ca
twitter.com
www.linkedin.com
benefitscanada.com
www.acquizition.biz
ladingpage.tcmlesaffaires.pages.dialoginsight.com
www.groupecontex.ca

Subject Issuer	Validity	Valid
avatar.tcmediasaffaires.com Amazon RSA 2048 M01	`2023-02-08` - `2024-03-08`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-08-07` - `2023-10-30`	3 months	crt.sh
*.freeskreen.com Amazon RSA 2048 M02	`2023-02-22` - `2023-12-16`	10 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-08-07` - `2023-10-30`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-08-07` - `2023-10-30`	3 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-02-01` - `2024-01-31`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2023-08-07` - `2023-10-30`	3 months	crt.sh
linkedin.oribi.io Amazon RSA 2048 M01	`2023-06-08` - `2024-07-07`	a year	crt.sh
*.m32.media Sectigo RSA Domain Validation Secure Server CA	`2023-01-13` - `2023-11-22`	10 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-08-07` - `2023-10-30`	3 months	crt.sh
*.google.ca GTS CA 1C3	`2023-08-07` - `2023-10-30`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-08-07` - `2023-10-30`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-07` - `2024-05-06`	a year	crt.sh
*.id5-sync.com R3	`2023-09-01` - `2023-11-30`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-08-07` - `2023-10-30`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2023-08-07` - `2023-10-30`	3 months	crt.sh
fw.adsafeprotected.com Amazon RSA 2048 M01	`2023-03-29` - `2024-04-27`	a year	crt.sh
static.adsafeprotected.com Amazon RSA 2048 M02	`2023-07-07` - `2024-08-04`	a year	crt.sh
tqe36.flx10.com R3	`2023-07-28` - `2023-10-26`	3 months	crt.sh
dt.adsafeprotected.com Amazon RSA 2048 M01	`2023-05-09` - `2024-06-06`	a year	crt.sh

This page contains 18 frames:

Primary Page: https://www.benefitscanada.com/canadian-investment-review/
Frame ID: DA6CE646BD9DB746EFEE2212C5B49730
Requests: 90 HTTP requests in this frame

Frame: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: B4540A14F53FED5C928482D7CE099197
Requests: 1 HTTP requests in this frame

Frame: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: D36F53075E00C751C4AF87BC290A3CA8
Requests: 16 HTTP requests in this frame

Frame: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: FDCD51E2D1B54D883BD5F8D9A07456A3
Requests: 26 HTTP requests in this frame

Frame: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 841CFC6B7186FACD0612184771270E4B
Requests: 22 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsua_778dIIugSZU_xcRHA1Jy7BSMNKYxTKEp-3dzbBc-IO2QBB6MgqOXoxnmxfYgmkxgVAQa_XW8cSZJOBBC75UVoVjsiMdRlfdaocmUsnXDZugj_SLE6_qPQ3G87jejHjSEkA0I1BnibTMwyyZKYa1kvaEajCTINY7dyHQokt5-izH-vvX7CyP--p33GB_4Hj9DOYvewUc42NXKdAzewk2Pk4TmCIS0lkbX8N50toSFmVYANrlG8SluBK1dzkyz_GaFQ7jQqhFbGvUN5w0FkSlZsijHjrMC172NNOFwGDn38TpQobjmM2QK3zj-BDudyabrwyvkub9FWGzL9X9wOLhljuZUTRHMFtg7PnCfQK7NO9S0fihJBWhLbpW_1x9-p0HeYUF8P3o_wk_iw&sai=AMfl-YRQgLmJmktipgBHfxQEMityI8xyVrWp_HrKlagk6C0FT0nVQTdprtNxp1pPO4j6PjZizzSPEU6fOTa4ws9wvqLhSFAb6n_7s_T5RxRPcoAKdlPZrm827XLs9T1JSDWjgB8mNfgQ2z3-MeO1fT0&sig=Cg0ArKJSzOy5Rz831OeCEAE&uach_m=[UACH]&adurl=
Frame ID: D1C9C368013FCAA91E3439BE4BB6664C
Requests: 6 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu7sYeaGY_f864IFsjoXBCwbCnFZa5JoK4ef-PwtL4oCpvSYwtovAXHVeSWtAsJCFgUCl4WQoJyARLZ6EqSeivn3A5BD4Zw0tQ6I1ARUTPaygheH5R4TLISZE73nF_ItZQbWrbZQVjh8zHBZb90zfDTnqq5eFNaFAap8bfdcQDn_03wboMvMo9oowwqLadmv9J7jDLBsykVsKAm97udCqACK9rHs7R0WYT_PQrwBxT7nMW_QX6LKjfmLhWiaam2FATEPQ2mkG5yinZcS16PESCy8T5GxOxIPXid8tMGRPibH5KIgqgOVr2Grjx5OEdEDr_HK-K79o2jl9OCUQ-Hi-BWrIZID-iA3U-IlIvPTYWWAGoJNxWHtpcukItXlK_kyR0qBfAaOa-tx1fhZw&sai=AMfl-YSEmQn3oECJJ5fCxsHujOijkiNZ_2dWmYgeVENOzoC47_PFlaHrhJ5oVuuw4AbO5WnArmkfO8HebKZV2U2tORPQpUC3OuH7Y11CDAfiw8B4Q1alOshN8Fpgx1jCkSNypETJ0aLSuQIZ-rWnY7j-&sig=Cg0ArKJSzCKI3vPQJJjfEAE&uach_m=[UACH]&adurl=
Frame ID: 93E956B7CCF6A6F619059247349A1832
Requests: 6 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstM76gk5I6QwOo-3E1IoEcOiV8CaZQy5ZL3JHgOs4RcxwXjlNzC6_fwp9dkvUKjB9bk2m3fkYKH0AKGnd6mpVAEHpieVP2kDDWQUQ1eIUckc28Ww0hF00TaM0K3loCZeAR-N8A3uvnlM7MX8u8tW97Uy0okWgLB2goTwzCfDn0kOYdguO_we5dL5m9DHnVg-GJ29wojCtPBNwPlqzsv5Hxu6MSJBQslbxsCUwAwuHDfMecNcXV_gO0uqxfrMWagW4gCQAgZf8FhBvoWF6P_D5vQtIY6lHJkVUIg13_BQ_JMeKzjrSxpqOIiwlIkcU0PbEWZ62NGpa2gzWvHTqTx_oZm7cEZPZ_zNgcYSPvaSbmO7PqWuL5dqQgPp9vAKL97EqVL6qJk0_HbjtEEdQ&sai=AMfl-YRmnF2OWFiFEkbkViz6RZtpew8DDgMsnfZYa0isr9fgJuGoX2PAZhRRJUXOgzL28a8cfPDZ8b4bTBDsUoF6fHuThSTx83w1ejqdQOQj2a8k9OaaivB-iwATiIdJ3uCy942BoCiKTiY09iCc9oei&sig=Cg0ArKJSzDJIRUhnSZWMEAE&uach_m=[UACH]&adurl=
Frame ID: C400EFCF6923F2986FCFAA8B4D5E6CE7
Requests: 6 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 7C0CFA7EC95B8BCC3176F577C856EE0B
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: B0F4A3119E5963E6B0445D7AE4215AB8
Requests: 2 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/16870859579687053945/23-1127-GAM-Display-video-Eng_728x90/index.html?ev=01_250
Frame ID: FEC3BDD5DCAF133C48A10BA6E332379B
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 4C5F6352A2123877F05279890137D485
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250
Frame ID: E9C2643DEF30452B90579E76E47691AB
Requests: 13 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 00EF9248D3F2BD8482D4BC93A60715F5
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 81271C54176CF4CFE524E82626E155FD
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250
Frame ID: CE2D5473D5906B3DE3931E48755E6812
Requests: 13 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.6.2.js
Frame ID: 974B22AED584F052E72593515246D633
Requests: 1 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.6.2.js
Frame ID: 6C5C5D3CC3797373C6F26948C8FB6CB3
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Investments | Benefits Canada.com

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick Ad Exchange (AdX) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

tpc\.googlesyndication\.com/safeframe

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

/recaptcha/api\.js

Page Statistics

217
Requests

98 %
HTTPS

0 %
IPv6

20
Domains

34
Subdomains

32
IPs

4
Countries

6227 kB
Transfer

11257 kB
Size

23
Cookies

10 Outgoing links

These are links going to different origins than the main page.

URL: https://www.avantages.ca/
Title: AVANTAGES

Search URL Search Domain Scan URL

URL: http://www.ciin.ca/
Title: CIIN

Search URL Search Domain Scan URL

URL: https://twitter.com/InvestReviewCA

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/canadian-investment-review

Search URL Search Domain Scan URL

URL: https://benefitscanada.com/partner-content-cir/
Title: See all

Search URL Search Domain Scan URL

URL: https://www.acquizition.biz/en/home

Search URL Search Domain Scan URL

URL: http://www.avantages.ca/

Search URL Search Domain Scan URL

URL: https://www.ciin.ca/

Search URL Search Domain Scan URL

URL: http://ladingpage.tcmlesaffaires.pages.dialoginsight.com/Privacy_Policy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.groupecontex.ca/en/
Title: <img src="/wp-content/uploads/sites/7/2021/02/Logo-Contex-NBG.png" alt="Groupe Context">

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 39

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=5252220&time=1693618336016&url=https%3A%2F%2Fwww.benefitscanada.com%2Fcanadian-investment-review%2F HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=5252220&time=1693618336016&url=https%3A%2F%2Fwww.benefitscanada.com%2Fcanadian-investment-review%2F&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D5252220%26time%3D1693618336016%26url%3Dhttps%253A%252F%252Fwww.benefitscanada.com%252Fcanadian-investment-review%252F%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=5252220&time=1693618336016&url=https%3A%2F%2Fwww.benefitscanada.com%2Fcanadian-investment-review%2F&cookiesTest=true&liSync=true

Request Chain 78

https://ib.adnxs.com/seg?add_Code=3Dd6FpoPJdA&member=2437 HTTP 307
https://ib.adnxs.com/bounce?%2Fseg%3Fadd_Code%3D3Dd6FpoPJdA%26member%3D2437

Request Chain 197

https://fw.adsafeprotected.com/rfw/st/1347897/69359102/skeleton.js?adsafe_url=https%3A%2F%2Fwww.benefitscanada.com&adsafe_type=y&adsafe_url=https%3A%2F%2Fwww.benefitscanada.com%2F&adsafe_type=e&adsafe_url=https%3A%2F%2F4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com%2F&adsafe_type=f&adsafe_url=https%3A%2F%2F4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&adsafe_type=d&adsafe_jsinfo=,id:b04fd5c3-41f7-22e9-37d0-8c7a894c72d5,c:mZ8DP3,sl:na,em:true,fr:false,thd:1,mn:jsserver-primary-67bdfc9f5d-dwd9t,rg:va,pt:1-5-15,mu:10000,br:c,bru:c,an:n,oam:0,mtim:296,mot:0,app:0,maw:0,fm:tOEVWVA+11%7C12%7C131%7C1321%7C14*.1347897-69359102%7C1411%7C142%7C151%7C1521%7C16%7C17%7C18%7C19%7C1a,idMap:14*,pl:CV8L.VEBo.0YtC,rmeas:1,rend:1,renddet:DIV.qs.sn,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,tt:rjss,et:311,oid:8db76be3-4930-11ee-a666-e676b973bfeb,v:19.8.439,sp:1,st:0,fwm:1,wr:1600.1200,sr:1600.1200,ov:0 HTTP 302
https://static.adsafeprotected.com/skeleton.js

Request Chain 199

https://fw.adsafeprotected.com/rfw/st/1347897/69359102/skeleton.js?adsafe_url=https%3A%2F%2Fwww.benefitscanada.com&adsafe_type=y&adsafe_url=https%3A%2F%2Fwww.benefitscanada.com%2F&adsafe_type=e&adsafe_url=https%3A%2F%2F4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com%2F&adsafe_type=f&adsafe_url=https%3A%2F%2F4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&adsafe_type=d&adsafe_jsinfo=,id:d83a4d1e-1542-a13c-cb90-ee040b3ae6a6,c:mZ8DPq,sl:na,em:true,fr:false,thd:1,mn:jsserver-primary-67bdfc9f5d-f2lcg,rg:va,pt:1-5-15,mu:10000,br:c,bru:c,an:n,oam:0,mtim:311,mot:0,app:0,maw:0,fm:tOEVWVS+11%7C12%7C131%7C1321%7C1411%7C142%7C143%7C15*.1347897-69359102%7C151%7C1521%7C16%7C17%7C18%7C19%7C1a,idMap:15*,pl:CV8L.VEBo.0YtC,rmeas:1,rend:1,renddet:DIV.qs.sn,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,tt:rjss,et:316,oid:8db792f7-4930-11ee-af80-a28ccc0494ce,v:19.8.439,sp:1,st:0,fwm:1,wr:1600.1200,sr:1600.1200,ov:0 HTTP 302
https://static.adsafeprotected.com/skeleton.js

217 HTTP transactions
7 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.benefitscanada.com/canadian-investment-review/ 131 KB
22 KB 253ms
170ms Document
text/html 18.165.25.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.benefitscanada.com/canadian-investment-review/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.25.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-25-35.pit50.r.cloudfront.net
Software: Apache/2.4.56 (Amazon) PHP/7.1.33 / PHP/7.1.33
Resource Hash: 83042b42008dd9a3e22dd5168543f765a4cc7049700687a88a7e5c4df37458ae

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-origin: *
cache-control: max-age=0
content-encoding: gzip
content-length: 21618
content-type: text/html; charset=UTF-8
date: Sat, 02 Sep 2023 01:32:15 GMT
expires: Sat, 02 Sep 2023 01:32:15 GMT
last-modified: Sat, 02 Sep 2023 01:24:20 GMT
server: Apache/2.4.56 (Amazon) PHP/7.1.33
vary: Accept-Encoding
via: 1.1 e7e1cceb60dd8f54a960238fa44796a8.cloudfront.net (CloudFront)
x-amz-cf-id: lBpd95RhkMuqueKNyjhW9_iV2Q83gNHmDBCbcy3-cQTzf8ExzTQwsg==
x-amz-cf-pop: PIT50-P2
x-cache: Miss from cloudfront
x-powered-by: PHP/7.1.33

GET
H2 200 vendors.min-1.0.2.css
www.benefitscanada.com/wp-content/cache/busting/7/wp-content/themes/avatar-tcm/assets/css/ 164 KB
29 KB 36ms
35ms Stylesheet
text/css 18.165.25.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.benefitscanada.com/wp-content/cache/busting/7/wp-content/themes/avatar-tcm/assets/css/vendors.min-1.0.2.css
Requested by: Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.25.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-25-35.pit50.r.cloudfront.net
Software: Apache/2.4.56 (Amazon) PHP/7.1.33 /
Resource Hash: b59668075b67f78c188d4186567ebc8077567486445d17c65c4ea836ffa0ac42

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/canadian-investment-review/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Fri, 01 Sep 2023 13:37:45 GMT
content-encoding: gzip
via: 1.1 e7e1cceb60dd8f54a960238fa44796a8.cloudfront.net (CloudFront)
x-amz-cf-pop: PIT50-P2
age: 42870
x-cache: Hit from cloudfront
content-length: 29529
last-modified: Tue, 29 Aug 2023 12:14:45 GMT
server: Apache/2.4.56 (Amazon) PHP/7.1.33
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public
accept-ranges: bytes
x-amz-cf-id: xtTvtH9B_ephWcw-lLiy74YLhYpcc84ubxtiQR4mIifNbiEh5OBNYQ==
expires: Sat, 31 Aug 2024 13:37:45 GMT

GET
H2 200 style-2.4.css
www.benefitscanada.com/wp-content/cache/busting/7/wp-content/themes/avatar-tcm/ 532 KB
74 KB 42ms
41ms Stylesheet
text/css 18.165.25.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.benefitscanada.com/wp-content/cache/busting/7/wp-content/themes/avatar-tcm/style-2.4.css
Requested by: Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.25.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-25-35.pit50.r.cloudfront.net
Software: Apache/2.4.56 (Amazon) PHP/7.1.33 /
Resource Hash: 07ff015d1a1147e70fdc0f24cbc4077a8094d902309544eddc6722e462b6e853

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/canadian-investment-review/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Fri, 01 Sep 2023 13:37:46 GMT
content-encoding: gzip
via: 1.1 e7e1cceb60dd8f54a960238fa44796a8.cloudfront.net (CloudFront)
last-modified: Tue, 29 Aug 2023 12:14:46 GMT
server: Apache/2.4.56 (Amazon) PHP/7.1.33
x-amz-cf-pop: PIT50-P2
age: 42869
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public
accept-ranges: bytes
x-amz-cf-id: t0iQqa25UMtdwx_vAnvOXm4nuhxGmrb0C6V688StqfA1jgBsaeTJmA==
expires: Sat, 31 Aug 2024 13:37:46 GMT

GET
H2 200 style-1.1.7.css
www.benefitscanada.com/wp-content/cache/busting/7/wp-content/themes/avatar-be/ 8 KB
3 KB 70ms
70ms Stylesheet
text/css 18.165.25.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.benefitscanada.com/wp-content/cache/busting/7/wp-content/themes/avatar-be/style-1.1.7.css
Requested by: Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.25.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-25-35.pit50.r.cloudfront.net
Software: Apache/2.4.56 (Amazon) PHP/7.1.33 /
Resource Hash: ff823a9edbf91a5cc0df894573f186edcb29d38381311aa9e27b2741b95b3795

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/canadian-investment-review/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Fri, 01 Sep 2023 13:37:46 GMT
content-encoding: gzip
via: 1.1 e7e1cceb60dd8f54a960238fa44796a8.cloudfront.net (CloudFront)
x-amz-cf-pop: PIT50-P2
age: 42869
x-cache: Hit from cloudfront
content-length: 2336
last-modified: Tue, 29 Aug 2023 12:14:46 GMT
server: Apache/2.4.56 (Amazon) PHP/7.1.33
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public
accept-ranges: bytes
x-amz-cf-id: DcawNg5Zh-Dvi8zoWwsXGGmNh3Bp_6QqXGdiNHHBaY0vjsBL4KppkA==
expires: Sat, 31 Aug 2024 13:37:46 GMT

GET
H2 200 jquery-1.12.4.js Show response
www.benefitscanada.com/wp-content/cache/busting/7/wp-includes/js/jquery/ 95 KB
33 KB 65ms
65ms Script
text/javascript 18.165.25.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.benefitscanada.com/wp-content/cache/busting/7/wp-includes/js/jquery/jquery-1.12.4.js
Requested by: Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.25.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-25-35.pit50.r.cloudfront.net
Software: Apache/2.4.56 (Amazon) PHP/7.1.33 /
Resource Hash: fc48d1d80ece71a79a7b39877f4104d49d3da6c3665cf6dc203000fb7df4447e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/canadian-investment-review/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Fri, 01 Sep 2023 13:49:43 GMT
content-encoding: gzip
via: 1.1 e7e1cceb60dd8f54a960238fa44796a8.cloudfront.net (CloudFront)
x-amz-cf-pop: PIT50-P2
age: 42152
x-cache: Hit from cloudfront
content-length: 33766
last-modified: Tue, 29 Aug 2023 12:14:46 GMT
server: Apache/2.4.56 (Amazon) PHP/7.1.33
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=2592000, public
accept-ranges: bytes
x-amz-cf-id: SkUWX_e4NtWpEl6A0mPh1vGHJc8XXADteC7EWgzrpFUvYKTd-psKyQ==
expires: Sun, 01 Oct 2023 13:49:43 GMT

GET
H2 200 jquery-migrate.min-1.4.1.js Show response
www.benefitscanada.com/wp-content/cache/busting/7/wp-includes/js/jquery/ 10 KB
4 KB 37ms
33ms Script
text/javascript 18.165.25.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.benefitscanada.com/wp-content/cache/busting/7/wp-includes/js/jquery/jquery-migrate.min-1.4.1.js
Requested by: Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.25.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-25-35.pit50.r.cloudfront.net
Software: Apache/2.4.56 (Amazon) PHP/7.1.33 /
Resource Hash: 48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/canadian-investment-review/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Fri, 01 Sep 2023 13:49:43 GMT
content-encoding: gzip
via: 1.1 e7e1cceb60dd8f54a960238fa44796a8.cloudfront.net (CloudFront)
x-amz-cf-pop: PIT50-P2
age: 42152
x-cache: Hit from cloudfront
content-length: 4014
last-modified: Tue, 29 Aug 2023 12:14:46 GMT
server: Apache/2.4.56 (Amazon) PHP/7.1.33
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=2592000, public
accept-ranges: bytes
x-amz-cf-id: pRNO7QnE_sKKEBz1YNiUWi_WegV-rmCmHb8Ejj_qB-XN2LuoKKp8Jg==
expires: Sun, 01 Oct 2023 13:49:43 GMT

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 1 KB
1 KB 95ms
46ms Script
text/javascript 172.217.13.196
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js

Requested by

Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.196 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f4.1e100.net

Software

GSE /

Resource Hash

fe5e157c57b8a5017a03e866ec659bd8efa054c5e54276593ab43be9420fba14

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 834
x-xss-protection: 1; mode=block
expires: Sat, 02 Sep 2023 01:32:15 GMT

GET
H/1.1 200
OK freeskreen.min.js Show response
static.freeskreen.com/ba/20/ 24 KB
9 KB 116ms
28ms Script
text/javascript 18.165.9.115
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.freeskreen.com/ba/20/freeskreen.min.js
Requested by: Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.9.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-9-115.pit50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e49b3b965d5090252ff51b3bd2ac2d65872b7a9160bb5e575af2e6886824669b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

x-amz-version-id: DFHjhAP0G__BRlGWII4iqM8VXmLL4x1v
Content-Encoding: gzip
Via: 1.1 8299d32f4832af5cd8a5973fd79c6968.cloudfront.net (CloudFront)
Date: Fri, 01 Sep 2023 02:00:36 GMT
Last-Modified: Fri, 16 Jul 2021 17:37:20 GMT
Server: AmazonS3
X-Amz-Cf-Pop: PIT50-P1
Age: 84700
ETag: "433d9547dfdd9db5e6c21af0e8d26ae1"
X-Cache: Hit from cloudfront
Content-Type: text/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 8833
X-Amz-Cf-Id: LRLziYBmAH-XFkyh-7biglgNb1lqN-7WkAzc8Y6gC7lYeUdQEe_mbg==

GET
H2 200 Benefits_logo-1.png
www.benefitscanada.com/wp-content/uploads/sites/7/2023/07/ 49 KB
49 KB 39ms
35ms Image
image/png 18.165.25.35
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitscanada.com/wp-content/uploads/sites/7/2023/07/Benefits_logo-1.png
Requested by: Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.25.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-25-35.pit50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ea0ae4fae8924dd26f897ee18cb3b8477306b682a8d7a758abd8da7fb55c1cb7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/canadian-investment-review/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

x-amz-version-id: nYg8YYVHQ4iwjwqbnm6AdBuSDlc4tNkJ
date: Thu, 31 Aug 2023 10:55:28 GMT
via: 1.1 e7e1cceb60dd8f54a960238fa44796a8.cloudfront.net (CloudFront)
x-amz-cf-pop: PIT50-P2
age: 139008
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 50083
last-modified: Mon, 10 Jul 2023 13:32:20 GMT
server: AmazonS3
etag: "668ea174228fb803e42d7a6e210e18df"
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: xTjp-0GiisVHyUWFIuuKBYIp9dlgZoLXSi0bn1xv5sEE0cDNsmo5-w==
expires: Tue, 09 Jul 2024 13:32:19 GMT

GET
H2 200 CIR_Logo_Horizontal.png
www.benefitscanada.com/wp-content/themes/avatar-be/assets/images/ 26 KB
27 KB 79ms
76ms Image
image/png 18.165.25.35
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitscanada.com/wp-content/themes/avatar-be/assets/images/CIR_Logo_Horizontal.png
Requested by: Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.25.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-25-35.pit50.r.cloudfront.net
Software: Apache/2.4.56 (Amazon) PHP/7.1.33 /
Resource Hash: fa9f8844bab2a4b87f3401044f3e46fc6bcab2a3aa60f5587e9bcc5cede0e978

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/canadian-investment-review/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Fri, 01 Sep 2023 15:02:44 GMT
via: 1.1 e7e1cceb60dd8f54a960238fa44796a8.cloudfront.net (CloudFront)
last-modified: Fri, 01 Sep 2023 13:27:53 GMT
server: Apache/2.4.56 (Amazon) PHP/7.1.33
x-amz-cf-pop: PIT50-P2
age: 37771
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 27123
x-amz-cf-id: tUjE9ILl0354ulTKQdveXUiTKdKVqyjILXTeiDGbMxLGx6j5Swokbw==
expires: Sun, 01 Oct 2023 15:02:44 GMT

GET
H2 200 2023-Consultants-live-widget.jpg
www.benefitscanada.com/wp-content/uploads/sites/7/2023/08/ 34 KB
35 KB 53ms
49ms Image
image/jpeg 18.165.25.35
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitscanada.com/wp-content/uploads/sites/7/2023/08/2023-Consultants-live-widget.jpg
Requested by: Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.25.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-25-35.pit50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2606426c88d86613d05e231cd610a07ee1a5e46b9a8ff1d8fdea473e05a1bad0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/canadian-investment-review/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 17:37:14 GMT
x-amz-version-id: Dw3U34G_lx6PxRULbS8OuVdnlSYR7urx
via: 1.1 e7e1cceb60dd8f54a960238fa44796a8.cloudfront.net (CloudFront)
x-amz-cf-pop: PIT50-P2
age: 114902
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 35018
last-modified: Mon, 14 Aug 2023 15:00:22 GMT
server: AmazonS3
etag: "40d15c4e7210300359f15224aa239bbd"
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: Nx6eNf9pKlOo7pw8BWTTpWEDWkBhVbQlLrElRM8UgRZWelggAblfVw==
expires: Tue, 13 Aug 2024 15:00:21 GMT

GET
H2 200 VIEWTHEWINNERS-pla-2023.jpg
www.benefitscanada.com/wp-content/uploads/sites/7/2022/04/ 20 KB
21 KB 56ms
53ms Image
image/jpeg 18.165.25.35
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitscanada.com/wp-content/uploads/sites/7/2022/04/VIEWTHEWINNERS-pla-2023.jpg
Requested by: Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.25.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-25-35.pit50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a64c5c06053fe49fa02a2c2d7bdb13420e2bb8a45416784eb7ad8c705d228f6f

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/canadian-investment-review/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 26 Aug 2023 17:05:52 GMT
x-amz-version-id: wOSPlQSLKKa_p_0_4.LR0LWJIvnHmNBj
via: 1.1 e7e1cceb60dd8f54a960238fa44796a8.cloudfront.net (CloudFront)
x-amz-cf-pop: PIT50-P2
age: 548784
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 20589
last-modified: Tue, 16 May 2023 19:15:46 GMT
server: AmazonS3
etag: "1cd89a085c5536e598df186b4369608d"
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: H4jc6surtIy9P-6z4Qkqg3Po_clRMbnYdgG28RK9CCotS8t43fk3cw==
expires: Wed, 15 May 2024 19:15:45 GMT

GET
H2 200 CIIN-Overview-2022-widget.jpg
www.benefitscanada.com/wp-content/uploads/sites/7/2023/04/ 49 KB
49 KB 76ms
72ms Image
image/jpeg 18.165.25.35
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitscanada.com/wp-content/uploads/sites/7/2023/04/CIIN-Overview-2022-widget.jpg
Requested by: Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.25.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-25-35.pit50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 036117b5a4d0997e21eb2190ce8c5b0315e8cc77aad572eac78a3faa276e95b3

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/canadian-investment-review/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Tue, 29 Aug 2023 13:54:47 GMT
x-amz-version-id: SAww.MN1UmRhbL3PJZkzpsgbPTwE2OYf
via: 1.1 e7e1cceb60dd8f54a960238fa44796a8.cloudfront.net (CloudFront)
x-amz-cf-pop: PIT50-P2
age: 301049
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 49893
last-modified: Tue, 25 Apr 2023 17:10:19 GMT
server: AmazonS3
etag: "7510405831b6c64fdf29f4e50dec27ca"
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: 6ezY1Fwsuveb1wbb8Bf4P-XiEwHtRylbaVg-gvRK4VRrOwSTp5JGNA==
expires: Wed, 24 Apr 2024 17:10:18 GMT

GET
H2 200 LOGO-Acquizition-blanc.png
www.benefitscanada.com/wp-content/uploads/sites/7/2023/06/ 6 KB
6 KB 44ms
40ms Image
image/png 18.165.25.35
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitscanada.com/wp-content/uploads/sites/7/2023/06/LOGO-Acquizition-blanc.png
Requested by: Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.25.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-25-35.pit50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 59dad5a09fa6be9c1a998f2a899ef182de3e1d204d5b2e5dd72c41b6317d1995

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/canadian-investment-review/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

x-amz-version-id: XP4mxuzIBu9ws9PGkgOGMm11iC8rxxFX
date: Wed, 30 Aug 2023 06:14:43 GMT
via: 1.1 e7e1cceb60dd8f54a960238fa44796a8.cloudfront.net (CloudFront)
x-amz-cf-pop: PIT50-P2
age: 242253
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 6075
last-modified: Tue, 06 Jun 2023 13:51:47 GMT
server: AmazonS3
etag: "863295195815740554439e9d700dbc2d"
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: CNSuNU77JAmKDusTmU0QRLJF5oeyNZMcZTnymnnl8XInPP2JLKJr0A==
expires: Wed, 05 Jun 2024 13:51:46 GMT

GET
H2 200 Avantages_2012w.png
www.benefitscanada.com/wp-content/uploads/sites/7/2019/06/ 7 KB
7 KB 45ms
41ms Image
image/png 18.165.25.35
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitscanada.com/wp-content/uploads/sites/7/2019/06/Avantages_2012w.png
Requested by: Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.25.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-25-35.pit50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 14466f041b4b990865284bd6eb409aed61ebf2fa42ae0dbc3b467ab95146d71c

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/canadian-investment-review/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 13:25:03 GMT
x-amz-version-id: null
via: 1.1 e7e1cceb60dd8f54a960238fa44796a8.cloudfront.net (CloudFront)
last-modified: Wed, 26 Jun 2019 13:06:43 GMT
server: AmazonS3
x-amz-cf-pop: PIT50-P2
age: 130033
etag: "451e6e18eafdc309d1237697344fde13"
x-cache: Hit from cloudfront
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 6948
x-amz-cf-id: mN8xmDgs2wcb81s-qeRytnGX3ZcTG7bd6rPoRaMqd2QgB5vCqvVvBQ==
expires: Thu, 25 Jun 2020 13:06:42 GMT

GET
H2 200 BenefitsCanada-Logo-White.png
www.benefitscanada.com/wp-content/uploads/sites/7/2019/08/ 7 KB
7 KB 51ms
47ms Image
image/png 18.165.25.35
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitscanada.com/wp-content/uploads/sites/7/2019/08/BenefitsCanada-Logo-White.png
Requested by: Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.25.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-25-35.pit50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8f42cfa3c8ef87f84cbf220cab248f0c451f3ac31411e0240f1f3cf4bd2e85c7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/canadian-investment-review/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

x-amz-version-id: null
date: Tue, 29 Aug 2023 03:42:46 GMT
via: 1.1 e7e1cceb60dd8f54a960238fa44796a8.cloudfront.net (CloudFront)
x-amz-cf-pop: PIT50-P2
age: 337770
x-cache: Hit from cloudfront
content-length: 7141
last-modified: Tue, 13 Aug 2019 16:51:06 GMT
server: AmazonS3
etag: "1796a1f8e64abf557181b1ba1743e398"
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: xuvULKFMH6uL7j4ttsNd_n8VLFXkNjD2guISC0AC2RcMVJjjIR45fg==
expires: Wed, 12 Aug 2020 16:51:05 GMT

GET
H2 200 CIIN-logo.png
www.benefitscanada.com/wp-content/uploads/sites/7/2019/09/ 57 KB
58 KB 46ms
43ms Image
image/png 18.165.25.35
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitscanada.com/wp-content/uploads/sites/7/2019/09/CIIN-logo.png
Requested by: Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.25.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-25-35.pit50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e9ad5f2249841dc7d21706f582f33dc92bfd3629abe38db96a02226bf45fa003

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/canadian-investment-review/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

x-amz-version-id: null
date: Sun, 27 Aug 2023 02:25:45 GMT
via: 1.1 e7e1cceb60dd8f54a960238fa44796a8.cloudfront.net (CloudFront)
x-amz-cf-pop: PIT50-P2
age: 515191
x-cache: Hit from cloudfront
content-length: 58456
last-modified: Wed, 04 Sep 2019 17:51:08 GMT
server: AmazonS3
etag: "58c1ef865c9fff36ffdcc4c8e5956df8"
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: YqJC3R9woUMlJHeEKlJW5R5Xk75fC9UQwvv5_AHmaAxz-I6cLM7mIw==
expires: Thu, 03 Sep 2020 17:51:07 GMT

GET
H2 200 CIR_Logo_Horizontal_CMYK_white.png
www.benefitscanada.com/wp-content/uploads/sites/7/2019/09/ 20 KB
21 KB 61ms
58ms Image
image/png 18.165.25.35
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitscanada.com/wp-content/uploads/sites/7/2019/09/CIR_Logo_Horizontal_CMYK_white.png
Requested by: Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.25.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-25-35.pit50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e81f118d334e426146c5b6e3c672d89309e45d448e35f9e0c8f28c0c82f8cc1f

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/canadian-investment-review/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 12:04:34 GMT
x-amz-version-id: null
via: 1.1 e7e1cceb60dd8f54a960238fa44796a8.cloudfront.net (CloudFront)
last-modified: Mon, 09 Sep 2019 17:28:16 GMT
server: AmazonS3
x-amz-cf-pop: PIT50-P2
age: 480462
etag: "d183acd54411b3523b3d238f1c087779"
x-cache: Hit from cloudfront
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 20654
x-amz-cf-id: 7gNZbg2x407Lys550BFvc2npkr55XrLFZQcWWuNShEfM0NkqdjDTDw==
expires: Tue, 08 Sep 2020 17:28:15 GMT

GET
H2 200 sow-image-default-d9fa1d607b92.css
www.benefitscanada.com/wp-content/uploads/sites/7/siteorigin-widgets/ 247 B
631 B 49ms
48ms Stylesheet
text/css 18.165.25.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.benefitscanada.com/wp-content/uploads/sites/7/siteorigin-widgets/sow-image-default-d9fa1d607b92.css
Requested by: Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.25.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-25-35.pit50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 86d9b404e9716923cdab26b34d0520ce8235c1ae544f09e4c5472c79ea38bf99

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/canadian-investment-review/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

x-amz-version-id: nJJ2hZmy8ttouMZDsYLVYxjfkBlLtZNn
date: Sat, 02 Sep 2023 01:32:15 GMT
via: 1.1 e7e1cceb60dd8f54a960238fa44796a8.cloudfront.net (CloudFront)
last-modified: Mon, 16 Aug 2021 17:14:53 GMT
server: AmazonS3
x-amz-cf-pop: PIT50-P2
age: 37771
etag: "6a69df4a00ad29d487a040e438796df0"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
accept-ranges: bytes
content-length: 247
x-amz-cf-id: XN44Ids0TA0c9upVO-Vaa4XSWEiESSKO7fywMnrc884QjNNt5l7pGA==

GET
H2 200 front-flex.min-2.15.0.css
www.benefitscanada.com/wp-content/cache/busting/7/wp-content/plugins/siteorigin-panels/css/ 1 KB
926 B 53ms
53ms Stylesheet
text/css 18.165.25.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.benefitscanada.com/wp-content/cache/busting/7/wp-content/plugins/siteorigin-panels/css/front-flex.min-2.15.0.css
Requested by: Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.25.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-25-35.pit50.r.cloudfront.net
Software: Apache/2.4.56 (Amazon) PHP/7.1.33 /
Resource Hash: 9043986fde648c179ce63d202242b956fe5bae1cbba32612c721e28aeeae65ab

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/canadian-investment-review/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Fri, 01 Sep 2023 15:02:44 GMT
content-encoding: gzip
via: 1.1 e7e1cceb60dd8f54a960238fa44796a8.cloudfront.net (CloudFront)
x-amz-cf-pop: PIT50-P2
age: 37771
x-cache: Hit from cloudfront
content-length: 485
last-modified: Tue, 29 Aug 2023 12:43:40 GMT
server: Apache/2.4.56 (Amazon) PHP/7.1.33
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public
accept-ranges: bytes
x-amz-cf-id: BILJ5dy60rBAaI3atCmIjetdkVsnUB2Rm_RhasCIvVf2plT3BC0ueQ==
expires: Sat, 31 Aug 2024 15:02:44 GMT

GET
H2 200 vendors.min.js Show response
www.benefitscanada.com/wp-content/themes/avatar-tcm/assets/javascripts/ 76 KB
21 KB 58ms
55ms Script
text/javascript 18.165.25.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.benefitscanada.com/wp-content/themes/avatar-tcm/assets/javascripts/vendors.min.js
Requested by: Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.25.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-25-35.pit50.r.cloudfront.net
Software: Apache/2.4.56 (Amazon) PHP/7.1.33 /
Resource Hash: fad6921438493bdaccf27caa773ed5a79e7a1498b4c8d1a23ccb620e6d8c4dbf

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/canadian-investment-review/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Fri, 01 Sep 2023 13:49:43 GMT
content-encoding: gzip
via: 1.1 e7e1cceb60dd8f54a960238fa44796a8.cloudfront.net (CloudFront)
x-amz-cf-pop: PIT50-P2
age: 42152
x-cache: Hit from cloudfront
content-length: 21266
last-modified: Fri, 01 Sep 2023 13:27:54 GMT
server: Apache/2.4.56 (Amazon) PHP/7.1.33
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=2592000, public
accept-ranges: bytes
x-amz-cf-id: fJ6yh5fBrwnCF-xpRwEdyDVz9QplcnotIa7ZuwjlXfu5Ui0fg_Kn8A==
expires: Sun, 01 Oct 2023 13:49:43 GMT

GET
H2 200 main.min.js Show response
www.benefitscanada.com/wp-content/themes/avatar-tcm/assets/javascripts/ 12 KB
4 KB 64ms
61ms Script
text/javascript 18.165.25.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.benefitscanada.com/wp-content/themes/avatar-tcm/assets/javascripts/main.min.js
Requested by: Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.25.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-25-35.pit50.r.cloudfront.net
Software: Apache/2.4.56 (Amazon) PHP/7.1.33 /
Resource Hash: ee30dfefc3b21776329dcdcc03bd10c08b79afadcae7dfbd2df9bad0319767fb

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/canadian-investment-review/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Fri, 01 Sep 2023 13:49:43 GMT
content-encoding: gzip
via: 1.1 e7e1cceb60dd8f54a960238fa44796a8.cloudfront.net (CloudFront)
x-amz-cf-pop: PIT50-P2
age: 42152
x-cache: Hit from cloudfront
content-length: 3766
last-modified: Fri, 01 Sep 2023 13:27:54 GMT
server: Apache/2.4.56 (Amazon) PHP/7.1.33
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=2592000, public
accept-ranges: bytes
x-amz-cf-id: Mgqm8_SDiR-N_AiLC74pyuZvbF9HlvHkq4YRJp3UKu_6z9EA9NCyvA==
expires: Sun, 01 Oct 2023 13:49:43 GMT

GET
H2 200 css
fonts.googleapis.com/ 7 KB
1 KB 75ms
35ms Stylesheet
text/css 172.217.13.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600,700

Requested by

Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/wp-content/cache/busting/7/wp-content/themes/avatar-tcm/style-2.4.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f10.1e100.net

Software

ESF /

Resource Hash

0f168400f35726c05050a7361b4bdffa89148cf119cc412ebfc3193d71159805

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 02 Sep 2023 01:32:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 02 Sep 2023 01:21:11 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 02 Sep 2023 01:32:15 GMT

GET
H2 200 css
fonts.googleapis.com/ 9 KB
942 B 77ms
37ms Stylesheet
text/css 172.217.13.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Tinos:400,400i,700,700i

Requested by

Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/wp-content/cache/busting/7/wp-content/themes/avatar-tcm/style-2.4.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f10.1e100.net

Software

ESF /

Resource Hash

85877a6ebe16556aeb60af362fb11d239878b92bfc38f7a5b60c4ff5691d68aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 02 Sep 2023 01:32:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 02 Sep 2023 01:32:15 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 02 Sep 2023 01:32:15 GMT

GET
H2 200 css
fonts.googleapis.com/ 4 KB
728 B 77ms
36ms Stylesheet
text/css 172.217.13.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,700

Requested by

Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/wp-content/cache/busting/7/wp-content/themes/avatar-tcm/style-2.4.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f10.1e100.net

Software

ESF /

Resource Hash

3d2b34675fd418a1b23c652fa791f4875ccc12860d9b4b6ec8ae4aa09d51ec1e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 02 Sep 2023 01:32:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 02 Sep 2023 01:23:31 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 02 Sep 2023 01:32:15 GMT

GET
H2 200 css
fonts.googleapis.com/ 2 KB
550 B 97ms
57ms Stylesheet
text/css 172.217.13.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Libre+Baskerville:400,400i,700

Requested by

Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/wp-content/cache/busting/7/wp-content/themes/avatar-tcm/style-2.4.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f10.1e100.net

Software

ESF /

Resource Hash

938023085ff1da3a855c55a15d949bc8a65b3e611b7148d3986c3cd475197b72

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 02 Sep 2023 01:32:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 02 Sep 2023 01:16:28 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 02 Sep 2023 01:32:15 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 142 KB
52 KB 123ms
75ms Script
application/javascript 172.217.13.168
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-KX3CRJW

Requested by

Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.168 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

808ad1fe438060832ef05c9d5da8b2f55364f8726eaaa9b7c81cf253a86df069

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:15 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 53489
x-xss-protection: 0
last-modified: Sat, 02 Sep 2023 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 02 Sep 2023 01:32:15 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 150 KB
55 KB 102ms
55ms Script
application/javascript 172.217.13.168
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-NDQKHZN

Requested by

Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.168 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

393cce26304628e179a76da1ce676640aa7a51ce134d2309952ce5821d157414

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:15 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56183
x-xss-protection: 0
last-modified: Sat, 02 Sep 2023 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 02 Sep 2023 01:32:15 GMT

GET
DATA 200
OK truncated
/ 35 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a3479b45d477eb8429f4be8a396050d90f894559a72068ec3593ec43f586d138

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 1 KB
1 KB 95ms
18ms Script
application/javascript 23.215.130.171
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.215.130.171 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-215-130-171.deploy.static.akamaitechnologies.com

Software

Resource Hash

292f853f9ef0e448c5536987fe87197f401bafcde3e0857e17de1f0676f5b2eb

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:15 GMT
x-content-type-options: nosniff
last-modified: Wed, 30 Aug 2023 18:41:20 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
content-type: application/javascript;charset=utf-8
cache-control: max-age=44543
accept-ranges: bytes
content-length: 1046

GET
H2 200 fontawesome-webfont.woff2
www.benefitscanada.com/wp-content/themes/avatar-tcm/assets/fonts/ 75 KB
76 KB 59ms
56ms Font
application/octet-stream 18.165.25.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.benefitscanada.com/wp-content/themes/avatar-tcm/assets/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by: Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/wp-content/cache/busting/7/wp-content/themes/avatar-tcm/assets/css/vendors.min-1.0.2.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.25.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-25-35.pit50.r.cloudfront.net
Software: Apache/2.4.56 (Amazon) PHP/7.1.33 /
Resource Hash: 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Referer: https://www.benefitscanada.com/wp-content/cache/busting/7/wp-content/themes/avatar-tcm/assets/css/vendors.min-1.0.2.css
Origin: https://www.benefitscanada.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Fri, 01 Sep 2023 13:55:09 GMT
content-encoding: gzip
via: 1.1 e7e1cceb60dd8f54a960238fa44796a8.cloudfront.net (CloudFront)
last-modified: Fri, 01 Sep 2023 13:27:54 GMT
server: Apache/2.4.56 (Amazon) PHP/7.1.33
x-amz-cf-pop: PIT50-P2
age: 41826
vary: Accept-Encoding
x-cache: Hit from cloudfront
access-control-allow-origin: *
cache-control: max-age=2592000
accept-ranges: bytes
x-amz-cf-id: 0mElTWhx3v_pcFBmbkkFMM9CSBd6G9ulR720FoiDYYCAsgd0cB8ySA==
expires: Sun, 01 Oct 2023 13:55:09 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 72ms
11ms Font
font/woff2 172.217.13.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f3.1e100.net

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.benefitscanada.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Wed, 30 Aug 2023 20:47:37 GMT
x-content-type-options: nosniff
age: 189878
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 29 Aug 2024 20:47:37 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 80ms
19ms Font
font/woff2 172.217.13.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f3.1e100.net

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.benefitscanada.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Wed, 30 Aug 2023 21:01:26 GMT
x-content-type-options: nosniff
age: 189049
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 29 Aug 2024 21:01:26 GMT

GET
H2 200 kmKnZrc3Hgbbcjq75U4uslyuy4kn0qNZaxM.woff2
fonts.gstatic.com/s/librebaskerville/v14/ 26 KB
27 KB 84ms
24ms Font
font/woff2 172.217.13.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/librebaskerville/v14/kmKnZrc3Hgbbcjq75U4uslyuy4kn0qNZaxM.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Libre+Baskerville:400,400i,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f3.1e100.net

Software

sffe /

Resource Hash

6c6c9c3fad669c3d32227f5cc3467735c8211ddcf4f8c184c2e62e7f3ef7af44

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.benefitscanada.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 26 Aug 2023 16:34:24 GMT
x-content-type-options: nosniff
age: 550671
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27120
x-xss-protection: 0
last-modified: Tue, 26 Apr 2022 16:42:07 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 25 Aug 2024 16:34:24 GMT

GET
H2 200 lazyload-10.3.5.min.js Show response
www.benefitscanada.com/wp-content/plugins/wp-rocket/inc/front/js/ 3 KB
2 KB 37ms
32ms Script
text/javascript 18.165.25.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.benefitscanada.com/wp-content/plugins/wp-rocket/inc/front/js/lazyload-10.3.5.min.js
Requested by: Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.25.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-25-35.pit50.r.cloudfront.net
Software: Apache/2.4.56 (Amazon) PHP/7.1.33 /
Resource Hash: 1f01c860bdb5390bf81294d8b174c53072f9b9fe6ec5e7e3ac675329f1faca81

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/canadian-investment-review/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Fri, 01 Sep 2023 13:49:43 GMT
content-encoding: gzip
via: 1.1 e7e1cceb60dd8f54a960238fa44796a8.cloudfront.net (CloudFront)
x-amz-cf-pop: PIT50-P2
age: 42152
x-cache: Hit from cloudfront
content-length: 1439
last-modified: Fri, 01 Sep 2023 13:27:53 GMT
server: Apache/2.4.56 (Amazon) PHP/7.1.33
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=2592000, public
accept-ranges: bytes
x-amz-cf-id: msLEw86v8PpsUTYYqYBEWsfNv-HHrALL4BIMY4Kee3oW3CbD7-u04A==
expires: Sun, 01 Oct 2023 13:49:43 GMT

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/0hCdE87LyjzAkFO5Ff-v7Hj1/ 451 KB
181 KB 51ms
12ms Script
text/javascript 172.217.13.195
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/0hCdE87LyjzAkFO5Ff-v7Hj1/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.195 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f3.1e100.net

Software

sffe /

Resource Hash

6df509c54af64a8a81d168c1bce4e0bc1d30be5a3206c25e702fea2f33ab7f3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.benefitscanada.com/
Origin: https://www.benefitscanada.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Mon, 28 Aug 2023 20:21:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 364268
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 185062
x-xss-protection: 0
last-modified: Mon, 21 Aug 2023 02:02:34 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 27 Aug 2024 20:21:07 GMT

GET
H2 200 insight.old.min.js Show response
snap.licdn.com/li.lms-analytics/ 13 KB
5 KB 20ms
19ms Script
application/x-javascript 23.215.130.171
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.old.min.js

Requested by

Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.215.130.171 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-215-130-171.deploy.static.akamaitechnologies.com

Software

Resource Hash

fa53fcd8da139d256c0ca83b69cb37473ca627b6052368ed3327c80d9fb61e25

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 28 Aug 2023 12:14:15 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/x-javascript;charset=utf-8
cache-control: max-age=10589
accept-ranges: bytes
content-length: 4862

GET
H2 200 script.js Show response
sb.freeskreen.com/publisher/ 67 KB
20 KB 141ms
83ms Script
text/html 34.195.71.162
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.freeskreen.com/publisher/script.js?bai=20&ut=&uts=&flc=&slc=&windowlocation=https%3A%2F%2Fwww.benefitscanada.com%2Fcanadian-investment-review%2F&usp=&gdpr=-1&cs=-1
Requested by: Host: static.freeskreen.com
URL: https://static.freeskreen.com/ba/20/freeskreen.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.195.71.162 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-195-71-162.compute-1.amazonaws.com
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 79ad46fc05e5e5e043431d54f79b46fb8be082594254a5a91df85b1aa91f9d67

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Sep 2023 01:32:16 GMT
content-encoding: gzip
server: Apache/2.4.29 (Ubuntu)
vary: Accept-Encoding
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI INT DEM STA PRE COM NAV NOI DSP COR"
content-type: text/html;charset=UTF-8
cache-control: no-cache, no-store, must-revalidate
content-length: 20080
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 250 KB
85 KB 53ms
52ms Script
application/javascript 172.217.13.168
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-D5M7SSGHRQ&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NDQKHZN

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.168 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

512cb70a1266db2c9d3529c16f0c5483ece0ae3c57c7d86a005305a7f709d088

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:16 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 86997
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sat, 02 Sep 2023 01:32:16 GMT

GET
H2 200 token Show response
cdn.linkedin.oribi.io/partner/5252220/domain/benefitscanada.com/ 36 B
375 B 131ms
37ms XHR
application/json 18.165.25.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.linkedin.oribi.io/partner/5252220/domain/benefitscanada.com/token
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.old.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.25.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-25-91.pit50.r.cloudfront.net
Software: /
Resource Hash: 7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept: *
Referer: https://www.benefitscanada.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:23:01 GMT
content-encoding: gzip
via: 1.1 e390b58f4068fa19907d58bb09d89366.cloudfront.net (CloudFront)
x-amz-cf-pop: PIT50-P2
age: 555
vary: accept-encoding
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=3600
x-amz-cf-id: _9gah_8P97y7imDMb42bz0mkoAJhdhQHc-bLiKBaeOAlQg-ZndU-VQ==

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=5252220&time=1693618336016&url=https%3A%2F%2Fwww.benefitscanada.com%2Fcanadian-investment-review%2F
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=5252220&time=1693618336016&url=https%3A%2F%2Fwww.benefitscanada.com%2Fcanadian-investment-review%2F&cookiesTest=true
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D5252220%26time%3D1693618336016%26url%3Dhttps%253A%252F%252Fwww.benefitscanada.com...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=5252220&time=1693618336016&url=https%3A%2F%2Fwww.benefitscanada.com%2Fcanadian-investment-review%2F&cookiesTest=true&liSync=true

0
397 B

42ms
41ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=5252220&time=1693618336016&url=https%3A%2F%2Fwww.benefitscanada.com%2Fcanadian-investment-review%2F&cookiesTest=true&liSync=true
Requested by: Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:15 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: C06C75A72534465C999F0C457EA4C04A Ref B: YMQ01EDGE0306 Ref C: 2023-09-02T01:32:16Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-lva1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYEVj9RsdOCnBrfYYu0hQ==

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: default-src 'none'; connect-src 'self' *.licdn.com *.linkedin.com cdn.linkedin.oribi.io dpm.demdex.net/id lnkd.demdex.net blob: accounts.google.com/gsi/ linkedin.sc.omtrdc.net/b/ss/ *.microsoft.com *.adnxs.com; script-src 'report-sample' 'sha256-SSoodjUD3LGm2FfFCVHGqEb8D4UM3OOigidT2UKDcYg=' 'sha256-cKTgdnmO6+hXd85a9wKg1effVfVzenUAtUCyOKY9bQE=' 'sha256-DwtT8+ZZKpxH9pqZNAmJ3GdbLAh5SsYaXR3omTXPCns=' 'sha256-sV9jZa797T0QWBzcU/CNd4tpBhTnh+TFdLnfjlitl28=' 'sha256-aa/Q8CRBDSqTQbCIyioPhZaz+G+dbPyu7BzsjInEmiU=' 'sha256-THuVhwbXPeTR0HszASqMOnIyxqEgvGyBwSPBKBF/iMc=' 'sha256-zTIusdVJJeXz9+iox2a+pdDglzbpRpFVRzEwvW4AONk=' 'sha256-iC8MPqNLw0FDnsBf4DlSkFLNTwhkI85aouiAEB819ic=' 'sha256-2EqrEvcPzl8c6/TSGVvaVMEe7lg700MAz/te4/3kTYY=' 'sha256-y5uW69VItKj51mcc7UD9qfptDVUqicZL+bItEpvVNDw=' 'sha256-DatsFGoJ8gFkzzxo47Ou76WZ+3QBPOQHtBu9p9b3DhA=' 'sha256-k95cyM8gFgPziZe5VQ2IvJvBUVyd5zFt2CokIUwqdHE=' 'sha256-PyCXNcEkzRWqbiNr087fizmiBBrq9O6GGD8eV3P09Ik=' 'sha256-2SQ55Erm3CPCb+k03EpNxU9bdV3XL9TnVTriDs7INZ4=' 'sha256-S/KSPe186K/1B0JEjbIXcCdpB97krdzX05S+dHnQjUs=' 'sha256-3RIGhhApBii1KY+aW1xk7kFyoQY8vSVE5DfT7E9SJUc=' 'sha256-9pXOIwF4N0gPltLd3AI69lkCjSC2H/Eb3sc5zdmUyYU=' 'sha256-jou6v/Nleyzoc+LXktAv1Fp8M807dVVxy7E/yzVljHc=' 'sha256-6E4e/3dSvj/8JZT2S2yR91mspqM6MyOpKl5lrhHsZa8=' 'sha256-3woF8BZ54TeXM+czaH3aXoaJsVpiamuAKFsXDykAR/Q=' 'sha256-vIfNcKb8ixJg1cfJIoNNYjWcm0lezj1/XpUNFiZyVsU=' 'sha256-cLsHUHFgT/VGX04cZrJ9xgm4HbzTR7ptutkxK+7BlMk=' 'sha256-BwU8jMnQYUhjOpsDVABpfddV/DlP1ZYrFcTumYw7x54=' 'sha256-wz6ika9i3WU3bpUPdhYDZeO/NrDQniDyiscN0LWnyaY=' 'sha256-wy4DvlEW9PHPIGvQJW6Wv4woBSa/0LJHs8LHsBVVXCs=' 'sha256-065A0cJTDQ+hyKvufSL/flW02hIbgLndOINLRWux6To=' 'sha256-Ga5SLB8hPdWUE8Wb6LgZ05D9Z5vrdLAaPbDBW2m3BI8=' static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com snap.licdn.com; img-src data: blob: * android-webview-video-poster:; font-src data: *; style-src 'self' 'unsafe-inline' static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; media-src 'self' *.licdn.com *.lynda.com; worker-src 'self' blob: static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; frame-src 'self' www.youtube.com/embed/ www.youtube-nocookie.com/embed/ lnkd.demdex.net smartlock.google.com accounts.google.com player.vimeo.com *.linkedin.com www.slideshare.net *.megaphone.fm *.omny.fm *.sounder.fm msit.powerbi.com app.powerbi.com linkedin.github.io *.licdn.com *.adnxs.com acdn.adnxs-simple.com radar.cedexis.com; frame-ancestors 'self' *.www.linkedin.com:*; manifest-src 'self'; report-uri https://www.linkedin.com/security/csp?f=default
x-content-type-options: nosniff
date: Sat, 02 Sep 2023 01:32:15 GMT
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-length: 0
x-li-uuid: AAYEVj9QvbE+s/i23vEWWQ==
pragma: no-cache
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 768F967FE7E74F8DBBC660044BBC538E Ref B: YMQ01EDGE0306 Ref C: 2023-09-02T01:32:16Z
x-frame-options: sameorigin
x-li-fabric: prod-lva1
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=5252220&time=1693618336016&url=https%3A%2F%2Fwww.benefitscanada.com%2Fcanadian-investment-review%2F&cookiesTest=true&liSync=true
cache-control: no-cache, no-store
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 13024095_Top5_123RF.png
www.benefitscanada.com/wp-content/uploads/sites/7/2022/04/ 331 KB
332 KB 89ms
87ms Image
image/png 18.165.25.35
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitscanada.com/wp-content/uploads/sites/7/2022/04/13024095_Top5_123RF.png
Requested by: Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.25.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-25-35.pit50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2153b673e7ea622eb4c87aff8d6661334381ef08aa9df97143b76226b2290037

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/canadian-investment-review/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Tue, 29 Aug 2023 17:29:52 GMT
x-amz-version-id: wh9jXzQ6hJkJpLLryA7CjbaYCUXwuvAN
via: 1.1 e7e1cceb60dd8f54a960238fa44796a8.cloudfront.net (CloudFront)
last-modified: Thu, 07 Apr 2022 12:47:55 GMT
server: AmazonS3
x-amz-cf-pop: PIT50-P2
age: 288145
etag: "20ca18bc7f00902a254f38e5e587625e"
x-cache: Hit from cloudfront
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 339122
x-amz-cf-id: -xSx8OpQFLPgF1idVYOI1_zDiba8kjFUgazTYVnAfDmQEt-Ke6uLBA==
expires: Fri, 07 Apr 2023 12:47:54 GMT

GET
H2 200 red-arrows-up-blue-background.jpg
www.benefitscanada.com/wp-content/uploads/sites/7/2023/08/ 138 KB
139 KB 35ms
33ms Image
image/jpeg 18.165.25.35
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitscanada.com/wp-content/uploads/sites/7/2023/08/red-arrows-up-blue-background.jpg
Requested by: Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.25.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-25-35.pit50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7e72680d9db2af3015d08d822ff9e95327526dababd86b42b24863d5332a44a5

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/canadian-investment-review/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 15:29:55 GMT
x-amz-version-id: gZwfHPqFMboro.C4cuR35v1pfjPFXOQQ
via: 1.1 e7e1cceb60dd8f54a960238fa44796a8.cloudfront.net (CloudFront)
x-amz-cf-pop: PIT50-P2
age: 122542
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 141579
last-modified: Thu, 31 Aug 2023 15:27:06 GMT
server: AmazonS3
etag: "95697e64149ce793a1c7dda5c0b57691"
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: D02Y4dCWXgMpJbQps49aC5eR0jkCoIU-URpwW91pahbl7Kbpd2xSHA==
expires: Fri, 30 Aug 2024 15:27:05 GMT

GET
H2 200 self-storage-units-red.jpg
www.benefitscanada.com/wp-content/uploads/sites/7/2023/08/ 133 KB
134 KB 35ms
34ms Image
image/jpeg 18.165.25.35
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitscanada.com/wp-content/uploads/sites/7/2023/08/self-storage-units-red.jpg
Requested by: Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.25.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-25-35.pit50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9e968ca5d02783cfd0b84f562b748995a666285db2a555fc312783a78e9cd2df

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/canadian-investment-review/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Wed, 30 Aug 2023 18:19:47 GMT
x-amz-version-id: wF5zrNbzYMx.PPrIy7eAJDHM7ga2WFRF
via: 1.1 e7e1cceb60dd8f54a960238fa44796a8.cloudfront.net (CloudFront)
x-amz-cf-pop: PIT50-P2
age: 198750
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 136365
last-modified: Wed, 30 Aug 2023 18:19:47 GMT
server: AmazonS3
etag: "21db6468db8392396a87e00cae4e895e"
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: pJEVsoSlzQo8fGfKHRJcaWdDZ5Qs-Y1LQPFlPdbZHSUWX6d3D8k-Mw==
expires: Thu, 29 Aug 2024 18:19:46 GMT

GET
H2 200 193420140_WrenchFineTunePlanDesign.jpg
www.benefitscanada.com/wp-content/uploads/sites/7/2023/08/ 390 KB
391 KB 54ms
53ms Image
image/jpeg 18.165.25.35
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitscanada.com/wp-content/uploads/sites/7/2023/08/193420140_WrenchFineTunePlanDesign.jpg
Requested by: Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.25.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-25-35.pit50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 69615d87a7a4ba717a1a7acecdd648d1a082bc1c1fb37b11fcc9c17acef3493b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/canadian-investment-review/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Wed, 30 Aug 2023 16:21:17 GMT
x-amz-version-id: KX09HXpYy4Dk0srbazyMFt_uIjqT7eeK
via: 1.1 e7e1cceb60dd8f54a960238fa44796a8.cloudfront.net (CloudFront)
x-amz-cf-pop: PIT50-P2
age: 205860
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 399580
last-modified: Wed, 30 Aug 2023 15:09:31 GMT
server: AmazonS3
etag: "407043b844e0cd29f1f77fd4b27b1c9b"
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: crwySrSiacUGKzRFtcSIS-UzGV4EXW397rCzlA6sfff1o6kGV_3g0Q==
expires: Thu, 29 Aug 2024 15:09:30 GMT

GET
H2 200 WelcomeBack_Handshake_42883873_l-123RF.jpg
www.benefitscanada.com/wp-content/uploads/sites/7/2020/11/ 151 KB
152 KB 91ms
90ms Image
image/jpeg 18.165.25.35
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitscanada.com/wp-content/uploads/sites/7/2020/11/WelcomeBack_Handshake_42883873_l-123RF.jpg
Requested by: Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.25.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-25-35.pit50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1a61ef895c2bb94c6ce740162d367427f2e377a6a72ccd14c2ad8a877bb70204

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/canadian-investment-review/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Mon, 28 Aug 2023 18:17:06 GMT
x-amz-version-id: X4oLwASrVTCnnW5Xm1BEWGsHiP3I0zKJ
via: 1.1 e7e1cceb60dd8f54a960238fa44796a8.cloudfront.net (CloudFront)
last-modified: Tue, 17 Nov 2020 15:10:13 GMT
server: AmazonS3
x-amz-cf-pop: PIT50-P2
age: 371711
etag: "bd9e69639f93e23645a35f98e2558dc8"
x-cache: Hit from cloudfront
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 154564
x-amz-cf-id: 3c7oMHsi8RU2Gchvkd_4EdJUTstjCsu5xSLl4OiNU0xs6g2tHaW-wA==
expires: Wed, 17 Nov 2021 15:10:12 GMT

GET
H2 200 11313202_xl-1.jpg
www.benefitscanada.com/wp-content/uploads/sites/7/2021/04/ 276 KB
277 KB 73ms
72ms Image
image/jpeg 18.165.25.35
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitscanada.com/wp-content/uploads/sites/7/2021/04/11313202_xl-1.jpg
Requested by: Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.25.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-25-35.pit50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4a389530dd25362035b6d565c2928a7972d2fca6395e2b2547f414e805102664

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/canadian-investment-review/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Tue, 29 Aug 2023 13:25:17 GMT
x-amz-version-id: 3jPJgoPg6fNUAthXRh7z87il8wjoMMJw
via: 1.1 e7e1cceb60dd8f54a960238fa44796a8.cloudfront.net (CloudFront)
last-modified: Tue, 27 Apr 2021 20:09:57 GMT
server: AmazonS3
x-amz-cf-pop: PIT50-P2
age: 302820
etag: "d15dc75edad68f39494e6073026d646c"
x-cache: Hit from cloudfront
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 282694
x-amz-cf-id: 5GqIWxjPRN2EYHoCXUo0kbiMtymfrhLA_2LoBjd-Rcf1I0pfVnKScQ==
expires: Wed, 27 Apr 2022 20:09:56 GMT

GET
H2 200 96445678_123RF_Top5Stars.jpg
www.benefitscanada.com/wp-content/uploads/sites/7/2022/04/ 741 KB
742 KB 92ms
91ms Image
image/jpeg 18.165.25.35
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitscanada.com/wp-content/uploads/sites/7/2022/04/96445678_123RF_Top5Stars.jpg
Requested by: Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.25.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-25-35.pit50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a5a6595f548d8a44d01f303121d52f133892a51417203bdf771e5f42dbb336b4

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/canadian-investment-review/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

x-amz-version-id: X.ZCDCA8dLjRsEPmiCqEjx9LB.oQ.tw7
date: Sat, 02 Sep 2023 01:32:16 GMT
via: 1.1 e7e1cceb60dd8f54a960238fa44796a8.cloudfront.net (CloudFront)
x-amz-cf-pop: PIT50-P2
age: 158340
x-cache: Hit from cloudfront
content-length: 758826
last-modified: Thu, 21 Apr 2022 18:11:10 GMT
server: AmazonS3
etag: "906852d90ff77649fa649b066e508b49"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: fgoy56BBFHVB4bubq8X8qhlwZ9yo15NaWna7tUZh7thDS_PT2IYuwQ==
expires: Fri, 21 Apr 2023 18:11:09 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 61ms
14ms Script
text/javascript 172.217.13.142
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KX3CRJW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.142 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 01 Sep 2023 23:33:53 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 7103
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Sat, 02 Sep 2023 01:33:53 GMT

GET
H2 200 madops.js Show response
rdc.m32.media/ 59 KB
17 KB 56ms
12ms Script
application/javascript 151.101.194.132
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://rdc.m32.media/madops.js

Requested by

Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.194.132 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

cbee8a781a5813460ac9573aee4cb78b2660b48ed5fdb3a20aa0cd4c7bf00b1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:16 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31557600
age: 22533
x-guploader-uploadid: ADPycdv_uL06M4yjTkAx75dAgCnq0A4Yrn37GxR3GxqbHNrCkS6AD04eShQ4j4ON7QK7-6DOXmO26CGF83QBnH255XY3hCqwontD
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 16901
x-served-by: cache-yul12823-YUL
last-modified: Tue, 25 Jul 2023 19:16:15 GMT
server: UploadServer
x-timer: S1693618336.089337,VS0,VE0
etag: "2275fca9d0ba359e43c258ed385823ce"
vary: Accept-Encoding
x-goog-generation: 1690312575253774
content-type: application/javascript
access-control-allow-origin: *
x-goog-hash: crc32c=JIqMwQ==, md5=InX8qdC6NZ5DwljtOFgjzg==
access-control-expose-headers: Content-Type
cache-control: public,max-age=3600
x-goog-stored-content-length: 60845
x-amz-checksum-crc32c: JIqMwQ==
accept-ranges: bytes
x-cache-hits: 8746

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 180 KB
65 KB 54ms
52ms Script
application/javascript 172.217.13.168
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-93098928-3

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KX3CRJW

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.168 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

00fbf4ee38865721663d55f336cdf7abf9d685b6e03a65ce4cdaf9e86557e88e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:16 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66628
x-xss-protection: 0
last-modified: Sat, 02 Sep 2023 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 02 Sep 2023 01:32:16 GMT

GET
H2 200 custom.json Show response
rdc.m32.media/adops/custom_files/benefitscanada.com/ 1 KB
1 KB 41ms
11ms XHR
application/json 151.101.194.132
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://rdc.m32.media/adops/custom_files/benefitscanada.com/custom.json

Requested by

Host: rdc.m32.media
URL: https://rdc.m32.media/madops.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.194.132 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

1dd8974746f1ea5544f8c0c64dcdd65a915b267edb4cca1dbe449956d8b13a5d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:16 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31557600
age: 14384
x-guploader-uploadid: ADPycdveJDE_2MbjFMwBFmLqMRgRnhXtiuCNvCbV2GOMfcTX4QW06m8ZsLt8LLdTbL6IypXCJ2lG5ol5zkRNMUPWZM9J7NQXlinD
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 559
x-served-by: cache-yul12834-YUL
last-modified: Fri, 01 Sep 2023 09:06:37 GMT
server: UploadServer
x-timer: S1693618336.146368,VS0,VE0
etag: "eac010649f87797f19e43b347d558b05"
vary: Accept-Encoding
x-goog-generation: 1693559197832647
content-type: application/json
access-control-allow-origin: *
x-goog-hash: crc32c=bCVL1g==, md5=6sAQZJ+HeX8Z5Ds0fVWLBQ==
access-control-expose-headers: Content-Length, Content-Type, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: public,max-age=3600
x-goog-stored-content-length: 1231
x-amz-checksum-crc32c: bCVL1g==
accept-ranges: bytes
x-cache-hits: 2

POST
H2 200 collect Show response
www.google-analytics.com/j/ 16 B
227 B 33ms
32ms XHR
text/plain 172.217.13.142
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=342929710&t=pageview&_s=1&dl=https%3A%2F%2Fwww.benefitscanada.com%2Fcanadian-investment-review%2F&ul=en-us&de=UTF-8&dt=Investments%20%7C%20Benefits%20Canada.com&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAACAAI~&jid=305453449&gjid=824609902&cid=1305301600.1693618336&tid=UA-2314729-4&_gid=1317403488.1693618336&_r=1&_slc=1&gtm=45He38u0n81KX3CRJW&z=592484099

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.142 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

8e928581e136ab067804a4d9a85b404f236fd8b79b1fa965ebd41d5f4bbf0758

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.benefitscanada.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 02 Sep 2023 01:32:16 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.benefitscanada.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 collect
www.google-analytics.com/g/ 0
17 B 32ms
32ms Ping
text/plain 172.217.13.142
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-D5M7SSGHRQ&gtm=45je38u0&_p=342929710&cid=1305301600.1693618336&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1693618336&sct=1&seg=0&dl=https%3A%2F%2Fwww.benefitscanada.com%2Fcanadian-investment-review%2F&dt=Investments%20%7C%20Benefits%20Canada.com&en=page_view&_fv=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-D5M7SSGHRQ&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.217.13.142 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: yul02s05-in-f14.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Sep 2023 01:32:16 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.benefitscanada.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 98 KB
29 KB 110ms
63ms Script
text/javascript 172.217.13.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: rdc.m32.media
URL: https://rdc.m32.media/madops.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f2.1e100.net

Software

cafe /

Resource Hash

3c2c302666746df6544f8e44abe43e774c6e4f20925dcaa688cbd6a3328c76fe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:16 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28999
x-xss-protection: 0
server: cafe
etag: 923 / 19602 / m202308290101 / config-hash: 15830000896466728742
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sat, 02 Sep 2023 01:32:16 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
354 B 89ms
32ms XHR
text/plain 172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-2314729-4&cid=1305301600.1693618336&jid=305453449&gjid=824609902&_gid=1317403488.1693618336&_u=YEBAAEAAAAAAACAAI~&z=1842663325

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f155.1e100.net

Software

Golfe2 /

Resource Hash

8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.benefitscanada.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Sat, 02 Sep 2023 01:32:16 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.benefitscanada.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 234 KB
82 KB 63ms
53ms Script
application/javascript 172.217.13.168
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-2F1HV6LLNX&cx=c&_slc=1

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.168 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

359984220fe9766ca92ecf285b13fb40b23dfac2e45bd8f9b762f05336329287

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:16 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 83729
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sat, 02 Sep 2023 01:32:16 GMT

GET
H2 200 computer-processor-close-up.jpg
www.benefitscanada.com/wp-content/uploads/sites/7/2023/08/ 118 KB
118 KB 51ms
51ms Image
image/jpeg 18.165.25.35
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitscanada.com/wp-content/uploads/sites/7/2023/08/computer-processor-close-up.jpg
Requested by: Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.25.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-25-35.pit50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6c0d9873fc3a1e67b5f9d0a80f6cd881c742484239c441b2b34a137acfc9b8e2

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/canadian-investment-review/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 12:14:24 GMT
x-amz-version-id: HOke3qzztxmd.kTDVINLBV4WY_Ox3TU_
via: 1.1 e7e1cceb60dd8f54a960238fa44796a8.cloudfront.net (CloudFront)
x-amz-cf-pop: PIT50-P2
age: 134273
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 120345
last-modified: Wed, 23 Aug 2023 17:12:48 GMT
server: AmazonS3
etag: "9117914635ba0658c8d0917cd0e23621"
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: QzKUwpHK89IfPUUSEasByF_7_3fDhXEoZIhcrLAaSuGoKhpG46d28Q==
expires: Thu, 22 Aug 2024 17:12:47 GMT

GET
H2 200 ESG.jpg
www.benefitscanada.com/wp-content/uploads/sites/7/2023/04/ 261 KB
262 KB 42ms
42ms Image
image/jpeg 18.165.25.35
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.benefitscanada.com/wp-content/uploads/sites/7/2023/04/ESG.jpg
Requested by: Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.25.35 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-25-35.pit50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 85f76daf4d09ec8d7f93cb5f486b95d514b4fc7e26e5a25ac368d78b94c8c238

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/canadian-investment-review/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Tue, 29 Aug 2023 08:41:39 GMT
x-amz-version-id: FmAHkfDcWkKBimleBv_QYMEj3QbPruhh
via: 1.1 e7e1cceb60dd8f54a960238fa44796a8.cloudfront.net (CloudFront)
x-amz-cf-pop: PIT50-P2
age: 319838
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 267225
last-modified: Fri, 07 Apr 2023 17:37:08 GMT
server: AmazonS3
etag: "630781acb4b31a3a82361354154cdba8"
content-type: image/jpeg
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: IaNkAGnKhWRW5fLHMmGB20jqJBDewjZbNy_TifAx3N_jEDtd0YytfA==
expires: Sat, 06 Apr 2024 17:37:07 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 229 KB
80 KB 59ms
58ms Script
application/javascript 172.217.13.168
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-7S1N9SQ4FP&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-93098928-3

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.168 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

15b030a461073a73acba35e57624800e0ceb7db9232fa4b04366b4e0a676514b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:16 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 81645
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sat, 02 Sep 2023 01:32:16 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 180 KB
65 KB 52ms
51ms Script
application/javascript 172.217.13.168
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-2314729-4&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NDQKHZN

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.168 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

aff50d42e55c5c834a491c4a534bfcb04ac9e639f48aa678e37d324fe24be8a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:16 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66664
x-xss-protection: 0
last-modified: Sat, 02 Sep 2023 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 02 Sep 2023 01:32:16 GMT

GET
H2 200 m32pixel.min.js Show response
rdc.m32.media/ 60 KB
17 KB 11ms
10ms Script
application/javascript 151.101.194.132
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://rdc.m32.media/m32pixel.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KX3CRJW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.194.132 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

eabc4eac53d1e6d57597c21ed423e61a15924e8b92c02c88cc7b3585d0f800cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:16 GMT
content-encoding: gzip
via: 1.1 varnish
strict-transport-security: max-age=31557600
age: 25516
x-guploader-uploadid: ADPycdtD1Ws1EGLFjC3CK9u1IVLdt6ywF3JJULKks2zRhotMo61HyrQEL6zlzCIfyJX4_-t9MHIMCQ8nbL_ehS1U4rTl
x-cache: HIT
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 17138
x-served-by: cache-yul12823-YUL
last-modified: Tue, 25 Jul 2023 18:26:51 GMT
server: UploadServer
x-timer: S1693618336.227798,VS0,VE0
etag: "f5657c0f6d1f8d8bd2b3acfd66866835"
vary: Accept-Encoding
x-goog-generation: 1690309611471862
content-type: application/javascript
access-control-allow-origin: *
x-goog-hash: crc32c=SUw7Rg==, md5=9WV8D20fjYvSs6z9ZoZoNQ==
access-control-expose-headers: Content-Type
cache-control: public,max-age=3600
x-goog-stored-content-length: 61796
x-amz-checksum-crc32c: SUw7Rg==
accept-ranges: bytes
x-cache-hits: 18636

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
296 B 38ms
38ms Image
image/gif 172.217.13.196
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-2314729-4&cid=1305301600.1693618336&jid=305453449&_u=YEBAAEAAAAAAACAAI~&z=1155300400

Requested by

Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.196 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Sep 2023 01:32:16 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.ca/ads/ 42 B
408 B 80ms
38ms Image
image/gif 172.217.13.131
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-2314729-4&cid=1305301600.1693618336&jid=305453449&_u=YEBAAEAAAAAAACAAI~&z=1155300400

Requested by

Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Sep 2023 01:32:16 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
analytics.google.com/g/ 0
250 B 108ms
43ms Ping
text/plain 216.239.34.181
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-2F1HV6LLNX&gtm=45je38u0&_p=342929710&_gaz=1&ul=en-us&sr=1600x1200&cid=1305301600.1693618336&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=ABAI&_s=1&dl=https%3A%2F%2Fwww.benefitscanada.com%2Fcanadian-investment-review%2F&dt=Investments%20%7C%20Benefits%20Canada.com&sid=1693618336&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-2F1HV6LLNX&cx=c&_slc=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.239.34.181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Sep 2023 01:32:16 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.benefitscanada.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
47 B 57ms
53ms Ping
text/plain 172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-2F1HV6LLNX&cid=1305301600.1693618336&gtm=45je38u0&aip=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-2F1HV6LLNX&cx=c&_slc=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.253.63.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bi-in-f155.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Sep 2023 01:32:16 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.benefitscanada.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.ca/ads/ 42 B
107 B 60ms
57ms Image
image/gif 172.217.13.131
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-2F1HV6LLNX&cid=1305301600.1693618336&gtm=45je38u0&aip=1&z=908544209

Requested by

Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Sep 2023 01:32:16 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubads_impl_fy2012.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308290101/ 403 KB
127 KB 13ms
12ms Script
text/javascript 172.217.13.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308290101/pubads_impl_fy2012.js?cb=31076166

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f2.1e100.net

Software

cafe /

Resource Hash

2394d12e4577671d6d8a98826b3712c6c321b2d3fdc67d335ee329415631cebb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Fri, 01 Sep 2023 16:37:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 32090
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 129682
x-xss-protection: 0
server: cafe
etag: 12917394590533080382
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Sat, 31 Aug 2024 16:37:26 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 48ms
47ms XHR
text/plain 172.217.13.142
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=342929710&t=pageview&_s=1&dl=https%3A%2F%2Fwww.benefitscanada.com%2Fcanadian-investment-review%2F&ul=en-us&de=UTF-8&dt=Investments%20%7C%20Benefits%20Canada.com&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aEDAAUABAAAAACAAI~&jid=1144056959&gjid=298389943&cid=1305301600.1693618336&tid=UA-2314729-4&_gid=1317403488.1693618336&_r=1&gtm=457e38u0&jsscut=1&z=1976322371

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.142 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.benefitscanada.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 02 Sep 2023 01:32:16 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.benefitscanada.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
25 B 33ms
32ms XHR
text/plain 172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-2314729-4&cid=1305301600.1693618336&jid=1144056959&gjid=298389943&_gid=1317403488.1693618336&_u=aEDAAUABAAAAACAAI~&z=776010571

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f155.1e100.net

Software

Golfe2 /

Resource Hash

8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.benefitscanada.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Sat, 02 Sep 2023 01:32:16 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.benefitscanada.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.com/ads/ 42 B
63 B 39ms
38ms Image
image/gif 172.217.13.196
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-2314729-4&cid=1305301600.1693618336&jid=1144056959&_u=aEDAAUABAAAAACAAI~&z=536365377

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.196 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Sep 2023 01:32:16 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.ca/ads/ 42 B
63 B 38ms
37ms Image
image/gif 172.217.13.131
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-2314729-4&cid=1305301600.1693618336&jid=1144056959&_u=aEDAAUABAAAAACAAI~&z=536365377

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Sep 2023 01:32:16 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 a
www.googletagmanager.com/ 0
11 B 41ms
40ms Image
text/html 172.217.13.168
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?v=3&t=l&pid=1226505768&rv=38u0&u=AAAAAAAAAAAAAACA&ut=AACA&h=Ag&cid=GTM-NDQKHZN&l=GTM-NDQKHZN.L456.S1.Y17.E471.EC5.TC10.HTC0~gtm.init.S0.V0.E17~gtm.js.S0.V0.E25.TS5gclidw.TI4.TE3.TS5gaawc.TI48.TE0.TS5evl.TI91.TE0.TS5lcl.TI92.TE0.TS5fsl.TI94.TE0.TS5lcl.TI95.TE0.TS5lcl.TI96.TE0.TS5lcl.TI97.TE0.TS5lcl.TI98.TE0~gtm.dom.S0.V0.E11~gtm.load.S0.V0.E5.TS5sdl.TI93.TE0~gtm.init_consent.S1.V1.E19

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.168 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:16 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 / Show response
fastlygeo.m32.media/ 181 B
251 B 14ms
10ms XHR
application/json 151.101.194.132
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlygeo.m32.media/
Requested by: Host: rdc.m32.media
URL: https://rdc.m32.media/m32pixel.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.194.132 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: cd41c0922788433d753ae8c6ee3fbf720cbecc5d480f5617fac477a641a2c58d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

x-served-by: cache-yul12834-YUL
date: Sat, 02 Sep 2023 01:32:16 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1693618337.939596,VS0,VE0
x-cache: HIT
content-type: application/json
access-control-allow-origin: *
accept-ranges: bytes
content-length: 181
retry-after: 0
x-cache-hits: 0

POST
H/1.1 200
OK uuid Show response
seg.m32.media/ 38 B
361 B 57ms
31ms XHR
application/json 35.203.92.254
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://seg.m32.media/uuid

Requested by

Host: rdc.m32.media
URL: https://rdc.m32.media/m32pixel.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

35.203.92.254 Montreal, Canada, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

254.92.203.35.bc.googleusercontent.com

Software

nginx/1.18.0 (Ubuntu) /

Resource Hash

ff28e37bbf7cf7caf5e14dbd6b848447b02c136fb094f9bc59cd914bccf91959

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;

Request headers

Referer: https://www.benefitscanada.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
Content-type: text/plain

Response headers

Date: Sat, 02 Sep 2023 01:32:17 GMT
Strict-Transport-Security: max-age=31536000; includeSubdomains;
Content-Encoding: gzip
Server: nginx/1.18.0 (Ubuntu)
Transfer-Encoding: chunked
Content-Type: application/json
access-control-allow-origin: *
Connection: keep-alive

GET
H2 200 esp.js Show response
cdn.id5-sync.com/api/1.0/ 119 KB
26 KB 81ms
36ms Script
text/javascript 104.22.53.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/esp.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308290101/pubads_impl_fy2012.js?cb=31076166

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.22.53.86 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1168c8abfe02845289bb55fd1091f344ddc7b63f7d4c5e95c895b72b4bca982d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:17 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 21 Aug 2023 10:48:56 GMT
server: cloudflare
x-amz-request-id: 7RJ6F0E4SRH5GQ04
age: 965
etag: W/"e6744398f78bbd5138fa1a9e34f686e4"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 8001ff8f1a7aa21d-YYZ
x-amz-id-2: bjtVPBRxq2N8278RW6vXZTrHS/QQyEiC/ZYyfPKiF9lfzbM3SUfy5m95CrP26Eh81EWEH7lmADY6OgxiYwHO1A==

GET
H/1.1 200
OK b1d3ce0b-90a6-4896-ad50-ddc4612dee9e Show response
seg.m32.media/segments/ 82 B
401 B 46ms
45ms XHR
application/json 35.203.92.254
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://seg.m32.media/segments/b1d3ce0b-90a6-4896-ad50-ddc4612dee9e

Requested by

Host: rdc.m32.media
URL: https://rdc.m32.media/m32pixel.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

35.203.92.254 Montreal, Canada, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

254.92.203.35.bc.googleusercontent.com

Software

nginx/1.18.0 (Ubuntu) /

Resource Hash

79daa4caacf1d6de3a1b1e3ee93bfe8594b7021aa1de81aea14b6270bf0d8fca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Date: Sat, 02 Sep 2023 01:32:17 GMT
Strict-Transport-Security: max-age=31536000; includeSubdomains;
Content-Encoding: gzip
Server: nginx/1.18.0 (Ubuntu)
Transfer-Encoding: chunked
Content-Type: application/json
access-control-allow-origin: *
Connection: keep-alive

POST
H/1.1 200
OK page_view Show response
seg.m32.media/ 0
259 B 66ms
61ms XHR
application/json 35.203.92.254
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://seg.m32.media/page_view

Requested by

Host: rdc.m32.media
URL: https://rdc.m32.media/m32pixel.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

35.203.92.254 Montreal, Canada, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

254.92.203.35.bc.googleusercontent.com

Software

nginx/1.18.0 (Ubuntu) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;

Request headers

Referer: https://www.benefitscanada.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
Content-type: text/plain

Response headers

access-control-allow-origin: *
Date: Sat, 02 Sep 2023 01:32:17 GMT
Strict-Transport-Security: max-age=31536000; includeSubdomains;
Server: nginx/1.18.0 (Ubuntu)
Connection: keep-alive
Content-Length: 0
Content-Type: application/json

GET
H/1.1 204 increment Show response
id5-sync.com/api/esp/ 0
331 B 305ms
99ms XHR
text/plain 162.19.138.120
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/esp/increment?counter=no-config

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/esp.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.120 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

ns31533571.ip-162-19-138.eu

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.benefitscanada.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.benefitscanada.com
date: Sat, 02 Sep 2023 01:32:16 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2

200

bounce Show response
ib.adnxs.com/
Redirect Chain

https://ib.adnxs.com/seg?add_Code=3Dd6FpoPJdA&member=2437
https://ib.adnxs.com/bounce?%2Fseg%3Fadd_Code%3D3Dd6FpoPJdA%26member%3D2437

43 B
747 B

18ms
18ms

XHR
image/gif

68.67.160.137
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/bounce?%2Fseg%3Fadd_Code%3D3Dd6FpoPJdA%26member%3D2437

Protocol

Server

68.67.160.137 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

639.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Sep 2023 01:32:17 GMT
an-x-request-uuid: c20e6450-a3f0-40db-99e1-50bacb4f6345
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
access-control-allow-origin: https://www.benefitscanada.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 185.199.101.133; 185.199.101.133; 639.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 02 Sep 2023 01:32:17 GMT
an-x-request-uuid: fd0dcb28-bc11-458a-b77b-2624ffcc9344
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: https://www.benefitscanada.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://ib.adnxs.com/bounce?%2Fseg%3Fadd_Code%3D3Dd6FpoPJdA%26member%3D2437
x-proxy-origin: 185.199.101.133; 185.199.101.133; 639.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 30 KB
13 KB 79ms
79ms Fetch
text/plain 172.217.13.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4122981767688932&correlator=643341464871183&eid=31076166%2C20222283&output=ldjh&gdfp_req=1&vrg=202308290101&ptt=17&impl=fifs&iu_parts=4916%2Ctc.en.eco.biz_canadianinvestmentreview%2Ccanadian-investment-review&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=728x90%7C970x250%7C980x200%7C970x60%7C980x60&ifi=1&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1693618337302&lmt=1693643060&adxs=230&adys=258&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fwww.benefitscanada.com%2Fcanadian-investment-review%2F&vis=1&psz=1170x1&msz=728x90&fws=132&ohw=728&ga_vid=1305301600.1693618336&ga_sid=1693618337&ga_hid=342929710&ga_fc=true&ga_cid=1317403488.1693618336&a3p=EhsKDGlkNS1zeW5jLmNvbRiz6pOcpTFIAFICCGQ.&dlt=1693618335636&idt=813&prev_scp=pos%3Datf%2Cbut1%2Ctop_leaderboard%26tile%3D0&cust_params=title%3DInvestments---Benefits-Canada-%26full_title%3DInvestments---Benefits-Canada-com%26title_40%3DInvestments---Benefits-Canada-com%26pg%3Dsectionhome%26ss%3Dcanadian-investment-review%26section%3Dinvestments%26avt-ad-code-site%3Dtc.en.eco.biz_canadianinvestmentreview%26avt-language%3Den_US%26avt-url%3Dhttps%253A%252F%252Fwww.benefitscanada.com%252Fcanadian-investment-review%26avt-device%3Ddesktop%26avt-page-type%3Dcategory%26m32_segments%3D3Dd6FpoPJdA&adks=2442671454&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308290101/pubads_impl_fy2012.js?cb=31076166

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f2.1e100.net

Software

cafe /

Resource Hash

1d019e698599b87dbbf5387671a1e125f078f461f46406fd269190e8057be09a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:17 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13015
x-xss-protection: 0
google-lineitem-id: 6364939864
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138444296452
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.benefitscanada.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 15 KB
12 KB 85ms
47ms XHR
application/json 172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202308290101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308290101/pubads_impl_fy2012.js?cb=31076166

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f2.1e100.net

Software

cafe /

Resource Hash

e922db6f7c5ac4f3a95672d6b49be6610d58531d5b25f1beb3eb001c9218087e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:17 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11817
x-xss-protection: 0

GET
H2 200 container.html Show response
4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame B454 6 KB
3 KB 83ms
34ms Document
text/html 172.217.13.161
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308290101/pubads_impl_fy2012.js?cb=31076166

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.161 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f1.1e100.net

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.benefitscanada.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 02 Sep 2023 01:32:17 GMT
expires: Sun, 01 Sep 2024 01:32:17 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 30 KB
13 KB 78ms
77ms Fetch
text/plain 172.217.13.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4122981767688932&correlator=643341464871183&eid=31076166%2C20222283&output=ldjh&gdfp_req=1&vrg=202308290101&ptt=17&impl=fifs&iu_parts=4916%2Ctc.en.eco.biz_canadianinvestmentreview%2Ccanadian-investment-review&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=300x250&ifi=2&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1693618337333&lmt=1693643060&adxs=1010&adys=602&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fwww.benefitscanada.com%2Fcanadian-investment-review%2F&vis=1&psz=359x1&msz=300x0&fws=128&ohw=0&ga_vid=1305301600.1693618336&ga_sid=1693618337&ga_hid=342929710&ga_fc=true&ga_cid=1317403488.1693618336&a3p=EhsKDGlkNS1zeW5jLmNvbRiz6pOcpTFIAFICCGQ.&dlt=1693618335636&idt=813&prev_scp=pos%3Datf%2Cbut1%2Cright_bigbox%2Ctop_right_bigbox%26tile%3D1&cust_params=title%3DInvestments---Benefits-Canada-%26full_title%3DInvestments---Benefits-Canada-com%26title_40%3DInvestments---Benefits-Canada-com%26pg%3Dsectionhome%26ss%3Dcanadian-investment-review%26section%3Dinvestments%26avt-ad-code-site%3Dtc.en.eco.biz_canadianinvestmentreview%26avt-language%3Den_US%26avt-url%3Dhttps%253A%252F%252Fwww.benefitscanada.com%252Fcanadian-investment-review%26avt-device%3Ddesktop%26avt-page-type%3Dcategory%26m32_segments%3D3Dd6FpoPJdA&adks=1041939613&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308290101/pubads_impl_fy2012.js?cb=31076166

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f2.1e100.net

Software

cafe /

Resource Hash

63ce79afb9dfc2ff292a4bd6d7ead40964bf44050937c2b9cedcfbeb6860772a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:17 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12832
x-xss-protection: 0
google-lineitem-id: 6327522193
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138444480518
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.benefitscanada.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 30 KB
13 KB 81ms
80ms Fetch
text/plain 172.217.13.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4122981767688932&correlator=643341464871183&eid=31076166%2C20222283&output=ldjh&gdfp_req=1&vrg=202308290101&ptt=17&impl=fifs&iu_parts=4916%2Ctc.en.eco.biz_canadianinvestmentreview%2Ccanadian-investment-review&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=300x1050%7C300x600%7C300x250&ifi=3&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1693618337355&lmt=1693643060&adxs=1010&adys=1363&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=1&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fwww.benefitscanada.com%2Fcanadian-investment-review%2F&vis=1&psz=359x1&msz=300x0&fws=128&ohw=0&ga_vid=1305301600.1693618336&ga_sid=1693618337&ga_hid=342929710&ga_fc=true&ga_cid=1317403488.1693618336&a3p=EhsKDGlkNS1zeW5jLmNvbRiz6pOcpTFIAFICCGQ.&dlt=1693618335636&idt=813&prev_scp=pos%3Datf%2Cbut1%2Cright_bigbox%2Ctop_right_bigbox%26tile%3D2&cust_params=title%3DInvestments---Benefits-Canada-%26full_title%3DInvestments---Benefits-Canada-com%26title_40%3DInvestments---Benefits-Canada-com%26pg%3Dsectionhome%26ss%3Dcanadian-investment-review%26section%3Dinvestments%26avt-ad-code-site%3Dtc.en.eco.biz_canadianinvestmentreview%26avt-language%3Den_US%26avt-url%3Dhttps%253A%252F%252Fwww.benefitscanada.com%252Fcanadian-investment-review%26avt-device%3Ddesktop%26avt-page-type%3Dcategory%26m32_segments%3D3Dd6FpoPJdA&adks=3762322903&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308290101/pubads_impl_fy2012.js?cb=31076166

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f2.1e100.net

Software

cafe /

Resource Hash

0dedddbdb2f1e0e33951167e3fcdbcd90003024f21ccf49cf05a179a7222b795

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:17 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12845
x-xss-protection: 0
google-lineitem-id: 6327522940
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138444480518
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.benefitscanada.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 70 KB
16 KB 77ms
77ms Fetch
text/plain 172.217.13.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4122981767688932&correlator=643341464871183&eid=31076166%2C20222283&output=ldjh&gdfp_req=1&vrg=202308290101&ptt=17&impl=fifs&iu_parts=4916%2Ctc.en.eco.biz_canadianinvestmentreview%2Ccanadian-investment-review&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=728x90%7C970x250%7C980x200&ifi=4&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1693618337369&lmt=1693643060&adxs=230&adys=2110&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=2&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fwww.benefitscanada.com%2Fcanadian-investment-review%2F&vis=1&psz=1170x41&msz=728x90&fws=132&ohw=728&ga_vid=1305301600.1693618336&ga_sid=1693618337&ga_hid=342929710&ga_fc=true&ga_cid=1317403488.1693618336&a3p=EhsKDGlkNS1zeW5jLmNvbRiz6pOcpTFIAFICCGQ.&dlt=1693618335636&idt=813&prev_scp=pos%3Dbtf%2Cbut2%2Cmiddle_leaderboard%2Cmid_leaderboard%26tile%3D3&cust_params=title%3DInvestments---Benefits-Canada-%26full_title%3DInvestments---Benefits-Canada-com%26title_40%3DInvestments---Benefits-Canada-com%26pg%3Dsectionhome%26ss%3Dcanadian-investment-review%26section%3Dinvestments%26avt-ad-code-site%3Dtc.en.eco.biz_canadianinvestmentreview%26avt-language%3Den_US%26avt-url%3Dhttps%253A%252F%252Fwww.benefitscanada.com%252Fcanadian-investment-review%26avt-device%3Ddesktop%26avt-page-type%3Dcategory%26m32_segments%3D3Dd6FpoPJdA&adks=3468567799&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308290101/pubads_impl_fy2012.js?cb=31076166

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f2.1e100.net

Software

cafe /

Resource Hash

0a333b964eaf742e05d794cf18c6fa2e06a6df52f484687b70a36624acd6b567

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:17 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16717
x-xss-protection: 0
google-lineitem-id: 6333840159
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138437497727
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.benefitscanada.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 70 KB
16 KB 87ms
86ms Fetch
text/plain 172.217.13.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4122981767688932&correlator=643341464871183&eid=31076166%2C20222283&output=ldjh&gdfp_req=1&vrg=202308290101&ptt=17&impl=fifs&iu_parts=4916%2Ctc.en.eco.biz_canadianinvestmentreview%2Ccanadian-investment-review&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=300x1050%7C300x600%7C300x250&ifi=5&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1693618337377&lmt=1693643060&adxs=1010&adys=2210&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=3&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fwww.benefitscanada.com%2Fcanadian-investment-review%2F&vis=1&psz=389x2448&msz=389x1&fws=128&ohw=0&ga_vid=1305301600.1693618336&ga_sid=1693618337&ga_hid=342929710&ga_fc=true&ga_cid=1317403488.1693618336&a3p=EhsKDGlkNS1zeW5jLmNvbRiz6pOcpTFIAFICCGQ.&dlt=1693618335636&idt=813&prev_scp=pos%3Dbtf%2Cbut2%2Cright_bigbox_last%2Cbottom_right_bigbox%26tile%3D4&cust_params=title%3DInvestments---Benefits-Canada-%26full_title%3DInvestments---Benefits-Canada-com%26title_40%3DInvestments---Benefits-Canada-com%26pg%3Dsectionhome%26ss%3Dcanadian-investment-review%26section%3Dinvestments%26avt-ad-code-site%3Dtc.en.eco.biz_canadianinvestmentreview%26avt-language%3Den_US%26avt-url%3Dhttps%253A%252F%252Fwww.benefitscanada.com%252Fcanadian-investment-review%26avt-device%3Ddesktop%26avt-page-type%3Dcategory%26m32_segments%3D3Dd6FpoPJdA&adks=3762322901&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308290101/pubads_impl_fy2012.js?cb=31076166

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f2.1e100.net

Software

cafe /

Resource Hash

85442adc44f098e7a9e139444b21ca5cfe592d457267d6299a10280588544eab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:17 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16720
x-xss-protection: 0
google-lineitem-id: 6284223519
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138431370400
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.benefitscanada.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 70 KB
16 KB 80ms
80ms Fetch
text/plain 172.217.13.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4122981767688932&correlator=643341464871183&eid=31076166%2C20222283&output=ldjh&gdfp_req=1&vrg=202308290101&ptt=17&impl=fifs&iu_parts=4916%2Ctc.en.eco.biz_canadianinvestmentreview%2Ccanadian-investment-review&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=728x90%7C970x250%7C980x200&ifi=6&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1693618337387&lmt=1693643060&adxs=230&adys=4655&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=4&ucis=6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fwww.benefitscanada.com%2Fcanadian-investment-review%2F&vis=1&psz=1170x21&msz=728x90&fws=132&ohw=728&ga_vid=1305301600.1693618336&ga_sid=1693618337&ga_hid=342929710&ga_fc=true&ga_cid=1317403488.1693618336&a3p=EhsKDGlkNS1zeW5jLmNvbRiz6pOcpTFIAFICCGQ.&dlt=1693618335636&idt=813&prev_scp=pos%3Dbtf%2Cbut1%2Cbottom_leaderboard%26tile%3D5&cust_params=title%3DInvestments---Benefits-Canada-%26full_title%3DInvestments---Benefits-Canada-com%26title_40%3DInvestments---Benefits-Canada-com%26pg%3Dsectionhome%26ss%3Dcanadian-investment-review%26section%3Dinvestments%26avt-ad-code-site%3Dtc.en.eco.biz_canadianinvestmentreview%26avt-language%3Den_US%26avt-url%3Dhttps%253A%252F%252Fwww.benefitscanada.com%252Fcanadian-investment-review%26avt-device%3Ddesktop%26avt-page-type%3Dcategory%26m32_segments%3D3Dd6FpoPJdA&adks=3468567797&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308290101/pubads_impl_fy2012.js?cb=31076166

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f2.1e100.net

Software

cafe /

Resource Hash

c777317496ec51b2f74ef6bc9be6e77454f85a76dc1fc5c3a1a74aac31eea768

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:17 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16772
x-xss-protection: 0
google-lineitem-id: 6370427689
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138444331871
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.benefitscanada.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 601 B
321 B 70ms
70ms Fetch
text/plain 172.217.13.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4122981767688932&correlator=643341464871183&eid=31076166%2C20222283&output=ldjh&gdfp_req=1&vrg=202308290101&ptt=17&impl=fifs&iu_parts=4916%2Ctc.en.eco.biz_canadianinvestmentreview%2Ccanadian-investment-review&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=1x1&ifi=7&sfv=1-0-40&ists=1&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1693618337399&lmt=1693643060&adxs=0&adys=0&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=7&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fwww.benefitscanada.com%2Fcanadian-investment-review%2F&vis=1&psz=1600x5280&msz=0x-1&fws=128&ohw=0&ga_vid=1305301600.1693618336&ga_sid=1693618337&ga_hid=342929710&ga_fc=true&ga_cid=1317403488.1693618336&a3p=EhsKDGlkNS1zeW5jLmNvbRiz6pOcpTFIAFICCGQ.&dlt=1693618335636&idt=813&prev_scp=pos%3Datf%2Cbut1%2Ctop_leaderboard%26tile%3D6&cust_params=title%3DInvestments---Benefits-Canada-%26full_title%3DInvestments---Benefits-Canada-com%26title_40%3DInvestments---Benefits-Canada-com%26pg%3Dsectionhome%26ss%3Dcanadian-investment-review%26section%3Dinvestments%26avt-ad-code-site%3Dtc.en.eco.biz_canadianinvestmentreview%26avt-language%3Den_US%26avt-url%3Dhttps%253A%252F%252Fwww.benefitscanada.com%252Fcanadian-investment-review%26avt-device%3Ddesktop%26avt-page-type%3Dcategory%26m32_segments%3D3Dd6FpoPJdA&adks=3027794491&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308290101/pubads_impl_fy2012.js?cb=31076166

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f2.1e100.net

Software

cafe /

Resource Hash

1e75f74f02491f21b2606db4c5dc219eb0498c5c568d4f12db4217b1e892b879

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:17 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.benefitscanada.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 164ms
124ms Script
text/javascript 172.217.13.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308290101/pubads_impl_fy2012.js?cb=31076166

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f1.1e100.net

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 02 Sep 2023 01:32:17 GMT

GET
H2 200 container.html Show response
4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame D36F 6 KB
3 KB 13ms
11ms Document
text/html 172.217.13.161
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308290101/pubads_impl_fy2012.js?cb=31076166

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.161 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f1.1e100.net

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.benefitscanada.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 02 Sep 2023 01:32:17 GMT
expires: Sun, 01 Sep 2024 01:32:17 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame FDCD 6 KB
3 KB 12ms
11ms Document
text/html 172.217.13.161
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308290101/pubads_impl_fy2012.js?cb=31076166

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.161 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f1.1e100.net

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.benefitscanada.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 02 Sep 2023 01:32:17 GMT
expires: Sun, 01 Sep 2024 01:32:17 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 841C 6 KB
3 KB 13ms
11ms Document
text/html 172.217.13.161
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308290101/pubads_impl_fy2012.js?cb=31076166

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.161 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f1.1e100.net

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.benefitscanada.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 02 Sep 2023 01:32:17 GMT
expires: Sun, 01 Sep 2024 01:32:17 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame D1C9 0
0 37ms
37ms Fetch
image/gif 172.217.13.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsua_778dIIugSZU_xcRHA1Jy7BSMNKYxTKEp-3dzbBc-IO2QBB6MgqOXoxnmxfYgmkxgVAQa_XW8cSZJOBBC75UVoVjsiMdRlfdaocmUsnXDZugj_SLE6_qPQ3G87jejHjSEkA0I1BnibTMwyyZKYa1kvaEajCTINY7dyHQokt5-izH-vvX7CyP--p33GB_4Hj9DOYvewUc42NXKdAzewk2Pk4TmCIS0lkbX8N50toSFmVYANrlG8SluBK1dzkyz_GaFQ7jQqhFbGvUN5w0FkSlZsijHjrMC172NNOFwGDn38TpQobjmM2QK3zj-BDudyabrwyvkub9FWGzL9X9wOLhljuZUTRHMFtg7PnCfQK7NO9S0fihJBWhLbpW_1x9-p0HeYUF8P3o_wk_iw&sai=AMfl-YRQgLmJmktipgBHfxQEMityI8xyVrWp_HrKlagk6C0FT0nVQTdprtNxp1pPO4j6PjZizzSPEU6fOTa4ws9wvqLhSFAb6n_7s_T5RxRPcoAKdlPZrm827XLs9T1JSDWjgB8mNfgQ2z3-MeO1fT0&sig=Cg0ArKJSzOy5Rz831OeCEAE&uach_m=[UACH]&adurl=

Requested by

Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:17 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230830/r20110914/client/ Frame D1C9 3 KB
2 KB 12ms
11ms Script
text/javascript 172.217.13.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230830/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308290101/pubads_impl_fy2012.js?cb=31076166

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f1.1e100.net

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Fri, 01 Sep 2023 14:00:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 41499
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 15 Sep 2023 14:00:38 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame D1C9 181 KB
57 KB 111ms
66ms Script
text/javascript 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308290101/pubads_impl_fy2012.js?cb=31076166

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f2.1e100.net

Software

sffe /

Resource Hash

2dad5ac646a269db9be6741f1c5973a4d0f242d176413662178a5710613934b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57780
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1693394992224923"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 02 Sep 2023 01:32:17 GMT

GET
H2 200 6192138020643397821
tpc.googlesyndication.com/simgad/ Frame D1C9 68 KB
69 KB 11ms
11ms Image
image/png 172.217.13.193
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/6192138020643397821

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308290101/pubads_impl_fy2012.js?cb=31076166

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f1.1e100.net

Software

sffe /

Resource Hash

5fe2d57b8b035e9ba614058881f126ed6f5cf5da2556d4a235472e98723bd110

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Tue, 29 Aug 2023 13:36:41 GMT
x-content-type-options: nosniff
age: 302136
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 69886
x-xss-protection: 0
last-modified: Mon, 26 Jun 2023 16:18:19 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 28 Aug 2024 13:36:41 GMT

GET
DATA 200
OK truncated
/ Frame D1C9 209 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e8c316d63711b8974a0e939c96e4483209bc3298f4bd1d32d540ee2ee5b3e077

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame D36F 24 KB
7 KB 20ms
19ms Script
text/javascript 172.217.13.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js

Requested by

Host: 4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com
URL: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f1.1e100.net

Software

sffe /

Resource Hash

08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:14:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1065
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6402
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sun, 01 Sep 2024 01:14:32 GMT

GET
H2 200 dcmads.js Show response
www.googletagservices.com/dcm/ Frame D36F 16 KB
7 KB 45ms
13ms Script
text/javascript 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Host: 4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com
URL: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f2.1e100.net

Software

sffe /

Resource Hash

d72c9fb59846aff6405d2973c81bd8da823493502fab893e026a736a1ba01838

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:12:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1211
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6830
x-xss-protection: 0
last-modified: Wed, 24 May 2023 18:59:20 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Sat, 02 Sep 2023 02:12:06 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame D36F 181 KB
57 KB 129ms
97ms Script
text/javascript 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com
URL: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f2.1e100.net

Software

sffe /

Resource Hash

2dad5ac646a269db9be6741f1c5973a4d0f242d176413662178a5710613934b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57780
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1693394992224923"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 02 Sep 2023 01:32:17 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 93E9 0
0 42ms
41ms Fetch
image/gif 172.217.13.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu7sYeaGY_f864IFsjoXBCwbCnFZa5JoK4ef-PwtL4oCpvSYwtovAXHVeSWtAsJCFgUCl4WQoJyARLZ6EqSeivn3A5BD4Zw0tQ6I1ARUTPaygheH5R4TLISZE73nF_ItZQbWrbZQVjh8zHBZb90zfDTnqq5eFNaFAap8bfdcQDn_03wboMvMo9oowwqLadmv9J7jDLBsykVsKAm97udCqACK9rHs7R0WYT_PQrwBxT7nMW_QX6LKjfmLhWiaam2FATEPQ2mkG5yinZcS16PESCy8T5GxOxIPXid8tMGRPibH5KIgqgOVr2Grjx5OEdEDr_HK-K79o2jl9OCUQ-Hi-BWrIZID-iA3U-IlIvPTYWWAGoJNxWHtpcukItXlK_kyR0qBfAaOa-tx1fhZw&sai=AMfl-YSEmQn3oECJJ5fCxsHujOijkiNZ_2dWmYgeVENOzoC47_PFlaHrhJ5oVuuw4AbO5WnArmkfO8HebKZV2U2tORPQpUC3OuH7Y11CDAfiw8B4Q1alOshN8Fpgx1jCkSNypETJ0aLSuQIZ-rWnY7j-&sig=Cg0ArKJSzCKI3vPQJJjfEAE&uach_m=[UACH]&adurl=

Requested by

Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:17 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230830/r20110914/client/ Frame 93E9 3 KB
1 KB 12ms
11ms Script
text/javascript 172.217.13.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230830/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308290101/pubads_impl_fy2012.js?cb=31076166

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f1.1e100.net

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Fri, 01 Sep 2023 14:00:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 41499
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 15 Sep 2023 14:00:38 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 93E9 181 KB
57 KB 89ms
89ms Script
text/javascript 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308290101/pubads_impl_fy2012.js?cb=31076166

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f2.1e100.net

Software

sffe /

Resource Hash

2dad5ac646a269db9be6741f1c5973a4d0f242d176413662178a5710613934b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57780
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1693394992224923"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 02 Sep 2023 01:32:17 GMT

GET
H3 200 17821921316786563056
tpc.googlesyndication.com/simgad/ Frame 93E9 61 KB
61 KB 13ms
13ms Image
image/jpeg 172.217.13.193
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/17821921316786563056

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308290101/pubads_impl_fy2012.js?cb=31076166

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f1.1e100.net

Software

sffe /

Resource Hash

81574785aacf772653667ad1fd2714f09386298b79946805d08aeb072ee4be81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 26 Aug 2023 16:09:55 GMT
x-content-type-options: nosniff
age: 552142
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62763
x-xss-protection: 0
last-modified: Tue, 25 Apr 2023 21:03:06 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 25 Aug 2024 16:09:55 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame C400 0
0 43ms
42ms Fetch
image/gif 172.217.13.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstM76gk5I6QwOo-3E1IoEcOiV8CaZQy5ZL3JHgOs4RcxwXjlNzC6_fwp9dkvUKjB9bk2m3fkYKH0AKGnd6mpVAEHpieVP2kDDWQUQ1eIUckc28Ww0hF00TaM0K3loCZeAR-N8A3uvnlM7MX8u8tW97Uy0okWgLB2goTwzCfDn0kOYdguO_we5dL5m9DHnVg-GJ29wojCtPBNwPlqzsv5Hxu6MSJBQslbxsCUwAwuHDfMecNcXV_gO0uqxfrMWagW4gCQAgZf8FhBvoWF6P_D5vQtIY6lHJkVUIg13_BQ_JMeKzjrSxpqOIiwlIkcU0PbEWZ62NGpa2gzWvHTqTx_oZm7cEZPZ_zNgcYSPvaSbmO7PqWuL5dqQgPp9vAKL97EqVL6qJk0_HbjtEEdQ&sai=AMfl-YRmnF2OWFiFEkbkViz6RZtpew8DDgMsnfZYa0isr9fgJuGoX2PAZhRRJUXOgzL28a8cfPDZ8b4bTBDsUoF6fHuThSTx83w1ejqdQOQj2a8k9OaaivB-iwATiIdJ3uCy942BoCiKTiY09iCc9oei&sig=Cg0ArKJSzDJIRUhnSZWMEAE&uach_m=[UACH]&adurl=

Requested by

Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:17 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230830/r20110914/client/ Frame C400 3 KB
1 KB 13ms
13ms Script
text/javascript 172.217.13.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230830/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308290101/pubads_impl_fy2012.js?cb=31076166

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f1.1e100.net

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Fri, 01 Sep 2023 14:00:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 41499
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 15 Sep 2023 14:00:38 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C400 181 KB
57 KB 70ms
69ms Script
text/javascript 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308290101/pubads_impl_fy2012.js?cb=31076166

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f2.1e100.net

Software

sffe /

Resource Hash

2dad5ac646a269db9be6741f1c5973a4d0f242d176413662178a5710613934b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57780
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1693394992224923"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 02 Sep 2023 01:32:17 GMT

GET
H3 200 11722865786537224243
tpc.googlesyndication.com/simgad/ Frame C400 15 KB
15 KB 15ms
15ms Image
image/png 172.217.13.193
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/11722865786537224243

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202308290101/pubads_impl_fy2012.js?cb=31076166

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f1.1e100.net

Software

sffe /

Resource Hash

60f33bd1a5d5676415ec32d27074d36ad853b8c0acca1dca5b926f1b1a144d78

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Thu, 31 Aug 2023 12:35:59 GMT
x-content-type-options: nosniff
age: 132978
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15608
x-xss-protection: 0
last-modified: Tue, 29 Aug 2023 19:59:06 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 30 Aug 2024 12:35:59 GMT

GET
DATA 200
OK truncated
/ Frame 93E9 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 29955cf92fbec587744de23937360c7065d6d0c771f176863340c18b21c4702d

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame C400 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3acf6434a328154b9004ea118db26ef6902e025ab7ab27968448feed39a94b55

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame FDCD 24 KB
6 KB 29ms
29ms Script
text/javascript 172.217.13.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js

Requested by

Host: 4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com
URL: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f1.1e100.net

Software

sffe /

Resource Hash

08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:14:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1065
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6402
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sun, 01 Sep 2024 01:14:32 GMT

GET
H2 200 dcmads.js Show response
www.googletagservices.com/dcm/ Frame FDCD 16 KB
7 KB 12ms
11ms Script
text/javascript 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Host: 4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com
URL: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f2.1e100.net

Software

sffe /

Resource Hash

d72c9fb59846aff6405d2973c81bd8da823493502fab893e026a736a1ba01838

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:12:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1211
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6830
x-xss-protection: 0
last-modified: Wed, 24 May 2023 18:59:20 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Sat, 02 Sep 2023 02:12:06 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame FDCD 181 KB
57 KB 73ms
72ms Script
text/javascript 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com
URL: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f2.1e100.net

Software

sffe /

Resource Hash

2dad5ac646a269db9be6741f1c5973a4d0f242d176413662178a5710613934b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57780
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1693394992224923"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 02 Sep 2023 01:32:17 GMT

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame 841C 24 KB
6 KB 29ms
28ms Script
text/javascript 172.217.13.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js

Requested by

Host: 4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com
URL: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f1.1e100.net

Software

sffe /

Resource Hash

08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:14:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1065
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6402
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sun, 01 Sep 2024 01:14:32 GMT

GET
H2 200 dcmads.js Show response
www.googletagservices.com/dcm/ Frame 841C 16 KB
7 KB 25ms
0ms Script
text/javascript 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Host: 4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com
URL: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f2.1e100.net

Software

sffe /

Resource Hash

d72c9fb59846aff6405d2973c81bd8da823493502fab893e026a736a1ba01838

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:12:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1211
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6830
x-xss-protection: 0
last-modified: Wed, 24 May 2023 18:59:20 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Sat, 02 Sep 2023 02:12:06 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 841C 181 KB
57 KB 77ms
49ms Script
text/javascript 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com
URL: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f2.1e100.net

Software

sffe /

Resource Hash

2dad5ac646a269db9be6741f1c5973a4d0f242d176413662178a5710613934b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57780
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1693394992224923"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 02 Sep 2023 01:32:17 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame D36F 0
0 41ms
37ms Fetch
image/gif 172.217.13.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss-3or1z80STGOBF9UO1Kwz_zRD_awW2l8--n8d9FKEXApb2cAbi25PknpQMAJQlPuxdo4DDkX6QKIWs_3d6mwF8NXUsGguT172yNnRKfIKCD78i_SKmzHFi2ehSU6VMZdZNsRyKR1aVYFwnhq7zt3W3JO7qYesHUZCFn9_wLMdFeJQnmWptr4cfby52ltfnQAUdUNjm1xTZkixL60Hcsul1X9J9OFSqxZAbZ9lfvVnziFmBuxnzKlWacyWf6LIJ4IsHwxZRVcD60rkrzs6ows7FOrPecVjLWXo32F-sz6J_gPshvcj3iStNtUgpN8uDXK1SoRqsqty2WH8fdiuTe-nv0Gn3tS9ICJajRamlpopU65MnJTUINNzvpJj4GxORW2mvWKeTpCV6zXK0JQBIOk&sai=AMfl-YT8wGtqzqeHuFnr6Ijnutq1er5a0xf1xYwXwYNh_Ok0saw5qFR4crIj2LJe-a9IjQe4HFGuOpQmdpLMyvCvhhyDRQwSIMfvvjtIpPPvHSX-AUr3SUR87yWM8lXjgd2Ro6EIElH-qskiMqdnO0M&sig=Cg0ArKJSzEcmTWQR_sUPEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: 4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com
URL: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:17 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 7C0C 13 KB
5 KB 20ms
15ms Document
text/html 172.217.13.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f1.1e100.net

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.benefitscanada.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 578571
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 26 Aug 2023 08:49:26 GMT
expires: Sun, 25 Aug 2024 08:49:26 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame B0F4 829 B
561 B 55ms
53ms Document
text/html 172.217.13.196
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.196 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f4.1e100.net

Software

GSE /

Resource Hash

423d522143859f16eba2f7d349c646171033572995cd6af75010a4a2b57d76e3

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-9ExOPq4If7ckWRG0kQcFxA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.benefitscanada.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-length: 539
content-security-policy: script-src 'report-sample' 'nonce-9ExOPq4If7ckWRG0kQcFxA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sat, 02 Sep 2023 01:32:17 GMT
expires: Sat, 02 Sep 2023 01:32:17 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 impl_v96.js Show response
www.googletagservices.com/dcm/ Frame D36F 49 KB
20 KB 14ms
14ms Script
text/javascript 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v96.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f2.1e100.net

Software

sffe /

Resource Hash

843dea1d022be79c95643821b1140cc2d081094ee77ccf7a1f637a1ad8fca33f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 26 Aug 2023 09:19:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 576757
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20157
x-xss-protection: 0
last-modified: Mon, 22 May 2023 16:41:33 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 25 Aug 2024 09:19:40 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame FDCD 0
0 41ms
40ms Fetch
image/gif 172.217.13.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv_pCsv2E6ygdHYMszxhIHpvD9tSNKBg75hMTZmX_rCUIyJCwOiOjIkZZc31pUuPXJyxvpdtn9q3-J7-pjw89NlyVv2ID902658lcbmTa7GY0Eb6Bb9FjJxp0_G6jSzV80U87VpbdlH8VIU2w_vBHjISq8VoW3OAvi4dm6aoMTP9x2_uSESh3s8aC5_u7JaYDOwXFBl9PiYTnLhr5zqzsYA9FVyhupyv9soQpPWlc5_SaE5ajc841mYwJNW2Llub5NfSjMAj5WN5GccuIxs5wvyv-RBXglm3WLdrpLMK3gTe9pqGL9IoCHONzlYnT0S4rfAIptoBpmY0cwzcynVePXQ5-0e6IpcsZoqdO5mAPaSjSVMLiABoqDe-QlTZcLF83gxOs_dvhxc0jiOKA&sai=AMfl-YSSZAXMORQO3vovl_84THu7LEgvmPCA-YhmIwclFefj4lpb6AUxY703sszY3EIKGkJ2j-K-AjEwa9hfZ_v5eBv8jKiVV-FNYJ1-rNWGASMD1W70E7omNyLZ6_zBpnV2I1meymoDzMEDzj4KoqT4&sig=Cg0ArKJSzLS-QK4JVNIkEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: 4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com
URL: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:17 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 impl_v96.js Show response
www.googletagservices.com/dcm/ Frame FDCD 49 KB
20 KB 12ms
12ms Script
text/javascript 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v96.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f2.1e100.net

Software

sffe /

Resource Hash

843dea1d022be79c95643821b1140cc2d081094ee77ccf7a1f637a1ad8fca33f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 26 Aug 2023 09:19:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 576757
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20157
x-xss-protection: 0
last-modified: Mon, 22 May 2023 16:41:33 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 25 Aug 2024 09:19:40 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 841C 0
0 37ms
36ms Fetch
image/gif 172.217.13.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvzR_HIAA3E4RLY8A3sCQylO-ArYQ3_9aEivW5Neif9vk0aJynArbWFa9bI0HABn7ZpEqNTt5ipZdktB06kaSohJhTW8z_tmpT8MSQKSUNYrpjYuLGl2iYm2FYNbamvSNiwdU2qTsIS_-6BAySPpETIGVZXppsjv9Rx4qDIo0-b_O95NBS6iU_K-mrD3UMTZlYxtspWRkQUp6yqECuy_IRs7hjAV96L4UujM8zfAsWUX2xyebqk1Ze8mtCq0XXZ82f3NyAhBtinT1tuslMIT5Sdne6VF61nCLk5sl5-s7582I2c3LNgUFLqqzKHsSbvcw_dx5S4zWp_qgSulp5RUN5a4ydeLfWN41yQt3EEl3LePd8SoMy-ZvhcdnSUoRZPaKHi0meSmkZf_BUu7lIZHRk&sai=AMfl-YRbTTsqMaZocaYC-qQkkGAMRAcCHzneWp9xY22b6_JPUjrHSEr5vgIkL8DDlcMfZHuGQ2HNeABYZjmREbM5QCXT6k9b1C80YjVbfasyolm-6pYwbs1WLluGDtCivDsaD9SWJOnZcPvfMJ4q7mo&sig=Cg0ArKJSzC6MbcYvT9BHEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: 4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com
URL: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:17 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 impl_v96.js Show response
www.googletagservices.com/dcm/ Frame 841C 49 KB
20 KB 13ms
11ms Script
text/javascript 172.217.13.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v96.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f2.1e100.net

Software

sffe /

Resource Hash

843dea1d022be79c95643821b1140cc2d081094ee77ccf7a1f637a1ad8fca33f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 26 Aug 2023 09:19:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 576757
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20157
x-xss-protection: 0
last-modified: Mon, 22 May 2023 16:41:33 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 25 Aug 2024 09:19:40 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame D1C9 0
0 64ms
37ms Fetch
image/gif 172.217.13.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvu6R9mer--4HCm7OzxatgAoj_xwTRtQF42VNR1YBXHuPagzi6fcEOP8SK2tCN5_b44z3ACpLtjhlr7FtKW_jX-L2qkzmxSHdwVDdFK4ymQRO6LACUPN6YtpJOJc1FVDMWM9hugaznWfH9XQnNEc297d6aGmsNTK4EmJNCTgRN8xx9SmBpK1XTveZfhDhZ0_v7yySp3q_J3RxndjtWqiYQiVhT_4tOygnN8gZ5s4tsRLMSF4DTel86g1UptoFIQ9nvBPxCGC93JICsbwl7I5kswcfxANXzpfGGsHfBkMrlSePPz8GL8P1cD_skieSxhA8WS7qnjnPkeS5ggb-isnfzxqgVaPQS8QAGd8Cd42B27R0cRnm1LKy3ARF6GKD_n_8n7dctAVy19zOqcsCVz&sai=AMfl-YR3bUM2ON2icSgf4ugxm2cumywBR-djcZHIjHwjBNRygae5sDA5_e3M0UsM9dNCr1kEYi70JCtaqKC1VFvdZT_cpgq8NKPJS0zgMzA4nG-gXP-CidGbJhYRhMdEwI3tvV1GhPQYhFwip_8Pg7E&sig=Cg0ArKJSzCanmlvXPKNmEAE&uach_m=[UACH]&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:17 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 02 Sep 2023 01:32:17 GMT

GET
H2 200 B29913665.373904408;dc_ver=96.284;dc_eid=40004000;sz=728x90;u_sd=1;dc_adk=3756782277;ord=5u12gp;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjstZAYeHQyL-F-qwVTc4A36EUUhC7... Show response
ad.doubleclick.net/ddm/adj/N9322.4436867GROUPECONTEXT/ Frame D36F 74 KB
31 KB 121ms
69ms Script
text/javascript 172.217.13.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adj/N9322.4436867GROUPECONTEXT/B29913665.373904408;dc_ver=96.284;dc_eid=40004000;sz=728x90;u_sd=1;dc_adk=3756782277;ord=5u12gp;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjstZAYeHQyL-F-qwVTc4A36EUUhC7Cp_gR6p9QFWdHVQ5fBXtWJvu5rFTIYaQDyRUUF6Iog3QKrKkMVq8oWOK87Kded9J_XMfGWxLhH9LSoEbOSVesMGQLVUDoll3GEpFkb0eVFM9YAPcvXwXaF4tjiwsPtQomQTpfWz3X2b-FGM7BDZtQs0j9rgt1zXn_JR8Z3ae2eHGhmr-TF1Nga4dXVKyQSx5NKVKaCijzgH2C2PQLJq-fcl5n7DxYoI1eTOqs4j0EmS6N89e5vHQybps3NmabZHbwd83TtQr7-T2BEBAkWRGKQheDiiVOXQGF3PDMi-F28yubD6Y6uUNkfp-mg3fLogsQ4W11xeWs3S8Gb-7x-r_xD3n0_qRKw1ZHGvwhwdqzS28G2CjpfbYiU%26sai%3DAMfl-YQrNPjq82NvSrjk2GhVi_G3D7Eeq7Ih5uuxD0LGvUOFPPkyS9fWEa-ZcGNR5R3pWEaWjbLHH0g3ZcfBVeflOZL88Yo7q9wTWuFbEHn2-d26lumxQ1hItouP7KF3Jrw_tKzzJgoO6iQjKOn38q0%26sig%3DCg0ArKJSzJ6W5ivwJN-4EAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26adurl%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=1,https%3A%2F%2Fwww.benefitscanada.com%2F$0;xdt=1;crlt=UD0J26sIs2;stc=1;chaa=1;sttr=82;prcl=s

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v96.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s04-in-f6.1e100.net

Software

cafe /

Resource Hash

667107ab0cded30464dc87f4e482ae4eba3d469be2ae651dbc7b01e499d4d610

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Sep 2023 01:32:17 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31376
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 93E9 0
0 45ms
45ms Fetch
image/gif 172.217.13.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssGOh5twHPG6q2z8TlipfQf_C1YGwMtN3CA5c-P9-zM9xsXz_ThzNM0oLWBr2MWITOaU6es5EB0SFgDcswHam7Q3jNHodG4pH9ClH4G3bfGHRw5h6Yley7bBKR1N6qTlV_ADViOp5BcLvwh5X_ZDC5H3u2P1zsk9dxtk4uKyeJ5qFjBkZ_uOx8JEvzLiZI6iSvgUzaXQvc_XELD3Md-yi8XvBMfrW-7qkij0_s37fGoYAv1dzsYEkgVT8LT_ZdZt9I5wokTk_4q6f4CiESUcNmi8ymJ9xfIPWYpG5boX0hLoIJbueXJIoDy6d4hcwyGj1_fW4Vf86Cjax0fulxB6geNs85bhAafwHAzGIoeM-nKY6faGdxKeWNRqcjSjaCNYFbpjTfBktRZ-6jAAJGh&sai=AMfl-YSphDP9iKuCqOFwxX8BXA8Yk6eYJAgsudEtKQZ1mhtTafS173lnKGuGWzWkSJidMHq5DbQzlDa22o9FHTWoLILj6eDL-ggmzJbpeP5H_kSvLTYQa6uzQbksxuWp8hTGobj7w-0EJnLSOqIbuOUh&sig=Cg0ArKJSzDaXHotU8r7KEAE&uach_m=[UACH]&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:17 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 02 Sep 2023 01:32:17 GMT

GET
H2 200 B29271218.358372995;dc_ver=96.284;dc_eid=40004000;sz=300x250;u_sd=1;dc_adk=2539888514;ord=2tjbno;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjssMs9GFIQJWUakvOAJOM3PlSix4... Show response
ad.doubleclick.net/ddm/adj/N31708.274667BENEFITSCANADA/ Frame FDCD 90 KB
34 KB 100ms
86ms Script
text/javascript 172.217.13.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adj/N31708.274667BENEFITSCANADA/B29271218.358372995;dc_ver=96.284;dc_eid=40004000;sz=300x250;u_sd=1;dc_adk=2539888514;ord=2tjbno;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjssMs9GFIQJWUakvOAJOM3PlSix4lIoxjNFG3T1ic1Q5yVWwbQRo2UznX5uJoJlE0OGVCbNEH5YnzWi1bKewQaC9gvwSjI7jZRGNcAYtg-VvM31mxofXakmTfNeDb3qo5qr3VolFKxcndHpHTo-qtAntVCP8nlcuwCMX8v0yHZgsH3wdv5Lvidi9ytN1DPPaEkA1auShQAn4fz1oew6lFR_AFQUeAYNuCRVsdcUbpXAgT4eWxbbEyOxJTlWDZZq1sLnPpS0U-eUHY005bgxi7l-67sbVGP61Hu7Gmm37bt5e9v0LOCwkoZXwCNhUqnGLFgviMUjgxs5UUGPevk6qMxrLoOeJH3K3qZ4fhrCAILrx0oaVWEnoAfGibXB-3OHgR4o62w_FdqDGOA%26sai%3DAMfl-YS2kBFhQAv5orRZ299TYn-ceaYsRut28DRvdBIC8gw9kcH9rtGs81LKTqmtkd6sZr7I7acRLzC0s8VxASJWwpLx6S8Sgn1l0PaHf67huQ_VDoQzO4DeVWR49BxAVjUNk6bWhJ-34CJKj4sMq7Pi%26sig%3DCg0ArKJSzE4p4o_7H0KUEAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26adurl%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=1,https%3A%2F%2Fwww.benefitscanada.com%2F$0;xdt=1;crlt=UD0J26sIs2;stc=1;chaa=1;sttr=103;prcl=s

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v96.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s04-in-f6.1e100.net

Software

cafe /

Resource Hash

ea3191584f8e74dd6cb413b915e9258cc57b1a8c0c5bf4038e20d22f17647c78

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Sep 2023 01:32:17 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34236
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 B29271218.358372995;dc_ver=96.284;dc_eid=40004000;sz=300x250;u_sd=1;dc_adk=153457192;ord=3lgt1c;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsvzMcbOE1tEEXf22ImtmqvHoNI7-... Show response
ad.doubleclick.net/ddm/adj/N31708.274667BENEFITSCANADA/ Frame 841C 90 KB
34 KB 101ms
90ms Script
text/javascript 172.217.13.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adj/N31708.274667BENEFITSCANADA/B29271218.358372995;dc_ver=96.284;dc_eid=40004000;sz=300x250;u_sd=1;dc_adk=153457192;ord=3lgt1c;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsvzMcbOE1tEEXf22ImtmqvHoNI7-RLRhx4gJW3YKvZ9XbCR3exLPXTuFWVUEzhRDm5Nl8mTLGYavgYyPe1AgTzZcScMM9rFZ29oGZGgiNUptJ76VafYUpeV7a3pLpPyKDCCj5uc0yCEle1Er832OIJopFf3RwmvoEnxpRuUvX9_I1oXsVMWBhRKasBt7ePqTQlt1LU5OGcma-QKk6lgGNPVW94in94BN8N9UkmisMapTZIDZO1x8c3D0aKlAn-CJrtI_6jOkW_a7hghTqCXT20EdHrudVfS_0QLgw-NeoMXXj6G0i2PVthQ45M7pKXIHmthgvourLwnQAAbH1nrSu8W4kli_9F05F1mnHA8bl0VF7hlf4Vqk3jSALY9FQXEUubRMOhuPhju3yzpzCo%26sai%3DAMfl-YSS015ZY_QMdZm6S5tyKf_9i4YURJb0iN7XsvftPjBlwSuiwkutzafF-f5WY8-ZgBmQOXwKMmtys4hQuu7IbF0f5ipAne0LbS04uYdz-J0dccQWnj5SNe98szbgoXBsh2OZoN_vIIwU7J4YnaM%26sig%3DCg0ArKJSzHlInYOXY7JhEAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26adurl%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=1,https%3A%2F%2Fwww.benefitscanada.com%2F$0;xdt=1;crlt=UD0J26sIs2;stc=1;chaa=1;sttr=100;prcl=s

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v96.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s04-in-f6.1e100.net

Software

cafe /

Resource Hash

7278105d2ddea29fa46c2eaaa8406ea557d9f3e010010e02c662ed6725977c30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Sep 2023 01:32:17 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34440
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame C400 0
0 36ms
36ms Fetch
image/gif 172.217.13.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuOM6Ljru9Q4XgcW-kJ6Vkus1H-Mb21F4KaM45157P7u5Di8Ei2TfvSLhf7UutkCdRXkmfVG0Ui_3IdN-BfbkqeMQVGHXxloDO5M4a1A-JfQL4SAM1M73XD6u1B_aZL3aTG3u965N9t8vsbTJq5hpKEuOSN-j0SoGSqG3teWGetHzjePq26_XZL7l7vMi6rENTmYI7QYF2A3btfWeHemxrJ7mBLQg78y9wU-zjgFhDxQHqaqfawFetzvBI3HLLmrWs7QrAT0-7ZDSzD3YrJpWIaucyl3kegy0AMkJlFQasYHWa4zfMmtH4AB47CdCsOrv8O_-UMURB6Q8T5xcChtrLiCmb_MbzdXAGtsQrBRWXX-DW1_7PmCRkibh9BuZEaJoFx3k9hpC9DeVEm4XLo&sai=AMfl-YQQBJbiUS3tcnKlVcMYDDpORXKIFz5RGYgTrOZfr1cZAQfZO0oxSpT1FJo8yDzBuP27sNcFgslFMijvfp935xqOUF84tLcKQrn3it9dS3Yoej5TepLj7Mbd0mnagfObgczZE8DjZEoaM_fiSi4_&sig=Cg0ArKJSzEJ267Jd104ZEAE&uach_m=[UACH]&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:17 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 02 Sep 2023 01:32:17 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame B0F4 0
0 63ms
37ms Image
text/html 172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202308290101&jk=4122981767688932&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.217.13.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: yul03s04-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

GET
H3 200 45TQ4WJNUFNsi_RKEccy4FYYQq63aBzPbRMjDYcMLJU.js Show response
pagead2.googlesyndication.com/bg/ Frame 7C0C 38 KB
15 KB 36ms
12ms Script
text/javascript 172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/45TQ4WJNUFNsi_RKEccy4FYYQq63aBzPbRMjDYcMLJU.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f2.1e100.net

Software

sffe /

Resource Hash

e394d0e1624d50536c8bf44a11c732e0561842aeb7681ccf6d13230d870c2c95

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Tue, 29 Aug 2023 14:20:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 299525
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14879
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 28 Aug 2024 14:20:12 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame D36F 111 KB
39 KB 48ms
10ms Script
text/javascript 172.217.13.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f6.1e100.net

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
Origin: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:15:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1036
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 03 Sep 2023 01:15:01 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230830/r20110914/elements/html/ Frame D36F 11 KB
4 KB 10ms
10ms Script
text/javascript 172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230830/r20110914/elements/html/omrhp.js

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N9322.4436867GROUPECONTEXT/B29913665.373904408;dc_ver=96.284;dc_eid=40004000;sz=728x90;u_sd=1;dc_adk=3756782277;ord=5u12gp;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjstZAYeHQyL-F-qwVTc4A36EUUhC7Cp_gR6p9QFWdHVQ5fBXtWJvu5rFTIYaQDyRUUF6Iog3QKrKkMVq8oWOK87Kded9J_XMfGWxLhH9LSoEbOSVesMGQLVUDoll3GEpFkb0eVFM9YAPcvXwXaF4tjiwsPtQomQTpfWz3X2b-FGM7BDZtQs0j9rgt1zXn_JR8Z3ae2eHGhmr-TF1Nga4dXVKyQSx5NKVKaCijzgH2C2PQLJq-fcl5n7DxYoI1eTOqs4j0EmS6N89e5vHQybps3NmabZHbwd83TtQr7-T2BEBAkWRGKQheDiiVOXQGF3PDMi-F28yubD6Y6uUNkfp-mg3fLogsQ4W11xeWs3S8Gb-7x-r_xD3n0_qRKw1ZHGvwhwdqzS28G2CjpfbYiU%26sai%3DAMfl-YQrNPjq82NvSrjk2GhVi_G3D7Eeq7Ih5uuxD0LGvUOFPPkyS9fWEa-ZcGNR5R3pWEaWjbLHH0g3ZcfBVeflOZL88Yo7q9wTWuFbEHn2-d26lumxQ1hItouP7KF3Jrw_tKzzJgoO6iQjKOn38q0%26sig%3DCg0ArKJSzJ6W5ivwJN-4EAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26adurl%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=1,https%3A%2F%2Fwww.benefitscanada.com%2F$0;xdt=1;crlt=UD0J26sIs2;stc=1;chaa=1;sttr=82;prcl=s

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f2.1e100.net

Software

cafe /

Resource Hash

4b61f735ba127d88a8673f26e34a79bc25968d5be1bb43004958065526d28bb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Fri, 01 Sep 2023 13:55:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 41825
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4196
x-xss-protection: 0
server: cafe
etag: 15907914729094346842
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 15 Sep 2023 13:55:12 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame D36F 41 KB
13 KB 11ms
11ms Script
text/javascript 172.217.13.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f1.1e100.net

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 26 Aug 2023 15:11:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 555634
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 25 Aug 2024 15:11:43 GMT

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/1347897/69359102/ Frame FDCD 46 KB
12 KB 97ms
26ms Script
application/javascript 3.211.247.215
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/1347897/69359102/skeleton.js
Requested by: Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.211.247.215 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-211-247-215.compute-1.amazonaws.com
Software: /
Resource Hash: e2f1d542c09b03a54ae82d3e0d921dd128437a6b35e8ae3722274b4ff621c4dd

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Sep 2023 01:32:17 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame FDCD 111 KB
39 KB 57ms
30ms Script
text/javascript 172.217.13.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f6.1e100.net

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
Origin: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:15:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1036
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 03 Sep 2023 01:15:01 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230830/r20110914/elements/html/ Frame FDCD 11 KB
4 KB 10ms
10ms Script
text/javascript 172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230830/r20110914/elements/html/omrhp.js

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N31708.274667BENEFITSCANADA/B29271218.358372995;dc_ver=96.284;dc_eid=40004000;sz=300x250;u_sd=1;dc_adk=2539888514;ord=2tjbno;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjssMs9GFIQJWUakvOAJOM3PlSix4lIoxjNFG3T1ic1Q5yVWwbQRo2UznX5uJoJlE0OGVCbNEH5YnzWi1bKewQaC9gvwSjI7jZRGNcAYtg-VvM31mxofXakmTfNeDb3qo5qr3VolFKxcndHpHTo-qtAntVCP8nlcuwCMX8v0yHZgsH3wdv5Lvidi9ytN1DPPaEkA1auShQAn4fz1oew6lFR_AFQUeAYNuCRVsdcUbpXAgT4eWxbbEyOxJTlWDZZq1sLnPpS0U-eUHY005bgxi7l-67sbVGP61Hu7Gmm37bt5e9v0LOCwkoZXwCNhUqnGLFgviMUjgxs5UUGPevk6qMxrLoOeJH3K3qZ4fhrCAILrx0oaVWEnoAfGibXB-3OHgR4o62w_FdqDGOA%26sai%3DAMfl-YS2kBFhQAv5orRZ299TYn-ceaYsRut28DRvdBIC8gw9kcH9rtGs81LKTqmtkd6sZr7I7acRLzC0s8VxASJWwpLx6S8Sgn1l0PaHf67huQ_VDoQzO4DeVWR49BxAVjUNk6bWhJ-34CJKj4sMq7Pi%26sig%3DCg0ArKJSzE4p4o_7H0KUEAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26adurl%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=1,https%3A%2F%2Fwww.benefitscanada.com%2F$0;xdt=1;crlt=UD0J26sIs2;stc=1;chaa=1;sttr=103;prcl=s

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f2.1e100.net

Software

cafe /

Resource Hash

4b61f735ba127d88a8673f26e34a79bc25968d5be1bb43004958065526d28bb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Fri, 01 Sep 2023 13:55:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 41825
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4196
x-xss-protection: 0
server: cafe
etag: 15907914729094346842
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 15 Sep 2023 13:55:12 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame FDCD 41 KB
13 KB 11ms
11ms Script
text/javascript 172.217.13.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f1.1e100.net

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 26 Aug 2023 15:11:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 555634
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 25 Aug 2024 15:11:43 GMT

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/1347897/69359102/ Frame 841C 46 KB
12 KB 100ms
38ms Script
application/javascript 3.211.247.215
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/1347897/69359102/skeleton.js
Requested by: Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.211.247.215 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-211-247-215.compute-1.amazonaws.com
Software: /
Resource Hash: c76339e5917229c272522a3dda7d920a9e45dd26df73473a9309c632b8ac3c06

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Sep 2023 01:32:17 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 841C 111 KB
39 KB 42ms
24ms Script
text/javascript 172.217.13.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f6.1e100.net

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
Origin: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:15:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1036
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 03 Sep 2023 01:15:01 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230830/r20110914/elements/html/ Frame 841C 11 KB
4 KB 10ms
10ms Script
text/javascript 172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230830/r20110914/elements/html/omrhp.js

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N31708.274667BENEFITSCANADA/B29271218.358372995;dc_ver=96.284;dc_eid=40004000;sz=300x250;u_sd=1;dc_adk=153457192;ord=3lgt1c;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsvzMcbOE1tEEXf22ImtmqvHoNI7-RLRhx4gJW3YKvZ9XbCR3exLPXTuFWVUEzhRDm5Nl8mTLGYavgYyPe1AgTzZcScMM9rFZ29oGZGgiNUptJ76VafYUpeV7a3pLpPyKDCCj5uc0yCEle1Er832OIJopFf3RwmvoEnxpRuUvX9_I1oXsVMWBhRKasBt7ePqTQlt1LU5OGcma-QKk6lgGNPVW94in94BN8N9UkmisMapTZIDZO1x8c3D0aKlAn-CJrtI_6jOkW_a7hghTqCXT20EdHrudVfS_0QLgw-NeoMXXj6G0i2PVthQ45M7pKXIHmthgvourLwnQAAbH1nrSu8W4kli_9F05F1mnHA8bl0VF7hlf4Vqk3jSALY9FQXEUubRMOhuPhju3yzpzCo%26sai%3DAMfl-YSS015ZY_QMdZm6S5tyKf_9i4YURJb0iN7XsvftPjBlwSuiwkutzafF-f5WY8-ZgBmQOXwKMmtys4hQuu7IbF0f5ipAne0LbS04uYdz-J0dccQWnj5SNe98szbgoXBsh2OZoN_vIIwU7J4YnaM%26sig%3DCg0ArKJSzHlInYOXY7JhEAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26adurl%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=1,https%3A%2F%2Fwww.benefitscanada.com%2F$0;xdt=1;crlt=UD0J26sIs2;stc=1;chaa=1;sttr=100;prcl=s

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f2.1e100.net

Software

cafe /

Resource Hash

4b61f735ba127d88a8673f26e34a79bc25968d5be1bb43004958065526d28bb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Fri, 01 Sep 2023 13:55:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 41825
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4196
x-xss-protection: 0
server: cafe
etag: 15907914729094346842
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 15 Sep 2023 13:55:12 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 841C 41 KB
13 KB 11ms
11ms Script
text/javascript 172.217.13.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f1.1e100.net

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 26 Aug 2023 15:11:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 555634
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13692
x-xss-protection: 0
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 25 Aug 2024 15:11:43 GMT

GET
DATA 200
OK truncated
/ Frame D36F 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 66bf586b17b91a28f1e6f6370fbf15bb867a5740214dca2b67e98e6666590da0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame FDCD 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9e69137a7f67870542332493cbc2f895b56d60ac0a59c92113b655f69b6dab60

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 841C 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0c18c4124867b5e78d7f21e941c88e30184b57ba05024b696ed2ad8b34946b7a

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/16870859579687053945/23-1127-GAM-Display-video-Eng_728x90/ Frame FEC3 76 KB
20 KB 39ms
12ms Document
text/html 172.217.13.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/16870859579687053945/23-1127-GAM-Display-video-Eng_728x90/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f6.1e100.net

Software

sffe /

Resource Hash

47573ab718b847e465e2c968b7c3052e157285d58e669371d68b29315b675889

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 217293
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 20340
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Wed, 30 Aug 2023 13:10:45 GMT
expires: Thu, 29 Aug 2024 13:10:45 GMT
last-modified: Thu, 27 Jul 2023 14:23:09 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame D36F 0
0 76ms
38ms Fetch
image/gif 172.217.13.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvRd15ZDCurM1oZFFT85DnQSxP-EtG7YsI3VUC9ThBdTDw66S3TuigxZEjSo9FmXPvZ49zg6V8TLL_kRbsp8pqHxsv-OLn1KKlpWUoA5qIgicVG0WW-TYTsi0kymqAU4IIHbwzoj316k8-S8ZdPbfW5NtrjTfRS0ZNSr32PyTYH4qLic17KKc5EOUCWmDudnBCXs_PyMegO&sai=AMfl-YR31_jTRreeuWs-NzvCVhmIiR7imUrjDwH-rFZOuCsX_O8MA3_2VKgmNbu0wmttO2B_5dK53rZaWGBcRCOOC_k8Vb78MdhhkwBgLA&sig=Cg0ArKJSzNBdKxY9T9sAEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=109&cbvp=1&cstd=105&cisv=r20230830.04334&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:18 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 02 Sep 2023 01:32:18 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 4C5F 22 KB
8 KB 13ms
11ms Document
text/html 172.217.13.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f1.1e100.net

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 457468
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 27 Aug 2023 18:27:50 GMT
expires: Mon, 26 Aug 2024 18:27:50 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 7C0C 0
10 B 13ms
12ms Image
text/plain 172.217.13.193
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?nZSP9w
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.217.13.193 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: yul03s05-in-f1.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:18 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/16574131566136882149/ Frame E9C2 5 KB
2 KB 39ms
38ms Document
text/html 172.217.13.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f6.1e100.net

Software

sffe /

Resource Hash

86ca547be7b52490b493ee4b6f24410a3d47bf2e9a2f4b2fa026ca1400be8332

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 1522
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Sat, 02 Sep 2023 01:32:18 GMT
expires: Sun, 01 Sep 2024 01:32:18 GMT
last-modified: Wed, 05 May 2021 20:31:49 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 841C 0
0 38ms
38ms Fetch
image/gif 172.217.13.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstvl75ADCo99tGmvuL4LSNaBcICTZsM-B_XbhboUBU0ZbDgwtd8ZjRgc9GRYBVRMCqwGdsfxqTT1UG1REUo3FwXWrBwhpSyJ0-UqytrlP5cFgS2Bt0hux_g9QtXNXrMWIX0I2GdQAXW4mKoQs8_fFSxwRyzeo3Gm4SKl4MnOWczICX0s3ooc6V-KhZtAEYM5f14hxFsdhDD&sai=AMfl-YRtfqO3-gBCM2NAiytjZrbE9J7xyWjRtc2K1kMz-sxNL-5m3_fN17kIe8Fz1CVOJ0z1LyGUQ9W7SyXkkwf4PW0tA7Zq7YzdgpKxAw&sig=Cg0ArKJSzDiF4Np9fUrZEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=154&cbvp=1&cstd=152&cisv=r20230830.38997&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:18 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 02 Sep 2023 01:32:18 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 00EF 22 KB
8 KB 13ms
11ms Document
text/html 172.217.13.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f1.1e100.net

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 457468
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 27 Aug 2023 18:27:50 GMT
expires: Mon, 26 Aug 2024 18:27:50 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 8127 22 KB
8 KB 13ms
12ms Document
text/html 172.217.13.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f1.1e100.net

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 457468
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 27 Aug 2023 18:27:50 GMT
expires: Mon, 26 Aug 2024 18:27:50 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/16574131566136882149/ Frame CE2D 5 KB
2 KB 29ms
28ms Document
text/html 172.217.13.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f6.1e100.net

Software

sffe /

Resource Hash

86ca547be7b52490b493ee4b6f24410a3d47bf2e9a2f4b2fa026ca1400be8332

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 1522
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Sat, 02 Sep 2023 01:32:18 GMT
expires: Sun, 01 Sep 2024 01:32:18 GMT
last-modified: Wed, 05 May 2021 20:31:49 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame FDCD 0
0 38ms
37ms Fetch
image/gif 172.217.13.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssAQIMcanG3Bee0VK6ejLIJmkUDVdPyqXmbFIL2I-B13mYgQM2mqBRaHF0Ftwdqr6HURX_k2QzPk1Wq57FMVwUlRiE7CeiZveeL8hO8zXJQA3_waX9nW9zExDpNaA4O8tfAGWMnxIBpnrodT8p2D8QplQfp_oRceOG-GP60DYRRBdX5mbihDxQwN30ALmy4-CrJPg_Ezb11&sai=AMfl-YTavhhMFtY5EGRtSo2OnAFQa66Hj9l0XV2wcZIlsV9M9anF2kAy9TU918mjM3z5EjR41zpuUqmpDoXTthYjTbFQ4OFmzV01NTYk-w&sig=Cg0ArKJSzN_829S1OQohEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=175&cbvp=1&cstd=174&cisv=r20230830.82305&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:18 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 02 Sep 2023 01:32:18 GMT

GET
H3 200 BMO-logo_2R.svg.js Show response
s0.2mdn.net/sadbundle/16870859579687053945/23-1127-GAM-Display-video-Eng_728x90/ Frame FEC3 2 KB
1 KB 14ms
13ms Script
application/x-javascript 172.217.13.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/16870859579687053945/23-1127-GAM-Display-video-Eng_728x90/BMO-logo_2R.svg.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16870859579687053945/23-1127-GAM-Display-video-Eng_728x90/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f6.1e100.net

Software

sffe /

Resource Hash

40a2c1a9097ba1cdf4cb7fad3a2484ff69ed39d070fef6d69131801e7f646c22

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16870859579687053945/23-1127-GAM-Display-video-Eng_728x90/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Wed, 30 Aug 2023 13:10:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 217293
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1091
x-xss-protection: 0
last-modified: Thu, 27 Jul 2023 14:23:09 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 29 Aug 2024 13:10:45 GMT

GET
H3 200 Learn-more_eng_Rev.svg.js Show response
s0.2mdn.net/sadbundle/16870859579687053945/23-1127-GAM-Display-video-Eng_728x90/ Frame FEC3 2 KB
962 B 15ms
14ms Script
application/x-javascript 172.217.13.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/16870859579687053945/23-1127-GAM-Display-video-Eng_728x90/Learn-more_eng_Rev.svg.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16870859579687053945/23-1127-GAM-Display-video-Eng_728x90/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f6.1e100.net

Software

sffe /

Resource Hash

533782fe48b7cbf09750419bf306d38d73988942901aa7e323f24c45c8c9df88

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16870859579687053945/23-1127-GAM-Display-video-Eng_728x90/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Wed, 30 Aug 2023 13:10:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 217293
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 933
x-xss-protection: 0
last-modified: Thu, 27 Jul 2023 14:23:09 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 29 Aug 2024 13:10:45 GMT

GET
H2 200 main.19.8.439.js Show response
static.adsafeprotected.com/ Frame FDCD 207 KB
65 KB 123ms
37ms Script
application/javascript 18.165.9.12
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/main.19.8.439.js
Requested by: Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rjss/st/1347897/69359102/skeleton.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.9.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-9-12.pit50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: efc2b5f3cfb42ac86c11900be6091d645853af46ab4f01bfba7280c3ac37ae02

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Wed, 09 Aug 2023 13:44:02 GMT
x-amz-version-id: jxULgCd28jZVPRI.j5D8yH73I4fVMdj5
content-encoding: gzip
via: 1.1 029770487313d967c36e80d84bd19a44.cloudfront.net (CloudFront)
x-amz-cf-pop: PIT50-P1
age: 2029697
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 08 Aug 2023 19:01:42 GMT
server: AmazonS3
etag: W/"f00fcc2e1b804b8a3edfbb8cb19bddaa"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: I6PMNFUILyWaQmIh7cGK93X0aSIK3YtRO7uPG-9CsJkL97Imv-4fww==

GET
H3 200 main.css
s0.2mdn.net/sadbundle/16574131566136882149/styles/ Frame E9C2 7 KB
1 KB 34ms
34ms Stylesheet
text/css 172.217.13.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/16574131566136882149/styles/main.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f6.1e100.net

Software

sffe /

Resource Hash

4bf167b2b41dff122d605ffe138eaea06674108c4acc5bf97c2152696f325424

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1299
x-xss-protection: 0
last-modified: Wed, 05 May 2021 20:31:49 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 01 Sep 2024 01:32:18 GMT

GET
H3 200 globe.png
s0.2mdn.net/sadbundle/16574131566136882149/images/ Frame E9C2 40 KB
40 KB 37ms
36ms Image
image/png 172.217.13.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16574131566136882149/images/globe.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f6.1e100.net

Software

sffe /

Resource Hash

13913cb4bc2713aa502124640903ac1a664e1dbbf5009b992a8460af09634632

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:18 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 40566
x-xss-protection: 0
last-modified: Wed, 05 May 2021 20:31:49 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 01 Sep 2024 01:32:18 GMT

GET
H3 200 f1_txt1.svg
s0.2mdn.net/sadbundle/16574131566136882149/images/ Frame E9C2 18 KB
4 KB 40ms
39ms Image
image/svg+xml 172.217.13.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16574131566136882149/images/f1_txt1.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f6.1e100.net

Software

sffe /

Resource Hash

545352fca284287fb75bd635ec754346854faf6fdb5885a063116814a9c7626e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 05 May 2021 20:31:49 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 01 Sep 2024 01:32:18 GMT

GET
H3 200 f2_txt1.svg
s0.2mdn.net/sadbundle/16574131566136882149/images/ Frame E9C2 6 KB
2 KB 58ms
55ms Image
image/svg+xml 172.217.13.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16574131566136882149/images/f2_txt1.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f6.1e100.net

Software

sffe /

Resource Hash

8fa9ad5689dce99bd6c2acdd7df991228a365f7eb8f8c8e03bd7ffdc84c142fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2012
x-xss-protection: 0
last-modified: Wed, 05 May 2021 20:31:49 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 01 Sep 2024 01:32:18 GMT

GET
H3 200 f2_txt2.svg
s0.2mdn.net/sadbundle/16574131566136882149/images/ Frame E9C2 8 KB
3 KB 44ms
41ms Image
image/svg+xml 172.217.13.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16574131566136882149/images/f2_txt2.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f6.1e100.net

Software

sffe /

Resource Hash

bcb32fbdffcceb701d3eee56133a5890cf51850c69d22d429bcc3b48b782f1bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2568
x-xss-protection: 0
last-modified: Wed, 05 May 2021 20:31:49 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 01 Sep 2024 01:32:18 GMT

GET
H3 200 f3_txt1.svg
s0.2mdn.net/sadbundle/16574131566136882149/images/ Frame E9C2 17 KB
5 KB 56ms
53ms Image
image/svg+xml 172.217.13.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16574131566136882149/images/f3_txt1.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f6.1e100.net

Software

sffe /

Resource Hash

25223585444df85d831c9f3100e86505e458f748cbdda44cece7043d81ea393a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 05 May 2021 20:31:49 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 01 Sep 2024 01:32:18 GMT

GET
H3 200 pattern.svg
s0.2mdn.net/sadbundle/16574131566136882149/images/ Frame E9C2 655 B
345 B 47ms
44ms Image
image/svg+xml 172.217.13.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16574131566136882149/images/pattern.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f6.1e100.net

Software

sffe /

Resource Hash

1f4fcb5a0843275c87c1a34f23d96ac1ab39051cc41f9b071c66a4e7ea916347

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 317
x-xss-protection: 0
last-modified: Wed, 05 May 2021 20:31:49 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 01 Sep 2024 01:32:18 GMT

GET
H3 200 glare.png
s0.2mdn.net/sadbundle/16574131566136882149/images/ Frame E9C2 3 KB
3 KB 50ms
47ms Image
image/png 172.217.13.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16574131566136882149/images/glare.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f6.1e100.net

Software

sffe /

Resource Hash

157887652c78ab7eb82fb3adef93c3344dcc4ce864d878dda2b6ded962ecf537

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:18 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3324
x-xss-protection: 0
last-modified: Wed, 05 May 2021 20:31:49 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 01 Sep 2024 01:32:18 GMT

GET
H3 200 cta.svg
s0.2mdn.net/sadbundle/16574131566136882149/images/ Frame E9C2 2 KB
1 KB 46ms
43ms Image
image/svg+xml 172.217.13.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16574131566136882149/images/cta.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f6.1e100.net

Software

sffe /

Resource Hash

583af8a07ffac1285fba3f94907106a9ff1f51404c97cf753b9da29071bee164

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1023
x-xss-protection: 0
last-modified: Wed, 05 May 2021 20:31:49 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 01 Sep 2024 01:32:18 GMT

GET
H3 200 logo.svg
s0.2mdn.net/sadbundle/16574131566136882149/images/ Frame E9C2 4 KB
2 KB 48ms
45ms Image
image/svg+xml 172.217.13.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16574131566136882149/images/logo.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f6.1e100.net

Software

sffe /

Resource Hash

1a102a4c8db58abe65a64a5f963e557c82fa3c37236a854fdce524ca71cdd695

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1659
x-xss-protection: 0
last-modified: Wed, 05 May 2021 20:31:49 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 01 Sep 2024 01:32:18 GMT

GET
H3 200 code.svg
s0.2mdn.net/sadbundle/16574131566136882149/images/ Frame E9C2 2 KB
1 KB 49ms
46ms Image
image/svg+xml 172.217.13.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16574131566136882149/images/code.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f6.1e100.net

Software

sffe /

Resource Hash

22f2d9f0b79a682c7b96bd242dca09c3c338fe0e52c5be03106a4eb587e53c7e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1035
x-xss-protection: 0
last-modified: Wed, 05 May 2021 20:31:49 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 01 Sep 2024 01:32:18 GMT

GET
H3 200 main.css
s0.2mdn.net/sadbundle/16574131566136882149/styles/ Frame CE2D 7 KB
1 KB 30ms
29ms Stylesheet
text/css 172.217.13.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/16574131566136882149/styles/main.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f6.1e100.net

Software

sffe /

Resource Hash

4bf167b2b41dff122d605ffe138eaea06674108c4acc5bf97c2152696f325424

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1299
x-xss-protection: 0
last-modified: Wed, 05 May 2021 20:31:49 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 01 Sep 2024 01:32:18 GMT

GET
H3 200 globe.png
s0.2mdn.net/sadbundle/16574131566136882149/images/ Frame CE2D 40 KB
40 KB 37ms
37ms Image
image/png 172.217.13.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16574131566136882149/images/globe.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f6.1e100.net

Software

sffe /

Resource Hash

13913cb4bc2713aa502124640903ac1a664e1dbbf5009b992a8460af09634632

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:18 GMT
x-content-type-options: nosniff
age: 0
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 40566
x-xss-protection: 0
last-modified: Wed, 05 May 2021 20:31:49 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 01 Sep 2024 01:32:18 GMT

GET
H3 200 f1_txt1.svg
s0.2mdn.net/sadbundle/16574131566136882149/images/ Frame CE2D 18 KB
4 KB 40ms
40ms Image
image/svg+xml 172.217.13.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16574131566136882149/images/f1_txt1.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f6.1e100.net

Software

sffe /

Resource Hash

545352fca284287fb75bd635ec754346854faf6fdb5885a063116814a9c7626e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4438
x-xss-protection: 0
last-modified: Wed, 05 May 2021 20:31:49 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 01 Sep 2024 01:32:18 GMT

GET
H3 200 f2_txt1.svg
s0.2mdn.net/sadbundle/16574131566136882149/images/ Frame CE2D 6 KB
2 KB 62ms
59ms Image
image/svg+xml 172.217.13.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16574131566136882149/images/f2_txt1.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f6.1e100.net

Software

sffe /

Resource Hash

8fa9ad5689dce99bd6c2acdd7df991228a365f7eb8f8c8e03bd7ffdc84c142fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2012
x-xss-protection: 0
last-modified: Wed, 05 May 2021 20:31:49 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 01 Sep 2024 01:32:18 GMT

GET
H3 200 f2_txt2.svg
s0.2mdn.net/sadbundle/16574131566136882149/images/ Frame CE2D 8 KB
3 KB 48ms
45ms Image
image/svg+xml 172.217.13.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16574131566136882149/images/f2_txt2.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f6.1e100.net

Software

sffe /

Resource Hash

bcb32fbdffcceb701d3eee56133a5890cf51850c69d22d429bcc3b48b782f1bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2568
x-xss-protection: 0
last-modified: Wed, 05 May 2021 20:31:49 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 01 Sep 2024 01:32:18 GMT

GET
H3 200 f3_txt1.svg
s0.2mdn.net/sadbundle/16574131566136882149/images/ Frame CE2D 17 KB
5 KB 60ms
57ms Image
image/svg+xml 172.217.13.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16574131566136882149/images/f3_txt1.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f6.1e100.net

Software

sffe /

Resource Hash

25223585444df85d831c9f3100e86505e458f748cbdda44cece7043d81ea393a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4894
x-xss-protection: 0
last-modified: Wed, 05 May 2021 20:31:49 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 01 Sep 2024 01:32:18 GMT

GET
H3 200 pattern.svg
s0.2mdn.net/sadbundle/16574131566136882149/images/ Frame CE2D 655 B
346 B 54ms
51ms Image
image/svg+xml 172.217.13.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16574131566136882149/images/pattern.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f6.1e100.net

Software

sffe /

Resource Hash

1f4fcb5a0843275c87c1a34f23d96ac1ab39051cc41f9b071c66a4e7ea916347

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 317
x-xss-protection: 0
last-modified: Wed, 05 May 2021 20:31:49 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 01 Sep 2024 01:32:18 GMT

GET
H3 200 glare.png
s0.2mdn.net/sadbundle/16574131566136882149/images/ Frame CE2D 3 KB
3 KB 59ms
56ms Image
image/png 172.217.13.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16574131566136882149/images/glare.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f6.1e100.net

Software

sffe /

Resource Hash

157887652c78ab7eb82fb3adef93c3344dcc4ce864d878dda2b6ded962ecf537

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:18 GMT
x-content-type-options: nosniff
age: 0
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3324
x-xss-protection: 0
last-modified: Wed, 05 May 2021 20:31:49 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 01 Sep 2024 01:32:18 GMT

GET
H3 200 cta.svg
s0.2mdn.net/sadbundle/16574131566136882149/images/ Frame CE2D 2 KB
1 KB 55ms
52ms Image
image/svg+xml 172.217.13.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16574131566136882149/images/cta.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f6.1e100.net

Software

sffe /

Resource Hash

583af8a07ffac1285fba3f94907106a9ff1f51404c97cf753b9da29071bee164

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1023
x-xss-protection: 0
last-modified: Wed, 05 May 2021 20:31:49 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 01 Sep 2024 01:32:18 GMT

GET
H3 200 logo.svg
s0.2mdn.net/sadbundle/16574131566136882149/images/ Frame CE2D 4 KB
2 KB 56ms
54ms Image
image/svg+xml 172.217.13.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16574131566136882149/images/logo.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f6.1e100.net

Software

sffe /

Resource Hash

1a102a4c8db58abe65a64a5f963e557c82fa3c37236a854fdce524ca71cdd695

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1659
x-xss-protection: 0
last-modified: Wed, 05 May 2021 20:31:49 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 01 Sep 2024 01:32:18 GMT

GET
H3 200 code.svg
s0.2mdn.net/sadbundle/16574131566136882149/images/ Frame CE2D 2 KB
1 KB 58ms
55ms Image
image/svg+xml 172.217.13.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16574131566136882149/images/code.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f6.1e100.net

Software

sffe /

Resource Hash

22f2d9f0b79a682c7b96bd242dca09c3c338fe0e52c5be03106a4eb587e53c7e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16574131566136882149/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1035
x-xss-protection: 0
last-modified: Wed, 05 May 2021 20:31:49 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 01 Sep 2024 01:32:18 GMT

GET
H2 200 main.19.8.439.js Show response
static.adsafeprotected.com/ Frame 841C 207 KB
65 KB 123ms
55ms Script
application/javascript 18.165.9.12
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/main.19.8.439.js
Requested by: Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rjss/st/1347897/69359102/skeleton.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.9.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-9-12.pit50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: efc2b5f3cfb42ac86c11900be6091d645853af46ab4f01bfba7280c3ac37ae02

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Wed, 09 Aug 2023 13:44:02 GMT
x-amz-version-id: jxULgCd28jZVPRI.j5D8yH73I4fVMdj5
content-encoding: gzip
via: 1.1 029770487313d967c36e80d84bd19a44.cloudfront.net (CloudFront)
x-amz-cf-pop: PIT50-P1
age: 2029697
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 08 Aug 2023 19:01:42 GMT
server: AmazonS3
etag: W/"f00fcc2e1b804b8a3edfbb8cb19bddaa"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: Yblsy2SYY8Zl1wxyloUw6gFUedImDX-389C88bRa5JEfAPjQsQl8lg==

GET
H3 200 45TQ4WJNUFNsi_RKEccy4FYYQq63aBzPbRMjDYcMLJU.js Show response
pagead2.googlesyndication.com/bg/ Frame 4C5F 38 KB
15 KB 11ms
10ms Script
text/javascript 172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/45TQ4WJNUFNsi_RKEccy4FYYQq63aBzPbRMjDYcMLJU.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f2.1e100.net

Software

sffe /

Resource Hash

e394d0e1624d50536c8bf44a11c732e0561842aeb7681ccf6d13230d870c2c95

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Tue, 29 Aug 2023 14:20:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 299526
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14879
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 28 Aug 2024 14:20:12 GMT

GET
H3 200 45TQ4WJNUFNsi_RKEccy4FYYQq63aBzPbRMjDYcMLJU.js Show response
pagead2.googlesyndication.com/bg/ Frame 00EF 38 KB
15 KB 12ms
12ms Script
text/javascript 172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/45TQ4WJNUFNsi_RKEccy4FYYQq63aBzPbRMjDYcMLJU.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f2.1e100.net

Software

sffe /

Resource Hash

e394d0e1624d50536c8bf44a11c732e0561842aeb7681ccf6d13230d870c2c95

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Tue, 29 Aug 2023 14:20:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 299526
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14879
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 28 Aug 2024 14:20:12 GMT

GET
H3 200 45TQ4WJNUFNsi_RKEccy4FYYQq63aBzPbRMjDYcMLJU.js Show response
pagead2.googlesyndication.com/bg/ Frame 8127 38 KB
15 KB 12ms
11ms Script
text/javascript 172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/45TQ4WJNUFNsi_RKEccy4FYYQq63aBzPbRMjDYcMLJU.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f2.1e100.net

Software

sffe /

Resource Hash

e394d0e1624d50536c8bf44a11c732e0561842aeb7681ccf6d13230d870c2c95

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Tue, 29 Aug 2023 14:20:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 299526
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14879
x-xss-protection: 0
last-modified: Mon, 28 Aug 2023 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 28 Aug 2024 14:20:12 GMT

GET
H2 200 5997a0ab8fcdcc20f9e8f00b5317fac94c45721f
tqe36.flx10.com/ Frame FEC3 135 KB
135 KB 88ms
22ms Font
font/otf 151.139.128.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://tqe36.flx10.com/5997a0ab8fcdcc20f9e8f00b5317fac94c45721f?subset=Suporting%20hes%2Caf%2E
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16870859579687053945/23-1127-GAM-Display-video-Eng_728x90/index.html?ev=01_250
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: map3.hwcdn.net
Software: AmazonS3 /
Resource Hash: 31a2ac142ca8f3347708d4499a703e31f2ee6a7acab9a8392e79335302993947

Request headers

Referer: https://s0.2mdn.net/
Origin: https://s0.2mdn.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:18 GMT
last-modified: Wed, 03 Aug 2022 15:17:11 GMT
server: AmazonS3
x-amz-request-id: 9MA1CGA08JCZJRWJ
etag: "fef1a5c8f9100b8c48abec4daaf59018"
x-hw: 1693618338.cds217.tr2.hn,1693618338.cds209.tr2.c
content-type: font/otf
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
content-length: 137836
x-amz-id-2: ZDP4Z1QYt77/6GWcRnmJfOMDVwCtaOKe0MT81s85N6J79DJgJ+IJvhkkl2glYDmCI8pRvDjd8eWMk+OJJdyE0g==

GET
H2 200 011191a7790031a5bed4f7de0c368bed28340c20
tqe36.flx10.com/ Frame FEC3 140 KB
140 KB 117ms
51ms Font
font/otf 151.139.128.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://tqe36.flx10.com/011191a7790031a5bed4f7de0c368bed28340c20?subset=Suporting%20hes%2Caf%2E
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16870859579687053945/23-1127-GAM-Display-video-Eng_728x90/index.html?ev=01_250
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: map3.hwcdn.net
Software: AmazonS3 /
Resource Hash: 57ab4a5d1018a5fabfd46143b3ada119096d004876a8109f61ca2db62f2dc78c

Request headers

Referer: https://s0.2mdn.net/
Origin: https://s0.2mdn.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:18 GMT
last-modified: Wed, 03 Aug 2022 15:17:07 GMT
server: AmazonS3
x-amz-request-id: 1PDA4XE3GK60T63Y
etag: "326033aefaeba03162f3ed17e2c2dd73"
x-hw: 1693618338.cds217.tr2.hn,1693618338.cds203.tr2.c
content-type: font/otf
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
content-length: 142900
x-amz-id-2: UBRJUwCgz9Ron+7FgkxiKQQZedZhjPOPlApAt9FI0y5ffFUVd7TqPEcfymGtjcR+qBrWQ1K488o=

GET
H2 200 6ef103283e242d22946a4000fad017638ef44dc0
tqe36.flx10.com/ Frame FEC3 139 KB
139 KB 131ms
65ms Font
font/otf 151.139.128.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://tqe36.flx10.com/6ef103283e242d22946a4000fad017638ef44dc0?subset=Drivng%20poesthaucmwdly%2ESf
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16870859579687053945/23-1127-GAM-Display-video-Eng_728x90/index.html?ev=01_250
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: map3.hwcdn.net
Software: AmazonS3 /
Resource Hash: 08b7a780bab13f35e4f7a8ed67f363ca5333fde5f6190c10fef6fe78275f4874

Request headers

Referer: https://s0.2mdn.net/
Origin: https://s0.2mdn.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:18 GMT
last-modified: Wed, 03 Aug 2022 15:16:58 GMT
server: AmazonS3
x-amz-request-id: 1PD6T5ATVSESMC4T
etag: "9fb2ec123a1630f3e945126c59b7bbb6"
x-hw: 1693618338.cds217.tr2.hn,1693618338.cds217.tr2.c
content-type: font/otf
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
content-length: 141872
x-amz-id-2: 8VWOeNA+O42c5vmaJf2U5PvoBmn8d8/tyhl3R560WlU1O/n/G6BM3VJSG+ekccM/zx2bGVQ3FTx2cpHk2ce9Qg==

GET
H2 200 7712f02a49a96ec86436906f33056af80d399756
tqe36.flx10.com/ Frame FEC3 139 KB
140 KB 132ms
66ms Font
font/otf 151.139.128.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://tqe36.flx10.com/7712f02a49a96ec86436906f33056af80d399756?subset=creat%20youlivngsfm
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16870859579687053945/23-1127-GAM-Display-video-Eng_728x90/index.html?ev=01_250
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: map3.hwcdn.net
Software: AmazonS3 /
Resource Hash: c55c077b3af3907481a2ef2763ed20420a6dd80d1f6ccfc05ed178a3e1f006c8

Request headers

Referer: https://s0.2mdn.net/
Origin: https://s0.2mdn.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:18 GMT
last-modified: Wed, 03 Aug 2022 15:17:26 GMT
server: AmazonS3
x-amz-request-id: 1PD7VR5KQHV0BPSN
etag: "e489553a78d75004a5f703f8de138fed"
x-hw: 1693618338.cds217.tr2.hn,1693618338.cds004.tr2.c
content-type: font/otf
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
content-length: 142640
x-amz-id-2: AHIhkPR81exIVPnwx25/Hn47IKOJUJ0qveokx41e5X3zsouEAJNZBTS16PP/A+XOsM+v32ok4uU=

GET
H3 200 bg.jpg
s0.2mdn.net/sadbundle/16574131566136882149/images/ Frame CE2D 13 KB
13 KB 57ms
54ms Image
image/jpeg 172.217.13.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16574131566136882149/images/bg.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16574131566136882149/styles/main.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f6.1e100.net

Software

sffe /

Resource Hash

e626d3fb541ebc90026c4cb5cf3fb8586536cd95cc9f1db87469f24adde77f23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16574131566136882149/styles/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:18 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13127
x-xss-protection: 0
last-modified: Wed, 05 May 2021 20:31:49 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 01 Sep 2024 01:32:18 GMT

GET
H3 200 bg.jpg
s0.2mdn.net/sadbundle/16574131566136882149/images/ Frame E9C2 13 KB
13 KB 59ms
56ms Image
image/jpeg 172.217.13.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16574131566136882149/images/bg.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16574131566136882149/styles/main.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f6.1e100.net

Software

sffe /

Resource Hash

e626d3fb541ebc90026c4cb5cf3fb8586536cd95cc9f1db87469f24adde77f23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16574131566136882149/styles/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:18 GMT
x-content-type-options: nosniff
age: 0
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13127
x-xss-protection: 0
last-modified: Wed, 05 May 2021 20:31:49 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 01 Sep 2024 01:32:18 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 841C 0
0 36ms
35ms Fetch
image/gif 172.217.13.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstvl75ADCo99tGmvuL4LSNaBcICTZsM-B_XbhboUBU0ZbDgwtd8ZjRgc9GRYBVRMCqwGdsfxqTT1UG1REUo3FwXWrBwhpSyJ0-UqytrlP5cFgS2Bt0hux_g9QtXNXrMWIX0I2GdQAXW4mKoQs8_fFSxwRyzeo3Gm4SKl4MnOWczICX0s3ooc6V-KhZtAEYM5f14hxFsdhDD&sai=AMfl-YRtfqO3-gBCM2NAiytjZrbE9J7xyWjRtc2K1kMz-sxNL-5m3_fN17kIe8Fz1CVOJ0z1LyGUQ9W7SyXkkwf4PW0tA7Zq7YzdgpKxAw&sig=Cg0ArKJSzDiF4Np9fUrZEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=476&vt=11&dtpt=322&dett=3&cstd=152&cisv=r20230830.38997&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:18 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 02 Sep 2023 01:32:18 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame FDCD 0
0 38ms
37ms Fetch
image/gif 172.217.13.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssAQIMcanG3Bee0VK6ejLIJmkUDVdPyqXmbFIL2I-B13mYgQM2mqBRaHF0Ftwdqr6HURX_k2QzPk1Wq57FMVwUlRiE7CeiZveeL8hO8zXJQA3_waX9nW9zExDpNaA4O8tfAGWMnxIBpnrodT8p2D8QplQfp_oRceOG-GP60DYRRBdX5mbihDxQwN30ALmy4-CrJPg_Ezb11&sai=AMfl-YTavhhMFtY5EGRtSo2OnAFQa66Hj9l0XV2wcZIlsV9M9anF2kAy9TU918mjM3z5EjR41zpuUqmpDoXTthYjTbFQ4OFmzV01NTYk-w&sig=Cg0ArKJSzN_829S1OQohEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=487&vt=11&dtpt=312&dett=3&cstd=174&cisv=r20230830.82305&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:18 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 02 Sep 2023 01:32:18 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame D36F 0
0 36ms
36ms Fetch
image/gif 172.217.13.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvRd15ZDCurM1oZFFT85DnQSxP-EtG7YsI3VUC9ThBdTDw66S3TuigxZEjSo9FmXPvZ49zg6V8TLL_kRbsp8pqHxsv-OLn1KKlpWUoA5qIgicVG0WW-TYTsi0kymqAU4IIHbwzoj316k8-S8ZdPbfW5NtrjTfRS0ZNSr32PyTYH4qLic17KKc5EOUCWmDudnBCXs_PyMegO&sai=AMfl-YR31_jTRreeuWs-NzvCVhmIiR7imUrjDwH-rFZOuCsX_O8MA3_2VKgmNbu0wmttO2B_5dK53rZaWGBcRCOOC_k8Vb78MdhhkwBgLA&sig=Cg0ArKJSzNBdKxY9T9sAEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=505&vt=11&dtpt=396&dett=3&cstd=105&cisv=r20230830.04334&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: www.benefitscanada.com
URL: https://www.benefitscanada.com/canadian-investment-review/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:18 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 02 Sep 2023 01:32:18 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame D36F 0
0 37ms
36ms Fetch
image/gif 172.217.13.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvuNmKmBAiR_OTbKVTzhwLq5BokCvWqCczLcJ0-ESvutn5674GbeHBKXPldzVcYw6QPM_yAZNwYFERFel4dslDa-83k5YLoFeYnOGHS3i7NgEptSfHM4c7qEu8MGRiWXFUa5R7gJG6BsdHQP9yrSCiCbBoU8StTbVjBUahMm-jknuw7XDVVETV4Ta9wNq48rb-5Azipu4HKajuWCCQheBRs9snamysrsHFDp1BaklpftMCOhKag5NmtDH06rxuObZWXnrP3cmvKSGhy1CH5ug7Ygg10MwaDuwU2BoEhztDeYsX65-L4FrlfWX5JloDWWYJqoMnvVug9ax2VHZYDWJ6XNMdpoMyGBbT5Izm20fPsLza96wcFGhnp-Z1OX-SC36uDFgo5EnRbK63UUTDpbVDVJA&sai=AMfl-YQcrgiEl5VqzyaVkb3CA2c0nhWdBKB3KcTePue6SsSGWIklNtRi72Gvoe7-mZSNslnhRoD3rwKSkTtH2g78d6kGvTwlOhxlVq_nw6ezqocm-x1LRGyo6lDntAsRplAd5eFKatcw4G6Vyp_U4vk&sig=Cg0ArKJSzIh2cD4Dxk96EAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:18 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 02 Sep 2023 01:32:18 GMT

GET
H3 200 GettyImages-1156574117-REV2.jpg
s0.2mdn.net/sadbundle/16870859579687053945/23-1127-GAM-Display-video-Eng_728x90/ Frame FEC3 66 KB
66 KB 12ms
12ms Image
image/jpeg 172.217.13.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16870859579687053945/23-1127-GAM-Display-video-Eng_728x90/GettyImages-1156574117-REV2.jpg?

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f6.1e100.net

Software

sffe /

Resource Hash

a5f91d77c5942b2b530ebbeaaf581b968801dacf4dfddea3fd72217e5d4166c9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16870859579687053945/23-1127-GAM-Display-video-Eng_728x90/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Wed, 30 Aug 2023 13:10:47 GMT
x-content-type-options: nosniff
age: 217291
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 67662
x-xss-protection: 0
last-modified: Thu, 27 Jul 2023 14:23:09 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 29 Aug 2024 13:10:47 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame FDCD 0
0 36ms
35ms Fetch
image/gif 172.217.13.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu8v0ZTCvt21isUg378YNRV_ddQK8bkcaOMTdFMROQ7Dy8etJ2_BmAqtxbPpK2YKW6jfNRSVqr_8wkgzJ9IbrdIRcxQSHUDUWr-_DhhQRG2fP3FlIgDLI0kjwyaPdvrf_hitMvqHtXHI_C0P59NV4A9W3bit0uPM0F_U88t3VXP3I3KKf_HVZAGkZFWj5GFQnXx2QYk3bXqhe0UYlVcKcuNv3C6M__ikTl9QOYSy9jxuZDtgyHu3mmItyK9OeujRq5epBIbWUyZnrAZPy-fa2XIJHlxkYqjq2DWZ5XMjXMTQVasLgwDVWczn5tfz3o2O4G4ax60p5kWExQibms1J0QJpcKda67OpScbjWtM681cjBzpxKiAVufWCfv32fVQWDzZ37PTx55agKblac4E&sai=AMfl-YSQ8Q1z34cRDhTzmC7okZdVCNB57u_yhdJgwDkaplk7xE69ksWXacSu-H-ImSOS0IMDaboGxlZ8bed31vCqUrZtx4RNe8YaidwBG7aPCbmaHoIdiGOzoEHwkbF3iq-6I_E1ADOEr_jSb_puerAe&sig=Cg0ArKJSzPbiiTQxub8IEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:18 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 02 Sep 2023 01:32:18 GMT

GET
H2

200

skeleton.js Show response
static.adsafeprotected.com/ Frame FDCD
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/1347897/69359102/skeleton.js?adsafe_url=https%3A%2F%2Fwww.benefitscanada.com&adsafe_type=y&adsafe_url=https%3A%2F%2Fwww.benefitscanada.com%2F&adsafe_type=e&ads...
https://static.adsafeprotected.com/skeleton.js

17 B
464 B

29ms
29ms

Script
application/javascript

18.165.9.12
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/skeleton.js
Protocol: H2
Server: 18.165.9.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-9-12.pit50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: bdeed1e1c0751610c8f3dc2a5c78c93f841c366b36a7f7a54f5e6752c2656c05

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Tue, 01 Aug 2023 00:59:33 GMT
x-amz-version-id: nylqTweorRThFHMBJSrf_fHcWx3KVKN3
via: 1.1 029770487313d967c36e80d84bd19a44.cloudfront.net (CloudFront)
x-amz-cf-pop: PIT50-P1
age: 2766766
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 17
last-modified: Mon, 17 Aug 2020 23:54:35 GMT
server: AmazonS3
etag: "53fab767ecbd3bf07990b10246befbd4"
content-type: application/javascript
cache-control: max-age=315360000
accept-ranges: bytes
x-amz-cf-id: xsjXA_UN553Ka5Rb5Y256EXqcfGQeYzjem2w72-_twDbor6GRqQbxA==

Redirect headers

pragma: no-cache
date: Sat, 02 Sep 2023 01:32:18 GMT
server: nginx
x-server-name: app29.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/skeleton.js
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame 974B 91 KB
23 KB 30ms
29ms Script
application/javascript 18.165.9.12
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: 4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com
URL: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.9.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-9-12.pit50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Mon, 31 Jul 2023 03:25:40 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 029770487313d967c36e80d84bd19a44.cloudfront.net (CloudFront)
x-amz-cf-pop: PIT50-P1
age: 2844399
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: W4CHk4XRIebWkveEB3-e2lLzW1SG76X7GjAuiFmIMm_ER6xpDYAKEQ==

GET
H2

200

skeleton.js Show response
static.adsafeprotected.com/ Frame 841C
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/1347897/69359102/skeleton.js?adsafe_url=https%3A%2F%2Fwww.benefitscanada.com&adsafe_type=y&adsafe_url=https%3A%2F%2Fwww.benefitscanada.com%2F&adsafe_type=e&ads...
https://static.adsafeprotected.com/skeleton.js

17 B
464 B

29ms
28ms

Script
application/javascript

18.165.9.12
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/skeleton.js
Requested by: Host: 4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com
URL: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 18.165.9.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-9-12.pit50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: bdeed1e1c0751610c8f3dc2a5c78c93f841c366b36a7f7a54f5e6752c2656c05

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Tue, 01 Aug 2023 00:59:33 GMT
x-amz-version-id: nylqTweorRThFHMBJSrf_fHcWx3KVKN3
via: 1.1 029770487313d967c36e80d84bd19a44.cloudfront.net (CloudFront)
x-amz-cf-pop: PIT50-P1
age: 2766766
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 17
last-modified: Mon, 17 Aug 2020 23:54:35 GMT
server: AmazonS3
etag: "53fab767ecbd3bf07990b10246befbd4"
content-type: application/javascript
cache-control: max-age=315360000
accept-ranges: bytes
x-amz-cf-id: sMAnwTrga-bLIE3ytvZ5afvr3z_1Befzq1cvBUAoY4OO0XNWIum3pA==

Redirect headers

pragma: no-cache
date: Sat, 02 Sep 2023 01:32:18 GMT
server: nginx
x-server-name: app17.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/skeleton.js
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame 6C5C 91 KB
23 KB 30ms
29ms Script
application/javascript 18.165.9.12
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: 4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com
URL: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.9.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-9-12.pit50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Mon, 31 Jul 2023 03:25:40 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 029770487313d967c36e80d84bd19a44.cloudfront.net (CloudFront)
x-amz-cf-pop: PIT50-P1
age: 2844399
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: ByitN1Tt0eIgMpGCbGI32UFQsYDw9f5uhDk5Ju_orBAmAG1veLUxUw==

GET
H2 502 dt
dt.adsafeprotected.com/ Frame FDCD 0
0 291ms
95ms Image
text/html 52.40.92.86
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1347897&asId=b04fd5c3-41f7-22e9-37d0-8c7a894c72d5&tv=%7Bc:mZ8DQc,pingTime:-3,time:382,type:v,clog:%5B%7Bpiv:-1,vs:n,r:,w:300,h:250,t:310%7D,%7Bpiv:0,vs:o,r:l,t:381%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:382,n:381,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:310,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B82~1,0~0%5D,as:%5B82~300.250%5D%7D%7D,%7Bsl:o,t:381,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B1~0%5D,as:%5B1~300.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tOEVWVA+11%7C12%7C131%7C1321%7C14*.1347897-69359102%7C1411%7C142%7C151%7C1521%7C16%7C17%7C18%7C19%7C1a,idMap:14*,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:312%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.40.92.86 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-40-92-86.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

GET
H2 200 dt
dt.adsafeprotected.com/ Frame FDCD 43 B
215 B 290ms
97ms Image
image/gif 52.40.92.86
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1347897&asId=b04fd5c3-41f7-22e9-37d0-8c7a894c72d5&tv=%7Bc:mZ8DQd,pingTime:-6,time:383,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:383,n:381,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:310,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B82~1,0~0%5D,as:%5B82~300.250%5D%7D%7D,%7Bsl:o,t:381,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B3~0%5D,as:%5B3~300.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tOEVWVA+11%7C12%7C131%7C1321%7C14*.1347897-69359102%7C1411%7C142%7C151%7C1521%7C16%7C17%7C18%7C19%7C1a,idMap:14*,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:312%7D&tpiLookup=ao:www.benefitscanada.com*&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.40.92.86 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-40-92-86.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Sep 2023 01:32:18 GMT
server: nginx
x-server-name: dt04.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 841C 43 B
215 B 369ms
181ms Image
image/gif 52.40.92.86
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1347897&asId=d83a4d1e-1542-a13c-cb90-ee040b3ae6a6&tv=%7Bc:mZ8DQk,pingTime:-3,time:372,type:v,clog:%5B%7Bpiv:-1,vs:n,r:,w:300,h:250,t:316%7D,%7Bpiv:0,vs:o,r:l,t:372%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:372,n:371,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:316,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B60~1,0~0%5D,as:%5B60~300.250%5D%7D%7D,%7Bsl:o,t:371,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B0~0%5D,as:%5B0~300.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tOEVWVA+11%7C12%7C131%7C1321%7C14.1347897-69359102%7C1411%7C142%7C143%7C15*.1347897-69359102%7C151%7C1521%7C16%7C17%7C18%7C19%7C1a,idMap:15*,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:316%7D&br=c
Requested by: Host: 4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com
URL: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.40.92.86 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-40-92-86.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Sep 2023 01:32:18 GMT
server: nginx
x-server-name: dt09.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 841C 43 B
215 B 367ms
180ms Image
image/gif 52.40.92.86
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1347897&asId=d83a4d1e-1542-a13c-cb90-ee040b3ae6a6&tv=%7Bc:mZ8DQl,pingTime:-6,time:373,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:373,n:371,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:316,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B60~1,0~0%5D,as:%5B60~300.250%5D%7D%7D,%7Bsl:o,t:371,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B1~0%5D,as:%5B1~300.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tOEVWVA+11%7C12%7C131%7C1321%7C14.1347897-69359102%7C1411%7C142%7C143%7C15*.1347897-69359102%7C151%7C1521%7C16%7C17%7C18%7C19%7C1a,idMap:15*,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:316%7D&tpiLookup=ao:www.benefitscanada.com*&br=c
Requested by: Host: 4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com
URL: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.40.92.86 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-40-92-86.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Sep 2023 01:32:18 GMT
server: nginx
x-server-name: dt13.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 GettyImages-1156574117-REV2.jpg
s0.2mdn.net/sadbundle/16870859579687053945/23-1127-GAM-Display-video-Eng_728x90/ Frame FEC3 66 KB
66 KB 11ms
11ms Image
image/jpeg 172.217.13.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16870859579687053945/23-1127-GAM-Display-video-Eng_728x90/GettyImages-1156574117-REV2.jpg?

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16870859579687053945/23-1127-GAM-Display-video-Eng_728x90/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s05-in-f6.1e100.net

Software

sffe /

Resource Hash

a5f91d77c5942b2b530ebbeaaf581b968801dacf4dfddea3fd72217e5d4166c9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16870859579687053945/23-1127-GAM-Display-video-Eng_728x90/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Wed, 30 Aug 2023 13:10:47 GMT
x-content-type-options: nosniff
age: 217291
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 67662
x-xss-protection: 0
last-modified: Thu, 27 Jul 2023 14:23:09 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 29 Aug 2024 13:10:47 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame FDCD 43 B
215 B 341ms
179ms Image
image/gif 52.40.92.86
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1347897&asId=b04fd5c3-41f7-22e9-37d0-8c7a894c72d5&tv=%7Bc:mZ8DQL,pingTime:-2,time:417,type:a,im:%7Bsf:1,pom:1,prf:%7BbdA:418,bdZ:527,beA:703,beZ:704,mfA:999,cmA:1000,inA:1000,inZ:1004,prA:1004,prZ:1009,si:1014,poA:1015,poZ:1030,cmZ:1030,mfZ:1030,loA:1086,loZ:1089,ltA:1119,ltZ:1119,mdA:705,mdZ:843%7D%7D,sca:%7Bdfp:%7Bdf:3,sz:300.250,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:-1,vs:n,r:,w:300,h:250,t:310%7D,%7Bpiv:0,vs:o,r:l,t:381%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:417,n:381,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:310,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B82~1,0~0%5D,as:%5B82~300.250%5D%7D%7D,%7Bsl:o,t:381,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B36~0%5D,as:%5B36~300.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tOEVWVA+11%7C12%7C131%7C1321%7C14*.1347897-69359102%7C1411%7C142%7C15.1347897-69359102%7C151%7C1521%7C16%7C17%7C18%7C19%7C1a,idMap:14*,pd:0YtC.internal-nacl-plugin,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:312,sinceFw:104,readyFired:true%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.40.92.86 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-40-92-86.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Sep 2023 01:32:18 GMT
server: nginx
x-server-name: dt07.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 841C 43 B
215 B 241ms
96ms Image
image/gif 52.40.92.86
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1347897&asId=d83a4d1e-1542-a13c-cb90-ee040b3ae6a6&tv=%7Bc:mZ8DR0,pingTime:-2,time:414,type:a,im:%7Bsf:1,pom:1,prf:%7BbdA:415,bdZ:519,beA:709,beZ:710,mfA:1020,cmA:1020,inA:1020,inZ:1021,prA:1021,prZ:1024,si:1025,poA:1025,poZ:1034,cmZ:1034,mfZ:1034,loA:1081,loZ:1082,ltA:1123,ltZ:1123,mdA:711,mdZ:848%7D%7D,sca:%7Bdfp:%7Bdf:3,sz:300.250,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:-1,vs:n,r:,w:300,h:250,t:316%7D,%7Bpiv:0,vs:o,r:l,t:372%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:415,n:371,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:316,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B60~1,0~0%5D,as:%5B60~300.250%5D%7D%7D,%7Bsl:o,t:371,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B43~0%5D,as:%5B43~300.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tOEVWVA+11%7C12%7C131%7C1321%7C14.1347897-69359102%7C1411%7C142%7C143%7C15*.1347897-69359102%7C151%7C1521%7C16%7C17%7C18%7C19%7C1a,idMap:15*,pd:CV8L.internal-pdf-viewer,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:316,sinceFw:97,readyFired:true%7D&br=c
Requested by: Host: 4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com
URL: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.40.92.86 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-40-92-86.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Sep 2023 01:32:18 GMT
server: nginx
x-server-name: dt06.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4C5F 0
20 B 36ms
35ms Image
image/gif 172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BKbjwoZDyZK-QMdi0oPMP7p22wAcAAAAAOAHgBAI&bg=!w8ClwI_NAAYHwnCgJ8I7ADQBe5WfOIAFyX5Hqoi706o2ZRYiLp9TtnOHwW-S3FRJDXO9itjBBvUtXfrkpU73MVb3HT_jAgAAAZ5SAAAABWgBBwoAPse72lyIdvT-rRNl1-I8k5jpg3Z_P9qfluWoWP6Qn7q48ujgrAkKKu_TcQUopsmsvH1s3NS-OWX-wCzojdT3mQL7TKDkJklmDvF1C2rTm-saXlfgLaLm54vhAFA8urQqlICnrDNGVscZ97vedc68kLjOxRhLi-qA_laGzKJRBrhZ6YlPa2kcC5EcbUV1YLy41BBX60HHROI5uk-nWiLuNas_MghslTOZEQK6qWZXE8YUZT66vmdAIOmldRh_qmgJD3k7cb2r5znG3nt9wwt8Uq3yNuia4-ypR5d30JrGygTfV6Az6rmtZ-26NbPviSD4aqebeYPyiKJz0UNsQpVgdLZRuNUYmg5K6OmTQUGthOWLfrfC62_hW-0Nnron8nGFTNyRznvKbYz4xXwwQhdZQ6hF07jw49n7DL4_RbuFUUdSsHH2wtuspPSgFyDqT4MbA3Bxq02Dj_lrOqTfTe6WPIO03SWHNiE5LkEwDKbTj5cwvlPe0YmmPJrs9e3de2EDQAl_5-B16wXWqJn0SDbawFbetMIp35kiSPqFiX9xQ-QCrTVxyR1RYFRGk70zE87xLC-rvVviF7akR3Zbf2Z3s7l2GLEk4DKiHBTxviG8p-8Dk3TTmvsksK1y-ctIb2msEm-Ogcx_bBCUXA8zpGX3iwi8X9EYm-n817YKVimNeUVoteWlJUQ1YnUen6VTO-rlSkQ8IaZnc5_Zkq6hkA_VvcAQBj1mnXyP9KtWsK6RqK8jnpVMKxzd2J2Ic2SCBnvcrGCzGtPIhRpMnFs_-YimLJst6jAbCUCPA6b7j6nCAGixm1rNwo1eGA8n8hkrbyTagJ10dFNHKNTs7gKwvBbtoB5D4qxH40cVs70mMlqhlcObKT2il22-NoMKvyxXlNd7VCQjhExPPF26lWm5pm2aml6C6x-bOSxNJL3Op674HAqVo4NsWFplEocNlXf7ythTXZ1nQLKefmLnG0W3N-cD3O0HwPJshhzdicJT0O5y_PSIGbR55T0NhIGko0fNfaqwGlW7dU2ExQbuvxtuwq2l7IHYliMrSITSSYSxKLmQdJc3k_ZnSidwAlzJfdEaHn8P0aaM1X53BC5GOvBfuQ

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Sep 2023 01:32:18 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8127 0
20 B 36ms
36ms Image
image/gif 172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BzbijoZDyZPe3McKCyQOQ8qfQBQAAAAA4AeAEAg&bg=!8_Cl8L_NAAYHwnCgJ8I7ADQBe5WfOP2Srswg7dSOsYUCzErfcasO05dfUGzrPzfMvWFxz8Lb8p0m2IG8agGunA0kiMtUAgAAAYVSAAAABGgBBwoAHlhb11ihNeEWEVa0nL_JXI5Z2qtAU6a2AX1y8whcG5kDFH8DSTriNoC8qmBTh6LVIGeBSDARljz_kTGPwH955qn4V3jTnkn0rOYynhZNkL6xolxFRJhW95x7dMLKZUzD8sBCROXPREB8t80gE9ZACu2lw17zjf-L02J2zUuz9xvIgMatoZOrBdJEg50cUjDxWxKvGqpvyIyJgQLRniBEjIgDPc-jeTtFYKBllsVaO7yVvs0czc5GMLrNxNU52hNW56qISG-Y1d8Nok9Z6ihZwfOglip-rdXOEiI_8cBLgIvhdNeTXQcx5tJmIcxJkwgaRV15VgpzWSKzvFiurQ2SSX2lDiKFTFI-67tOnZpI3qhMWnehing3KH0YbT0OHA4w3WxbRDWIgYhNjQXQ82oniQK1JjkMni85pOpMQwiKpA4-zaARi7sOFvrftnEjIBO6-mWOnWjVmXh010l1oGelytIW7z5KRap5yHwJr3Hmlv4QhZiWr73mVRQb5cy-o93vMkf3jWnIMpXJR9sPRG8lwkH4gUyfVncXaYBjPSjouVchRhP4ryyrAugxEQOXKEfaEHwrwue5wHdWt4GBvmv2RU2-HvK-i2EY6czjk6LPaqdpnsH0vRrNhHrK9-Zq5J0LGP3-FN-_aWfuosUwoaNOSLm-0bOqX55ndggkMDSyZmcX_JO2rNosIHNSpsOFv0ASQkIfeurd_N8fEnNSceqC0YSVJGgzp2COG6IxC5FmL_tix12wkYurzWYF8xLiS-EnLWToD3PkXPs7k1sRxfqd3EOnzdpbmy3Y-oI3eMtkdb5s_DmZIkPj4lAG_3Y7_i-ors7TUP4vfknoGRGaHnbeJaAmoVd3ivekksQFaGQTHogDEcKn6X4B2URvoOgE6a2D71qaQiJscD8ow3XlPL9KYF7iScS_zRGMnkjni2FYEfVGKklkZApz2B2xM_u4YsvHhD6X0cs14RvNyM0dnNeQKUP8Mh8qLo2FyO3lCK28wl3YbhvlsdId_CScJskswgsG-EYayaY8wag1JAMYfyTiRHLDI3CTUYi0LvPzqHM3XMjNlGYdM5W3TBZZN6ZacGa-W2TuGcjI

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Sep 2023 01:32:18 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 00EF 0
20 B 35ms
34ms Image
image/gif 172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Bwa5uoZDyZImjMbKNyQPogqyIDAAAAAA4AeAEAg&bg=!tbaltvnNAAYHwnCgJ8I7ADQBe5WfOMIzY7HaAEh9MPc2zDAmV3r6Kl4oqHMFYZn1xStWgr8-ueLKMPcpDQECyb6YvhHGAgAAAalSAAAABWgBB5kC_RCYat7HRafKVdDLt_UJ72fvpcALL3KLH2Eq9p-dJdqIgcJevC9cMkLhdUJvjlhFHGclKdYQ4ciVCwNdUbz-fMSMRgZK2XIJwLLxT6489iUWwHxnBWWJyb5bIMfOhOsno4arBmO9CV1Xa6tr69cS25foIu2Dl4l7vEU5NGklnxAOXqc6A6byYJW6s4Zo-cuE7Jjroncl9cYDg5rgKQrfshmKLyWGXt0NRVBzBPobZ1Zm4te9QkNgbMNAoR4ccLbXFPe5R2XnujWKlsKG7UKCaBOS7sFGLckz3AeKLOKRMC8AOm0L8rtKobwNcVIg8l2wz62s-gEWch35wodETczxuYOHOzJd9Q1AW8qHfcfL02_uK6Bc2qwWsxlWWIzoAivSk7boGtZJHOl8DVpJbzWciBCLhbPOjRD5Ui_pLWFJEO7KjFIFPuBfSm5kJH474OV10FnkFczzAWwQbpY7_F6cQZWqJpSEGADWHQmuOq1fp2_Dl6D5duVFMbB7UMhrhY-0pocGZ54a6hilvzr1B8VLqqyBsjxYUfI1ceHPuq7k6qivSh-ygDDOhHDQ7_h9iT_7BsXMCb2ZO3c2ob7NJP-T_SJJX7nWUYIGM_TA8Fmfj4MTv-Cjin_R5VUH5wdPkY-wESKeHlNIUM01TpaJbq9qnsyWx9Q-pHcz5j-Xhgo_P9lDRTGa0HsTS4j-qm8xFK0jYBJceJI6d-YPsLBEN1RDIDAifXJWjk2D0GUrRJhPyaGSpAVr1r8O5s0helavYEnYLUOZkzDdBhsoNgXeG_2beNlxCHAXxyLgjWBe0UYl6sCxD3OkHDFtE5hLo-XTC9X6u4CDB1Mamz34ROPtjLtiN54jnichAHpeyW6UdEmjn3ErSVD8hyFQWkPQeIlUYX4HMvXMgcVjLfP0MVgHFlrrjdNO4Ru3S8C4nu8wqppbp1GZgXst2RhZd0bwPcb4_ZxlOjo1doFX0iBELb3QceKFYFWiqYpb3FW9yJem_VqiDyuxx28yBmvOi8TQQF_qcA

Requested by

Host: 4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com
URL: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Sep 2023 01:32:18 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 35ms
35ms Image
text/html 172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202308290101&jk=4122981767688932&bg=!_P-l_7DNAAYHwnCgJ8I7ADQBe5WfOBeVda48_AyHk3PUsPlG_GvaY95WXYRciduQAFhQbEOxxLedu0tuBm4ukt-kCd0YAgAAAW5SAAAABGgBBwoABKm4aoyZAsW7_Y4eiSbiVOEYXR20qbZjgXrHV3Su0rjwIyTKuczS9dxGuuODl7yHsNJXGbFBXzmba9kDfvqIqcIceSYwcw27UWCbVBJYaWC5EeMmqa7cpdSXraq_R8XxaucqGCLHMQJ4IOw9WxIKqPwcqDt2hIdsL5y7DyONhAjdEHY6fF2JV-U8fYnibX3W9awgALA2_VudSWSaD08_htS0sLmVoo37zwj4eBIqBuufFOLetr4nksfb9jfnpYkV8_EH36auL9Yzw1Ae2E-Fd-UYWN5Rd9nnQ6Jxj-tV0nuHF-siy6li_clohuchWpkpTkaCW62lalK7Kp2BTYMusVN1otfhxLQNDOsvoot11H1R7b8mfxOWhrNgr2HZFIqexGlSjlLoBLJfWEBpZfiCKz1k_W7ZCJU55GLWFJ5ETdbNRNtyDYhXfyXMxLUVjFq-b-a923BiGjGkbauGnULn9e1YNBA-x-uNXVY-jIMYpzUmtB7fQPEaqNZ5YO54C4nZmIYOYdfursqhus8rY3Cfg5yLPxCXO5jCjDKL8sYipEvpsZ6p8sKqL8HFktiuJNikM5BhbLfyFN3IEqdULVA82GP7Wl5RLpJHH37nSEW3Jjf7LQHfAqzGc9w183m-s-MjySYOkztJUwvGk0eseLrsOeRUPG0FH2RsJpKVthB1k-Kf6_bt1RGHqBVgS49W8hRC-NK0Mvg7gs-DMMseAyszh9fT1XOQVx-2K7opE-el1t5ufwGC3v-hGStErqczaxNUzQBeZrhTvgVrVYsqeLpzzEd1cQmrH-4_pxt3o6v_4gH1IwvC5rpM9OpONJiStsA7sdoOJh2QXwgy3jj2EgKfHVEbb7XH3e5N20vZ4FxOop4isUUU-hB8pPeKeuGoBe9NYgZi1OVj6BEMfzjn6OjAi5KKX-pTGoCZnlcOynUdA8EWApLctGzsT_AvfOmG
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.217.13.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: yul03s04-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://www.benefitscanada.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

GET
H2 200 dt
dt.adsafeprotected.com/ Frame FDCD 43 B
215 B 113ms
97ms Image
image/gif 52.40.92.86
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1347897&asId=b04fd5c3-41f7-22e9-37d0-8c7a894c72d5&tv=%7Bc:mZ8DT6,time:562,type:e,im:%7Bimprf:%7Bttecl:790,ecd:122,tsecr:72%7D%7D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:130,o:432,n:381,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:310,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B82~1,0~0%5D,as:%5B82~300.250%5D%7D%7D,%7Bsl:o,t:381,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B51~0%5D,as:%5B51~300.250%5D%7D%7D,%7Bsl:i,t:432,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B130~100%5D,as:%5B130~300.250%5D%7D%7D%5D,slEventCount:3,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tOEVWVA+11%7C12%7C131%7C1321%7C14*.1347897-69359102%7C1411%7C142%7C15.1347897-69359102%7C151%7C1521%7C16%7C17%7C18%7C19%7C1a,idMap:14*,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:312,sis:505%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.40.92.86 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-40-92-86.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Sep 2023 01:32:18 GMT
server: nginx
x-server-name: dt14.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 841C 43 B
215 B 196ms
180ms Image
image/gif 52.40.92.86
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1347897&asId=d83a4d1e-1542-a13c-cb90-ee040b3ae6a6&tv=%7Bc:mZ8DT7,time:545,type:e,im:%7Bimprf:%7Bttecl:784,ecd:103,tsecr:71%7D%7D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:545,n:371,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:316,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B60~1,0~0%5D,as:%5B60~300.250%5D%7D%7D,%7Bsl:o,t:371,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B173~0%5D,as:%5B173~300.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tOEVWVA+11%7C12%7C131%7C1321%7C14.1347897-69359102%7C1411%7C142%7C143%7C15*.1347897-69359102%7C151%7C1521%7C16%7C17%7C18%7C19%7C1a,idMap:15*,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:316,sis:490%7D&br=c
Requested by: Host: 4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com
URL: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.40.92.86 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-40-92-86.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Sep 2023 01:32:18 GMT
server: nginx
x-server-name: dt19.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame FDCD 43 B
215 B 97ms
96ms Image
image/gif 52.40.92.86
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1347897&asId=b04fd5c3-41f7-22e9-37d0-8c7a894c72d5&tv=%7Bc:mZ8DW2,pingTime:-10,time:744,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHw0MjB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMTYuMC41ODQ1LjE0MCBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,ch:n,fsc:17.6.2v222222220002222202222222220222222222202222222220222202000022000220222222220000222202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022220000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1693618338938%7C%7C9db049a00aa515e1d5041c9684a961fd%7C%7C0f286e8f7fa153358c622af13d09b529%7C%7Cf16e6e101954b4a41e8224b916791823%7C%7C940f5ea3e023a013d29835b6bfd8dd46%7C%7Cfd36c233bfaaa02a153f20e7f4cca48a%7C%7C7533ca47f28a0c6ff08b6984fbd1a57d%7C%7C3c78aa54d87200aa6a496fc01f71c2f3%7C%7C1663701684%7D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.40.92.86 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-40-92-86.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Sep 2023 01:32:18 GMT
server: nginx
x-server-name: dt06.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 841C 0
0 37ms
36ms Fetch
image/gif 172.217.13.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvhwPz2gfKn_cAALAp95ljG7iV0-kp3XadhpXY_dHmmW2TAoMcVQw4YFGkojHPZyJyNQfkRCEEleQ5Vchf7ryWkIQTlLZnvr31R9dGwEF7QDLEIrtQPn5ENu4uO7kSNDBgj7J3i1nIjK7n9GPmtWPYq-po5FUiOnNhEYmsQXA_C2_tvHRXm61n4ws30c2bVd2UFNlL8wtOMcQ52K8YMsikvInXhzWDxBE3WSpchDy1SsfGm9-bAiF3PustVE8qAdccvHW5ws9wA9aGfx-6pvwgIo0zE6QMjVzKdmqyoWWlrAByZhWsV_Xc6kh1wWOI0s2a-ApDeo9pVnRmCnXAYeTkYBS8avvK2f5KpFIMDOD0x6J4b7hXlnBzBz5l0XMopdFa_rEiegqAR5Il0rLVt709bRg&sai=AMfl-YRcvknN6vf8lLH8DGa_tSw0rOzwYpm3fgh2RhsftOv_Q7XG7JkKMp9QtzHfot2sPsIgSIa-jtgZ4JdUVyNVacXpjgm5EGzktz9hIqia6aCknLUr-wl6Ei1g2J5U22vA3CcYHuF5bIIkZL2lAgI&sig=Cg0ArKJSzHPReFSy30AGEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul02s05-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date: Sat, 02 Sep 2023 01:32:18 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 02 Sep 2023 01:32:18 GMT

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame D36F 42 B
174 B 36ms
35ms Fetch
image/gif 172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssFOGD53FCr0hvd2PeEvMNEBe0_vxbR4wrz_0zFc-O_KkHhDOeRH0rFAFCGLtSpuB-_6nRvRY1FwXQyEtfYgDkYAlO3FQsgSQ2h1tkbdQlvgF0&sig=Cg0ArKJSzORjwwrrXSjoEAE&id=lidar2&mcvt=1001&p=0,0,90,728&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20230830&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=34&adk=3756782277&rs=6&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1693618337446&rpt=615&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Sep 2023 01:32:19 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 841C 43 B
215 B 96ms
95ms Image
image/gif 52.40.92.86
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1347897&asId=d83a4d1e-1542-a13c-cb90-ee040b3ae6a6&tv=%7Bc:mZ8DZz,pingTime:-10,time:945,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHw0MjB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMTYuMC41ODQ1LjE0MCBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,ch:n,fsc:17.6.2v222222220002222202222222220222222222202222222220222202000022000220222222220000222202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022220000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1693618338938%7C%7C9db049a00aa515e1d5041c9684a961fd%7C%7C0f286e8f7fa153358c622af13d09b529%7C%7Cf16e6e101954b4a41e8224b916791823%7C%7C940f5ea3e023a013d29835b6bfd8dd46%7C%7Cfd36c233bfaaa02a153f20e7f4cca48a%7C%7C7533ca47f28a0c6ff08b6984fbd1a57d%7C%7C3c78aa54d87200aa6a496fc01f71c2f3%7C%7C1663701684,sca:%7Bspg:b04fd5c3-41f7-22e9-37d0-8c7a894c72d5%7D%7D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.40.92.86 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-40-92-86.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Sep 2023 01:32:19 GMT
server: nginx
x-server-name: dt13.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame FDCD 42 B
64 B 36ms
36ms Fetch
image/gif 172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuFlHf32D33rhYryVt-JBUXtMZ5IPS4LSosbkgB5yA9ZTpisp6uhZQBBTo0lw7JKgR96aInMybzStzEFzpX1laIrayGQO2bOjzjBQnnDzBYGqM&sig=Cg0ArKJSzJmtH1ms-g5HEAE&id=lidar2&mcvt=1000&p=0,0,250,300&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20230830&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=34&adk=2539888514&rs=6&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1693618337492&rpt=682&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Sep 2023 01:32:19 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame D36F 42 B
64 B 39ms
39ms Fetch
image/gif 172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjst4GiRA7oAX4fKzIjtwRTwo9aIF30qg9lOlzeFyYVkxabHqMV_ocS2Pwh5z1Gid7m0ZS2m7lTMc7uKyO_e3XbeUMNLx8f_OZHDalo28n2Kr_MZDfsgQ9ZRbBWhhjVOT&sig=Cg0ArKJSzFnrwz8x3vssEAE&id=lidar2&mcvt=1000&p=258,436,348,1164&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20230830&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=19&adk=2442671454&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1693618337446&rpt=966&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Sep 2023 01:32:19 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame FDCD 42 B
64 B 36ms
35ms Fetch
image/gif 172.217.13.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstkPV6-DNnEhbPDm1dqS2q7-aztu6cuf71AvRCQnH3MjA24dvqOMr1_Flbr_okPOb8O6vfoajm8mMa-HDjcnBhXjJN-Iet6ZZWJGG-U8iL0Va2t1-VvXHHQYKa1CDNP&sig=Cg0ArKJSzMIYXn4xOgIvEAE&id=lidar2&mcvt=1000&p=609,1039,859,1339&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20230830&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=19&adk=1041939613&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1693618337492&rpt=981&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.13.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

yul03s04-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Sep 2023 01:32:19 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame FDCD 43 B
215 B 96ms
95ms Image
image/gif 52.40.92.86
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1347897&asId=b04fd5c3-41f7-22e9-37d0-8c7a894c72d5&tv=%7Bc:mZ8E79,pingTime:1,time:1433,type:p,clog:%5B%7Bpiv:-1,vs:n,r:,w:300,h:250,t:310%7D,%7Bpiv:0,vs:o,r:l,t:381%7D,%7Bpiv:100,vs:i,r:,t:432%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:1001,o:432,n:381,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:310,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B82~1,0~0%5D,as:%5B82~300.250%5D%7D%7D,%7Bsl:o,t:381,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B51~0%5D,as:%5B51~300.250%5D%7D%7D,%7Bsl:i,t:432,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1001~100%5D,as:%5B1001~300.250%5D%7D%7D%5D,slEventCount:3,em:true,fr:false,e:,tt:rjss,dtt:99,fm:tOEVWVA+11%7C12%7C131%7C1321%7C14*.1347897-69359102%7C1411%7C142%7C15.1347897-69359102%7C151%7C1521%7C16%7C17%7C18%7C19%7C1a,idMap:14*,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:312,sis:505%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.40.92.86 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-40-92-86.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Sep 2023 01:32:19 GMT
server: nginx
x-server-name: dt07.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame FDCD 43 B
215 B 97ms
97ms Image
image/gif 52.40.92.86
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1347897&asId=b04fd5c3-41f7-22e9-37d0-8c7a894c72d5&tv=%7Bc:mZ8E79,pingTime:1,time:1433,type:pf,clog:%5B%7Bpiv:-1,vs:n,r:,w:300,h:250,t:310%7D,%7Bpiv:0,vs:o,r:l,t:381%7D,%7Bpiv:100,vs:i,r:,t:432%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:1001,o:432,n:381,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:310,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B82~1,0~0%5D,as:%5B82~300.250%5D%7D%7D,%7Bsl:o,t:381,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B51~0%5D,as:%5B51~300.250%5D%7D%7D,%7Bsl:i,t:432,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1001~100%5D,as:%5B1001~300.250%5D%7D%7D%5D,slEventCount:3,em:true,fr:false,e:,tt:rjss,dtt:99,fm:tOEVWVA+11%7C12%7C131%7C1321%7C14*.1347897-69359102%7C1411%7C142%7C15.1347897-69359102%7C151%7C1521%7C16%7C17%7C18%7C19%7C1a,idMap:14*,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:312,sis:505%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.40.92.86 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-40-92-86.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Sep 2023 01:32:19 GMT
server: nginx
x-server-name: dt06.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

Verdicts & Comments Add Verdict or Comment

110 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

23 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.benefitscanada.com/	1970-01-20 16:36:34	Name: _gcl_au Value: 1.1.1639145408.1693618336
.linkedin.com/	1970-01-20 16:36:34	Name: li_sugr Value: 60a83467-afe4-41ad-9b4b-3ae83e58a7b4
.linkedin.com/	1970-01-20 23:12:34	Name: bcookie Value: "v=2&23120737-83de-4ff1-828d-1a2b7e82a173"
.linkedin.com/	1970-01-20 14:28:24	Name: lidc Value: "b=VGST02:s=V:r=V:a=V:p=V:g=2975:u=1:x=1:i=1693618336:t=1693704736:v=2:sig=AQGn088nnCC1MluQscIgYoXcs9hVuWsC"
.benefitscanada.com/	1970-01-20 14:28:24	Name: _gid Value: GA1.2.1317403488.1693618336
.benefitscanada.com/	1970-01-20 14:26:58	Name: _gat_UA-2314729-4 Value: 1
.freeskreen.com/	1970-01-20 14:37:03	Name: a Value: NTkzNj0xfHw7
.freeskreen.com/	1970-01-20 14:37:03	Name: scmtid Value: "c2NtaWQ9ZWdhZ2RkaWJnZGpnYmVGUFVxeklpWGF8MTY5MzYxODMzNjA2NA=="
.benefitscanada.com/	1970-01-21 00:02:58	Name: _ga_D5M7SSGHRQ Value: GS1.1.1693618336.1.0.1693618336.0.0.0
.linkedin.com/	1970-01-20 15:10:10	Name: UserMatchHistory Value: AQLEZmKq4HirzgAAAYpThPGNAn7iNYrfrsatmC9MNzZPZZwAjvSLYtvJgx8hC0X1iWkifE6P2_XmkA
.linkedin.com/	1970-01-20 15:10:10	Name: AnalyticsSyncHistory Value: AQKqah2Ye3uviQAAAYpThPGNKpQOATHmgwipZ9-WRazaIfUt8zJle2_Y30KbI_LybxLmM53nsdr1xFfijnvGmQ
www.benefitscanada.com/	1970-01-20 14:28:24	Name: ln_or Value: eyI1MjUyMjIwIjoiZCJ9
.www.linkedin.com/	1970-01-20 23:12:34	Name: bscookie Value: "v=1&202309020132161f984716-61fc-48c5-8b16-c176264a596aAQF08suQlmNxsdSdNqV8PHXo_eu4i7CN"
.benefitscanada.com/	1970-01-21 00:02:58	Name: _ga_2F1HV6LLNX Value: GS1.2.1693618336.1.0.1693618336.60.0.0
.benefitscanada.com/	1970-01-21 00:02:58	Name: _ga Value: GA1.2.1305301600.1693618336
.benefitscanada.com/	1970-01-20 14:26:58	Name: _gat_gtag_UA_2314729_4 Value: 1
www.benefitscanada.com/	1970-01-20 14:26:58	Name: m32_pubgeo Value: JTdCJTIyaXAlMjIlM0ElMjIxODUuMTk5LjEwMS4xMzMlMjIlMkMlMjJjb3VudHJ5X2NvZGUlMjIlM0ElMjJDQSUyMiUyQyUyMmNvdW50cnlfbmFtZSUyMiUzQSUyMmNhbmFkYSUyMiUyQyUyMnJlZ2lvbl9jb2RlJTIyJTNBJTIyUUMlMjIlMkMlMjJjaXR5JTIyJTNBJTIybW9udHJlYWwlMjIlMkMlMjJsYXRpdHVkZSUyMiUzQTQ1LjUlMkMlMjJsb25naXR1ZGUlMjIlM0EtNzMuNiUyQyUyMm1ldHJvJTIyJTNBMTI0NDYyJTJDJTIycG9zdGFsX2NvZGUlMjIlM0ElMjJoM2glMjAxYTIlMjIlN0Q=
www.benefitscanada.com/	1970-01-20 23:12:34	Name: m32_uStorage Value: {"Version":"465","Data":{"uuid":"b1d3ce0b-90a6-4896-ad50-ddc4612dee9e"}}
www.benefitscanada.com/	1970-01-20 14:27:00	Name: m32_sStorage Value: 729795c7-e3d8-4197-8f29-b8400517860b
.doubleclick.net/	1970-01-21 00:02:58	Name: IDE Value: AHWqTUn0jLsZ-3VDKJMKDJlmaOZQKSq_1qiO_kheB83bXCnmGOnypiVro1aliKACB_o
.benefitscanada.com/	1970-01-20 23:48:34	Name: __gads Value: ID=41610150db5eb558:T=1693618337:RT=1693618337:S=ALNI_MZAvsCGMQg-5R81FdmDCXYpXM4k-g
.benefitscanada.com/	1970-01-20 23:48:34	Name: __gpi Value: UID=00000d8f69876c31:T=1693618337:RT=1693618337:S=ALNI_MZjLin-sGnG76vS9oDa-7oK4TuHMw
.doubleclick.net/	1970-01-20 18:46:10	Name: APC Value: AfxxVi490ccvZYBX-h3SUOfHeQjKPWwjWrEwG42GEEaG73bzOKO7Kg

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://www.googletagservices.com/dcm/impl_v96.js(Line 77) Message: Unrecognized feature: 'attribution-reporting'.
other	warning	URL: https://www.googletagservices.com/dcm/impl_v96.js(Line 77) Message: Unrecognized feature: 'attribution-reporting'.
other	warning	URL: https://www.googletagservices.com/dcm/impl_v96.js(Line 77) Message: Unrecognized feature: 'attribution-reporting'.
network	error	URL: https://dt.adsafeprotected.com/dt?advEntityId=1347897&asId=b04fd5c3-41f7-22e9-37d0-8c7a894c72d5&tv=%7Bc:mZ8DQc,pingTime:-3,time:382,type:v,clog:%5B%7Bpiv:-1,vs:n,r:,w:300,h:250,t:310%7D,%7Bpiv:0,vs:o,r:l,t:381%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:382,n:381,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:310,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B82~1,0~0%5D,as:%5B82~300.250%5D%7D%7D,%7Bsl:o,t:381,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B1~0%5D,as:%5B1~300.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tOEVWVA+11%7C12%7C131%7C1321%7C14.1347897-69359102%7C1411%7C142%7C151%7C1521%7C16%7C17%7C18%7C19%7C1a,idMap:14,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:312%7D&br=c Message: Failed to load resource: the server responded with a status of 502 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

4029c88a516283bab5073d6ca1569c05.safeframe.googlesyndication.com
ad.doubleclick.net
analytics.google.com
cdn.id5-sync.com
cdn.linkedin.oribi.io
dt.adsafeprotected.com
fastlygeo.m32.media
fonts.googleapis.com
fonts.gstatic.com
fw.adsafeprotected.com
googleads4.g.doubleclick.net
ib.adnxs.com
id5-sync.com
pagead2.googlesyndication.com
px.ads.linkedin.com
rdc.m32.media
s0.2mdn.net
sb.freeskreen.com
securepubads.g.doubleclick.net
seg.m32.media
snap.licdn.com
static.adsafeprotected.com
static.freeskreen.com
stats.g.doubleclick.net
tpc.googlesyndication.com
tqe36.flx10.com
www.benefitscanada.com
www.google-analytics.com
www.google.ca
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.linkedin.com
104.22.53.86
13.107.42.14
151.101.194.132
151.139.128.10
162.19.138.120
172.217.13.102
172.217.13.130
172.217.13.131
172.217.13.138
172.217.13.142
172.217.13.161
172.217.13.162
172.217.13.163
172.217.13.168
172.217.13.193
172.217.13.194
172.217.13.195
172.217.13.196
172.217.13.198
172.253.63.155
18.165.25.35
18.165.25.91
18.165.9.115
18.165.9.12
216.239.34.181
23.215.130.171
3.211.247.215
34.195.71.162
35.203.92.254
52.40.92.86
68.67.160.137
00fbf4ee38865721663d55f336cdf7abf9d685b6e03a65ce4cdaf9e86557e88e
01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd
036117b5a4d0997e21eb2190ce8c5b0315e8cc77aad572eac78a3faa276e95b3
07ff015d1a1147e70fdc0f24cbc4077a8094d902309544eddc6722e462b6e853
08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0
08b7a780bab13f35e4f7a8ed67f363ca5333fde5f6190c10fef6fe78275f4874
0a333b964eaf742e05d794cf18c6fa2e06a6df52f484687b70a36624acd6b567
0c18c4124867b5e78d7f21e941c88e30184b57ba05024b696ed2ad8b34946b7a
0dedddbdb2f1e0e33951167e3fcdbcd90003024f21ccf49cf05a179a7222b795
0f168400f35726c05050a7361b4bdffa89148cf119cc412ebfc3193d71159805
1168c8abfe02845289bb55fd1091f344ddc7b63f7d4c5e95c895b72b4bca982d
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
13913cb4bc2713aa502124640903ac1a664e1dbbf5009b992a8460af09634632
14466f041b4b990865284bd6eb409aed61ebf2fa42ae0dbc3b467ab95146d71c
157887652c78ab7eb82fb3adef93c3344dcc4ce864d878dda2b6ded962ecf537
15b030a461073a73acba35e57624800e0ceb7db9232fa4b04366b4e0a676514b
1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5
1a102a4c8db58abe65a64a5f963e557c82fa3c37236a854fdce524ca71cdd695
1a61ef895c2bb94c6ce740162d367427f2e377a6a72ccd14c2ad8a877bb70204
1d019e698599b87dbbf5387671a1e125f078f461f46406fd269190e8057be09a
1dd8974746f1ea5544f8c0c64dcdd65a915b267edb4cca1dbe449956d8b13a5d
1e75f74f02491f21b2606db4c5dc219eb0498c5c568d4f12db4217b1e892b879
1f01c860bdb5390bf81294d8b174c53072f9b9fe6ec5e7e3ac675329f1faca81
1f4fcb5a0843275c87c1a34f23d96ac1ab39051cc41f9b071c66a4e7ea916347
2153b673e7ea622eb4c87aff8d6661334381ef08aa9df97143b76226b2290037
22f2d9f0b79a682c7b96bd242dca09c3c338fe0e52c5be03106a4eb587e53c7e
2394d12e4577671d6d8a98826b3712c6c321b2d3fdc67d335ee329415631cebb
25223585444df85d831c9f3100e86505e458f748cbdda44cece7043d81ea393a
2606426c88d86613d05e231cd610a07ee1a5e46b9a8ff1d8fdea473e05a1bad0
292f853f9ef0e448c5536987fe87197f401bafcde3e0857e17de1f0676f5b2eb
29955cf92fbec587744de23937360c7065d6d0c771f176863340c18b21c4702d
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2dad5ac646a269db9be6741f1c5973a4d0f242d176413662178a5710613934b3
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
31a2ac142ca8f3347708d4499a703e31f2ee6a7acab9a8392e79335302993947
359984220fe9766ca92ecf285b13fb40b23dfac2e45bd8f9b762f05336329287
393cce26304628e179a76da1ce676640aa7a51ce134d2309952ce5821d157414
3acf6434a328154b9004ea118db26ef6902e025ab7ab27968448feed39a94b55
3c2c302666746df6544f8e44abe43e774c6e4f20925dcaa688cbd6a3328c76fe
3d2b34675fd418a1b23c652fa791f4875ccc12860d9b4b6ec8ae4aa09d51ec1e
40a2c1a9097ba1cdf4cb7fad3a2484ff69ed39d070fef6d69131801e7f646c22
423d522143859f16eba2f7d349c646171033572995cd6af75010a4a2b57d76e3
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
47573ab718b847e465e2c968b7c3052e157285d58e669371d68b29315b675889
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
4a389530dd25362035b6d565c2928a7972d2fca6395e2b2547f414e805102664
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4b61f735ba127d88a8673f26e34a79bc25968d5be1bb43004958065526d28bb9
4bf167b2b41dff122d605ffe138eaea06674108c4acc5bf97c2152696f325424
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
512cb70a1266db2c9d3529c16f0c5483ece0ae3c57c7d86a005305a7f709d088
533782fe48b7cbf09750419bf306d38d73988942901aa7e323f24c45c8c9df88
545352fca284287fb75bd635ec754346854faf6fdb5885a063116814a9c7626e
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
57ab4a5d1018a5fabfd46143b3ada119096d004876a8109f61ca2db62f2dc78c
583af8a07ffac1285fba3f94907106a9ff1f51404c97cf753b9da29071bee164
59dad5a09fa6be9c1a998f2a899ef182de3e1d204d5b2e5dd72c41b6317d1995
5fe2d57b8b035e9ba614058881f126ed6f5cf5da2556d4a235472e98723bd110
60f33bd1a5d5676415ec32d27074d36ad853b8c0acca1dca5b926f1b1a144d78
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
63ce79afb9dfc2ff292a4bd6d7ead40964bf44050937c2b9cedcfbeb6860772a
667107ab0cded30464dc87f4e482ae4eba3d469be2ae651dbc7b01e499d4d610
66bf586b17b91a28f1e6f6370fbf15bb867a5740214dca2b67e98e6666590da0
69615d87a7a4ba717a1a7acecdd648d1a082bc1c1fb37b11fcc9c17acef3493b
6c0d9873fc3a1e67b5f9d0a80f6cd881c742484239c441b2b34a137acfc9b8e2
6c6c9c3fad669c3d32227f5cc3467735c8211ddcf4f8c184c2e62e7f3ef7af44
6df509c54af64a8a81d168c1bce4e0bc1d30be5a3206c25e702fea2f33ab7f3f
7278105d2ddea29fa46c2eaaa8406ea557d9f3e010010e02c662ed6725977c30
79ad46fc05e5e5e043431d54f79b46fb8be082594254a5a91df85b1aa91f9d67
79daa4caacf1d6de3a1b1e3ee93bfe8594b7021aa1de81aea14b6270bf0d8fca
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89
7e72680d9db2af3015d08d822ff9e95327526dababd86b42b24863d5332a44a5
808ad1fe438060832ef05c9d5da8b2f55364f8726eaaa9b7c81cf253a86df069
81574785aacf772653667ad1fd2714f09386298b79946805d08aeb072ee4be81
83042b42008dd9a3e22dd5168543f765a4cc7049700687a88a7e5c4df37458ae
843dea1d022be79c95643821b1140cc2d081094ee77ccf7a1f637a1ad8fca33f
85442adc44f098e7a9e139444b21ca5cfe592d457267d6299a10280588544eab
85877a6ebe16556aeb60af362fb11d239878b92bfc38f7a5b60c4ff5691d68aa
85f76daf4d09ec8d7f93cb5f486b95d514b4fc7e26e5a25ac368d78b94c8c238
8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50
86ca547be7b52490b493ee4b6f24410a3d47bf2e9a2f4b2fa026ca1400be8332
86d9b404e9716923cdab26b34d0520ce8235c1ae544f09e4c5472c79ea38bf99
8e928581e136ab067804a4d9a85b404f236fd8b79b1fa965ebd41d5f4bbf0758
8f42cfa3c8ef87f84cbf220cab248f0c451f3ac31411e0240f1f3cf4bd2e85c7
8fa9ad5689dce99bd6c2acdd7df991228a365f7eb8f8c8e03bd7ffdc84c142fa
9043986fde648c179ce63d202242b956fe5bae1cbba32612c721e28aeeae65ab
938023085ff1da3a855c55a15d949bc8a65b3e611b7148d3986c3cd475197b72
9e69137a7f67870542332493cbc2f895b56d60ac0a59c92113b655f69b6dab60
9e968ca5d02783cfd0b84f562b748995a666285db2a555fc312783a78e9cd2df
a3479b45d477eb8429f4be8a396050d90f894559a72068ec3593ec43f586d138
a5a6595f548d8a44d01f303121d52f133892a51417203bdf771e5f42dbb336b4
a5f91d77c5942b2b530ebbeaaf581b968801dacf4dfddea3fd72217e5d4166c9
a64c5c06053fe49fa02a2c2d7bdb13420e2bb8a45416784eb7ad8c705d228f6f
aff50d42e55c5c834a491c4a534bfcb04ac9e639f48aa678e37d324fe24be8a2
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b59668075b67f78c188d4186567ebc8077567486445d17c65c4ea836ffa0ac42
bcb32fbdffcceb701d3eee56133a5890cf51850c69d22d429bcc3b48b782f1bb
bdeed1e1c0751610c8f3dc2a5c78c93f841c366b36a7f7a54f5e6752c2656c05
c55c077b3af3907481a2ef2763ed20420a6dd80d1f6ccfc05ed178a3e1f006c8
c76339e5917229c272522a3dda7d920a9e45dd26df73473a9309c632b8ac3c06
c777317496ec51b2f74ef6bc9be6e77454f85a76dc1fc5c3a1a74aac31eea768
cbee8a781a5813460ac9573aee4cb78b2660b48ed5fdb3a20aa0cd4c7bf00b1b
cd41c0922788433d753ae8c6ee3fbf720cbecc5d480f5617fac477a641a2c58d
d72c9fb59846aff6405d2973c81bd8da823493502fab893e026a736a1ba01838
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e2f1d542c09b03a54ae82d3e0d921dd128437a6b35e8ae3722274b4ff621c4dd
e394d0e1624d50536c8bf44a11c732e0561842aeb7681ccf6d13230d870c2c95
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e49b3b965d5090252ff51b3bd2ac2d65872b7a9160bb5e575af2e6886824669b
e626d3fb541ebc90026c4cb5cf3fb8586536cd95cc9f1db87469f24adde77f23
e81f118d334e426146c5b6e3c672d89309e45d448e35f9e0c8f28c0c82f8cc1f
e8c316d63711b8974a0e939c96e4483209bc3298f4bd1d32d540ee2ee5b3e077
e922db6f7c5ac4f3a95672d6b49be6610d58531d5b25f1beb3eb001c9218087e
e9ad5f2249841dc7d21706f582f33dc92bfd3629abe38db96a02226bf45fa003
ea0ae4fae8924dd26f897ee18cb3b8477306b682a8d7a758abd8da7fb55c1cb7
ea3191584f8e74dd6cb413b915e9258cc57b1a8c0c5bf4038e20d22f17647c78
eabc4eac53d1e6d57597c21ed423e61a15924e8b92c02c88cc7b3585d0f800cf
ee30dfefc3b21776329dcdcc03bd10c08b79afadcae7dfbd2df9bad0319767fb
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efc2b5f3cfb42ac86c11900be6091d645853af46ab4f01bfba7280c3ac37ae02
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
fa53fcd8da139d256c0ca83b69cb37473ca627b6052368ed3327c80d9fb61e25
fa9f8844bab2a4b87f3401044f3e46fc6bcab2a3aa60f5587e9bcc5cede0e978
fad6921438493bdaccf27caa773ed5a79e7a1498b4c8d1a23ccb620e6d8c4dbf
fc48d1d80ece71a79a7b39877f4104d49d3da6c3665cf6dc203000fb7df4447e
fe5e157c57b8a5017a03e866ec659bd8efa054c5e54276593ab43be9420fba14
ff28e37bbf7cf7caf5e14dbd6b848447b02c136fb094f9bc59cd914bccf91959
ff823a9edbf91a5cc0df894573f186edcb29d38381311aa9e27b2741b95b3795

www.benefitscanada.com Open in urlscan Pro 18.165.25.35 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

217 Requests

98 %HTTPS

0 %IPv6

20 Domains

34 Subdomains

32 IPs

4 Countries

6227 kBTransfer

11257 kBSize

23 Cookies

10 Outgoing links

Redirected requests

217 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 7 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.benefitscanada.com Open in urlscan Pro
18.165.25.35 Public Scan

Screenshot
Live screenshot

Full Image

217
Requests

98 %
HTTPS

0 %
IPv6

20
Domains

34
Subdomains

32
IPs

4
Countries

6227 kB
Transfer

11257 kB
Size

23
Cookies

217 HTTP transactions
7 data transactions