gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital Open in urlscan Pro
34.95.11.30 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Effective URL:
https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Submission: On February 14 via api (February 14th 2022, 2:42:03 pm UTC) from CA — Scanned from CA

Summary HTTP 249 Redirects Links 13 Behaviour Indicators

Summary

This website contacted 72 IPs in 5 countries across 59 domains to perform 249 HTTP transactions. The main IP is 34.95.11.30, located in Montreal, Canada and belongs to GOOGLE-PRIVATE-CLOUD, US. The main domain is gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital.
TLS certificate: Issued by R3 on February 14th 2022. Valid for: 3 months.

This is the only time gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 19	34.95.11.30 34.95.11.30	396982 (GOOGLE-PR...) (GOOGLE-PRIVATE-CLOUD)
10	142.251.40.130 142.251.40.130	15169 (GOOGLE) (GOOGLE)
4	143.204.137.197 143.204.137.197	16509 (AMAZON-02) (AMAZON-02)
2 15	104.16.68.69 104.16.68.69	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	99.84.125.52 99.84.125.52	16509 (AMAZON-02) (AMAZON-02)
5	2607:f8b0:400... 2607:f8b0:4006:822::200a	15169 (GOOGLE) (GOOGLE)
1	2606:4700:303... 2606:4700:3037::6815:3c3f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:10:... 2606:4700:10::6816:48e8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	13.33.46.124 13.33.46.124	16509 (AMAZON-02) (AMAZON-02)
1	13.33.46.106 13.33.46.106	16509 (AMAZON-02) (AMAZON-02)
5	143.204.143.94 143.204.143.94	16509 (AMAZON-02) (AMAZON-02)
7	2607:f8b0:400... 2607:f8b0:4006:81d::2003	15169 (GOOGLE) (GOOGLE)
2	2600:9000:214... 2600:9000:2140:b000:8:f216:eb80:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2607:f8b0:400... 2607:f8b0:4006:806::2008	15169 (GOOGLE) (GOOGLE)
2 6	13.33.46.48 13.33.46.48	16509 (AMAZON-02) (AMAZON-02)
2	2a04:4e42:600... 2a04:4e42:600::645	54113 (FASTLY) (FASTLY)
6	151.101.66.133 151.101.66.133	54113 (FASTLY) (FASTLY)
2	52.44.16.134 52.44.16.134	14618 (AMAZON-AES) (AMAZON-AES)
6	34.149.157.221 34.149.157.221	15169 (GOOGLE) (GOOGLE)
4	2a04:4e42:200... 2a04:4e42:200::645	54113 (FASTLY) (FASTLY)
2	142.250.176.194 142.250.176.194	15169 (GOOGLE) (GOOGLE)
1	2600:141b:13:... 2600:141b:13::17d7:82d1	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a03:2880:f01... 2a03:2880:f012:8:face:b00c:0:1	32934 (FACEBOOK) (FACEBOOK)
1	146.75.32.157 146.75.32.157	54113 (FASTLY) (FASTLY)
1 12	209.54.180.3 209.54.180.3	16509 (AMAZON-02) (AMAZON-02)
1	2607:f8b0:400... 2607:f8b0:4006:80c::2002	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:80f::2002	15169 (GOOGLE) (GOOGLE)
2	99.83.154.140 99.83.154.140	16509 (AMAZON-02) (AMAZON-02)
7	2607:f8b0:400... 2607:f8b0:4001:c15::78	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:81f::2001	15169 (GOOGLE) (GOOGLE)
4 4	2620:1ec:22::14 2620:1ec:22::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1	108.174.10.14 108.174.10.14	14413 (LINKEDIN) (LINKEDIN)
1 3	104.18.98.194 104.18.98.194	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	151.101.130.133 151.101.130.133	54113 (FASTLY) (FASTLY)
1 4	2607:f8b0:400... 2607:f8b0:4006:817::2002	15169 (GOOGLE) (GOOGLE)
2 2	2606:ae80:145... 2606:ae80:1451:12::1720	25751 (VALUECLICK) (VALUECLICK)
1	34.73.194.24 34.73.194.24	396982 (GOOGLE-PR...) (GOOGLE-PRIVATE-CLOUD)
5 10	34.200.159.147 34.200.159.147	14618 (AMAZON-AES) (AMAZON-AES)
1 1	69.90.254.78 69.90.254.78	13768 (COGECO-PEER1) (COGECO-PEER1)
2 2	54.175.198.118 54.175.198.118	14618 (AMAZON-AES) (AMAZON-AES)
2 2	52.45.33.138 52.45.33.138	14618 (AMAZON-AES) (AMAZON-AES)
1	104.244.42.131 104.244.42.131	13414 (TWITTER) (TWITTER)
1	104.244.42.133 104.244.42.133	13414 (TWITTER) (TWITTER)
2	2a03:2880:f11... 2a03:2880:f112:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
3 7	2607:f8b0:400... 2607:f8b0:4006:823::2004	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:4006:80f::2003	15169 (GOOGLE) (GOOGLE)
2	23.52.161.180 23.52.161.180	16625 (AKAMAI-AS) (AKAMAI-AS)
2	23.57.136.222 23.57.136.222	16625 (AKAMAI-AS) (AKAMAI-AS)
1 4	34.98.64.218 34.98.64.218	15169 (GOOGLE) (GOOGLE)
4 4	68.67.160.74 68.67.160.74	29990 (ASN-APPNEX) (ASN-APPNEX)
1 2	23.92.190.74 23.92.190.74	29791 (VOXEL-DOT...) (VOXEL-DOT-NET)
3 7	35.71.139.29 35.71.139.29	16509 (AMAZON-02) (AMAZON-02)
4 4	68.67.179.113 68.67.179.113	29990 (ASN-APPNEX) (ASN-APPNEX)
1 1	192.132.33.46 192.132.33.46	18568 (BIDTELLECT) (BIDTELLECT)
4 4	199.127.204.142 199.127.204.142	26120 (RHYTHMONE) (RHYTHMONE)
5 5	35.71.131.137 35.71.131.137	16509 (AMAZON-02) (AMAZON-02)
5	63.251.114.182 63.251.114.182	12181 (INTERNAP-...) (INTERNAP-2BLK)
1 1	213.19.162.80 213.19.162.80	3356 (LEVEL3) (LEVEL3)
2 2	75.126.248.142 75.126.248.142	36351 (SOFTLAYER) (SOFTLAYER)
2 2	35.207.24.140 35.207.24.140	15169 (GOOGLE) (GOOGLE)
5 6	151.101.130.49 151.101.130.49	54113 (FASTLY) (FASTLY)
1	2600:1f18:4e9... 2600:1f18:4e9:5a01:4fe8:190f:17d4:b6af	14618 (AMAZON-AES) (AMAZON-AES)
7 10	142.251.32.98 142.251.32.98	15169 (GOOGLE) (GOOGLE)
1	8.28.7.81 8.28.7.81	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1	104.16.190.66 104.16.190.66	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5 5	35.173.74.115 35.173.74.115	14618 (AMAZON-AES) (AMAZON-AES)
12	52.22.124.154 52.22.124.154	14618 (AMAZON-AES) (AMAZON-AES)
1 3	35.190.60.146 35.190.60.146	15169 (GOOGLE) (GOOGLE)
1 1	173.223.56.123 173.223.56.123	16625 (AKAMAI-AS) (AKAMAI-AS)
2 2	3.225.49.60 3.225.49.60	14618 (AMAZON-AES) (AMAZON-AES)
3 3	216.200.232.253 216.200.232.253	30419 (MEDIAMATH...) (MEDIAMATH-INC)
1 3	54.85.224.115 54.85.224.115	14618 (AMAZON-AES) (AMAZON-AES)
1	2600:9000:202... 2600:9000:202c:fa00:1a:609a:6780:93a1	16509 (AMAZON-02) (AMAZON-02)
2 2	23.52.162.21 23.52.162.21	16625 (AKAMAI-AS) (AKAMAI-AS)
4 9	69.173.151.100 69.173.151.100	26667 (RUBICONPR...) (RUBICONPROJECT)
10	2607:f8b0:400... 2607:f8b0:4006:80b::2001	15169 (GOOGLE) (GOOGLE)
15	2607:f8b0:400... 2607:f8b0:4006:80c::2001	15169 (GOOGLE) (GOOGLE)
1 2	185.167.164.37 185.167.164.37	198622 (ADFORM) (ADFORM)
3	104.36.113.107 104.36.113.107	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 1	107.178.254.65 107.178.254.65	15169 (GOOGLE) (GOOGLE)
1	8.28.7.84 8.28.7.84	62713 (AS-PUBMATIC) (AS-PUBMATIC)
3	104.36.115.109 104.36.115.109	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 1	2620:112:f002... 2620:112:f002:bbbb::21	6336 (TURN-US-ASN) (TURN-US-ASN)
6	99.84.125.69 99.84.125.69	16509 (AMAZON-02) (AMAZON-02)
1	2607:f8b0:400... 2607:f8b0:4006:820::2002	15169 (GOOGLE) (GOOGLE)
1	2600:9000:202... 2600:9000:202c:de00:8:48e:53c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2001:4998:14:... 2001:4998:14:800::1001	14777 (YAHOO) (YAHOO)
1	34.228.175.203 34.228.175.203	14618 (AMAZON-AES) (AMAZON-AES)
8	2607:f8b0:400... 2607:f8b0:4006:80d::2002	15169 (GOOGLE) (GOOGLE)
3	143.204.143.124 143.204.143.124	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:214... 2600:9000:2140:9600:7:75d4:e40:93a1	16509 (AMAZON-02) (AMAZON-02)
1	104.36.115.114 104.36.115.114	62713 (AS-PUBMATIC) (AS-PUBMATIC)
249	72

19 34.95.11.30 (Montreal, Canada) 1 redirects

ASN396982 (GOOGLE-PRIVATE-CLOUD, US)
PTR: 30.11.95.34.bc.googleusercontent.com

gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 142.251.40.130 (United States)

ASN15169 (GOOGLE, US)
PTR: lga25s80-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 143.204.137.197 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-137-197.ewr52.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 104.16.68.69 (None, ) 2 redirects

ASN13335 (CLOUDFLARENET, US)

hb.districtm.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.districtm.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dmx.districtm.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.84.125.52 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-125-52.ewr52.r.cloudfront.net

cdn.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2607:f8b0:4006:822::200a (Queens, United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3037::6815:3c3f (United States)

ASN13335 (CLOUDFLARENET, US)

www.npttech.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6816:48e8 (United States)

ASN13335 (CLOUDFLARENET, US)

auth.lrcontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.33.46.124 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-33-46-124.ewr52.r.cloudfront.net

ak.sail-horizon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.33.46.106 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-33-46-106.ewr52.r.cloudfront.net

fem.prod.postmedia.digital	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 143.204.143.94 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-143-94.ewr52.r.cloudfront.net

smartcdn.prod.postmedia.digital	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2607:f8b0:4006:81d::2003 (Queens, United States)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2140:b000:8:f216:eb80:93a1 (United States)

ASN16509 (AMAZON-02, US)

d395dw5zk780j2.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:806::2008 (Queens, United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 13.33.46.48 (United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: server-13-33-46-48.ewr52.r.cloudfront.net

sb.scorecardresearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:4e42:600::645 (United States)

ASN54113 (FASTLY, US)

jssdkcdns.mparticle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
jssdks.mparticle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 151.101.66.133 (United States)

ASN54113 (FASTLY, US)

cdn.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.44.16.134 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-44-16-134.compute-1.amazonaws.com

pixel.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 34.149.157.221 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 221.157.149.34.bc.googleusercontent.com

smartcdn.gprod.postmedia.digital	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a04:4e42:200::645 (United States)

ASN54113 (FASTLY, US)

identity.mparticle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.176.194 (United States)

ASN15169 (GOOGLE, US)
PTR: lga34s37-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:141b:13::17d7:82d1 (New York, United States)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f012:8:face:b00c:0:1 (Secaucus, United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.75.32.157 (Ashburn, United States)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 209.54.180.3 (Ashburn, United States) 1 redirects

ASN16509 (AMAZON-02, US)

s.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:80c::2002 (Queens, United States)

ASN15169 (GOOGLE, US)

adservice.google.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:80f::2002 (Queens, United States)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 99.83.154.140 (United States)

ASN16509 (AMAZON-02, US)
PTR: aa7557bb34ea5624b.awsglobalaccelerator.com

api.sail-personalize.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2607:f8b0:4001:c15::78 (Council Bluffs, United States)

ASN15169 (GOOGLE, US)

csi.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:81f::2001 (Queens, United States)

ASN15169 (GOOGLE, US)

52648fa4f34196b9c4176788bfe49daf.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:22::14 (United States) 4 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.174.10.14 (United States) 1 redirects

ASN14413 (LINKEDIN, US)
PTR: 108-174-10-14.fwd.linkedin.com

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.18.98.194 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

p.adsymptotic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.130.133 (United States)

ASN54113 (FASTLY, US)

consumer.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4006:817::2002 (Queens, United States) 1 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:ae80:1451:12::1720 (United States) 2 redirects

ASN25751 (VALUECLICK, US)

districtm-match.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.73.194.24 (North Charleston, United States)

ASN396982 (GOOGLE-PRIVATE-CLOUD, US)
PTR: 24.194.73.34.bc.googleusercontent.com

dmx.us-east-34.districtm.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 34.200.159.147 (Ashburn, United States) 5 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-200-159-147.compute-1.amazonaws.com

match.sharethrough.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.90.254.78 (Herndon, United States) 1 redirects

ASN13768 (COGECO-PEER1, CA)

ums.acuityplatform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.175.198.118 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-175-198-118.compute-1.amazonaws.com

sync.srv.stackadapt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.45.33.138 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-45-33-138.compute-1.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.131 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.133 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f112:83:face:b00c:0:25de (Secaucus, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2607:f8b0:4006:823::2004 (Queens, United States) 3 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:80f::2003 (Queens, United States)

ASN15169 (GOOGLE, US)

www.google.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.52.161.180 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-52-161-180.deploy.static.akamaitechnologies.com

ads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.57.136.222 (Piscataway, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-57-136-222.deploy.static.akamaitechnologies.com

eus.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 34.98.64.218 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 218.64.98.34.bc.googleusercontent.com

u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 68.67.160.74 (Brooklyn, United States) 4 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 671.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.92.190.74 (United States) 1 redirects

ASN29791 (VOXEL-DOT-NET, US)

ap.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 35.71.139.29 (United States) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: afb83dd09526a6517.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 68.67.179.113 (Secaucus, United States) 4 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.132.33.46 (United States) 1 redirects

ASN18568 (BIDTELLECT, US)
PTR: 46.bidtellect.com

bttrack.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 199.127.204.142 (United States) 4 redirects

ASN26120 (RHYTHMONE, US)

sync.1rx.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync.targeting.unrulymedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 35.71.131.137 (United States) 5 redirects

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 63.251.114.182 (United States)

ASN12181 (INTERNAP-2BLK, US)

ce.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 213.19.162.80 (United Kingdom) 1 redirects

ASN3356 (LEVEL3, US)

pixel-eu.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 75.126.248.142 (United States) 2 redirects

ASN36351 (SOFTLAYER, US)
PTR: 8e.f8.7e4b.ip4.static.sl-reverse.com

um.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.207.24.140 (North Charleston, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 140.24.207.35.bc.googleusercontent.com

rtb.mfadsrvr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 151.101.130.49 (United States) 5 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:4e9:5a01:4fe8:190f:17d4:b6af (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 142.251.32.98 (United States) 7 redirects

ASN15169 (GOOGLE, US)
PTR: lga25s77-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 8.28.7.81 (United States)

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.190.66 (None, )

ASN13335 (CLOUDFLARENET, US)

dmx.districtm.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 35.173.74.115 (Ashburn, United States) 5 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-173-74-115.compute-1.amazonaws.com

usermatch.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 52.22.124.154 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-22-124-154.compute-1.amazonaws.com

beacon.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.190.60.146 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 146.60.190.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
id.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 173.223.56.123 (Secaucus, United States) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a173-223-56-123.deploy.static.akamaitechnologies.com

stags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.225.49.60 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-225-49-60.compute-1.amazonaws.com

match.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 216.200.232.253 (United States) 3 redirects

ASN30419 (MEDIAMATH-INC, US)

sync.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 54.85.224.115 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-85-224-115.compute-1.amazonaws.com

ml314.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:202c:fa00:1a:609a:6780:93a1 (United States)

ASN16509 (AMAZON-02, US)

aa.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.52.162.21 (New York, United States) 2 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-52-162-21.deploy.static.akamaitechnologies.com

ssum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 69.173.151.100 (United States) 4 redirects

ASN26667 (RUBICONPROJECT, US)

token.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel-us-east.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2607:f8b0:4006:80b::2001 (Queens, United States)

ASN15169 (GOOGLE, US)

cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2607:f8b0:4006:80c::2001 (Queens, United States)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.167.164.37 (Denmark) 1 redirects

ASN198622 (ADFORM, DK)

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.36.113.107 (United States)

ASN62713 (AS-PUBMATIC, US)

simage2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 107.178.254.65 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 65.254.178.107.bc.googleusercontent.com

pippio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 8.28.7.84 (United States)

ASN62713 (AS-PUBMATIC, US)

image4.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.36.115.109 (United States)

ASN62713 (AS-PUBMATIC, US)

image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:112:f002:bbbb::21 (United States) 1 redirects

ASN6336 (TURN-US-ASN, US)

ad.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 99.84.125.69 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-125-69.ewr52.r.cloudfront.net

ib.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:820::2002 (Queens, United States)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:202c:de00:8:48e:53c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

static.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4998:14:800::1001 (United States)

ASN14777 (YAHOO, US)

ads.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.228.175.203 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-228-175-203.compute-1.amazonaws.com

tlx.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2607:f8b0:4006:80d::2002 (Queens, United States)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 143.204.143.124 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-143-124.ewr52.r.cloudfront.net

img.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2140:9600:7:75d4:e40:93a1 (United States)

ASN16509 (AMAZON-02, US)

assets.ribn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.36.115.114 (United States)

ASN62713 (AS-PUBMATIC, US)

simage4.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
31	postmedia.digital 1 redirects gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital fem.prod.postmedia.digital — Cisco Umbrella Rank: 86165 smartcdn.prod.postmedia.digital — Cisco Umbrella Rank: 178808 smartcdn.gprod.postmedia.digital — Cisco Umbrella Rank: 68899	663 KB
26	krxd.net 5 redirects cdn.krxd.net — Cisco Umbrella Rank: 1228 consumer.krxd.net — Cisco Umbrella Rank: 1569 usermatch.krxd.net — Cisco Umbrella Rank: 981 beacon.krxd.net — Cisco Umbrella Rank: 371	186 KB
24	googlesyndication.com 52648fa4f34196b9c4176788bfe49daf.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 120 pagead2.googlesyndication.com — Cisco Umbrella Rank: 92	169 KB
24	doubleclick.net 8 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 159 googleads.g.doubleclick.net — Cisco Umbrella Rank: 37 cm.g.doubleclick.net — Cisco Umbrella Rank: 175	246 KB
17	3lift.com 3 redirects eb2.3lift.com — Cisco Umbrella Rank: 356 ib.3lift.com — Cisco Umbrella Rank: 1015 tlx.3lift.com — Cisco Umbrella Rank: 532 img.3lift.com — Cisco Umbrella Rank: 2316	153 KB
17	districtm.io 2 redirects hb.districtm.io — Cisco Umbrella Rank: 70016 cdn.districtm.io — Cisco Umbrella Rank: 1644 dmx.districtm.io — Cisco Umbrella Rank: 1164 dmx.us-east-34.districtm.io — Cisco Umbrella Rank: 14533	20 KB
16	amazon-adsystem.com 1 redirects c.amazon-adsystem.com — Cisco Umbrella Rank: 263 s.amazon-adsystem.com — Cisco Umbrella Rank: 266	50 KB
14	gstatic.com fonts.gstatic.com csi.gstatic.com	109 KB
12	rubiconproject.com 5 redirects eus.rubiconproject.com — Cisco Umbrella Rank: 512 pixel-eu.rubiconproject.com — Cisco Umbrella Rank: 2038 token.rubiconproject.com — Cisco Umbrella Rank: 593 pixel-us-east.rubiconproject.com — Cisco Umbrella Rank: 935 pixel.rubiconproject.com — Cisco Umbrella Rank: 288	18 KB
11	pubmatic.com ads.pubmatic.com — Cisco Umbrella Rank: 429 image6.pubmatic.com — Cisco Umbrella Rank: 582 simage2.pubmatic.com — Cisco Umbrella Rank: 552 image4.pubmatic.com — Cisco Umbrella Rank: 738 image2.pubmatic.com — Cisco Umbrella Rank: 752 simage4.pubmatic.com — Cisco Umbrella Rank: 1024	26 KB
10	ampproject.org cdn.ampproject.org — Cisco Umbrella Rank: 346	221 KB
10	sharethrough.com 5 redirects match.sharethrough.com — Cisco Umbrella Rank: 561	2 KB
8	adnxs.com 8 redirects ib.adnxs.com — Cisco Umbrella Rank: 210 secure.adnxs.com — Cisco Umbrella Rank: 350	7 KB
8	google.com 3 redirects adservice.google.com — Cisco Umbrella Rank: 59 www.google.com — Cisco Umbrella Rank: 2	2 KB
7	lijit.com 1 redirects ap.lijit.com — Cisco Umbrella Rank: 598 ce.lijit.com — Cisco Umbrella Rank: 696	8 KB
6	everesttech.net 5 redirects sync-tm.everesttech.net — Cisco Umbrella Rank: 491	1 KB
6	mparticle.com jssdkcdns.mparticle.com — Cisco Umbrella Rank: 5051 identity.mparticle.com — Cisco Umbrella Rank: 2515 jssdks.mparticle.com — Cisco Umbrella Rank: 4790	48 KB
6	scorecardresearch.com 2 redirects sb.scorecardresearch.com — Cisco Umbrella Rank: 129	3 KB
5	adsrvr.org 5 redirects match.adsrvr.org — Cisco Umbrella Rank: 295	3 KB
5	linkedin.com 5 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 439 www.linkedin.com — Cisco Umbrella Rank: 602 px4.ads.linkedin.com — Cisco Umbrella Rank: 5087	4 KB
5	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 35	4 KB
4	openx.net 1 redirects u.openx.net — Cisco Umbrella Rank: 636 us-u.openx.net — Cisco Umbrella Rank: 322	1 KB
4	yahoo.com 2 redirects ups.analytics.yahoo.com — Cisco Umbrella Rank: 269 pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 419 ads.yahoo.com — Cisco Umbrella Rank: 835	2 KB
4	adsafeprotected.com cdn.adsafeprotected.com — Cisco Umbrella Rank: 3336 pixel.adsafeprotected.com — Cisco Umbrella Rank: 519 static.adsafeprotected.com — Cisco Umbrella Rank: 502	39 KB
3	ml314.com 1 redirects ml314.com — Cisco Umbrella Rank: 1357	13 KB
3	mathtag.com 3 redirects sync.mathtag.com — Cisco Umbrella Rank: 387	2 KB
3	rlcdn.com 1 redirects idsync.rlcdn.com — Cisco Umbrella Rank: 283 id.rlcdn.com — Cisco Umbrella Rank: 548	766 B
3	1rx.io 3 redirects sync.1rx.io — Cisco Umbrella Rank: 480	2 KB
3	adsymptotic.com 1 redirects p.adsymptotic.com — Cisco Umbrella Rank: 497	635 B
3	google.ca adservice.google.ca — Cisco Umbrella Rank: 12901 www.google.ca — Cisco Umbrella Rank: 8810	1 KB
2	adform.net 1 redirects c1.adform.net — Cisco Umbrella Rank: 529	952 B
2	casalemedia.com 2 redirects ssum-sec.casalemedia.com — Cisco Umbrella Rank: 463	2 KB
2	bidr.io 2 redirects match.prod.bidr.io — Cisco Umbrella Rank: 444	1 KB
2	mfadsrvr.com 2 redirects rtb.mfadsrvr.com — Cisco Umbrella Rank: 740	775 B
2	simpli.fi 2 redirects um.simpli.fi — Cisco Umbrella Rank: 691	1 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 97	424 B
2	stackadapt.com 2 redirects sync.srv.stackadapt.com — Cisco Umbrella Rank: 768	794 B
2	dotomi.com 2 redirects districtm-match.dotomi.com — Cisco Umbrella Rank: 6427	685 B
2	sail-personalize.com api.sail-personalize.com — Cisco Umbrella Rank: 2482	475 B
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 126	114 KB
2	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 99	16 KB
2	cloudfront.net d395dw5zk780j2.cloudfront.net	13 KB
1	ribn.com assets.ribn.com — Cisco Umbrella Rank: 44469	4 KB
1	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 146	38 KB
1	turn.com 1 redirects ad.turn.com — Cisco Umbrella Rank: 653	518 B
1	pippio.com 1 redirects pippio.com — Cisco Umbrella Rank: 692	555 B
1	agkn.com aa.agkn.com — Cisco Umbrella Rank: 388	655 B
1	bluekai.com 1 redirects stags.bluekai.com — Cisco Umbrella Rank: 447	716 B
1	unrulymedia.com 1 redirects sync.targeting.unrulymedia.com — Cisco Umbrella Rank: 821	584 B
1	bttrack.com 1 redirects bttrack.com — Cisco Umbrella Rank: 648	695 B
1	t.co t.co — Cisco Umbrella Rank: 456	335 B
1	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 468	457 B
1	acuityplatform.com 1 redirects ums.acuityplatform.com — Cisco Umbrella Rank: 946	606 B
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 539	6 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 830	2 KB
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 50	109 KB
1	sail-horizon.com ak.sail-horizon.com — Cisco Umbrella Rank: 2571	43 KB
1	lrcontent.com auth.lrcontent.com — Cisco Umbrella Rank: 37875	47 KB
1	npttech.com www.npttech.com — Cisco Umbrella Rank: 4023	3 KB
249	59

	Domain	Requested by
19	gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital	1 redirects gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
15	tpc.googlesyndication.com	gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital securepubads.g.doubleclick.net cdn.ampproject.org tpc.googlesyndication.com
12	beacon.krxd.net	gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital cdn.krxd.net
12	s.amazon-adsystem.com	1 redirects c.amazon-adsystem.com s.amazon-adsystem.com match.sharethrough.com ap.lijit.com u.openx.net cdn.districtm.io ads.pubmatic.com eus.rubiconproject.com
10	cdn.ampproject.org	securepubads.g.doubleclick.net
10	cm.g.doubleclick.net	7 redirects u.openx.net eus.rubiconproject.com
10	match.sharethrough.com	5 redirects s.amazon-adsystem.com match.sharethrough.com
10	dmx.districtm.io	1 redirects hb.districtm.io cdn.districtm.io gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
10	securepubads.g.doubleclick.net	gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital securepubads.g.doubleclick.net www.googletagservices.com
8	pagead2.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com
7	eb2.3lift.com	3 redirects
7	www.google.com	3 redirects gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital tpc.googlesyndication.com
7	csi.gstatic.com	securepubads.g.doubleclick.net cdn.ampproject.org
7	fonts.gstatic.com	fonts.googleapis.com
6	ib.3lift.com	securepubads.g.doubleclick.net ib.3lift.com
6	sync-tm.everesttech.net	5 redirects u.openx.net
6	smartcdn.gprod.postmedia.digital	gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
6	cdn.krxd.net	fem.prod.postmedia.digital cdn.krxd.net
6	sb.scorecardresearch.com	2 redirects fem.prod.postmedia.digital gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
5	usermatch.krxd.net	5 redirects
5	ce.lijit.com	ap.lijit.com
5	match.adsrvr.org	5 redirects
5	cdn.districtm.io	1 redirects hb.districtm.io cdn.districtm.io s.amazon-adsystem.com
5	smartcdn.prod.postmedia.digital	gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
5	fonts.googleapis.com	gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital securepubads.g.doubleclick.net
4	pixel.rubiconproject.com	eus.rubiconproject.com
4	token.rubiconproject.com	3 redirects eus.rubiconproject.com
4	secure.adnxs.com	4 redirects
4	ib.adnxs.com	4 redirects
4	googleads.g.doubleclick.net	1 redirects www.googleadservices.com gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
4	identity.mparticle.com	jssdkcdns.mparticle.com
4	c.amazon-adsystem.com	gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital c.amazon-adsystem.com
3	img.3lift.com	ib.3lift.com
3	image2.pubmatic.com	ads.pubmatic.com
3	simage2.pubmatic.com	ads.pubmatic.com
3	ml314.com	1 redirects gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital ml314.com
3	sync.mathtag.com	3 redirects
3	sync.1rx.io	3 redirects
3	consumer.krxd.net	cdn.krxd.net
3	p.adsymptotic.com	1 redirects gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital ads.pubmatic.com
3	px.ads.linkedin.com	3 redirects
2	c1.adform.net	1 redirects ads.pubmatic.com
2	ssum-sec.casalemedia.com	2 redirects
2	match.prod.bidr.io	2 redirects
2	idsync.rlcdn.com	1 redirects gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
2	us-u.openx.net	u.openx.net
2	rtb.mfadsrvr.com	2 redirects
2	um.simpli.fi	2 redirects
2	ap.lijit.com	1 redirects s.amazon-adsystem.com
2	u.openx.net	1 redirects s.amazon-adsystem.com
2	eus.rubiconproject.com	s.amazon-adsystem.com eus.rubiconproject.com
2	ads.pubmatic.com	s.amazon-adsystem.com ads.pubmatic.com
2	www.google.ca	gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
2	www.facebook.com	gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
2	ups.analytics.yahoo.com	2 redirects
2	sync.srv.stackadapt.com	2 redirects
2	districtm-match.dotomi.com	2 redirects
2	api.sail-personalize.com	ak.sail-horizon.com
2	connect.facebook.net	gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital connect.facebook.net
2	www.googleadservices.com	www.googletagmanager.com www.googleadservices.com
2	pixel.adsafeprotected.com	cdn.adsafeprotected.com gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
2	d395dw5zk780j2.cloudfront.net	fem.prod.postmedia.digital d395dw5zk780j2.cloudfront.net
1	jssdks.mparticle.com	jssdkcdns.mparticle.com
1	simage4.pubmatic.com	ads.pubmatic.com
1	assets.ribn.com	gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
1	tlx.3lift.com	ib.3lift.com
1	id.rlcdn.com	eus.rubiconproject.com
1	ads.yahoo.com	eus.rubiconproject.com
1	static.adsafeprotected.com	pixel.adsafeprotected.com
1	pixel-us-east.rubiconproject.com	1 redirects
1	www.googletagservices.com	securepubads.g.doubleclick.net
1	ad.turn.com	1 redirects
1	image4.pubmatic.com	ads.pubmatic.com
1	pippio.com	1 redirects
1	aa.agkn.com	gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
1	stags.bluekai.com	1 redirects
1	image6.pubmatic.com	ads.pubmatic.com
1	pr-bh.ybp.yahoo.com	u.openx.net
1	pixel-eu.rubiconproject.com	1 redirects
1	sync.targeting.unrulymedia.com	1 redirects
1	bttrack.com	1 redirects
1	t.co	gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
1	analytics.twitter.com	static.ads-twitter.com
1	ums.acuityplatform.com	1 redirects
1	dmx.us-east-34.districtm.io	gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
1	px4.ads.linkedin.com	1 redirects
1	www.linkedin.com	1 redirects
1	52648fa4f34196b9c4176788bfe49daf.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	adservice.google.com	securepubads.g.doubleclick.net
1	adservice.google.ca	securepubads.g.doubleclick.net
1	static.ads-twitter.com	gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
1	snap.licdn.com	www.googletagmanager.com
1	jssdkcdns.mparticle.com	fem.prod.postmedia.digital
1	www.googletagmanager.com	fem.prod.postmedia.digital
1	fem.prod.postmedia.digital	gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
1	ak.sail-horizon.com	gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
1	auth.lrcontent.com	gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
1	www.npttech.com	gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
1	cdn.adsafeprotected.com	gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
1	hb.districtm.io	gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
249	100

This site contains links to these domains. Also see Links.

Domain
ofoffers.ca
www.remembering.ca
eb2.3lift.com
shopping.ontariofarmer.com
www.businesswire.com
www.newsfilecorp.com
www.globenewswire.com
7c1e077b.flowpaper.com
www.facebook.com
twitter.com
www.postmediasolutions.com
adregistry.postmedia.com
www.postmedia.com

Subject Issuer	Validity	Valid
gcp-cheet-4407-driving.gdev.postmedia.digital R3	`2022-02-14` - `2022-05-15`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
c.amazon-adsystem.com Amazon	`2021-07-06` - `2022-06-27`	a year	crt.sh
districtm.io Cloudflare Inc ECC CA-3	`2021-06-02` - `2022-06-01`	a year	crt.sh
*.adsafeprotected.com Amazon	`2021-07-21` - `2022-08-19`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-05` - `2022-07-04`	a year	crt.sh
ak.sail-horizon.com Amazon	`2022-01-06` - `2023-02-02`	a year	crt.sh
fem.prod.postmedia.digital Amazon	`2021-11-08` - `2022-12-06`	a year	crt.sh
*.prod.postmedia.digital Amazon	`2022-01-15` - `2023-02-13`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
*.cloudfront.net Amazon	`2021-03-19` - `2022-03-17`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
*.scorecardresearch.com Amazon	`2022-01-29` - `2023-02-27`	a year	crt.sh
jssdkcdns.mparticle.com R3	`2021-12-27` - `2022-03-27`	3 months	crt.sh
cdn.krxd.net DigiCert TLS RSA SHA256 2020 CA1	`2021-12-30` - `2022-12-29`	a year	crt.sh
fw.adsafeprotected.com Amazon	`2021-08-11` - `2022-09-09`	a year	crt.sh
smartcdn.gprod.postmedia.digital GTS CA 1D4	`2022-02-12` - `2022-05-13`	3 months	crt.sh
identity.mparticle.com Go Daddy Secure Certificate Authority - G2	`2021-07-07` - `2022-08-08`	a year	crt.sh
www.googleadservices.com GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2021-07-15` - `2022-07-20`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-11-23` - `2022-02-21`	3 months	crt.sh
ads-twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2021-07-21` - `2022-07-26`	a year	crt.sh
s.amazon-adsystem.com Amazon	`2021-07-14` - `2022-06-27`	a year	crt.sh
*.google.ca GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
api.sail-personalize.com Amazon	`2021-06-24` - `2022-07-23`	a year	crt.sh
consumer.krxd.net DigiCert TLS RSA SHA256 2020 CA1	`2021-07-13` - `2022-07-12`	a year	crt.sh
*.googleadservices.com GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
*.twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2021-03-24` - `2022-03-23`	a year	crt.sh
t.co DigiCert TLS RSA SHA256 2020 CA1	`2021-03-24` - `2022-03-23`	a year	crt.sh
www.google.com GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
*.sharethrough.com Amazon	`2021-08-13` - `2022-09-11`	a year	crt.sh
*.pubmatic.com DigiCert SHA2 Secure Server CA	`2022-02-04` - `2023-02-03`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2021-04-01` - `2022-04-04`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2021-07-08` - `2022-08-08`	a year	crt.sh
*.lijit.com Go Daddy Secure Certificate Authority - G2	`2021-03-11` - `2022-04-12`	a year	crt.sh
*.ybp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2022-01-18` - `2022-07-13`	6 months	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2022-02-03` - `2023-02-25`	a year	crt.sh
*.ml314.com Amazon	`2021-12-17` - `2023-01-14`	a year	crt.sh
misc-sni.google.com GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
track.adform.net DigiCert TLS RSA SHA256 2020 CA1	`2021-09-06` - `2022-10-07`	a year	crt.sh
*.3lift.com Amazon	`2021-06-12` - `2022-07-11`	a year	crt.sh
static.adsafeprotected.com Amazon	`2021-09-05` - `2022-10-04`	a year	crt.sh
beacon.krxd.net DigiCert TLS RSA SHA256 2020 CA1	`2021-11-03` - `2022-11-02`	a year	crt.sh
*.ribn.com Amazon	`2021-09-20` - `2022-10-19`	a year	crt.sh
jssdks.mparticle.com R3	`2021-12-27` - `2022-03-27`	3 months	crt.sh

This page contains 28 frames:

Primary Page: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Frame ID: 88ABD54EEA84B4800D1052000BD6987E
Requests: 99 HTTP requests in this frame

Frame: https://d395dw5zk780j2.cloudfront.net/v51.1/xd.html
Frame ID: 027897D0649F8601FA07D752859E0425
Requests: 2 HTTP requests in this frame

Frame: https://cdn.districtm.io/ids/index.html
Frame ID: 1FD07BA273532EB2BC0D111C6A600CC3
Requests: 9 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&dcc=t
Frame ID: 011FE867848870D9003201D0AD16702E
Requests: 1 HTTP requests in this frame

Frame: https://cdn.krxd.net/partnerjs/xdi/proxy.3d2100fd7107262ecb55ce6847f01fa5.html
Frame ID: A7E4F53E0308BF0C7365CE22AC176DB8
Requests: 19 HTTP requests in this frame

Frame: https://52648fa4f34196b9c4176788bfe49daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 3EFB3716EA3D991AE7647F6308C48C23
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/v3/pr?exlist=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&fv=1.0&a=cm&cm3ppd=1
Frame ID: E0F359B05B305C8FEBE5F8FDF4737932
Requests: 1 HTTP requests in this frame

Frame: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Frame ID: E4C9DEF88BAA81E18F4742821DA15F5F
Requests: 6 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3DPM_UID%26ex%3Dpubmatic.com&userIdMacro=PM_UID
Frame ID: 3933DFD1B2417EE483F1DAB15744B222
Requests: 11 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Frame ID: 1F125C1E5916FC1E81E82D91BF815CF8
Requests: 12 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Frame ID: 11F8493CB09211DB6A9A1B46DAB80A65
Requests: 7 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?id=5894217850497717679&ex=districtm
Frame ID: 021AA08130FD95345920243EF62522D2
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?id=5894217850497717679&ex=appnexus.com
Frame ID: F28C3889DB30B398BDA7251F2D54092D
Requests: 1 HTTP requests in this frame

Frame: https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Frame ID: 78216C3B61EB1465E5EEB187B6E8D90E
Requests: 7 HTTP requests in this frame

Frame: https://cdn.districtm.io/ids/index.html?sellerid=10002&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Ddmx.com%26id%3D%7BUID%7D
Frame ID: 68B4D287BE29ED0296094FE1F2926264
Requests: 3 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=657918283301527424755
Frame ID: 6C14FC40D3F8B4F71B508B6D97293BCD
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 7608A13182EA8B3B5735F490E922235D
Requests: 1 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012201141909000/amp4ads-v0.mjs
Frame ID: BF604AEA6137810E86AADD438063AC04
Requests: 19 HTTP requests in this frame

Frame: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=F821B65A-E9C3-4E67-BB4B-F972CC37748C
Frame ID: 70811697E3CD511F18D30C70C980BFA2
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YgpqMgAGHgJiRgAy&gdpr=0&gdpr_consent=
Frame ID: 332572A4F45F1E0A18E5D28841F9AB96
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?id=F821B65A-E9C3-4E67-BB4B-F972CC37748C&ex=pubmatic.com
Frame ID: 4093B84F642B03E123C7D683981E1120
Requests: 1 HTTP requests in this frame

Frame: https://pixel.adsafeprotected.com/jload?anId=928934&campId=5x5&pubId=4811995650&chanId=21809871911&placementId=5900230719&pubCreative=138379291044&pubOrder=2975178441&cb=472998217&custom=index&custom2=1&adsafe_par&impId=3f2c8dd4-8da4-11ec-a4ac-022945e664bf
Frame ID: 1D332ECB66E81757D7470234EEBCF3CA
Requests: 2 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvdJtdTtdljLKJykAuFdctrhprCv7KY_gPKJwMcwFvFSHy8O6_kb0gpMkjKTT7XVmtrhufk780J-HkIVuSyFd5c3siupYKQCKIfghy9peLU6a-5DJM9ZdIDqKibiotYOOQaVulDqSOZ-cVC8wsw9mRWS5D0r9cVlxZE4lklPSFbcOpbgTxbC_TcyEZRFCfknJHKy74F4K_7sjFfxSOha9mBmXoeVHroIb2CTDLbh3_zvR-Dk6yZEjqTK71_oKXh2So2O09-D2JiiPu0PigtsCNgsG3jE01yjhNokFUTputBsLe79tpRPIPxz1LwFs2Vmc-b8z_a9Pqsu8qbOTU852uSGM02mCAWjYO39WwvCmsc5VnBxBWW1rqzyzh8Eg&sai=AMfl-YT-9DKpjJMyFTtcm-1cXHqZmJnRs4NL_gFXDj1dCcnHMSqIVxEcCZR8klVTBv_e--ttaLALqgKruWG_PDhqUdu_svlAB8LceFRNlXiWqbFRo5vfnDtbYoANSR1lLggh&sig=Cg0ArKJSzHDcVkxmZr8xEAE&uach_m=[UACH]&urlfix=1&adurl=
Frame ID: AC46F5DA7F8E0DBFCFA4FE62F8B89F89
Requests: 13 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012201141909000/amp4ads-v0.mjs
Frame ID: D2CC806415B516B526595D1DC3AB317C
Requests: 23 HTTP requests in this frame

Frame: https://tlx.3lift.com/web/adserving?inv_code=Promoted_By_Desktop&referrer=https%3A%2F%2Fgcp-cheet-4407-ontariofarmer.gdev.postmedia.digital%2F&rev=e0fe245&fe=0&ft=1&cb=5171092498&tid=11059141&n=1
Frame ID: D3195AEC65A82634822CADEB5F0A6B82
Requests: 1 HTTP requests in this frame

Frame: https://img.3lift.com/lp?width=334&height=258&url=%2F%2Fimages.3lift.com%2F15221614.jpg&logo_exclude=&v=15
Frame ID: 0EE6ECF8A89222F0D12B55783686278B
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 48C3EF78C48A976116249C272736887B
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: DCF3C382667DBB292BAF0A96A4775168
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Home | Ontario FarmerOntario Farmer

Page URL History Show full URLs

http://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/ HTTP 308
https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

comScore (Analytics) Expand

Overall confidence: 100%
Detected patterns

\.scorecardresearch\.com/beacon\.js|COMSCORE\.beacon

Page Statistics

249
Requests

80 %
HTTPS

33 %
IPv6

59
Domains

100
Subdomains

72
IPs

5
Countries

2372 kB
Transfer

6728 kB
Size

96
Cookies

13 Outgoing links

These are links going to different origins than the main page.

URL: https://ofoffers.ca/
Title: Subscribe

Search URL Search Domain Scan URL

URL: http://www.remembering.ca/about/
Title: Obituaries

Search URL Search Domain Scan URL

URL: https://eb2.3lift.com/pass?tl_clickthrough=true&redir=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjssWTLpJAKa8TDZ0-iwt8aGYcRmfuHcttJ5bYsSHmL-BMf2SYK9TCT-CKJO_C4obO3GmoWxw3E0R9gMKXgSDqG_Xm8m6oVpiTVBfjjx9GWL7wKpMeEdnvbVpxp4OcX8ZnO0-oiyOrPYDjfyCMkEdkOS_AaFgbUIC8r0ORUkXZER9gY7eY3vK9tIlY2ZU_oi-TCubIW4DPQX5sVOCUfev252DpwkbpI5VpFPlXOTzrhPVI2AVInJO53YAE3ZGiuPtl-F8HcG9mDd3FIBdvKZup9Z05LKOHwjsk2TOfn8pizfP6OhVoQD9oTN90fdqh6lnuILVgNc4iCU8H7_R0j1Jf5KRKHME5ibA89ge0qINS0NhxEwwvRzZKcfkhA%2526sai%253DAMfl-YTeunGIUgbKnSx0s3jSISGPUOpqpXRwHrsD9khNfle5sxMesUaw5MAl0ZVa4mVP4826ES3AIbZ5tJXikUliz7QEXCxZJppBkgfU8ykpdnqApbgNR3pJJsX3ApTc31Qj%2526sig%253DCg0ArKJSzHH74DKM-b3_EAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253Dhttps%253A%252F%252Fwww.healthing.ca%252Fwellness%252Fmental-health%252Fdepression-covid-vaccine-misinformation%252F%253Futm_source%253Dhealthingcontentads_marketing%2526utm_medium%253Donnetwork_native%2526utm_campaign%253Dhealthing_on_network_boosting_marketing%2526utm_content%253Ddepressed-fake-news&ss=0&bc=0.0&pr=%24%7BAUCTION_PRICE%7D&brid=1&bmid=0&advid=46559&clid=10660788&biid=0&tid=11059141&adid=&aid=11870724055702907300990&bcud=0&ts=1644849716&cb=83390
Title: Depressed people are more susceptible to fake news They found that people with depression were 2.2 times more likely to endorse misinformation about the vaccines.

Search URL Search Domain Scan URL

URL: https://shopping.ontariofarmer.com/
Title: London

Search URL Search Domain Scan URL

URL: https://www.businesswire.com/
Title: Promoted By Business Wire

Search URL Search Domain Scan URL

URL: https://www.newsfilecorp.com/
Title: Promoted By Newsfile

Search URL Search Domain Scan URL

URL: https://www.globenewswire.com/
Title: Promoted By GlobeNewswire

Search URL Search Domain Scan URL

URL: https://7c1e077b.flowpaper.com/Shopper/
Title: Ontario Farmer Shopper November 9, 2021

Search URL Search Domain Scan URL

URL: https://www.facebook.com/OntFarmerNews/

Search URL Search Domain Scan URL

URL: https://twitter.com/OntFarmerNews

Search URL Search Domain Scan URL

URL: https://www.postmediasolutions.com/contact-us/
Title: Advertise With Us

Search URL Search Domain Scan URL

URL: https://adregistry.postmedia.com/
Title: Digital Ad Registry

Search URL Search Domain Scan URL

URL: https://www.postmedia.com/brands

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/ HTTP 308
https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 62

https://sb.scorecardresearch.com/b?c1=2&c2=10276888&ns__t=1644849712337&ns_c=UTF-8&c8=Home%20%7C%20Ontario%20Farmer&c7=https%3A%2F%2Fgcp-cheet-4407-ontariofarmer.gdev.postmedia.digital%2F&c9= HTTP 302
https://sb.scorecardresearch.com/b2?c1=2&c2=10276888&ns__t=1644849712337&ns_c=UTF-8&c8=Home%20%7C%20Ontario%20Farmer&c7=https%3A%2F%2Fgcp-cheet-4407-ontariofarmer.gdev.postmedia.digital%2F&c9=

Request Chain 67

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift HTTP 302
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&dcc=t

Request Chain 78

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1747836&time=1644849713382&url=https%3A%2F%2Fgcp-cheet-4407-ontariofarmer.gdev.postmedia.digital%2F HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1747836&time=1644849713382&url=https%3A%2F%2Fgcp-cheet-4407-ontariofarmer.gdev.postmedia.digital%2F&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1747836%26time%3D1644849713382%26url%3Dhttps%253A%252F%252Fgcp-cheet-4407-ontariofarmer.gdev.postmedia.digital%252F%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1747836&time=1644849713382&url=https%3A%2F%2Fgcp-cheet-4407-ontariofarmer.gdev.postmedia.digital%2F&cookiesTest=true&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1747836&time=1644849713382&url=https%3A%2F%2Fgcp-cheet-4407-ontariofarmer.gdev.postmedia.digital%2F&cookiesTest=true&liSync=true&e_ipv6=AQIeDdf-zCvp3AAAAX74rtVC1SIR5OSeh82dsJac3l2u9AutrAu3uF9yyvVYg9QqYDxTus6XKg HTTP 302
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=20fd700a-ca2d-4991-98a6-a14e18612ecb HTTP 302
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=20fd700a-ca2d-4991-98a6-a14e18612ecb&_expected_cookie=c80322a6b8ec05e3dbbf3291754319a0

Request Chain 82

https://districtm-match.dotomi.com/match/bounce/current?version=1&networkId=33921&nuid=256ZtlaQ1z0vmkNWw4pXg9nARF5&rurl=//dmx.us-east-34.districtm.io/s/10007/ HTTP 302
https://districtm-match.dotomi.com/match/bounce/current?DotomiTest=2c922427c08111fd&is_secure=true&version=1&networkId=33921&nuid=256ZtlaQ1z0vmkNWw4pXg9nARF5&rurl=%2F%2Fdmx.us-east-34.districtm.io%2Fs%2F10007%2F HTTP 302
https://dmx.us-east-34.districtm.io/s/10007/AAAGZRz4UMDk1wNHLviNAAAAAAA&expiration=1644936114&nuid=256ZtlaQ1z0vmkNWw4pXg9nARF5&is_secure=true

Request Chain 83

https://match.sharethrough.com/1PQ8qgv7/v1/ HTTP 302
https://dmx.districtm.io/s/10059/e7c0abdf-9fb3-4781-beae-0b49ea731a1b

Request Chain 84

https://ums.acuityplatform.com/tum?umid=137&rurl=https%3A%2F%2Fdmx.districtm.io%2Fs%2F10022%2F___AUID___ HTTP 302
https://dmx.districtm.io/s/10022/647146259108

Request Chain 85

https://sync.srv.stackadapt.com/sync?nid=132 HTTP 302
https://dmx.districtm.io/s/10026/m4mZh7rQSnts18eK7qhf75U4mbc

Request Chain 86

https://ups.analytics.yahoo.com/ups/58377/occ?gdpr=&gdpr_consent= HTTP 302
https://ups.analytics.yahoo.com/ups/58377/occ?gdpr=&gdpr_consent=&verify=true HTTP 302
https://dmx.districtm.io/s/10057/y-ePmhI_FE2uGX4__0tKtJ71KtdRsl0KNeNd5dEhE-~A

Request Chain 95

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/580448699/?random=1827434592&cv=9&fst=1644849713400&num=1&value=0&label=FmJTCMOu_N8BELvj45QC&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg290&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fgcp-cheet-4407-ontariofarmer.gdev.postmedia.digital%2F&tiba=Home%20%7C%20Ontario%20Farmer&auid=335390189.1644849712&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=MWoKYo6oKdDy_gSFiKDoBw&sscte=1&crd=CNPgGw&eitems=ChAIgJiokAYQnfrV4_fqgoxOEh0AaVBoS20mhtOwqpp18DvxU1LA-zaF0S7ZB8Jwag HTTP 302
https://www.google.com/pagead/1p-conversion/580448699/?random=1827434592&cv=9&fst=1644849713400&num=1&value=0&label=FmJTCMOu_N8BELvj45QC&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg290&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fgcp-cheet-4407-ontariofarmer.gdev.postmedia.digital%2F&tiba=Home%20%7C%20Ontario%20Farmer&auid=335390189.1644849712&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=CNPgGw&is_vtc=1&ocp_id=MWoKYo6oKdDy_gSFiKDoBw&cid=CAQSKQCNIrLMrNLye87meWERX4MOdSoKtAjS4JMMSEGtAC3GsLQ413kqsuKE&eitems=ChAIgJiokAYQnfrV4_fqgoxOEh0AaVBoS8hL3_KLK9Rs34IcdcZKLIAqSAaVNwMekg&random=1970433870&resp=GooglemKTybQhCsO HTTP 302
https://www.google.ca/pagead/1p-conversion/580448699/?random=1827434592&cv=9&fst=1644849713400&num=1&value=0&label=FmJTCMOu_N8BELvj45QC&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg290&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fgcp-cheet-4407-ontariofarmer.gdev.postmedia.digital%2F&tiba=Home%20%7C%20Ontario%20Farmer&auid=335390189.1644849712&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=CNPgGw&is_vtc=1&ocp_id=MWoKYo6oKdDy_gSFiKDoBw&cid=CAQSKQCNIrLMrNLye87meWERX4MOdSoKtAjS4JMMSEGtAC3GsLQ413kqsuKE&eitems=ChAIgJiokAYQnfrV4_fqgoxOEh0AaVBoS8hL3_KLK9Rs34IcdcZKLIAqSAaVNwMekg&random=1970433870&resp=GooglemKTybQhCsO&ipr=y&prhg=0

Request Chain 100

https://u.openx.net/w/1.0/cm?id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D HTTP 302
https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D

Request Chain 101

https://ib.adnxs.com/getuid?https://s.amazon-adsystem.com/ecm3?id=$UID&ex=districtm HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID%26ex%3Ddistrictm HTTP 302
https://s.amazon-adsystem.com/ecm3?id=5894217850497717679&ex=districtm

Request Chain 102

https://ib.adnxs.com/getuid?https://s.amazon-adsystem.com/ecm3?id=$UID&ex=appnexus.com HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID%26ex%3Dappnexus.com HTTP 302
https://s.amazon-adsystem.com/ecm3?id=5894217850497717679&ex=appnexus.com

Request Chain 103

https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com HTTP 302
https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1

Request Chain 104

https://cdn.districtm.io/ids/?sellerid=10002&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Ddmx.com%26id%3D%7BUID%7D HTTP 301
https://cdn.districtm.io/ids/index.html?sellerid=10002&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Ddmx.com%26id%3D%7BUID%7D

Request Chain 105

https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID HTTP 302
https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=657918283301527424755

Request Chain 107

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=1 HTTP 302
https://secure.adnxs.com/getuid?https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&source_user_id=$UID HTTP 302
https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&source_user_id=5894217850497717679

Request Chain 108

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=2 HTTP 302
https://secure.adnxs.com/getuid?https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&source_user_id=$UID HTTP 302
https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&source_user_id=5894217850497717679

Request Chain 109

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=3 HTTP 302
https://bttrack.com/pixel/cookiesync?source=d0afdff5-c51e-4a8d-b07b-b52a29015170&secure=1 HTTP 302
https://match.sharethrough.com/sync/v1?source_id=FGhqNjC2WnFmmvNpTL32LMME&source_user_id=d9293377-3f47-447d-b3ae-2102ba9fdff9

Request Chain 110

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=4 HTTP 302
https://secure.adnxs.com/getuid?https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&source_user_id=$UID HTTP 302
https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&source_user_id=5894217850497717679

Request Chain 116

https://sync.1rx.io/usersync2/sovrn?gdpr=0&gdpr_consent= HTTP 302
https://sync.1rx.io/usersync2/sovrn?zcc=1&cb=1644849714831 HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=5825804547 HTTP 302
https://sync.1rx.io/usersync/tradedesk/c2da4108-b919-40cc-a8d8-9255d4db5b3e HTTP 302
https://sync.targeting.unrulymedia.com/csync/RX-708fe789-db7e-474d-b017-6e1fe43364b9-005?redir=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D56%263pid%3DRX-708fe789-db7e-474d-b017-6e1fe43364b9-005 HTTP 302
https://ce.lijit.com/merge?pid=56&3pid=RX-708fe789-db7e-474d-b017-6e1fe43364b9-005

Request Chain 117

https://pixel-eu.rubiconproject.com/exchange/sync.php?p=sovrn-onscroll&gdpr=0&gdpr_consent= HTTP 302
https://ce.lijit.com/merge?pid=83&3pid=KZMT1V8E-1O-5H7Z&gdpr=0

Request Chain 118

https://secure.adnxs.com/getuid?https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D12%263pid%3D%24UID&gdpr=0&gdpr_consent= HTTP 302
https://ce.lijit.com/merge?pid=12&3pid=5894217850497717679&gdpr=0&gdpr_consent=

Request Chain 119

https://um.simpli.fi/lj_match?r=1644849714310&gdpr=0&gdpr_consent= HTTP 302
https://ce.lijit.com/merge?pid=2&3pid=00909A6B55AB4796A6C21D838F770B8D

Request Chain 120

https://rtb.mfadsrvr.com/sync?ssp=sovrn&gdpr=0&gdpr_consent= HTTP 302
https://rtb.mfadsrvr.com/ul_cb/sync?ssp=sovrn&gdpr=0&gdpr_consent= HTTP 302
https://ce.lijit.com/merge?pid=87&3pid=64bc7537-2bbe-43ac-836a-f804e904695e

Request Chain 122

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=YgpqMgAGHw5hqwAy

Request Chain 124

https://match.adsrvr.org/track/cmf/openx?oxid=f17e5812-2a70-3580-77ba-fe0d3fd789df&gdpr=0 HTTP 302
https://match.adsrvr.org/track/cmb/openx?oxid=f17e5812-2a70-3580-77ba-fe0d3fd789df&gdpr=0 HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072971&val=c2da4108-b919-40cc-a8d8-9255d4db5b3e&ttd_puid=f17e5812-2a70-3580-77ba-fe0d3fd789df

Request Chain 126

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEEKHh1VU2wuzFMiUeaY9Qjw&google_cver=1

Request Chain 130

https://usermatch.krxd.net/um/v2?partner=google HTTP 302
https://cm.g.doubleclick.net/pixel?google_cm&google_nid=krux_digital&google_hm=T3FZVDBOYlY HTTP 302
https://beacon.krxd.net/usermatch.gif?google_gid=CAESEDkCxXvXAY4QMLhRe_P8IZY&google_cver=1

Request Chain 131

https://cm.g.doubleclick.net/pixel?google_nid=krux_digital&google_cm&google_hm=T3FZVDBOYlY HTTP 302
https://beacon.krxd.net/usermatch.gif?google_gid=CAESEDkCxXvXAY4QMLhRe_P8IZY&google_cver=1

Request Chain 133

https://stags.bluekai.com/site/26357?id=OqYT0NbV&redir=https://beacon.krxd.net/usermatch.gif?_kuid%3DOqYT0NbV%26partner%3Dbluekai%26bk_uuid%3D%24_BK_UUID HTTP 302
https://beacon.krxd.net/usermatch.gif?_kuid=OqYT0NbV&partner=bluekai&bk_uuid=$_BK_UUID

Request Chain 135

https://sync-tm.everesttech.net/upi/pid/NC4WTmcy?redir=https%3A%2F%2Fbeacon.krxd.net%2Fusermatch.gif%3Fpartner_id%3Dcb276571-e0d9-4438-9fd4-80a1ff034b01%26puid%3D%24%7BTM_USER_ID%7D HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/NC4WTmcy?redir=https%3A%2F%2Fbeacon.krxd.net%2Fusermatch.gif%3Fpartner_id%3Dcb276571-e0d9-4438-9fd4-80a1ff034b01%26puid%3D%24%7BTM_USER_ID%7D&_test=YgpqMgAGHgJiRgAy HTTP 302
https://beacon.krxd.net/usermatch.gif?partner_id=cb276571-e0d9-4438-9fd4-80a1ff034b01&puid=YgpqMgAGHgJiRgAy&_test=YgpqMgAGHgJiRgAy

Request Chain 136

https://usermatch.krxd.net/um/v2?partner=beeswax HTTP 302
https://match.prod.bidr.io/cookie-sync/krux?partner_user_id=OqYT0NbV HTTP 303
https://match.prod.bidr.io/cookie-sync/krux?partner_user_id=OqYT0NbV&_bee_ppp=1 HTTP 303
https://beacon.krxd.net/usermatch.gif?partner=beeswax&partner_uid=AAB4sU7EFNQAAH6IC2NkfA

Request Chain 137

https://usermatch.krxd.net/um/v2?partner=mediamath HTTP 302
https://sync.mathtag.com/sync/img?mt_exid=10031&mt_exuid=OqYT0NbV&redirect=https://beacon.krxd.net/usermatch.gif?partner%3Dmediamath%26partner_id%3D%5BMM_UUID%5D HTTP 302
https://beacon.krxd.net/usermatch.gif?partner=mediamath&partner_id=b0c1620a-6a33-4a00-8d09-8d3972873d75

Request Chain 139

https://usermatch.krxd.net/um/v2?partner=neustar HTTP 302
https://aa.agkn.com/adscores/g.js?sid=9212244187&_kdpid=OqYT0NbV

Request Chain 140

https://ssum-sec.casalemedia.com/usermatchredir?s=183716&cb=https%3A%2F%2Fbeacon.krxd.net%2Fusermatch.gif%3Fpartner%3Dcasale%26partner_uid%3D__UID__ HTTP 302
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fbeacon.krxd.net%2Fusermatch.gif%3Fpartner%3Dcasale%26partner_uid%3D__UID__&s=183716&C=1 HTTP 302
https://beacon.krxd.net/usermatch.gif?partner=casale&partner_uid=YgpqM.NJRzZAP61od8rrawAA%26465

Request Chain 141

https://sync.srv.stackadapt.com/sync?nid=salesforce HTTP 302
https://beacon.krxd.net/usermatch.gif?partner=stackadapt&partner_uid=m4mZh7rQSnts18eK7qhf75U4mbc

Request Chain 142

https://usermatch.krxd.net/um/v2?partner=triplelift&gdpr=0&cmp_cs=&us_privacy=undefined HTTP 302
https://eb2.3lift.com/xuid?mid=3587&xuid=OqYT0NbV&dongle=13b2&rdir=https://beacon.krxd.net/usermatch.gif?partner%3Dtriplelift%26partner_uid%3D$UID&gdpr=0&cmp_cs=&us_privacy=undefined HTTP 302
https://beacon.krxd.net/usermatch.gif?partner=triplelift&partner_uid=657918283301527424755

Request Chain 144

https://dmx.districtm.io/s/v1/users/10002 HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=dmx.com&id=eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJzaWQiOjEwMDAyLCJ1c3IiOiJxZ1llc2dZYk1qVTJXblJzWVZFeGVqQjJiV3RPVjNjMGNGaG5PVzVCVWtZMSJ9.pNv0JKm0HNkB6VP4balmUAof1Px1fgU35-O0hDlD_k1WlrxN1owB_HFf8njzDIzudIfrvDylqVCuDKubtJDxQw

Request Chain 158

https://c1.adform.net/serving/cookie/match?party=14&cid=F821B65A-E9C3-4E67-BB4B-F972CC37748C HTTP 302
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=F821B65A-E9C3-4E67-BB4B-F972CC37748C

Request Chain 159

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YgpqMgAGHgJiRgAy&gdpr=0&gdpr_consent=

Request Chain 161

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=-CG2WunDTme7S_lyzDd0jA%3D%3D HTTP 302
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=

Request Chain 162

https://idsync.rlcdn.com/420486.gif?partner_uid=F821B65A-E9C3-4E67-BB4B-F972CC37748C HTTP 307
https://pippio.com/api/sync?pid=5324&it=1&iv=fa3e0846cfeb4db2f758ad78d8643b5ca133b87d645aa7ba53830631f9278015791426b5417dce21&_=2 HTTP 307
https://p.adsymptotic.com/d/px?_pid=13553&_psign=9e62e5c043ecadc9479a0ccac401dd7d

Request Chain 163

https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D HTTP 302
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=b8e2620a-6a33-4d00-8981-0409f94f7352

Request Chain 164

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=RjgyMUI2NUEtRTlDMy00RTY3LUJCNEItRjk3MkNDMzc3NDhD&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

Request Chain 165

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEFWtj5GUgon5KZmlmrVp4og&google_cver=1

Request Chain 166

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:942897D38EDA4012AFD570B96A4D99AA

Request Chain 167

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=3691721727429404894&gdpr=0&gdpr_consent=&us_privacy=

Request Chain 168

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=c2da4108-b919-40cc-a8d8-9255d4db5b3e

Request Chain 193

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=a9us&khaos=KZMT1V8E-1O-5H7Z HTTP 302
https://s.amazon-adsystem.com/ecm3?id=KZMT1V8E-1O-5H7Z&ex=d-rubiconproject.com&status=ok

Request Chain 198

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc HTTP 302
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEFLiJuMLeQLXrqWcz-muprw&google_cver=1

Request Chain 199

https://sync.mathtag.com/sync/img?mt_exid=9&redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D4222%26nid%3D1512%26put%3D%5BMM_UUID%5D HTTP 302
https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=b0c1620a-6a33-4a00-8d09-8d3972873d75&expires=28

Request Chain 200

https://token.rubiconproject.com/token?pid=2249&pt=n HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ODBmNzRlMjBlMzFhZjBhMDA4OTQ4MDZkMjAzNGM2ODgxNjhiZTUwNQ

Request Chain 201

https://token.rubiconproject.com/token?pid=25470 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1pNVDFWOEUtMU8tNUg3Wg==

Request Chain 202

https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D191940%26nid%3D3778%26put%3D%24%7BUSER_ID%7D HTTP 302
https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=YgpqMgAGHgJiRgAy

Request Chain 203

https://match.adsrvr.org/track/cmf/rubicon HTTP 302
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=c2da4108-b919-40cc-a8d8-9255d4db5b3e&gdpr=0&gdpr_consent=&expires=30

Request Chain 204

https://token.rubiconproject.com/token?pid=26594 HTTP 302
https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KZMT1V8E-1O-5H7Z&sigv=1&esig=2~55caa742bf18ebd3fb6ea70a65f0d3ec6d907920

Request Chain 206

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 207

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 212

https://ml314.com/csync.ashx?fp=OqYT0NbV&person_id=3625135823814918189&eid=748&return=https%3A%2F%2Fbeacon.krxd.net%2Fusermatch.gif%3Fpartner%3Dmadisonlogic%26partner_uid%3D3625135823814918189 HTTP 302
https://beacon.krxd.net/usermatch.gif?partner=madisonlogic&partner_uid=3625135823814918189

Request Chain 231

https://sb.scorecardresearch.com/c2/10276888/cs.js HTTP 302
https://sb.scorecardresearch.com/internal-c2/default/cs.js

249 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Redirect Chain

http://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/

619 KB
189 KB

991ms
958ms

Document
text/html

34.95.11.30
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to

Full URL

https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.95.11.30 Montreal, Canada, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

30.11.95.34.bc.googleusercontent.com

Software

Resource Hash

92a8e061fc76bf12e807a8f159367dbfa7dc016fbcbc6db28475b64e02139822

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

date: Mon, 14 Feb 2022 14:41:50 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding user-agent
expires: Mon, 14 Feb 2022 14:45:57 GMT
cache-control: max-age=300
x-frame-options: SAMEORIGIN
x-pmd-backend: cheetah-nginx
content-encoding: gzip
strict-transport-security: max-age=15724800; includeSubDomains

Redirect headers

Date: Mon, 14 Feb 2022 14:41:49 GMT
Content-Type: text/html
Content-Length: 164
Connection: keep-alive
Location: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 80 KB
27 KB 111ms
44ms Script
text/javascript 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s80-in-f2.1e100.net

Software

sffe /

Resource Hash

1bfd3e9890809a2eefa255f6ec0d3f93697b8b0e49cea7b804c5b75c274f4068

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27165
x-xss-protection: 0
server: sffe
etag: "1131 / 790 of 1000 / last-modified: 1644840401"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Mon, 14 Feb 2022 14:41:50 GMT

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 134 KB
36 KB 79ms
26ms Script
application/javascript 143.204.137.197
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.137.197 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-137-197.ewr52.r.cloudfront.net
Software: Server /
Resource Hash: 238a7b88a5b7237a3fde744d5b7a0d8deafbe118e52453771e9e1872cac1b41f

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-amz-version-id: 7lRhf2yzZvvyzk64LWrohHfAViIplBk1
content-encoding: gzip
etag: f1657332112584c2a291a2c0cf3f7f54
age: 624
x-cache: Hit from cloudfront
server: Server
x-amz-rid: 0N6YJ62RF5P2SC01CQE4
date: Mon, 14 Feb 2022 14:32:09 GMT
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 b82a7340871763a856185e46298c05b8.cloudfront.net (CloudFront)
cache-control: public, max-age=900
x-amz-cf-pop: EWR52-C2
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: djTALy7fDkwohcT7V2AkRcnn4W2OvTN3MjR2D2v1IHfn5YtRUHsTyQ==

GET
H2 200 all.postmedia.js Show response
hb.districtm.io/prod/100549/ 36 KB
13 KB 110ms
51ms Script
application/javascript 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.districtm.io/prod/100549/all.postmedia.js
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.68.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d5f7c1c0cbec2c27d4165db4cd06b7780f477fc9161008bde67c7a9d62b223aa

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:50 GMT
via: 1.1 076b9b2d65e3c54d9f7c44a7bccddebe.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 6678
x-cache: Miss from cloudfront
cf-bgj: minify
content-encoding: br
last-modified: Thu, 10 Dec 2020 10:37:54 GMT
server: cloudflare
etag: W/"5f2e83162e71fb84bb30df8f49e91eee"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=43200
x-amz-cf-pop: BOS50-C3
cf-ray: 6dd70f432e5de6c8-EWR
x-amz-cf-id: Mkfq1S6avuHtMJRqml5IK9EcJfdOfBX97DcmT2P79U80hTRfuXz9NA==
expires: Tue, 15 Feb 2022 02:41:50 GMT

GET
H/1.1 200
OK iasPET.1.js Show response
cdn.adsafeprotected.com/ 22 KB
22 KB 78ms
27ms Script
application/javascript 99.84.125.52
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adsafeprotected.com/iasPET.1.js
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.125.52 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-125-52.ewr52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2afcabe2eb6314148dfd9dfdec1333b973d97d0780cc08fddab8501afbb013e9

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Sat, 12 Feb 2022 01:02:34 GMT
Via: 1.1 b9e793c57a48521c3ff94fb625d228a0.cloudfront.net (CloudFront)
Connection: keep-alive
Last-Modified: Wed, 02 Jun 2021 17:38:57 GMT
Server: AmazonS3
Age: 221957
ETag: "51636de3ce868a2172f9e6996c2934e0"
X-Cache: Hit from cloudfront
Content-Type: application/javascript
Cache-Control: max-age=604800
X-Amz-Cf-Pop: EWR52-C3
Accept-Ranges: bytes
Content-Length: 22521
X-Amz-Cf-Id: B3kYKQzFzRcIPE0vuahJpbCLgA93SyfVtCELPt0aauGdZOume6pIYg==

GET
H2 200 css
fonts.googleapis.com/ 7 KB
1 KB 108ms
49ms Stylesheet
text/css 2607:f8b0:4006:822::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto+Condensed:700%7CRoboto:400,700&display=swap

Requested by

Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:822::200a Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aa8c4f5924fd06cbaf5c65fac729f0c3207d1f70534b07fc0915948c41b29d6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 14 Feb 2022 14:19:11 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 14 Feb 2022 14:41:50 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 14 Feb 2022 14:41:50 GMT

GET
H2 200 advertising.js Show response
www.npttech.com/ 7 KB
3 KB 60ms
25ms Script
application/javascript 2606:4700:3037::6815:3c3f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.npttech.com/advertising.js
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::6815:3c3f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7538e8f23fac8278c6027d8865bd1240514a3ff64b2c0af3b8ed3583e8ecce6b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:50 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 981
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: JNMEQGQ9NJ9E6X1S
x-amz-id-2: fxImh/8M8kos4PfArLZQ66EMsMP9XUBIudAFPFkNaHH9tQrUf3+tzsmbOphXS4daZ7ig6eUbrKc=
last-modified: Wed, 19 Jun 2019 08:25:01 GMT
server: cloudflare
etag: W/"3d6f80c860866175f58a84bbbc9217c6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FIlVuec7Ytq%2By9PnUN1LRcA%2F1Z1fjoS4NQLLAUN0mmEvAYhIpblvzyjZUyOv9MHJbNrEirhw4lwv8z1mBK3DLwVAqNy2jZetvXCF1%2Bc8FnlaJEl%2B0YLX7yYN6G9nrFMfLfl4%2FN2P3GrXVr0Vg4g%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=28800
x-amz-version-id: hXQWgdpwSBM26VgKOeTSlm.4VT89.h9w
cf-ray: 6dd70f43cf9eca6f-YUL

GET
H2 200 LoginRadiusV2.js Show response
auth.lrcontent.com/v2/js/ 199 KB
47 KB 67ms
36ms Script
application/javascript 2606:4700:10::6816:48e8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.lrcontent.com/v2/js/LoginRadiusV2.js

Requested by

Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:48e8 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

68a335c0d87dce935fee1811892070e78c514828d50bfe2ae21fde739ec1002c

Security Headers

Name	Value
Strict-Transport-Security	max-age= 63072000; includeSubdomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:50 GMT
via: 1.1 c1c976b1b60b605adb44f62da9e0bb8a.cloudfront.net (CloudFront)
vary: Accept-Encoding
cf-cache-status: HIT
age: 4410
cf-polished: origSize=1238069
x-cache: Miss from cloudfront
content-encoding: gzip
last-modified: Mon, 13 Dec 2021 05:19:58 GMT
server: cloudflare
etag: W/"ae3463c4a59ae100b160ed4dd5dbf4b8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age= 63072000; includeSubdomains; preload
content-type: application/javascript
cache-control: max-age=14400
x-amz-cf-pop: EWR52-C3
cf-ray: 6dd70f432a03715a-YUL
x-amz-cf-id: UKx_SLTr25mJR9OxZ3Jl1iZpjZMyCaPjbVBPFMpyn7yVrNt_E6CAIg==
cf-bgj: minify

GET
H2 200 spm.v1.min.js Show response
ak.sail-horizon.com/spm/ 121 KB
43 KB 91ms
26ms Script
application/javascript 13.33.46.124
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ak.sail-horizon.com/spm/spm.v1.min.js
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.46.124 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-33-46-124.ewr52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d06ae5e97e495832fc4526c3e93d7e9440f1faf5f77669b41678c9d564a25faf

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:39:36 GMT
content-encoding: gzip
last-modified: Tue, 08 Jun 2021 04:22:34 GMT
server: AmazonS3
age: 135
etag: W/"b22b4f4738e8722be1636447be239da2"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 b78bfeca7339074512b7289497872df2.cloudfront.net (CloudFront)
cache-control: max-age=600; must-revalidate
x-amz-cf-pop: EWR52-C1
x-amz-cf-id: VKWOr3ZsRmnVD9PfVdoE7kevaWV15eaPvoV2ZFi28NrSez7TdtEOhw==

GET
H2 200 fem.js Show response
fem.prod.postmedia.digital/v51.1/ 259 KB
78 KB 79ms
29ms Script
application/javascript 13.33.46.106
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fem.prod.postmedia.digital/v51.1/fem.js
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.46.106 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-33-46-106.ewr52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 79c381d0b010da04e31a1da615ecb7b142984a8fa33f080485a2c109ce064f15

Request headers

Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Origin: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:40:59 GMT
content-encoding: gzip
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
age: 52
x-cache: Hit from cloudfront
access-control-allow-origin: *
last-modified: Mon, 07 Feb 2022 18:52:49 GMT
server: AmazonS3
etag: W/"4cc3e49974273ce5cad6c7cb78d3c130"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/javascript
via: 1.1 5d70fbb2ed26aa231fed552696cfa0a4.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: EWR52-C1
x-amz-cf-id: Zfp-B7FpRWWj8MBx84hc5VqI_p-dp0OXGw1l8Cyoa9UyOfT41Piruw==

GET
H2 200 business-wire-logo.svg
gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/9.1.1/websites/images/common/ 11 KB
4 KB 15ms
14ms Image
image/svg+xml 34.95.11.30
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/9.1.1/websites/images/common/business-wire-logo.svg

Requested by

Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.95.11.30 Montreal, Canada, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

30.11.95.34.bc.googleusercontent.com

Software

Resource Hash

7fb15552a88b764ca42963e71136255cecf99c6bccc6fdc68fbe0f930a516cb7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: public
date: Mon, 14 Feb 2022 14:41:50 GMT
content-encoding: gzip
last-modified: Thu, 16 Dec 2021 15:17:33 GMT
etag: W/"61bb588d-2b6a"
x-pmd-backend: cheetah-nginx
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=31104000, public
strict-transport-security: max-age=15724800; includeSubDomains
expires: Thu, 09 Feb 2023 14:41:50 GMT

GET
H2 200 Newsfile-High-Res.png
smartcdn.prod.postmedia.digital/nexus/wp-content/uploads/2021/04/ 13 KB
13 KB 75ms
19ms Image
image/webp 143.204.143.94
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://smartcdn.prod.postmedia.digital/nexus/wp-content/uploads/2021/04/Newsfile-High-Res.png
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.143.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-143-94.ewr52.r.cloudfront.net
Software: nginx/1.19.10 /
Resource Hash: 7720a0f40d088f144d749c07f075b8dfdc84afd25900a59045fe6c29d0fc5090

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-pmd-smartcdn-requester: nexus
date: Tue, 04 May 2021 23:36:37 GMT
via: 1.1 b078462cffa3a81b6e262ef7f6040412.cloudfront.net (CloudFront)
server: nginx/1.19.10
age: 24678313
etag: "58a1b532378c9a60bc8df47534dea7218beaf9a0"
vary: Accept
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=31536000,public
x-amz-cf-pop: EWR52-C2
x-pmd-smart-cdn-proxy: da21880a3f69
content-length: 13064
x-amz-cf-id: vt9Jd-NWXMCi_YXEqLUulXbsHVQ8K9DwD5R37BgmNnAzPKwLA6UtiA==
expires: Wed, 04 May 2022 23:36:37 GMT

GET
H2 200 globe-newswire.svg
gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/9.1.1/websites/images/common/ 14 KB
4 KB 20ms
19ms Image
image/svg+xml 34.95.11.30
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/9.1.1/websites/images/common/globe-newswire.svg

Requested by

Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.95.11.30 Montreal, Canada, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

30.11.95.34.bc.googleusercontent.com

Software

Resource Hash

ca157b8a9c98a19c0446a974ea642d13e3b3398f328d312fd474df9f63c45fe9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: public
date: Mon, 14 Feb 2022 14:41:50 GMT
content-encoding: gzip
last-modified: Thu, 16 Dec 2021 15:17:33 GMT
etag: W/"61bb588d-3750"
x-pmd-backend: cheetah-nginx
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=31104000, public
strict-transport-security: max-age=15724800; includeSubDomains
expires: Thu, 09 Feb 2023 14:41:50 GMT

GET
H2 200 icon-soc-fb.svg
gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/9.1.1/websites/images/share-icons/ 775 B
692 B 22ms
19ms Image
image/svg+xml 34.95.11.30
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/9.1.1/websites/images/share-icons/icon-soc-fb.svg

Requested by

Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.95.11.30 Montreal, Canada, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

30.11.95.34.bc.googleusercontent.com

Software

Resource Hash

40e562e806ce113ae7879d0dd76db82797b5c274794751c260381f2c8b283641

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: public
date: Mon, 14 Feb 2022 14:41:50 GMT
content-encoding: gzip
last-modified: Thu, 16 Dec 2021 15:17:33 GMT
etag: W/"61bb588d-307"
x-pmd-backend: cheetah-nginx
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=31104000, public
strict-transport-security: max-age=15724800; includeSubDomains
expires: Thu, 09 Feb 2023 14:41:50 GMT

GET
H2 200 icon-soc-tw.svg
gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/9.1.1/websites/images/share-icons/ 2 KB
1 KB 23ms
20ms Image
image/svg+xml 34.95.11.30
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/9.1.1/websites/images/share-icons/icon-soc-tw.svg

Requested by

Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.95.11.30 Montreal, Canada, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

30.11.95.34.bc.googleusercontent.com

Software

Resource Hash

975a64dc9bbc5e1884ba8ca2e76d9b2791d16d5c9f3619bf30477cd21a8636d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: public
date: Mon, 14 Feb 2022 14:41:50 GMT
content-encoding: gzip
last-modified: Thu, 16 Dec 2021 15:17:33 GMT
etag: W/"61bb588d-6a2"
x-pmd-backend: cheetah-nginx
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=31104000, public
strict-transport-security: max-age=15724800; includeSubDomains
expires: Thu, 09 Feb 2023 14:41:50 GMT

GET
H2 200 shared.79485ec11dc7.js Show response
gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/9.1.1/CACHE/js/ 24 KB
10 KB 24ms
21ms Script
application/javascript 34.95.11.30
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to

Full URL

https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/9.1.1/CACHE/js/shared.79485ec11dc7.js

Requested by

Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.95.11.30 Montreal, Canada, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

30.11.95.34.bc.googleusercontent.com

Software

Resource Hash

79485ec11dc7d9fe27462a6cd37fa698a55c25bc2f5a31189455a4ffe82c61c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Origin: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: public
date: Mon, 14 Feb 2022 14:41:50 GMT
content-encoding: gzip
last-modified: Thu, 16 Dec 2021 15:17:37 GMT
etag: W/"61bb5891-5e02"
x-pmd-backend: cheetah-nginx
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=31104000, public
strict-transport-security: max-age=15724800; includeSubDomains
expires: Thu, 09 Feb 2023 14:41:50 GMT

GET
H2 200 main.aebf0e0d15c0.js Show response
gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/9.1.1/CACHE/js/ 94 KB
30 KB 24ms
23ms Script
application/javascript 34.95.11.30
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to

Full URL

https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/9.1.1/CACHE/js/main.aebf0e0d15c0.js

Requested by

Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.95.11.30 Montreal, Canada, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

30.11.95.34.bc.googleusercontent.com

Software

Resource Hash

aebf0e0d15c0130fbe1375e3d5daff30441efea4c2545cc9f69cea6c13bab3a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Origin: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: public
date: Mon, 14 Feb 2022 14:41:50 GMT
content-encoding: gzip
last-modified: Thu, 16 Dec 2021 15:17:37 GMT
etag: W/"61bb5891-176b6"
x-pmd-backend: cheetah-nginx
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=31104000, public
strict-transport-security: max-age=15724800; includeSubDomains
expires: Thu, 09 Feb 2023 14:41:50 GMT

GET
DATA 200
OK truncated
/ 128 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 23d00276404c2322c5d3bb27f5e930b67f81bc964189b36b028ab1521a5929db

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ 15 KB
16 KB 76ms
21ms Font
font/woff2 2607:f8b0:4006:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto+Condensed:700%7CRoboto:400,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2003 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 08:30:30 GMT
x-content-type-options: nosniff
age: 367880
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:28 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Fri, 10 Feb 2023 08:30:30 GMT

GET
H2 200 ieVi2ZhZI2eCN5jzbjEETS9weq8-32meGCQYbw.woff2
fonts.gstatic.com/s/robotocondensed/v24/ 15 KB
15 KB 204ms
151ms Font
font/woff2 2607:f8b0:4006:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/robotocondensed/v24/ieVi2ZhZI2eCN5jzbjEETS9weq8-32meGCQYbw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto+Condensed:700%7CRoboto:400,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2003 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e79c1c1a140e6afb861074c70392db54cc65a06050de2a69162ab94eb95b0516

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:50 GMT
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15660
x-xss-protection: 0
last-modified: Wed, 26 Jan 2022 19:19:40 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Tue, 14 Feb 2023 14:41:50 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ 15 KB
15 KB 79ms
28ms Font
font/woff2 2607:f8b0:4006:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto+Condensed:700%7CRoboto:400,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2003 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 14:35:30 GMT
x-content-type-options: nosniff
age: 518780
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 08 Feb 2023 14:35:30 GMT

GET
H2 200 xd.html Show response
d395dw5zk780j2.cloudfront.net/v51.1/ Frame 0278 167 B
506 B 85ms
31ms Document
text/html 2600:9000:2140:b000:8:f216:eb80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d395dw5zk780j2.cloudfront.net/v51.1/xd.html
Requested by: Host: fem.prod.postmedia.digital
URL: https://fem.prod.postmedia.digital/v51.1/fem.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2140:b000:8:f216:eb80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1aefec411441da454a39e812f8300125bfd117abc33f50f98c124419314da704

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/

Response headers

content-type: text/html
content-length: 167
date: Mon, 07 Feb 2022 19:41:14 GMT
last-modified: Mon, 07 Feb 2022 18:52:49 GMT
etag: "1cb7c3921583ebfd6049b00de4ee73de"
cache-control: max-age=31536000
accept-ranges: bytes
server: AmazonS3
x-cache: Hit from cloudfront
via: 1.1 e000b4829c397da077a65028075a32a8.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR52-C1
x-amz-cf-id: ajdNyQlN5OcdKOiEJgesR92W7YcsNhttkvPsAs5McllxfTbOykfOGA==
age: 586838

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 483 KB
109 KB 185ms
41ms Script
application/javascript 2607:f8b0:4006:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MKM4ZNQ&l=dataLayer

Requested by

Host: fem.prod.postmedia.digital
URL: https://fem.prod.postmedia.digital/v51.1/fem.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:806::2008 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

dbdefe0cf576913616228702b9911f12d016fe54c45e4632c120a057d30b88c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:51 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 111194
x-xss-protection: 0
last-modified: Mon, 14 Feb 2022 12:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 14 Feb 2022 14:41:51 GMT

GET
H2 200 beacon.js Show response
sb.scorecardresearch.com/ 1 KB
1 KB 171ms
27ms Script
application/javascript 13.33.46.48
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.scorecardresearch.com/beacon.js
Requested by: Host: fem.prod.postmedia.digital
URL: https://fem.prod.postmedia.digital/v51.1/fem.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.46.48 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-33-46-48.ewr52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:02:14 GMT
content-encoding: gzip
etag: W/"1827f116c73f319409b97f10b8a58ade"
last-modified: Fri, 26 Feb 2021 14:35:05 GMT
server: AmazonS3
age: 59984
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 bc6981f82440e44448ee5dd3577bf4f4.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR52-C1
x-amz-cf-id: LSf6sbHPf9I0sGwOfHG0ksj5_aIWwZBmB9xw7h16qjzdhBpSa3g8AQ==

GET
H2 200 mparticle.js Show response
jssdkcdns.mparticle.com/js/v2/us1-a9588c0ddc27594cabd152e47ffe27ee/ 184 KB
48 KB 110ms
17ms Script
application/javascript 2a04:4e42:600::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://jssdkcdns.mparticle.com/js/v2/us1-a9588c0ddc27594cabd152e47ffe27ee/mparticle.js
Requested by: Host: fem.prod.postmedia.digital
URL: https://fem.prod.postmedia.digital/v51.1/fem.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42:600::645 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Kestrel /
Resource Hash: f7914b4836b5815c4b3dcd79c44fa3390dedf00785d79f90dc7f6c6f38c947c5

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:51 GMT
via: 1.1 varnish, 1.1 varnish
age: 764
x-origin-name: fastlyshield--shield_ssl_cache_iad_kjyo7100081_IAD
x-cache: HIT, HIT
x-cache-hits: 1, 2
content-encoding: gzip
content-length: 48496
x-served-by: cache-iad-kjyo7100081-IAD, cache-yul12828-YUL
server: Kestrel
x-timer: S1644849711.349728,VS0,VE0
vary: Accept, Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Mon, 14 Feb 2022 15:29:07 GMT

GET
H2 200 uthtxmddg.js Show response
cdn.krxd.net/controltag/ 29 KB
7 KB 134ms
10ms Script
text/javascript 151.101.66.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.krxd.net/controltag/uthtxmddg.js
Requested by: Host: fem.prod.postmedia.digital
URL: https://fem.prod.postmedia.digital/v51.1/fem.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.66.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 76a237b880fbfc8ac655e91dcf5c9af3b44ccc506c69328409b4047d72519eea

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-cdn-backend: 4FrRTvEr9h480D4BywjehZ--F_config_service_ash_prod
date: Mon, 14 Feb 2022 14:41:51 GMT
via: 1.1 varnish, 1.1 varnish
age: 684
x-cache: MISS, HIT, HIT
x-app-cache: HIT
x-age: 0
content-encoding: gzip
content-length: 6471
x-served-by: config-service-a002-ash-prod.krxd.net, cache-iad-kjyo7100163-IAD, cache-yul12829-YUL
x-response-time: 1
x-do-esi: esi
x-timer: S1644849711.424833,VS0,VE0
etag: "8d8408c6b02eb41f93710c678ece74490c4f6485"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: public, max-age=1200
accept-ranges: bytes
x-cache-hits: 0, 1, 24

GET
H2 200 pubads_impl_2022020901.js Show response
securepubads.g.doubleclick.net/gpt/ 357 KB
120 KB 44ms
31ms Script
text/javascript 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020901.js?31064847

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s80-in-f2.1e100.net

Software

sffe /

Resource Hash

8a4fd9dc6db644313269ca0055f0cef11c1361c8879480f45393332ae2c8e027

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 05:22:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 33587
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 122359
x-xss-protection: 0
last-modified: Wed, 09 Feb 2022 09:36:02 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 14 Feb 2023 05:22:04 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 130 B
142 B 96ms
40ms XHR
application/json 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s80-in-f2.1e100.net

Software

cafe /

Resource Hash

64e548443b4d7ad00948e92ee6c042ba44028c9f86b8dc87c6085702046516e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 14 Feb 2022 14:41:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 117
x-xss-protection: 0
expires: Mon, 14 Feb 2022 14:41:51 GMT

GET
H2 204 config Show response
c.amazon-adsystem.com/cdn/prod/ 0
333 B 85ms
45ms XHR
text/plain 143.204.137.197
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=3528&u=https%3A%2F%2Fgcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.137.197 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-137-197.ewr52.r.cloudfront.net
Software: Server /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:40:58 GMT
via: 1.1 b82a7340871763a856185e46298c05b8.cloudfront.net (CloudFront)
server: Server
age: 53
x-cache: Hit from cloudfront
access-control-allow-origin: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
x-amz-cf-pop: EWR52-C2
x-amz-cf-id: D676gxepkZ269GUMTeK4xvU6oSvr0jc5fKOsnedWgiSdsgVg6q4xug==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 113ms
62ms XHR
application/javascript 143.204.137.197
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.137.197 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-137-197.ewr52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:52 GMT
content-encoding: gzip
vary: Accept-Encoding,Origin
x-amz-cf-pop: EWR52-C2
x-cache: Miss from cloudfront
access-control-allow-origin: *
last-modified: Fri, 21 Jan 2022 02:54:57 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: eaU6ir6qmGswM2SGRmLi7PKhBcBrRdvn
via: 1.1 d873eb6ebbb9da58c373c3c3b1843e76.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
content-type: application/javascript
x-amz-cf-id: NjRBPteDvGcQ2Y4Ju0PC-LU_VE5htF8KjdRFaXBJ1C0R0DaO1GH45Q==

GET
H2 200 pub Show response
pixel.adsafeprotected.com/services/ 2 KB
2 KB 181ms
29ms XHR
application/json 52.44.16.134
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.adsafeprotected.com/services/pub?anId=928934&slot=%7Bid:ad-1,ss:%5B1200.250,1200.90,970.90,970.250,728.90,300.250%5D,p:/3081/SMCO_ENCO_MAGOnFarmer_EN_WEB/index,t:display%7D&slot=%7Bid:ad-2,ss:%5B6.6,1200.250,1200.90,970.90,970.250,728.90,300.250%5D,p:/3081/SMCO_ENCO_MAGOnFarmer_EN_WEB/index,t:display%7D&slot=%7Bid:ad-native-1,ss:%5B5.5%5D,p:/3081/SMCO_ENCO_MAGOnFarmer_EN_WEB/index,t:display%7D&slot=%7Bid:ad-3,ss:%5B7.7,1200.250,1200.90,970.90,970.250,728.90,300.250%5D,p:/3081/SMCO_ENCO_MAGOnFarmer_EN_WEB/index,t:display%7D&slot=%7Bid:ad-native-2,ss:%5B5.5%5D,p:/3081/SMCO_ENCO_MAGOnFarmer_EN_WEB/index,t:display%7D&slot=%7Bid:ad-4,ss:%5B1200.250,1200.90,970.90,970.250,728.90,300.250%5D,p:/3081/SMCO_ENCO_MAGOnFarmer_EN_WEB/index,t:display%7D&slot=%7Bid:ad-native-3,ss:%5B5.5%5D,p:/3081/SMCO_ENCO_MAGOnFarmer_EN_WEB/index,t:display%7D&slot=%7Bid:ad-5,ss:%5B1200.250,1200.90,970.90,970.250,728.90,300.250%5D,p:/3081/SMCO_ENCO_MAGOnFarmer_EN_WEB/index,t:display%7D&slot=%7Bid:ad-native-4,ss:%5B5.5%5D,p:/3081/SMCO_ENCO_MAGOnFarmer_EN_WEB/index,t:display%7D&slot=%7Bid:ad-6,ss:%5B1200.250,1200.90,970.90,970.250,728.90,300.250%5D,p:/3081/SMCO_ENCO_MAGOnFarmer_EN_WEB/index,t:display%7D&slot=%7Bid:ad-native-5,ss:%5B5.5%5D,p:/3081/SMCO_ENCO_MAGOnFarmer_EN_WEB/index,t:display%7D&slot=%7Bid:ad-7,ss:%5B1200.250,1200.90,970.90,970.250,728.90,300.250%5D,p:/3081/SMCO_ENCO_MAGOnFarmer_EN_WEB/index,t:display%7D&slot=%7Bid:ad-native-6,ss:%5B5.5%5D,p:/3081/SMCO_ENCO_MAGOnFarmer_EN_WEB/index,t:display%7D&slot=%7Bid:ad-8,ss:%5B1200.250,1200.90,970.90,970.250,728.90,300.250%5D,p:/3081/SMCO_ENCO_MAGOnFarmer_EN_WEB/index,t:display%7D&slot=%7Bid:ad-native-7,ss:%5B5.5%5D,p:/3081/SMCO_ENCO_MAGOnFarmer_EN_WEB/index,t:display%7D&slot=%7Bid:ad-9,ss:%5B1200.250,1200.90,970.90,970.250,728.90,300.250%5D,p:/3081/SMCO_ENCO_MAGOnFarmer_EN_WEB/index,t:display%7D&slot=%7Bid:ad-native-8,ss:%5B5.5%5D,p:/3081/SMCO_ENCO_MAGOnFarmer_EN_WEB/index,t:display%7D&slot=%7Bid:ad-10,ss:%5B1200.250,1200.90,970.90,970.250,728.90,300.250%5D,p:/3081/SMCO_ENCO_MAGOnFarmer_EN_WEB/index,t:display%7D&wr=1600.1200&sr=1600.1200&sessionId=f3dd0f5a-3b6f-5fd9-2ee0-8d8065e0716b&url=https%253A%252F%252Fgcp-cheet-4407-ontariofarmer.gdev.postmedia.digital%252F
Requested by: Host: cdn.adsafeprotected.com
URL: https://cdn.adsafeprotected.com/iasPET.1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.44.16.134 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-44-16-134.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 58491987638abe530d4f17c432c180273c708c169db08e55d664d5214fc04cdf

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:51 GMT
x-server-name: app30.va.303net.net
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
access-control-expose-headers: X-Server-Name
access-control-allow-credentials: true
timing-allow-origin: *
server: nginx

GET
H2 200 7b3b1c666ca0ec3aa30815.js Show response
gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/9.1.1/websites/js/ 13 KB
5 KB 62ms
0ms Script
application/javascript 34.95.11.30
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to

Full URL

https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/9.1.1/websites/js/7b3b1c666ca0ec3aa30815.js

Requested by

Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/9.1.1/CACHE/js/shared.79485ec11dc7.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.95.11.30 Montreal, Canada, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

30.11.95.34.bc.googleusercontent.com

Software

Resource Hash

709932d262282e65073a8940fc09fc3fffbeb13682a8190bf8a1e96fc2c59888

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: public
date: Mon, 14 Feb 2022 14:41:51 GMT
content-encoding: gzip
last-modified: Thu, 16 Dec 2021 15:16:56 GMT
etag: W/"61bb5868-3211"
x-pmd-backend: cheetah-nginx
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=31104000, public
strict-transport-security: max-age=15724800; includeSubDomains
expires: Thu, 09 Feb 2023 14:41:51 GMT

GET
H2 200 1bd3027b055930c428798.js Show response
gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/9.1.1/websites/js/ 10 KB
3 KB 93ms
16ms Script
application/javascript 34.95.11.30
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to

Full URL

https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/9.1.1/websites/js/1bd3027b055930c428798.js

Requested by

Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/9.1.1/CACHE/js/shared.79485ec11dc7.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.95.11.30 Montreal, Canada, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

30.11.95.34.bc.googleusercontent.com

Software

Resource Hash

3c59439b4ea6905545d0a5f41278422ee0d3bb3d370b4b8eaea35f306a9e1f63

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: public
date: Mon, 14 Feb 2022 14:41:51 GMT
content-encoding: gzip
last-modified: Thu, 16 Dec 2021 15:16:56 GMT
etag: W/"61bb5868-28b7"
x-pmd-backend: cheetah-nginx
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=31104000, public
strict-transport-security: max-age=15724800; includeSubDomains
expires: Thu, 09 Feb 2023 14:41:51 GMT

GET
H2 200 c21a9b55aee30072973019.js Show response
gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/9.1.1/websites/js/ 6 KB
3 KB 79ms
2ms Script
application/javascript 34.95.11.30
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to

Full URL

https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/9.1.1/websites/js/c21a9b55aee30072973019.js

Requested by

Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/9.1.1/CACHE/js/shared.79485ec11dc7.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.95.11.30 Montreal, Canada, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

30.11.95.34.bc.googleusercontent.com

Software

Resource Hash

65bdb0f68bb734a9ee0412aeb1d9898bd4098339efd43b8356acf19b3d8c3ad5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: public
date: Mon, 14 Feb 2022 14:41:51 GMT
content-encoding: gzip
last-modified: Thu, 16 Dec 2021 15:16:56 GMT
etag: W/"61bb5868-1890"
x-pmd-backend: cheetah-nginx
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=31104000, public
strict-transport-security: max-age=15724800; includeSubDomains
expires: Thu, 09 Feb 2023 14:41:51 GMT

GET
H2 200 02f6fe35cf4ad2674cc916.js Show response
gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/9.1.1/websites/js/ 7 KB
3 KB 80ms
3ms Script
application/javascript 34.95.11.30
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to

Full URL

https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/9.1.1/websites/js/02f6fe35cf4ad2674cc916.js

Requested by

Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/9.1.1/CACHE/js/shared.79485ec11dc7.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.95.11.30 Montreal, Canada, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

30.11.95.34.bc.googleusercontent.com

Software

Resource Hash

6902e79f7c8a801e6c1e25c65fd4dcf30034a12d12dad3286d2f0af4457c9b0c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: public
date: Mon, 14 Feb 2022 14:41:51 GMT
content-encoding: gzip
last-modified: Thu, 16 Dec 2021 15:16:56 GMT
etag: W/"61bb5868-1a84"
x-pmd-backend: cheetah-nginx
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=31104000, public
strict-transport-security: max-age=15724800; includeSubDomains
expires: Thu, 09 Feb 2023 14:41:51 GMT

GET
H2 200 d425b4b71b15e7eb53b310.js Show response
gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/9.1.1/websites/js/ 11 KB
4 KB 80ms
4ms Script
application/javascript 34.95.11.30
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to

Full URL

https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/9.1.1/websites/js/d425b4b71b15e7eb53b310.js

Requested by

Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/9.1.1/CACHE/js/shared.79485ec11dc7.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.95.11.30 Montreal, Canada, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

30.11.95.34.bc.googleusercontent.com

Software

Resource Hash

adaf81788242f9c48cc12172354c5df3e22fdcbcd2c3979dd83b419bb59e3db7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: public
date: Mon, 14 Feb 2022 14:41:51 GMT
content-encoding: gzip
last-modified: Thu, 16 Dec 2021 15:16:56 GMT
etag: W/"61bb5868-2ab4"
x-pmd-backend: cheetah-nginx
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=31104000, public
strict-transport-security: max-age=15724800; includeSubDomains
expires: Thu, 09 Feb 2023 14:41:51 GMT

GET
H2 200 f3500b3ce093146933ed28.js Show response
gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/9.1.1/websites/js/ 9 KB
3 KB 96ms
20ms Script
application/javascript 34.95.11.30
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to

Full URL

https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/9.1.1/websites/js/f3500b3ce093146933ed28.js

Requested by

Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/9.1.1/CACHE/js/shared.79485ec11dc7.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.95.11.30 Montreal, Canada, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

30.11.95.34.bc.googleusercontent.com

Software

Resource Hash

0878df8b9a030066f26276aab6a4e36e509b480ec37fdac609ec3037611267d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: public
date: Mon, 14 Feb 2022 14:41:51 GMT
content-encoding: gzip
last-modified: Thu, 16 Dec 2021 15:16:56 GMT
etag: W/"61bb5868-25d9"
x-pmd-backend: cheetah-nginx
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=31104000, public
strict-transport-security: max-age=15724800; includeSubDomains
expires: Thu, 09 Feb 2023 14:41:51 GMT

GET
H2 200 732f5d85811fe762c9444.js Show response
gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/9.1.1/websites/js/ 8 KB
3 KB 93ms
17ms Script
application/javascript 34.95.11.30
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to

Full URL

https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/9.1.1/websites/js/732f5d85811fe762c9444.js

Requested by

Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/9.1.1/CACHE/js/shared.79485ec11dc7.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.95.11.30 Montreal, Canada, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

30.11.95.34.bc.googleusercontent.com

Software

Resource Hash

c1613fae297f062becb2e3f0a24314be2a09ba5809d48bd1a2ea5eacb95e18ca

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: public
date: Mon, 14 Feb 2022 14:41:51 GMT
content-encoding: gzip
last-modified: Thu, 16 Dec 2021 15:16:56 GMT
etag: W/"61bb5868-1eaa"
x-pmd-backend: cheetah-nginx
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=31104000, public
strict-transport-security: max-age=15724800; includeSubDomains
expires: Thu, 09 Feb 2023 14:41:51 GMT

GET
H2 200 48cb48fffb4b21371c986.js Show response
gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/9.1.1/websites/js/ 19 KB
6 KB 97ms
22ms Script
application/javascript 34.95.11.30
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to

Full URL

https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/9.1.1/websites/js/48cb48fffb4b21371c986.js

Requested by

Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/9.1.1/CACHE/js/shared.79485ec11dc7.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.95.11.30 Montreal, Canada, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

30.11.95.34.bc.googleusercontent.com

Software

Resource Hash

fe3cd3089faea77abfd92708efafcb5af900dead2bea4d8655a5b879cefc0f05

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: public
date: Mon, 14 Feb 2022 14:41:51 GMT
content-encoding: gzip
last-modified: Thu, 16 Dec 2021 15:16:56 GMT
etag: W/"61bb5868-4c4a"
x-pmd-backend: cheetah-nginx
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=31104000, public
strict-transport-security: max-age=15724800; includeSubDomains
expires: Thu, 09 Feb 2023 14:41:51 GMT

GET
H2 200 a58e8c4ae3847ac9536913.js Show response
gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/9.1.1/websites/js/ 45 KB
12 KB 72ms
23ms Script
application/javascript 34.95.11.30
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to

Full URL

https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/9.1.1/websites/js/a58e8c4ae3847ac9536913.js

Requested by

Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/9.1.1/CACHE/js/shared.79485ec11dc7.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.95.11.30 Montreal, Canada, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

30.11.95.34.bc.googleusercontent.com

Software

Resource Hash

ec5048fe0002a0fd7fdc7141ffd02691784cd09dc8f1adee6783c86d8d5604cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: public
date: Mon, 14 Feb 2022 14:41:51 GMT
content-encoding: gzip
last-modified: Thu, 16 Dec 2021 15:16:56 GMT
etag: W/"61bb5868-b2ee"
x-pmd-backend: cheetah-nginx
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=31104000, public
strict-transport-security: max-age=15724800; includeSubDomains
expires: Thu, 09 Feb 2023 14:41:51 GMT

GET
H2 200 index.html Show response
cdn.districtm.io/ids/ Frame 1FD0 116 B
329 B 129ms
43ms Document
text/html 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.districtm.io/ids/index.html
Requested by: Host: hb.districtm.io
URL: https://hb.districtm.io/prod/100549/all.postmedia.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.68.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f752ad8cf812a358129aac3fd9784b0baf6f19899eb49116f08a1afab1fa133e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/

Response headers

date: Mon, 14 Feb 2022 14:41:51 GMT
content-type: text/html
cf-ray: 6dd70f498d81e6c8-EWR
age: 31687
last-modified: Thu, 20 May 2021 02:18:27 GMT
via: 1.1 7f822cbc5468903ff5582a7c6af4c024.cloudfront.net (CloudFront)
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-amz-cf-id: 14navJW6RuHIx86kuawl3hFvXKRPd7J0JOhpkRVHxOA44YEgGOpTwg==
x-amz-cf-pop: EWR53-C1
x-cache: Hit from cloudfront
vary: Accept-Encoding
server: cloudflare
content-encoding: br

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
38 B 158ms
88ms XHR
text/plain 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/b/v1

Requested by

Host: hb.districtm.io
URL: https://hb.districtm.io/prod/100549/all.postmedia.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.68.69 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 14 Feb 2022 14:41:51 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: origin, Accept-Encoding
access-control-allow-methods: OPTIONS, POST
access-control-allow-origin: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 6dd70f498d84e6c8-EWR
access-control-allow-headers: origin, content-type

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
230 B 130ms
59ms XHR
text/plain 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/b/v1

Requested by

Host: hb.districtm.io
URL: https://hb.districtm.io/prod/100549/all.postmedia.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.68.69 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 14 Feb 2022 14:41:51 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: origin, Accept-Encoding
access-control-allow-methods: OPTIONS, POST
access-control-allow-origin: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 6dd70f498d88e6c8-EWR
access-control-allow-headers: origin, content-type

GET
H2 200 CD_Bake-it-Foward-Truck-e1639757520670.jpg
smartcdn.prod.postmedia.digital/nexus/wp-content/uploads/2021/12/ 31 KB
32 KB 42ms
0ms Image
image/webp 143.204.143.94
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://smartcdn.prod.postmedia.digital/nexus/wp-content/uploads/2021/12/CD_Bake-it-Foward-Truck-e1639757520670.jpg?quality=90&strip=all&w=344&type=webp
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.143.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-143-94.ewr52.r.cloudfront.net
Software: nginx/1.19.10 /
Resource Hash: 5853621d02d975fba45c91907a09fec43c635c608a30f31ecd9b85342693b41d

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-pmd-smartcdn-requester: nexus
date: Sun, 13 Feb 2022 01:32:07 GMT
via: 1.1 b078462cffa3a81b6e262ef7f6040412.cloudfront.net (CloudFront)
server: nginx/1.19.10
age: 133784
etag: "ad4eb5e4458105b8a5460e49803224b75633b8a0"
vary: Accept
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=31536000,public
x-amz-cf-pop: EWR52-C2
x-pmd-smart-cdn-proxy: b5be47d68c91
content-length: 32210
x-amz-cf-id: CUqv4hQ2xixSLCwpnieC7bvn6vc9ROUfbHt1WR40i6Bi1kgzSvVd1g==
expires: Mon, 13 Feb 2023 01:32:07 GMT

GET
H2 200 wild-boars-e1637260632118.jpg
smartcdn.gprod.postmedia.digital/nexus/wp-content/uploads/2021/11/ 16 KB
16 KB 100ms
18ms Image
image/webp 34.149.157.221
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://smartcdn.gprod.postmedia.digital/nexus/wp-content/uploads/2021/11/wild-boars-e1637260632118.jpg?quality=90&strip=all&w=344&type=webp
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.157.221 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 221.157.149.34.bc.googleusercontent.com
Software: nginx/1.19.10 /
Resource Hash: c6d4675d324e5b40ed5fe0f15dfc55855a7d6389232ce7c981062d99b80d366c

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-pmd-smartcdn-requester: nexus
date: Sun, 13 Feb 2022 20:42:24 GMT
via: 1.1 google
server: nginx/1.19.10
cache-control: max-age=2592000,public
age: 64767
etag: "7a09af2688eda187779b301412175145979f59a9"
vary: Accept
content-type: image/webp
x-cache-hit: hit
x-pmd-smart-cdn-proxy: thumbor-proxy-64c799cd7-9g44k
alt-svc: clear
content-length: 16430

GET
H2 200 Peggy-Brekveld-President-e1637684271190.jpg
smartcdn.gprod.postmedia.digital/nexus/wp-content/uploads/2021/11/ 35 KB
35 KB 103ms
21ms Image
image/webp 34.149.157.221
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://smartcdn.gprod.postmedia.digital/nexus/wp-content/uploads/2021/11/Peggy-Brekveld-President-e1637684271190.jpg?quality=90&strip=all&w=344&type=webp
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.157.221 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 221.157.149.34.bc.googleusercontent.com
Software: nginx/1.19.10 /
Resource Hash: 42cb48fcecb9f09d629e736d1ca8a7eb9c37c8e493b140d071fa92396897b333

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-pmd-smartcdn-requester: nexus
date: Sun, 13 Feb 2022 20:42:24 GMT
via: 1.1 google
server: nginx/1.19.10
cache-control: max-age=2592000,public
age: 64767
etag: "9427ccddca2fc4413cf31e61819ef57d3a7733a0"
vary: Accept
content-type: image/webp
x-cache-hit: hit
x-pmd-smart-cdn-proxy: thumbor-proxy-64c799cd7-9g44k
alt-svc: clear
content-length: 35688

GET
H2 200 ca.0402-dn-migrants.dn_.jpg
smartcdn.gprod.postmedia.digital/nexus/wp-content/uploads/2021/10/ 28 KB
28 KB 138ms
57ms Image
image/webp 34.149.157.221
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://smartcdn.gprod.postmedia.digital/nexus/wp-content/uploads/2021/10/ca.0402-dn-migrants.dn_.jpg?quality=90&strip=all&w=344&type=webp
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.157.221 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 221.157.149.34.bc.googleusercontent.com
Software: nginx/1.19.10 /
Resource Hash: 39874e19af66fa05a8e943e773c81187cb7437bb3cb0076df6defb9381d32911

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-pmd-smartcdn-requester: nexus
date: Sun, 13 Feb 2022 20:42:24 GMT
via: 1.1 google
server: nginx/1.19.10
cache-control: max-age=2592000,public
age: 64767
etag: "0f76a31c5e5eab3492b396502a69587e7ce4fc0b"
vary: Accept
content-type: image/webp
x-cache-hit: hit
x-pmd-smart-cdn-proxy: thumbor-proxy-64c799cd7-9g44k
alt-svc: clear
content-length: 29074

GET
H2 200 wild-boars-e1637260632118.jpg
smartcdn.prod.postmedia.digital/nexus/wp-content/uploads/2021/11/ 16 KB
16 KB 64ms
8ms Image
image/webp 143.204.143.94
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://smartcdn.prod.postmedia.digital/nexus/wp-content/uploads/2021/11/wild-boars-e1637260632118.jpg?quality=90&strip=all&w=344&type=webp
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.143.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-143-94.ewr52.r.cloudfront.net
Software: nginx/1.19.10 /
Resource Hash: c6d4675d324e5b40ed5fe0f15dfc55855a7d6389232ce7c981062d99b80d366c

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-pmd-smartcdn-requester: nexus
date: Sun, 13 Feb 2022 01:32:07 GMT
via: 1.1 b078462cffa3a81b6e262ef7f6040412.cloudfront.net (CloudFront)
server: nginx/1.19.10
age: 133784
etag: "7a09af2688eda187779b301412175145979f59a9"
vary: Accept
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=31536000,public
x-amz-cf-pop: EWR52-C2
x-pmd-smart-cdn-proxy: 7f80d7c13d9a
content-length: 16430
x-amz-cf-id: tE2F4onHjlayFJ45pIMl7Z7IhhnqtuIgFwDeMh1FPUSJKwtX8C708Q==
expires: Mon, 13 Feb 2023 01:32:07 GMT

GET
H2 200 John-Hambly-and-Senator-Robert-Black-e1638401412154.jpg
smartcdn.prod.postmedia.digital/nexus/wp-content/uploads/2021/12/ 23 KB
23 KB 65ms
9ms Image
image/webp 143.204.143.94
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://smartcdn.prod.postmedia.digital/nexus/wp-content/uploads/2021/12/John-Hambly-and-Senator-Robert-Black-e1638401412154.jpg?quality=90&strip=all&w=344&type=webp
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.143.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-143-94.ewr52.r.cloudfront.net
Software: nginx/1.19.10 /
Resource Hash: 166b32472bd35ab18cf94e37efd5055f293406d30ffac183474318140b45ebf2

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-pmd-smartcdn-requester: nexus
date: Sun, 13 Feb 2022 01:32:07 GMT
via: 1.1 b078462cffa3a81b6e262ef7f6040412.cloudfront.net (CloudFront)
server: nginx/1.19.10
age: 133784
etag: "147c41b1ed8f81ee472e83e273ada9d134e9c4a1"
vary: Accept
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=31536000,public
x-amz-cf-pop: EWR52-C2
x-pmd-smart-cdn-proxy: f57c70a41ad7
content-length: 23408
x-amz-cf-id: WAjPmb2jBYf8uolx7lfnSMlxY8v_84Kf_8ypzA51wAqqx94jB9ER0A==
expires: Mon, 13 Feb 2023 01:32:07 GMT

GET
H2 200 pg.1125-pg-shawn.jpg
smartcdn.gprod.postmedia.digital/nexus/wp-content/uploads/2021/11/ 43 KB
43 KB 114ms
33ms Image
image/webp 34.149.157.221
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://smartcdn.gprod.postmedia.digital/nexus/wp-content/uploads/2021/11/pg.1125-pg-shawn.jpg?quality=90&strip=all&w=344&type=webp
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.157.221 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 221.157.149.34.bc.googleusercontent.com
Software: nginx/1.19.10 /
Resource Hash: c4cf4079ec71eea0051719d77dad827e876accf52dff47dbb7822f06d628fed4

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-pmd-smartcdn-requester: nexus
date: Sun, 13 Feb 2022 20:42:24 GMT
via: 1.1 google
server: nginx/1.19.10
cache-control: max-age=2592000,public
age: 64767
etag: "2ce9a641b071a9f7a6680503aeb6e5dac9bddd85"
vary: Accept
content-type: image/webp
x-cache-hit: hit
x-pmd-smart-cdn-proxy: thumbor-proxy-64c799cd7-5gnqt
alt-svc: clear
content-length: 43806

GET
H2 200 0525_na_farmers_1-scaled-e1605745495325.jpg
smartcdn.gprod.postmedia.digital/nexus/wp-content/uploads/2021/04/ 17 KB
17 KB 122ms
41ms Image
image/webp 34.149.157.221
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://smartcdn.gprod.postmedia.digital/nexus/wp-content/uploads/2021/04/0525_na_farmers_1-scaled-e1605745495325.jpg?quality=90&strip=all&w=344&type=webp
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.157.221 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 221.157.149.34.bc.googleusercontent.com
Software: nginx/1.19.10 /
Resource Hash: 5702be858374d0c1b9cfa6164335204df766faceb85311b0311cc81b77041708

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-pmd-smartcdn-requester: nexus
date: Sun, 13 Feb 2022 20:42:24 GMT
via: 1.1 google
server: nginx/1.19.10
cache-control: max-age=2592000,public
age: 64767
etag: "7391dc2d7e0f6c688ac932b148865f9d0a7131bb"
vary: Accept
content-type: image/webp
x-cache-hit: hit
x-pmd-smart-cdn-proxy: thumbor-proxy-64c799cd7-9g44k
alt-svc: clear
content-length: 17506

GET
H2 200 potato-wart.png
smartcdn.gprod.postmedia.digital/nexus/wp-content/uploads/2021/11/ 15 KB
15 KB 123ms
42ms Image
image/webp 34.149.157.221
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://smartcdn.gprod.postmedia.digital/nexus/wp-content/uploads/2021/11/potato-wart.png?quality=90&strip=all&w=344&type=webp
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.157.221 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 221.157.149.34.bc.googleusercontent.com
Software: nginx/1.19.10 /
Resource Hash: 5e2aab555cbfbe4f398bc031f658fd37c078428446a48154a9e9301fe01b72d9

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-pmd-smartcdn-requester: nexus
date: Sun, 13 Feb 2022 20:42:24 GMT
via: 1.1 google
server: nginx/1.19.10
cache-control: max-age=2592000,public
age: 64767
etag: "3ed5c9b1efe187888cedb87f003fb971133fddab"
vary: Accept
content-type: image/webp
x-cache-hit: hit
x-pmd-smart-cdn-proxy: thumbor-proxy-64c799cd7-prgwn
alt-svc: clear
content-length: 15746

GET
H2 200 same-three-crops-e1637087061815.jpg
smartcdn.prod.postmedia.digital/nexus/wp-content/uploads/2021/11/ 47 KB
48 KB 68ms
15ms Image
image/webp 143.204.143.94
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://smartcdn.prod.postmedia.digital/nexus/wp-content/uploads/2021/11/same-three-crops-e1637087061815.jpg?quality=90&strip=all&w=344&type=webp
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.143.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-143-94.ewr52.r.cloudfront.net
Software: nginx/1.19.10 /
Resource Hash: 2987df61c80f5e13507666bcb5e2805b7c766a6e3e4f664d4bd557848839e60c

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-pmd-smartcdn-requester: nexus
date: Sun, 13 Feb 2022 01:32:07 GMT
via: 1.1 b078462cffa3a81b6e262ef7f6040412.cloudfront.net (CloudFront)
server: nginx/1.19.10
age: 133784
etag: "8e64c1dd4cdac9fa97cfc843c6037477648f4b10"
vary: Accept
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=31536000,public
x-amz-cf-pop: EWR52-C2
x-pmd-smart-cdn-proxy: 2cace11a199b
content-length: 48502
x-amz-cf-id: p1Mt97CMHoiLGyp22jscifDthW4KZHMzRkOtf1Q6NQXfXaSC10oKhQ==
expires: Mon, 13 Feb 2023 01:32:07 GMT

GET
H2 200 xd.js Show response
d395dw5zk780j2.cloudfront.net/v51.1/ Frame 0278 36 KB
12 KB 62ms
3ms Script
application/javascript 2600:9000:2140:b000:8:f216:eb80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d395dw5zk780j2.cloudfront.net/v51.1/xd.js
Requested by: Host: d395dw5zk780j2.cloudfront.net
URL: https://d395dw5zk780j2.cloudfront.net/v51.1/xd.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2140:b000:8:f216:eb80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d984a247beba5abcd72a6b6dd131ae1767b6d0cc76ad1223b33e8e3d5a7e05c0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://d395dw5zk780j2.cloudfront.net/v51.1/xd.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 19:41:14 GMT
content-encoding: gzip
last-modified: Mon, 07 Feb 2022 18:52:49 GMT
server: AmazonS3
age: 586838
etag: W/"269a198fcd379487531b391a8641fd8a"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 e000b4829c397da077a65028075a32a8.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: EWR52-C1
x-amz-cf-id: 9-lDnBQip8mtlnoR5XmAU9h2cLZQ41Fe-OlaiP5e6cu-vfYUmf2f7w==

POST
H2 200 identify Show response
identity.mparticle.com/v1/ 175 B
278 B 47ms
42ms XHR
application/json 2a04:4e42:200::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://identity.mparticle.com/v1/identify

Requested by

Host: jssdkcdns.mparticle.com
URL: https://jssdkcdns.mparticle.com/js/v2/us1-a9588c0ddc27594cabd152e47ffe27ee/mparticle.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:200::645 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Kestrel /

Resource Hash

36a3464ca902ebef3790af8b964ac63c52d562e50efb6b0a986b493c4048a1b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=900

Request headers

x-mp-key: us1-a9588c0ddc27594cabd152e47ffe27ee
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 14 Feb 2022 14:41:51 GMT
content-encoding: gzip
server: Kestrel
x-timer: S1644849712.813416,VS0,VE27
x-origin-name: 4PrgpUXX9K0sNAH1JImfyI--F_us1_origin
x-served-by: cache-yul12826-YUL
vary: Accept-Encoding
x-cache: MISS
content-type: application/json; charset=utf-8
access-control-allow-origin: *
strict-transport-security: max-age=900
accept-ranges: bytes
via: 1.1 varnish
x-cache-hits: 0

OPTIONS
H2 204 identify
identity.mparticle.com/v1/ Frame 0
0 75ms
7ms Preflight 2a04:4e42:200::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://identity.mparticle.com/v1/identify

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:200::645 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=900

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type,x-mp-key
Origin: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

server: Kestrel
access-control-allow-headers: content-type,x-mp-key
access-control-allow-methods: POST
access-control-allow-origin: *
x-origin-name: 4PrgpUXX9K0sNAH1JImfyI--F_us1_origin
accept-ranges: bytes
date: Mon, 14 Feb 2022 14:41:51 GMT
via: 1.1 varnish
age: 1232
x-served-by: cache-yul12826-YUL
x-cache: HIT
x-cache-hits: 964
x-timer: S1644849712.793392,VS0,VE0
strict-transport-security: max-age=900

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 194 B
688 B 489ms
486ms XHR
text/javascript 143.204.137.197
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.amazon-adsystem.com/e/dtb/bid?src=3528&u=https%3A%2F%2Fgcp-cheet-4407-ontariofarmer.gdev.postmedia.digital%2F&pid=vJQuij3c9n5MD&cb=0&ws=1600x1200&v=7.73.0&t=2000&slots=%5B%7B%22sd%22%3A%22ad-1%22%2C%22s%22%3A%5B%221200x250%22%2C%221200x90%22%2C%22970x90%22%2C%22970x250%22%2C%22728x90%22%2C%22300x250%22%5D%7D%2C%7B%22sd%22%3A%22ad-2%22%2C%22s%22%3A%5B%226x6%22%2C%221200x250%22%2C%221200x90%22%2C%22970x90%22%2C%22970x250%22%2C%22728x90%22%2C%22300x250%22%5D%7D%2C%7B%22sd%22%3A%22ad-native-1%22%2C%22s%22%3A%5B%225x5%22%5D%7D%2C%7B%22sd%22%3A%22ad-3%22%2C%22s%22%3A%5B%227x7%22%2C%221200x250%22%2C%221200x90%22%2C%22970x90%22%2C%22970x250%22%2C%22728x90%22%2C%22300x250%22%5D%7D%2C%7B%22sd%22%3A%22ad-native-2%22%2C%22s%22%3A%5B%225x5%22%5D%7D%2C%7B%22sd%22%3A%22ad-4%22%2C%22s%22%3A%5B%221200x250%22%2C%221200x90%22%2C%22970x90%22%2C%22970x250%22%2C%22728x90%22%2C%22300x250%22%5D%7D%2C%7B%22sd%22%3A%22ad-native-3%22%2C%22s%22%3A%5B%225x5%22%5D%7D%2C%7B%22sd%22%3A%22ad-5%22%2C%22s%22%3A%5B%221200x250%22%2C%221200x90%22%2C%22970x90%22%2C%22970x250%22%2C%22728x90%22%2C%22300x250%22%5D%7D%2C%7B%22sd%22%3A%22ad-native-4%22%2C%22s%22%3A%5B%225x5%22%5D%7D%2C%7B%22sd%22%3A%22ad-6%22%2C%22s%22%3A%5B%221200x250%22%2C%221200x90%22%2C%22970x90%22%2C%22970x250%22%2C%22728x90%22%2C%22300x250%22%5D%7D%2C%7B%22sd%22%3A%22ad-native-5%22%2C%22s%22%3A%5B%225x5%22%5D%7D%2C%7B%22sd%22%3A%22ad-7%22%2C%22s%22%3A%5B%221200x250%22%2C%221200x90%22%2C%22970x90%22%2C%22970x250%22%2C%22728x90%22%2C%22300x250%22%5D%7D%2C%7B%22sd%22%3A%22ad-native-6%22%2C%22s%22%3A%5B%225x5%22%5D%7D%2C%7B%22sd%22%3A%22ad-8%22%2C%22s%22%3A%5B%221200x250%22%2C%221200x90%22%2C%22970x90%22%2C%22970x250%22%2C%22728x90%22%2C%22300x250%22%5D%7D%2C%7B%22sd%22%3A%22ad-native-7%22%2C%22s%22%3A%5B%225x5%22%5D%7D%2C%7B%22sd%22%3A%22ad-9%22%2C%22s%22%3A%5B%221200x250%22%2C%221200x90%22%2C%22970x90%22%2C%22970x250%22%2C%22728x90%22%2C%22300x250%22%5D%7D%2C%7B%22sd%22%3A%22ad-native-8%22%2C%22s%22%3A%5B%225x5%22%5D%7D%2C%7B%22sd%22%3A%22ad-10%22%2C%22s%22%3A%5B%221200x250%22%2C%221200x90%22%2C%22970x90%22%2C%22970x250%22%2C%22728x90%22%2C%22300x250%22%5D%7D%5D&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.137.197 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-137-197.ewr52.r.cloudfront.net

Software

Server /

Resource Hash

61a9435112cb68acc5f8da27798416ac4082a71a8ee5d392fb39c30185e4bc73

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:52 GMT
via: 1.1 b82a7340871763a856185e46298c05b8.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: EWR52-C2
x-amz-rid: KEFJ17MZ2SMRJMBWHKGM
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
access-control-allow-credentials: true
permissions-policy: interest-cohort=()
strict-transport-security: max-age=47474747; includeSubDomains; preload
timing-allow-origin: *
content-length: 194
x-amz-cf-id: aA8_rKHg549Q1UWeJed2pgoMhkbDFiMuO-OFmiekZNuAcJ_VGAxNaQ==

GET
H3 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ 60 KB
23 KB 41ms
38ms Script
text/javascript 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020901.js?31064847

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s80-in-f2.1e100.net

Software

cafe /

Resource Hash

0da1b7b795d8ed531c47ff870de07dfa167e2e7870be41c339bc05888c0c1900

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:09:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1935
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23078
x-xss-protection: 0
server: cafe
etag: 14764030400761178073
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Mon, 14 Feb 2022 15:09:36 GMT

GET
H2 200 controltag.js.a1705c5ac5f06cf0c202ff70908fc042 Show response
cdn.krxd.net/ctjs/ 259 KB
83 KB 60ms
8ms Script
application/javascript 151.101.66.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.krxd.net/ctjs/controltag.js.a1705c5ac5f06cf0c202ff70908fc042
Requested by: Host: cdn.krxd.net
URL: https://cdn.krxd.net/controltag/uthtxmddg.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.66.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 58d6350da5588a52d6baa4efc27a3362b4ee69dba3504fc762f934d7bb5d0bc4

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-cdn-backend: 4FrRTvEr9h480D4BywjehZ--F_Controltag_S3
date: Mon, 14 Feb 2022 14:41:51 GMT
content-encoding: gzip
age: 16943022
x-amz-server-side-encryption: AES256
x-cache: HIT
x-cache-hits: 1404222
content-length: 84509
x-served-by: cache-yul12829-YUL
last-modified: Mon, 02 Aug 2021 12:06:17 GMT
x-timer: S1644849712.967975,VS0,VE0
etag: "a1705c5ac5f06cf0c202ff70908fc042"
content-type: application/javascript
via: 1.1 varnish
cache-control: public, max-age=315360000
accept-ranges: bytes
expires: Thu, 31 Jul 2031 12:06:16 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 39 KB
15 KB 159ms
49ms Script
text/javascript 142.250.176.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKM4ZNQ&l=dataLayer

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.176.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f2.1e100.net

Software

cafe /

Resource Hash

cae0ae2d67aac89367108586ebd25e00afc5d0f8110e6eb71b8d274037f7a5d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14884
x-xss-protection: 0
server: cafe
etag: 16747055602125368176
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 14 Feb 2022 14:41:52 GMT

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 5 KB
2 KB 119ms
24ms Script
application/x-javascript 2600:141b:13::17d7:82d1
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKM4ZNQ&l=dataLayer
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:13::17d7:82d1 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: fed785a6a8ca96fb67230fec5d85f9c508db49f4075aa0ef284af56cd89813e3

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

X-EdgeConnect-Origin-MEX-Latency: 303
Date: Mon, 14 Feb 2022 14:41:52 GMT
Content-Encoding: gzip
Last-Modified: Wed, 29 Sep 2021 19:17:49 GMT
X-CDN: AKAM
X-EdgeConnect-MidMile-RTT: 1
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=67082
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2036

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 99 KB
26 KB 85ms
20ms Script
application/x-javascript 2a03:2880:f012:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

27bcdc67e32fef9bdd86b785b1bafadd7f6915c49f6b49bed86bfbddf414b2f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length: 26236
x-xss-protection: 0
pragma: public
x-fb-debug: N7dqMyuIWSciMYU+ABKvyuFvEJqcVyNjlXAs0FHxawujyabag3G8NVifYcYy7bdKmwrSJ+eDtruNeB1GBYIUnA==
x-fb-trip-id: 1512268381
x-frame-options: DENY
date: Mon, 14 Feb 2022 14:41:52 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=5,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 14 KB
6 KB 119ms
15ms Script
application/javascript 146.75.32.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.75.32.157 Ashburn, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4da3e3aa30b5b06390d7e7e3fcfb16d648909eb429d161c2748bd6d79a7ec5fb

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:52 GMT
content-encoding: gzip
last-modified: Sat, 05 Feb 2022 00:34:56 GMT
etag: "8dc11b7ca1d5ed9ec3b1ab1beb621c75+gzip"
vary: Accept-Encoding,Host
x-tw-cdn: FT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache
x-cache: HIT
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
content-length: 5410
x-served-by: cache-iad-kjyo7100115-IAD

GET
H2

204

b2
sb.scorecardresearch.com/
Redirect Chain

https://sb.scorecardresearch.com/b?c1=2&c2=10276888&ns__t=1644849712337&ns_c=UTF-8&c8=Home%20%7C%20Ontario%20Farmer&c7=https%3A%2F%2Fgcp-cheet-4407-ontariofarmer.gdev.postmedia.digital%2F&c9=
https://sb.scorecardresearch.com/b2?c1=2&c2=10276888&ns__t=1644849712337&ns_c=UTF-8&c8=Home%20%7C%20Ontario%20Farmer&c7=https%3A%2F%2Fgcp-cheet-4407-ontariofarmer.gdev.postmedia.digital%2F&c9=

0
224 B

80ms
18ms

Image
text/plain

13.33.46.48
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/b2?c1=2&c2=10276888&ns__t=1644849712337&ns_c=UTF-8&c8=Home%20%7C%20Ontario%20Farmer&c7=https%3A%2F%2Fgcp-cheet-4407-ontariofarmer.gdev.postmedia.digital%2F&c9=
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Server: 13.33.46.48 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-33-46-48.ewr52.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:52 GMT
via: 1.1 bc6981f82440e44448ee5dd3577bf4f4.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR52-C1
etag: W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"
x-amz-cf-id: PXMR77n2NzymFiEpIJmdCEONozAiWqWwZirlizB1h59KyA6UK96x1g==
x-cache: Miss from cloudfront

Redirect headers

date: Mon, 14 Feb 2022 14:41:52 GMT
via: 1.1 bc6981f82440e44448ee5dd3577bf4f4.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR52-C1
vary: Accept
x-cache: Miss from cloudfront
content-type: text/plain; charset=utf-8
location: https://sb.scorecardresearch.com/b2?c1=2&c2=10276888&ns__t=1644849712337&ns_c=UTF-8&c8=Home%20%7C%20Ontario%20Farmer&c7=https%3A%2F%2Fgcp-cheet-4407-ontariofarmer.gdev.postmedia.digital%2F&c9=
content-length: 214
x-amz-cf-id: 01aaBaW0HqoTfIMuxjfJTit0t5dQjoKa78zpaBU6_shXJ4bEfm6GgQ==

GET
H2 200 idsync.d5cb6b96.js Show response
cdn.districtm.io/ids/ Frame 1FD0 3 KB
2 KB 55ms
38ms Script
application/javascript 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.districtm.io/ids/idsync.d5cb6b96.js
Requested by: Host: cdn.districtm.io
URL: https://cdn.districtm.io/ids/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.68.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aebd50af0cd8da2f314a52e2088788775d1a441bd674ef9379578e7bc1b5ad50

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/ids/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:52 GMT
via: 1.1 697118bcd171d3b8a0299bf4ce5a8604.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 145835
cf-polished: origSize=3302
x-cache: Hit from cloudfront
cf-bgj: minify
content-encoding: br
last-modified: Thu, 20 May 2021 02:18:27 GMT
server: cloudflare
etag: W/"74ede07ef946dc2316f86b2661cf2dd3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=172800
x-amz-cf-pop: JFK51-C1
cf-ray: 6dd70f4f3b92e6c8-EWR
x-amz-cf-id: lwQ1lEw9tGsIlt1UY6HrsjBk2yAp9q3IbjALvHkHmH0V-8_svMWTYw==
expires: Wed, 16 Feb 2022 14:41:52 GMT

GET
H2 200 / Show response
gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/api-root/weather/current_conditions/ON/London/ 697 B
578 B 1107ms
1063ms Fetch
text/html 34.95.11.30
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to

Full URL

https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/api-root/weather/current_conditions/ON/London/?format=html

Requested by

Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/9.1.1/websites/js/f3500b3ce093146933ed28.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.95.11.30 Montreal, Canada, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

30.11.95.34.bc.googleusercontent.com

Software

Resource Hash

2f1021d1120c46f59533cf98a9c17e794b3aa55257ded087e7081f2d6275c388

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:53 GMT
content-encoding: gzip
vary: Accept-Encoding, Accept, Origin
x-frame-options: SAMEORIGIN
x-pmd-backend: cheetah-nginx
allow: GET
content-type: text/html; charset=utf-8
cache-control: max-age=60
strict-transport-security: max-age=15724800; includeSubDomains
expires: Mon, 14 Feb 2022 14:41:59 GMT

OPTIONS
H2 204 identify
identity.mparticle.com/v1/ Frame 0
0 51ms
10ms Preflight 2a04:4e42:200::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://identity.mparticle.com/v1/identify

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:200::645 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=900

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type,x-mp-key
Origin: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

server: Kestrel
access-control-allow-headers: content-type,x-mp-key
access-control-allow-methods: POST
access-control-allow-origin: *
x-origin-name: 4PrgpUXX9K0sNAH1JImfyI--F_us1_origin
accept-ranges: bytes
date: Mon, 14 Feb 2022 14:41:52 GMT
via: 1.1 varnish
age: 1233
x-served-by: cache-yul12826-YUL
x-cache: HIT
x-cache-hits: 967
x-timer: S1644849713.610507,VS0,VE0
strict-transport-security: max-age=900

POST
H2 200 identify Show response
identity.mparticle.com/v1/ 175 B
220 B 85ms
41ms XHR
application/json 2a04:4e42:200::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://identity.mparticle.com/v1/identify

Requested by

Host: jssdkcdns.mparticle.com
URL: https://jssdkcdns.mparticle.com/js/v2/us1-a9588c0ddc27594cabd152e47ffe27ee/mparticle.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:200::645 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Kestrel /

Resource Hash

cb52c26eedfd62b0b0eec89b1705d7f4d0906c043c6bb62a0a16f1214fb75e8c

Security Headers

Name	Value
Strict-Transport-Security	max-age=900

Request headers

x-mp-key: us1-a9588c0ddc27594cabd152e47ffe27ee
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 14 Feb 2022 14:41:52 GMT
content-encoding: gzip
server: Kestrel
x-timer: S1644849713.667923,VS0,VE38
x-origin-name: 4PrgpUXX9K0sNAH1JImfyI--F_us1_origin
x-served-by: cache-yul12826-YUL
vary: Accept-Encoding
x-cache: MISS
content-type: application/json; charset=utf-8
access-control-allow-origin: *
strict-transport-security: max-age=900
accept-ranges: bytes
via: 1.1 varnish
x-cache-hits: 0

GET
H/1.1

200
OK

iu3 Show response
s.amazon-adsystem.com/ Frame 011F
Redirect Chain

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&dcc=t

275 B
1 KB

47ms
45ms

Document
text/html

209.54.180.3
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&dcc=t

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.180.3 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

5bfee1a430ede5828fcb00547e58f4121e6758b35517b4ee1b5387067a2e65e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/

Response headers

Server: Server
Date: Mon, 14 Feb 2022 14:41:52 GMT
Content-Type: text/html;charset=ISO-8859-1
Content-Length: 275
Connection: keep-alive
x-amz-rid: 453W097SCG518QHTKRF7
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Permissions-Policy: interest-cohort=()

Redirect headers

Server: Server
Date: Mon, 14 Feb 2022 14:41:52 GMT
Content-Length: 0
Connection: keep-alive
x-amz-rid: QPQ7N6YQHQYX692VJNFQ
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&dcc=t
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Permissions-Policy: interest-cohort=()

GET
H2 200 integrator.js Show response
adservice.google.ca/adsid/ 107 B
792 B 131ms
33ms Script
application/javascript 2607:f8b0:4006:80c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020901.js?31064847

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 14 Feb 2022 14:41:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 145ms
41ms Script
application/javascript 2607:f8b0:4006:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020901.js?31064847

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 14 Feb 2022 14:41:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

OPTIONS
H2 200 simple
api.sail-personalize.com/v1/personalize/ Frame 0
0 120ms
40ms Preflight
text/plain 99.83.154.140
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.sail-personalize.com/v1/personalize/simple?pageviews=1&isMobile=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.83.154.140 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: aa7557bb34ea5624b.awsglobalaccelerator.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: authorization,content-type,x-lib-version,x-referring-url
Origin: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Mon, 14 Feb 2022 14:41:53 GMT
content-type: text/plain
content-length: 18
access-control-allow-origin: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
access-control-allow-credentials: true
access-control-max-age: 1800
access-control-allow-methods: OPTIONS,GET,POST,PUT,DELETE
access-control-allow-headers: Content-Type,Authorization,X-Requested-With,Content-Length,Accept,Origin,X-Lib-Version,X-Referring-URL
allow: HEAD,GET,OPTIONS

GET
H2 200 simple Show response
api.sail-personalize.com/v1/personalize/ 256 B
475 B 63ms
26ms Fetch
application/json 99.83.154.140
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.sail-personalize.com/v1/personalize/simple?pageviews=1&isMobile=0
Requested by: Host: ak.sail-horizon.com
URL: https://ak.sail-horizon.com/spm/spm.v1.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.83.154.140 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: aa7557bb34ea5624b.awsglobalaccelerator.com
Software: /
Resource Hash: 9b7ef2236c9f1cff8eba706ef2a3a30d932e2e3390e9e2c8a0c203ab5b5b4260

Request headers

x-lib-version: v1.0.1
Accept-Language: en-CA,en;q=0.9
authorization: Bearer b9d3df2fccd108b5eff3c44f573b2cd6
content-type: application/json
accept: application/json
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
x-referring-url: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/

Response headers

pragma: no-cache
date: Mon, 14 Feb 2022 14:41:53 GMT
content-encoding: gzip
allowedorigins: *
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: no-store
access-control-allow-credentials: true
allowedheaders: Content-Type,Authorization,X-Requested-With,Content-Length,Accept,Origin
content-length: 174
allowedmethods: GET,OPTIONS
expires: -1

GET
H2 200 proxy.3d2100fd7107262ecb55ce6847f01fa5.html Show response
cdn.krxd.net/partnerjs/xdi/ Frame A7E4 805 B
850 B 28ms
3ms Document
text/html 151.101.66.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.krxd.net/partnerjs/xdi/proxy.3d2100fd7107262ecb55ce6847f01fa5.html
Requested by: Host: cdn.krxd.net
URL: https://cdn.krxd.net/ctjs/controltag.js.a1705c5ac5f06cf0c202ff70908fc042
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.66.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 3bcfa04dbc2db44af54bd72a0f7b98912368f16f525729a1b9b673f62ca7e5c9

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/

Response headers

last-modified: Tue, 21 Feb 2017 17:50:54 GMT
etag: "3d2100fd7107262ecb55ce6847f01fa5"
cache-control: public, max-age=315360000
expires: Fri, 19 Feb 2027 17:50:50 GMT
content-type: text/html
x-cdn-backend: 4FrRTvEr9h480D4BywjehZ--F_Partner_JS_S3
content-encoding: gzip
accept-ranges: bytes
date: Mon, 14 Feb 2022 14:41:53 GMT
via: 1.1 varnish
age: 21700232
x-served-by: cache-yul12829-YUL
x-cache: HIT
x-cache-hits: 485273
x-timer: S1644849713.098200,VS0,VE0
vary: Accept-Encoding
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
content-length: 525

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 572 KB
51 KB 1585ms
1582ms XHR
text/plain 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2001621828581984&correlator=2504911747330378&output=ldjh&eid=31064847%2C31061691%2C31061693&output=ldjh&gdfp_req=1&vrg=2022020901&ptt=17&impl=fifs&sc=1&sfv=1-0-38&ecs=20220214&iu_parts=3081%2CSMCO_ENCO_MAGOnFarmer_EN_WEB%2Cindex&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=1200x250%7C1200x90%7C970x90%7C970x250%7C728x90%7C300x250%2C6x6%7C1200x250%7C1200x90%7C970x90%7C970x250%7C728x90%7C300x250%2C5x5%2C7x7%7C1200x250%7C1200x90%7C970x90%7C970x250%7C728x90%7C300x250%2C5x5%2C1200x250%7C1200x90%7C970x90%7C970x250%7C728x90%7C300x250%2C5x5%2C1200x250%7C1200x90%7C970x90%7C970x250%7C728x90%7C300x250%2C5x5%2C1200x250%7C1200x90%7C970x90%7C970x250%7C728x90%7C300x250%2C5x5%2C1200x250%7C1200x90%7C970x90%7C970x250%7C728x90%7C300x250%2C5x5%2C1200x250%7C1200x90%7C970x90%7C970x250%7C728x90%7C300x250%2C5x5%2C1200x250%7C1200x90%7C970x90%7C970x250%7C728x90%7C300x250%2C5x5%2C1200x250%7C1200x90%7C970x90%7C970x250%7C728x90%7C300x250&prev_scp=loc%3D1%26refresh%3Dtrue%26rc%3D0%26amznbid%3D2%26amznp%3D2%26id%3D3f2c8dd2-8da4-11ec-a4ac-022945e664bf%26vw%3D40%2C50%2C60%2C70%2C80%26grm%3D40%2C50%2C60%2C70%7Cloc%3D2%26refresh%3Dtrue%26rc%3D0%26amznbid%3D2%26amznp%3D2%26id%3D3f2c8dd3-8da4-11ec-a4ac-022945e664bf%26vw%3D40%2C50%2C60%2C70%2C80%26grm%3D40%2C50%2C60%2C70%26pub%3D40%7Cloc%3D1%26amznbid%3D2%26amznp%3D2%26id%3D3f2c8dd4-8da4-11ec-a4ac-022945e664bf%7Cloc%3D3%26refresh%3Dtrue%26rc%3D0%26amznbid%3D2%26amznp%3D2%26id%3D3f2c8dd5-8da4-11ec-a4ac-022945e664bf%26vw%3D40%2C50%2C60%2C70%2C80%26grm%3D40%2C50%2C60%2C70%7Cloc%3D2%26amznbid%3D2%26amznp%3D2%26id%3D3f2c8dd6-8da4-11ec-a4ac-022945e664bf%7Cloc%3D4%26refresh%3Dtrue%26rc%3D0%26amznbid%3D2%26amznp%3D2%26id%3D3f2c8dd7-8da4-11ec-a4ac-022945e664bf%26vw%3D40%2C50%2C60%2C70%2C80%26grm%3D40%2C50%2C60%2C70%26pub%3D40%7Cloc%3D3%26amznbid%3D2%26amznp%3D2%26id%3D3f2c8dd8-8da4-11ec-a4ac-022945e664bf%7Cloc%3D5%26refresh%3Dtrue%26rc%3D0%26amznbid%3D2%26amznp%3D2%26id%3D3f2c8dd9-8da4-11ec-a4ac-022945e664bf%26vw%3D40%2C50%2C60%2C70%2C80%26grm%3D40%2C50%2C60%2C70%2C80%26pub%3D40%7Cloc%3D4%26amznbid%3D2%26amznp%3D2%26id%3D3f2c8ddb-8da4-11ec-a4ac-022945e664bf%7Cloc%3D6%26refresh%3Dtrue%26rc%3D0%26amznbid%3D2%26amznp%3D2%26id%3D3f2c8ddc-8da4-11ec-a4ac-022945e664bf%26vw%3D40%2C50%2C60%2C70%2C80%26grm%3D40%2C50%2C60%2C70%26pub%3D40%7Cloc%3D5%26amznbid%3D2%26amznp%3D2%26id%3D3f2c8ddd-8da4-11ec-a4ac-022945e664bf%7Cloc%3D7%26refresh%3Dtrue%26rc%3D0%26amznbid%3D2%26amznp%3D2%26id%3D3f2c8dde-8da4-11ec-a4ac-022945e664bf%26vw%3D40%2C50%2C60%2C70%2C80%26grm%3D40%2C50%2C60%2C70%26pub%3D40%7Cloc%3D6%26amznbid%3D2%26amznp%3D2%26id%3D3f2c8ddf-8da4-11ec-a4ac-022945e664bf%7Cloc%3D8%26refresh%3Dtrue%26rc%3D0%26amznbid%3D2%26amznp%3D2%26id%3D3f2c8de0-8da4-11ec-a4ac-022945e664bf%26vw%3D40%2C50%2C60%2C70%2C80%26grm%3D40%2C50%2C60%2C70%26pub%3D40%7Cloc%3D7%26amznbid%3D2%26amznp%3D2%26id%3D3f2c8de1-8da4-11ec-a4ac-022945e664bf%7Cloc%3D9%26refresh%3Dtrue%26rc%3D0%26amznbid%3D2%26amznp%3D2%26id%3D3f2c8de2-8da4-11ec-a4ac-022945e664bf%26vw%3D40%2C50%2C60%2C70%2C80%26grm%3D40%2C50%2C60%2C70%26pub%3D40%7Cloc%3D8%26amznbid%3D2%26amznp%3D2%26id%3D3f2c8de3-8da4-11ec-a4ac-022945e664bf%7Cloc%3D10%26refresh%3Dtrue%26rc%3D0%26amznbid%3D2%26amznp%3D2%26id%3D3f2c8de4-8da4-11ec-a4ac-022945e664bf%26vw%3D40%2C50%2C60%2C70%2C80%26grm%3D40%2C50%2C60%2C70%26pub%3D40&eri=1&cust_params=no_pol%3Dtrue%26page%3Dindex%26pr%3Donf%26sensitive%3Dn%26negative%3Dn%26ck%3Dindex%26imp%3Dindex%26kuid%3D%26amznbid%3D0%26amznp%3D0%26fr%3Dfalse%26adt%3DveryLow%26alc%3DveryLow%26dlm%3DveryLow%26drg%3DveryLow%26hat%3DveryLow%26off%3DveryLow%26vio%3Dlow%26ias-kw%3D&cookie_enabled=1&bc=31&abxe=1&dt=1644849713156&lmt=1644849713&dlt=1644849710436&idt=1304&frm=20&biw=1600&bih=1200&oid=2&adxs=200%2C797%2C765%2C797%2C765%2C200%2C765%2C200%2C765%2C200%2C765%2C200%2C765%2C200%2C765%2C200%2C765%2C200&adys=233%2C566%2C1108%2C1847%2C2674%2C3413%2C3955%2C3754%2C4296%2C4095%2C4637%2C4436%2C4978%2C4777%2C5319%2C5118%2C5660%2C5459&adks=625928897%2C1960150758%2C1840685615%2C346298458%2C1840685612%2C625928910%2C1840685613%2C625928909%2C1840685586%2C625928908%2C1840685587%2C625928907%2C1840685584%2C625928906%2C1840685585%2C625928905%2C1840685590%2C2524969409&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8%7C9%7Ca%7Cb%7Cc%7Cd%7Ce%7Cf%7Cg%7Ch%7Ci&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&dmc=8&url=https%3A%2F%2Fgcp-cheet-4407-ontariofarmer.gdev.postmedia.digital%2F&rumc=2001621828581984&rume=1&vis=1&scr_x=0&scr_y=0&psz=1600x250%7C1600x250%7C628x5%7C1600x250%7C628x5%7C1600x250%7C628x5%7C1600x250%7C628x5%7C1600x250%7C628x5%7C1600x250%7C628x5%7C1600x250%7C628x5%7C1600x250%7C628x5%7C1600x250&msz=1600x250%7C1600x250%7C628x5%7C1600x250%7C628x5%7C1600x250%7C628x5%7C1600x250%7C628x5%7C1600x250%7C628x5%7C1600x250%7C628x5%7C1600x250%7C628x5%7C1600x250%7C628x5%7C1600x250&ga_vid=83574021.1644849713&ga_sid=1644849713&ga_hid=694964834&ga_fc=false&fws=4%2C4%2C4%2C4%2C4%2C4%2C4%2C4%2C4%2C4%2C4%2C4%2C4%2C4%2C4%2C4%2C4%2C4&ohw=1600%2C1600%2C628%2C1600%2C628%2C1600%2C628%2C1600%2C628%2C1600%2C628%2C1600%2C628%2C1600%2C628%2C1600%2C628%2C1600&btvi=0%7C0%7C0%7C1%7C2%7C3%7C4%7C5%7C6%7C7%7C8%7C9%7C10%7C11%7C12%7C13%7C14%7C15&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020901.js?31064847

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s80-in-f2.1e100.net

Software

cafe /

Resource Hash

4ad3ad6be0cf00486a36397b122abf89c949c7e8feca91688be40fb251267704

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:54 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2,-2,-2,-2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 52002
x-xss-protection: 0
google-lineitem-id: -1,-1,5900230719,-1,5900230719,5681750323,-2,-1,-2,-1,-2,-1,-2,-1,-2,-1,-2,-1
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -1,-1,138379291044,-1,138379268081,138347726640,-2,-1,-2,-1,-2,-1,-2,-1,-2,-1,-2,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ 0
327 B 186ms
87ms Ping
image/gif 2607:f8b0:4001:c15::78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&top=1&puid=1~kzmt1t9r&c=2001621828581984&e=31064847%2C31061691%2C31061693&ctx=1&met.9=1.1g6~13.1n5~2.1ss~9.0~3_19.2y5&met.3=827.1t5~947.1t7_1~947.1t8~86.1t8_1~947.1t8~86.1t8~947.1t8~86.1t8~947.1t9~947.1t9~86.1t9~947.1t9~86.1t9~947.1t9~86.1t9~947.1t9~86.1ta~947.1ta~86.1ta~947.1ta~86.1ta~947.1tb~9.1tb~947.1tb~485.1tb~947.1tb~6.1tb~947.1tb~5.1tb~91.1tb_1~947.1td~1.1td_1~947.1te~1.1te~947.1te~1.1te~947.1te~1.1te~947.1te~1.1te~947.1te~1.1te~947.1tf~1.1tf~947.1tf~1.1tf_1~74.1tj_3~947.1tm~43.1tm_2~49.1tp_1~49.1tq_1~49.1tr~74.1tr~947.1ts~43.1ts~49.1ts~49.1tt~49.1tt~74.1tt~947.1tu~43.1tu~49.1tu~74.1tv_1~947.1tw~43.1tw~49.1tw~49.1tw~49.1tw~74.1tx~947.1ty~43.1ty_1~49.1tz~74.1u0~947.1u0~43.1u0~49.1u0~49.1u0~49.1u0~74.1u9~947.1ua~43.1ua~49.1ua~74.1ub_1~947.1ub~43.1ub~49.1uc~49.1uc~49.1uc~74.1v0_1~947.1v1~43.1v1~49.1v1~74.1v2~947.1v3~43.1v3~49.1v3~49.1v3~49.1v4~74.1vc~947.1vc~43.1vc~49.1vc~74.1vd~947.1vd~43.1vd~49.1vd~49.1vd~49.1vd~74.1vh~947.1vh~43.1vh~49.1vh~74.1vi~947.1vi~43.1vi~49.1vi~49.1vi~49.1vi~74.1vm~947.1vm~43.1vm~49.1vm~74.1vm~947.1vn~43.1vn~49.1vn~49.1vn~49.1vn~74.1vp~947.1vp~43.1vp~49.1vp~74.1vq~947.1vq~43.1vq~49.1vq~49.1vr~49.1vr~947.1vw~573.1vw~598.1vx~54.1vx~598.1vx~54.1vx~598.1vx~54.1vx~598.1vx~54.1vx~598.1vy~54.1vy~598.1vy~54.1vy~598.1vy~54.1vy~598.1vy~54.1vy~598.1vy~54.1vy~598.1vy~54.1vy~598.1vy~54.1vy~598.1vy~54.1vy~598.1vy~54.1vy~598.1vy~54.1vy~598.1vy~54.1vy~598.1vy~54.1vy~598.1vy~54.1vy~598.1vz~54.1vz~947.1vz~38.1vz~51.1vz~49.1vz~49.1vz~51.1vz~49.1vz~49.1vz~51.1vz~49.1vz~49.1vz~51.1vz~49.1vz~49.1vz~51.1vz~49.1vz~49.1vz~51.1vz~49.1vz~49.1vz~51.1vz~49.1vz~49.1vz~51.1vz~49.1vz~49.1w0~51.1w0~49.1w0~49.1w0~51.1w0~49.1w0~49.1w0~51.1w0~49.1w0~49.1w0~51.1w0~49.1w0~49.1w0~51.1w0~49.1w0~49.1w0~51.1w0~49.1w0~49.1w0~51.1w0~49.1w0~49.1w0~51.1w0~49.1w0~49.1w0~51.1w0~49.1w0~49.1w0~51.1w0~49.1w0~49.1w0~76.1vw_5~947.1wh~1.1wh~947.1wh~1.1wi~77.1t7_3b~724.1wl_3~724.1wo_1~724.1wp~724.1wq~724.1wq~724.1wq~724.1wq_2~724.1ws~724.1ws~724.1ws_1~724.1wt~724.1wt~724.1wt~724.1wt~724.1wt~724.1wt~724.1wt~724.1wt~724.1wu~724.1wu~724.1wu~724.1wu~724.1wu~724.1wu~724.1wu~724.1wu~724.1wu~724.1wu~724.1wu~724.1wu~724.1wu~724.1wu~724.1wu~724.1wu~724.1wu~724.1wu~724.1wu~724.1wu~724.1wu~724.1wv~724.1wv~724.1wv~724.1wv~724.1wv~724.1wv~724.1wv~724.1wv~724.1wv~724.1wv~724.1wv~724.1wv~724.1wv~724.1wv~724.1wv~895.1wy~894.1wy~947.1xy~1.1xy~1.1xy~1.1xy~1.1xy~1.1xy~1.1xy~1.1xz~1.1xz~947.1xz~573.1xz~598.1xz~49.1xz~49.1xz~49.1xz~598.1xz~49.1xz~49.1xz~49.1xz~49.1xz~598.1xz~49.1xz~598.1xz~49.1y0~49.1y0~49.1y0~598.1y0~49.1y0~598.1y0~49.1y0~49.1y0~49.1y0~49.1y0~598.1y0~49.1y0~598.1y0~49.1y0~49.1y0~49.1y0~49.1y0~598.1y0~49.1y0~598.1y0~49.1y0~49.1y0~49.1y0~49.1y0~598.1y0~49.1y0~598.1y0~49.1y0~49.1y0~49.1y0~49.1y0~598.1y0~49.1y0~598.1y1~49.1y1~49.1y1~49.1y1~49.1y1~598.1y1~49.1y1~598.1y1~49.1y1~49.1y1~49.1y1~49.1y1~598.1y1~49.1y1~598.1y1~49.1y1~49.1y1~49.1y1~49.1y1~947.1y1~1.1y1_1~76.1xy_4~947.2dj~38.2dj~947.2dk~573.2dk~598.2dk~54.2dk~598.2dk~54.2dk~598.2dk~54.2dk~598.2dk~54.2dk~598.2dk~54.2dk~598.2dk~54.2dk~598.2dk~54.2dk~598.2dk~54.2dk~598.2dk~54.2dk~598.2dk~54.2dk~598.2dk~54.2dk~598.2dk~54.2dk~598.2dk~54.2dk~598.2dk~54.2dk~598.2dk~54.2dk~598.2dk~54.2dk~598.2dk~54.2dk~598.2dm~54.2dm~51.2dm~51.2dm~49.2dm~49.2dm~51.2dm~51.2dm~49.2dm~49.2dm~51.2dn~51.2dn~49.2dn~49.2dn~51.2dn~51.2dn~49.2dn~49.2dn~51.2dn~51.2dn~49.2dn~49.2dn~51.2dn~51.2dn~49.2dn~49.2dn~51.2e2~51.2e2~49.2e2~49.2e2~51.2e2~51.2e2~49.2e2~49.2e2~51.2e2~51.2e2~49.2e2~49.2e2~51.2e2~51.2e2~49.2e2~49.2e2~51.2e2~51.2e2~49.2e2~49.2e2~51.2e2~51.2e2~49.2e2~49.2e3~51.2e3~51.2e3~49.2e3~49.2e3~51.2e3~51.2e3~49.2e3~49.2e3~51.2e3~51.2e3~49.2e3~49.2e3~51.2e3~51.2e3~49.2e3~49.2e3~51.2e3~51.2e3~49.2e3~49.2e3~51.2e3~51.2e3~49.2e3~49.2e3~947.2e7~86.2e7~76.2e7~947.2e7~38.2e7~947.2e7~573.2e7~598.2e7~54.2e7~598.2e7~54.2e7~598.2e7~54.2e7~598.2e8~54.2e8~598.2e8~54.2e8~598.2e8~54.2e8~598.2e8~54.2e8~598.2e8~54.2e8~598.2e8~54.2e8~598.2e8~54.2e8~598.2e8~54.2e8~598.2e8~54.2e8~598.2e8~54.2e8~598.2e8~54.2e8~598.2e8~54.2e8~598.2e8~54.2e8~598.2e8~54.2e8~598.2e8~54.2e8~51.2e8~51.2e8~51.2e8~51.2e8~51.2e8~51.2e8~51.2e8~51.2e8~51.2e8~51.2e8~51.2e8~51.2e8~51.2e8~51.2e8~51.2e8~51.2e8~51.2e8~51.2e8~51.2e8~51.2e8~51.2e8~51.2e8~51.2e8~51.2e8~51.2e8~51.2e8~51.2e8~51.2e8~51.2e8~51.2e8~51.2e8~51.2e8~51.2e8~51.2e8~51.2e8~51.2e8~76.2e7_2~947.2e9~572.2e9~947.2e9~572.2e9~947.2e9~76.2e9_1~947.2m5~95.2m2_b~11.2md_b~725.2mp~725.2mp~725.2mp~725.2mp~725.2mp~725.2mp~725.2mp~725.2mp~725.2mp~725.2mp~725.2mp~725.2mp~725.2mp~725.2mp~725.2mp~725.2mp~725.2mp~725.2mp~872.2mu~895.2nd~112.2rz_8~907.2ud_2~808.2y9~598.2y9~598.2y9~52.2y9~705.2y9~808.2ya~598.2ya~598.2ya~52.2ya~705.2ya~808.2ya~598.2ya~598.2ya~52.2ya~705.2ya_1&met.10=1_4.ILYTEAAIgLUYGICYdSgA~1_3.ILYTEMYYCMYYGICYdSgB~1_9.ILYTEAAIABiAmHUoAA~1_10.ILYTEAAIgLUYGICYdSgA~1_8.ILYTEAAIgLUYGICYdSgA~1_17.ILYTEAAIABiAmHUoAA~1_7.ILYTEAAIABiAmHUoAA~1_5.ILYTEAAIxhgYgJh1KAA~1_1.ILYTEIC1GAiAtRgYgJh1KAE~1_13.ILYTEAAIABiAmHUoAA~1_14.ILYTEAAIgLUYGICYdSgA~1_11.ILYTEAAIABiAmHUoAA~1_12.ILYTEAAIgLUYGICYdSgA~1_16.ILYTEAAIgLUYGICYdSgA~1_18.ILYTEAAIgLUYGICYdSgA~1_2.ILYTEIC1GAiAtRgYgJh1KAE~1_15.ILYTEAAIABiAmHUoAA~1_6.ILYTEAAIgLUYGICYdSgA~1_1.INEaEAAIABgAKAA~1_2.INEaEAAIABgAKAA~1_3.INEaEAAIABgAKAA~1_4.INEaEAAIABgAKAA~1_5.INEaEAAIABgAKAA~1_6.INEaEAAIABgAKAA~1_7.INEaEAAIABgAKAA~1_8.INEaEAAIABgAKAA~1_9.INEaEAAIABgAKAA~1_10.INEaEAAIABgAKAA~1_11.INEaEAAIABgAKAA~1_12.INEaEAAIABgAKAA~1_13.INEaEAAIABgAKAA~1_14.INEaEAAIABgAKAA~1_15.INEaEAAIABgAKAA~1_16.INEaEAAIABgAKAA~1_17.INEaEAAIABgAKAA~1_18.INEaEAAIABgAKAA~1_22.IPcbEAAIgLUYGICYdSgA~1_21.IPcbEMYYCMYYGICYdSgB~1_20.IPcbEIC1GAiAtRgYgJh1KAE~1_28.IPcbEAAIgLUYGICYdSgA~1_26.IPcbEAAIgLUYGICYdSgA~1_35.IPcbEAAIABiAmHUoAA~1_25.IPcbEAAIABiAmHUoAA~1_23.IPcbEAAIxhgYgJh1KAA~1_19.IPcbEIC1GAiAtRgYgJh1KAE~1_31.IPcbEAAIABiAmHUoAA~1_32.IPcbEAAIgLUYGICYdSgA~1_29.IPcbEAAIABiAmHUoAA~1_30.IPcbEAAIgLUYGICYdSgA~1_27.IPcbEAAIABiAmHUoAA~1_34.IPcbEAAIgLUYGICYdSgA~1_36.IPcbEAAIgLUYGICYdSgA~1_33.IPcbEAAIABiAmHUoAA~1_24.IPcbEAAIgLUYGICYdSgA
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4001:c15::78 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Feb 2022 14:41:53 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
52648fa4f34196b9c4176788bfe49daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 3EFB 6 KB
4 KB 118ms
43ms Document
text/html 2607:f8b0:4006:81f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://52648fa4f34196b9c4176788bfe49daf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020901.js?31064847

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81f::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Mon, 14 Feb 2022 14:41:53 GMT
expires: Tue, 14 Feb 2023 14:41:53 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 buyers Show response
dmx.districtm.io/s/v1/ Frame 1FD0 591 B
802 B 71ms
58ms XHR
application/json 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/s/v1/buyers

Requested by

Host: cdn.districtm.io
URL: https://cdn.districtm.io/ids/idsync.d5cb6b96.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.68.69 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cb0c81a0e7ee6b45a21865507c1ad9bb2232c7006567a386031fcb2ec9ea186b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:53 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: DELETE, GET, OPTIONS, POST
content-type: application/json
access-control-allow-origin: https://cdn.districtm.io
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 6dd70f5418fde6c8-EWR
access-control-allow-headers: Origin, Content-Type

GET
H3 200 1685973801652415 Show response
connect.facebook.net/signals/config/ 310 KB
88 KB 60ms
26ms Script
application/x-javascript 2a03:2880:f012:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1685973801652415?v=2.9.52&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

f709a1b342d481f0abc9c55d87f77025b129543e8104f331dc708c1caf64ccf3

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length: 90183
x-xss-protection: 0
pragma: public
x-fb-debug: iUxkhUBDMH6ww/j6KC1pePe+UkA7U3n68q8RSxoPjmFezjJdCr05MijCfgUX92zaa1vXojHSc8ZXJz8BVF6whg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Mon, 14 Feb 2022 14:41:53 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2

200

/
p.adsymptotic.com/d/px/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1747836&time=1644849713382&url=https%3A%2F%2Fgcp-cheet-4407-ontariofarmer.gdev.postmedia.digital%2F
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1747836&time=1644849713382&url=https%3A%2F%2Fgcp-cheet-4407-ontariofarmer.gdev.postmedia.digital%2F&cookiesTest=true
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1747836%26time%3D1644849713382%26url%3Dhttps%253A%252F%252Fgcp-cheet-4407-ontario...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1747836&time=1644849713382&url=https%3A%2F%2Fgcp-cheet-4407-ontariofarmer.gdev.postmedia.digital%2F&cookiesTest=true&liSync=true
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1747836&time=1644849713382&url=https%3A%2F%2Fgcp-cheet-4407-ontariofarmer.gdev.postmedia.digital%2F&cookiesTest=true&liSync=true&e_ipv6=AQIeDdf-z...
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=20fd700a-ca2d-4991-98a6-a14e18612ecb
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=20fd700a-ca2d-4991-98a6-a14e18612ecb&_expected_cookie=c80322a6b8ec05e3dbbf3291...

43 B
142 B

50ms
49ms

Image
image/gif

104.18.98.194
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=20fd700a-ca2d-4991-98a6-a14e18612ecb&_expected_cookie=c80322a6b8ec05e3dbbf3291754319a0
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Server: 104.18.98.194 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:55 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 6dd70f6278afcacc-YYZ
p3p: CP='NON DSP COR CONi OUR BUS CNT'
content-type: image/gif
content-length: 43

Redirect headers

location: https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=20fd700a-ca2d-4991-98a6-a14e18612ecb&_expected_cookie=c80322a6b8ec05e3dbbf3291754319a0
date: Mon, 14 Feb 2022 14:41:55 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 6dd70f612ee9cacc-YYZ
content-length: 0
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"

GET
H2 200 42fb57ac-2013-45a6-8dad-332d53e17c1b Show response
consumer.krxd.net/consent/get/ 239 B
431 B 122ms
0ms Script
text/javascript 151.101.130.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://consumer.krxd.net/consent/get/42fb57ac-2013-45a6-8dad-332d53e17c1b?idt=device&dt=kxcookie&callback=Krux.ns.postmedia.kxjsonp_consent_get_0
Requested by: Host: cdn.krxd.net
URL: https://cdn.krxd.net/ctjs/controltag.js.a1705c5ac5f06cf0c202ff70908fc042
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.130.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 8ddf9e8fa96d1bbbeaf292ca94fc082dde61e4a6be90c87f8b2609fd88edbd4d

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:53 GMT
via: 1.1 varnish
age: 54
x-served-by: consumer-a004-ash-prod.krxd.net, cache-yul12820-YUL
vary: Accept-Encoding
x-cache: MISS, HIT
content-type: text/javascript; charset=UTF-8
content-encoding: gzip
cache-control: max-age=1800
x-age: 0
accept-ranges: bytes
x-timer: S1644849714.514503,VS0,VE0
content-length: 193
x-cache-hits: 0, 2

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/990309138/ 2 KB
2 KB 291ms
37ms Script
text/javascript 2607:f8b0:4006:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/990309138/?random=1644849713397&cv=9&fst=1644849713397&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg290&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fgcp-cheet-4407-ontariofarmer.gdev.postmedia.digital%2F&tiba=Home%20%7C%20Ontario%20Farmer&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f62f21e013d1dfa2015a7b2cf91d3619944ed308e3be879f9ca5d2fc132c1c70

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Feb 2022 14:41:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1039
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
www.googleadservices.com/pagead/conversion/580448699/ 2 KB
1 KB 213ms
45ms Script
text/javascript 142.250.176.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/580448699/?random=1644849713400&cv=9&fst=1644849713400&num=1&value=0&label=FmJTCMOu_N8BELvj45QC&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg290&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fgcp-cheet-4407-ontariofarmer.gdev.postmedia.digital%2F&tiba=Home%20%7C%20Ontario%20Farmer&auid=335390189.1644849712&hn=www.googleadservices.com&bttype=purchase&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.176.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f2.1e100.net

Software

cafe /

Resource Hash

fb3a71bdda31c197c7c2ecf6bb0c391414c239e083db24276f25792ff3239d25

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Feb 2022 14:41:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1238
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

AAAGZRz4UMDk1wNHLviNAAAAAAA&expiration=1644936114&nuid=256ZtlaQ1z0vmkNWw4pXg9nARF5&is_secure=true Show response
dmx.us-east-34.districtm.io/s/10007/ Frame 1FD0
Redirect Chain

https://districtm-match.dotomi.com/match/bounce/current?version=1&networkId=33921&nuid=256ZtlaQ1z0vmkNWw4pXg9nARF5&rurl=//dmx.us-east-34.districtm.io/s/10007/
https://districtm-match.dotomi.com/match/bounce/current?DotomiTest=2c922427c08111fd&is_secure=true&version=1&networkId=33921&nuid=256ZtlaQ1z0vmkNWw4pXg9nARF5&rurl=%2F%2Fdmx.us-east-34.districtm.io%...
https://dmx.us-east-34.districtm.io/s/10007/AAAGZRz4UMDk1wNHLviNAAAAAAA&expiration=1644936114&nuid=256ZtlaQ1z0vmkNWw4pXg9nARF5&is_secure=true

153 B
291 B

237ms
36ms

Script
application/javascript

34.73.194.24
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.us-east-34.districtm.io/s/10007/AAAGZRz4UMDk1wNHLviNAAAAAAA&expiration=1644936114&nuid=256ZtlaQ1z0vmkNWw4pXg9nARF5&is_secure=true

Requested by

Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/

Protocol

Server

34.73.194.24 North Charleston, United States, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

24.194.73.34.bc.googleusercontent.com

Software

Resource Hash

e39c093bb7e5ecc532c3523c4deb01b6159aa538fd8d587705c987cb9a791469

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:54 GMT
content-length: 153
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8

Redirect headers

pragma: no-cache
date: Mon, 14 Feb 2022 14:41:54 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: //dmx.us-east-34.districtm.io/s/10007/AAAGZRz4UMDk1wNHLviNAAAAAAA&expiration=1644936114&nuid=256ZtlaQ1z0vmkNWw4pXg9nARF5&is_secure=true
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H2

200

e7c0abdf-9fb3-4781-beae-0b49ea731a1b Show response
dmx.districtm.io/s/10059/ Frame 1FD0
Redirect Chain

https://match.sharethrough.com/1PQ8qgv7/v1/
https://dmx.districtm.io/s/10059/e7c0abdf-9fb3-4781-beae-0b49ea731a1b

92 B
151 B

144ms
77ms

Script
application/javascript

104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/s/10059/e7c0abdf-9fb3-4781-beae-0b49ea731a1b

Requested by

Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/

Protocol

Server

104.16.68.69 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a1d526b82510b4038b635164e9c3e25c729503fb22589194cb617eb4dbb68681

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
date: Mon, 14 Feb 2022 14:41:54 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cf-ray: 6dd70f58cdf2e6c8-EWR

Redirect headers

location: https://dmx.districtm.io/s/10059/e7c0abdf-9fb3-4781-beae-0b49ea731a1b
date: Mon, 14 Feb 2022 14:41:53 GMT
content-length: 0

GET
H2

200

647146259108 Show response
dmx.districtm.io/s/10022/ Frame 1FD0
Redirect Chain

https://ums.acuityplatform.com/tum?umid=137&rurl=https%3A%2F%2Fdmx.districtm.io%2Fs%2F10022%2F___AUID___
https://dmx.districtm.io/s/10022/647146259108

68 B
125 B

133ms
70ms

Script
application/javascript

104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/s/10022/647146259108

Requested by

Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/

Protocol

Server

104.16.68.69 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1be02b0ab5187f9c9837e30461f2fa049d651ebdf831418de6c0d4a593b55317

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
date: Mon, 14 Feb 2022 14:41:54 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cf-ray: 6dd70f58cdfae6c8-EWR

Redirect headers

Access-Control-Allow-Origin: *
Content-Length: 0
Location: https://dmx.districtm.io/s/10022/647146259108

GET
H2

200

m4mZh7rQSnts18eK7qhf75U4mbc Show response
dmx.districtm.io/s/10026/ Frame 1FD0
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=132
https://dmx.districtm.io/s/10026/m4mZh7rQSnts18eK7qhf75U4mbc

83 B
188 B

126ms
62ms

Script
application/javascript

104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/s/10026/m4mZh7rQSnts18eK7qhf75U4mbc

Requested by

Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/

Protocol

Server

104.16.68.69 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2e02ca5eec746266c9dcb0ed96178d2a77e8c7adc7f3b34d9c18c97ad842a87b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
date: Mon, 14 Feb 2022 14:41:54 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cf-ray: 6dd70f58cdf7e6c8-EWR

Redirect headers

Location: https://dmx.districtm.io/s/10026/m4mZh7rQSnts18eK7qhf75U4mbc
Date: Mon, 14 Feb 2022 14:41:53 GMT
Connection: keep-alive
Content-Length: 83
Content-Type: text/html; charset=utf-8

GET
H2

200

y-ePmhI_FE2uGX4__0tKtJ71KtdRsl0KNeNd5dEhE-~A Show response
dmx.districtm.io/s/10057/ Frame 1FD0
Redirect Chain

https://ups.analytics.yahoo.com/ups/58377/occ?gdpr=&gdpr_consent=
https://ups.analytics.yahoo.com/ups/58377/occ?gdpr=&gdpr_consent=&verify=true
https://dmx.districtm.io/s/10057/y-ePmhI_FE2uGX4__0tKtJ71KtdRsl0KNeNd5dEhE-~A

100 B
164 B

176ms
54ms

Script
application/javascript

104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/s/10057/y-ePmhI_FE2uGX4__0tKtJ71KtdRsl0KNeNd5dEhE-~A

Requested by

Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/

Protocol

Server

104.16.68.69 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ea32733a0810a064a05057e4a86787f509bc7ad26b825c8284526c98cb123473

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
date: Mon, 14 Feb 2022 14:41:54 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cf-ray: 6dd70f5a6804e6c8-EWR

Redirect headers

location: https://dmx.districtm.io/s/10057/y-ePmhI_FE2uGX4__0tKtJ71KtdRsl0KNeNd5dEhE-~A
date: Mon, 14 Feb 2022 14:41:54 GMT
server: ATS/9.1.0.33
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
457 B 231ms
55ms Script
application/javascript 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=o01de&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=7936f6ac-64b7-4513-827a-a391dab9bfcf&tw_document_href=https%3A%2F%2Fgcp-cheet-4407-ontariofarmer.gdev.postmedia.digital%2F&tpx_cb=twttr.conversion.loadPixels

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-response-time: 7
date: Mon, 14 Feb 2022 14:41:53 GMT
content-encoding: gzip
server: tsa_b
strict-transport-security: max-age=631138519
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0
x-connection-hash: ce4044ba258669f16d49484ad70ea0e29db87f17af36ddfa456205e62071a9d2
content-type: application/javascript;charset=utf-8
content-length: 57

GET
H2 200 adsct
t.co/i/ 43 B
335 B 212ms
54ms Image
image/gif 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=o01de&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=7936f6ac-64b7-4513-827a-a391dab9bfcf&tw_document_href=https%3A%2F%2Fgcp-cheet-4407-ontariofarmer.gdev.postmedia.digital%2F

Requested by

Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-response-time: 7
date: Mon, 14 Feb 2022 14:41:53 GMT
server: tsa_b
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 621c97d697e64662b9eeb42f2025cbbdd994a9280762e9e2d73d2dacf551cd8c
content-length: 43

GET
H/1.1 200
OK pr Show response
s.amazon-adsystem.com/v3/ Frame E0F3 2 KB
3 KB 35ms
31ms Document
text/html 209.54.180.3
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/v3/pr?exlist=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&fv=1.0&a=cm&cm3ppd=1

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&dcc=t

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.180.3 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

bed79e22634d48c6e53d084c7dc1ac8e7ed34377df61478f7020d89248124ea1

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&dcc=t

Response headers

Server: Server
Date: Mon, 14 Feb 2022 14:41:53 GMT
Content-Type: text/html;charset=ISO-8859-1
Content-Length: 2044
Connection: keep-alive
x-amz-rid: Q7ET3C26PD85Y7187VDN
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Permissions-Policy: interest-cohort=()

GET
H2 200 uthtxmddg.js Show response
cdn.krxd.net/controltag/ Frame A7E4 29 KB
7 KB 13ms
12ms Script
text/javascript 151.101.66.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.krxd.net/controltag/uthtxmddg.js
Requested by: Host: cdn.krxd.net
URL: https://cdn.krxd.net/partnerjs/xdi/proxy.3d2100fd7107262ecb55ce6847f01fa5.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.66.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 76a237b880fbfc8ac655e91dcf5c9af3b44ccc506c69328409b4047d72519eea

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.krxd.net/partnerjs/xdi/proxy.3d2100fd7107262ecb55ce6847f01fa5.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-cdn-backend: 4FrRTvEr9h480D4BywjehZ--F_config_service_ash_prod
date: Mon, 14 Feb 2022 14:41:53 GMT
via: 1.1 varnish, 1.1 varnish
age: 686
x-cache: MISS, HIT, HIT
x-app-cache: HIT
x-age: 0
content-encoding: gzip
content-length: 6471
x-served-by: config-service-a002-ash-prod.krxd.net, cache-iad-kjyo7100163-IAD, cache-yul12829-YUL
x-response-time: 1
x-do-esi: esi
x-timer: S1644849714.745115,VS0,VE0
etag: "8d8408c6b02eb41f93710c678ece74490c4f6485"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: public, max-age=1200
accept-ranges: bytes
x-cache-hits: 0, 1, 25

GET
H2 200 /
www.facebook.com/tr/ 44 B
406 B 288ms
7ms Image
image/gif 2a03:2880:f112:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1685973801652415&ev=PageView&dl=https%3A%2F%2Fgcp-cheet-4407-ontariofarmer.gdev.postmedia.digital%2F&rl=&if=false&ts=1644849713846&sw=1600&sh=1200&v=2.9.52&r=stable&ec=0&o=30&par[0]=%7B%22extractorID%22%3A%22514537319740368%22%2C%22jsonLD%22%3A%7B%22%40context%22%3A%22http%3A%2F%2Fschema.org%22%2C%22%40type%22%3A%22Product%22%2C%22offers%22%3A%7B%22priceCurrency%22%3A%22CAD%22%7D%7D%7D&par[1]=%7B%22extractorID%22%3A%22503487844400487%22%2C%22jsonLD%22%3A%7B%22%40context%22%3A%22http%3A%2F%2Fschema.org%22%2C%22%40type%22%3A%22Product%22%2C%22offers%22%3A%7B%22priceCurrency%22%3A%22CAD%22%7D%7D%7D&par[2]=%7B%22extractorID%22%3A%221042784969583558%22%2C%22jsonLD%22%3A%7B%22%40context%22%3A%22http%3A%2F%2Fschema.org%22%2C%22%40type%22%3A%22Product%22%2C%22offers%22%3A%7B%22priceCurrency%22%3A%22CAD%22%7D%7D%7D&par[3]=%7B%22extractorID%22%3A%22858678751523779%22%2C%22jsonLD%22%3A%7B%22%40context%22%3A%22http%3A%2F%2Fschema.org%22%2C%22%40type%22%3A%22Product%22%2C%22offers%22%3A%7B%7D%7D%7D&par[4]=%7B%22extractorID%22%3A%221127243281129742%22%2C%22jsonLD%22%3A%7B%22%40context%22%3A%22http%3A%2F%2Fschema.org%22%2C%22%40type%22%3A%22Product%22%2C%22offers%22%3A%7B%7D%7D%7D&par[5]=%7B%22extractorID%22%3A%22497819211464386%22%2C%22jsonLD%22%3A%7B%22%40context%22%3A%22http%3A%2F%2Fschema.org%22%2C%22%40type%22%3A%22Product%22%2C%22offers%22%3A%7B%7D%7D%7D&fbp=fb.1.1644849713825.1599502105&it=1644849713364&coo=false&rqm=GET

Requested by

Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:54 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600
content-length: 44
expires: Mon, 14 Feb 2022 14:41:54 GMT

GET
H2 200 hp_w_ion_l.svg
gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/9.1.1/weather/images/ 39 KB
15 KB 57ms
2ms Image
image/svg+xml 34.95.11.30
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/9.1.1/weather/images/hp_w_ion_l.svg

Requested by

Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.95.11.30 Montreal, Canada, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

30.11.95.34.bc.googleusercontent.com

Software

Resource Hash

29184c416fa3c5ffcbc4baf96ffe14c8d5fe2a0ff451da9d40b7109960ba3c2f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: public
date: Mon, 14 Feb 2022 14:41:54 GMT
content-encoding: gzip
last-modified: Thu, 16 Dec 2021 15:17:33 GMT
etag: W/"61bb588d-9ab0"
x-pmd-backend: cheetah-nginx
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=31104000, public
strict-transport-security: max-age=15724800; includeSubDomains
expires: Thu, 09 Feb 2023 14:41:54 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/990309138/ 42 B
548 B 274ms
58ms Image
image/gif 2607:f8b0:4006:823::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/990309138/?random=1644849713397&cv=9&fst=1644847200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg290&sendb=1&frm=0&url=https%3A%2F%2Fgcp-cheet-4407-ontariofarmer.gdev.postmedia.digital%2F&tiba=Home%20%7C%20Ontario%20Farmer&async=1&fmt=3&is_vtc=1&random=2444570078&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2004 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Feb 2022 14:41:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.ca/pagead/1p-user-list/990309138/ 42 B
548 B 274ms
59ms Image
image/gif 2607:f8b0:4006:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-user-list/990309138/?random=1644849713397&cv=9&fst=1644847200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg290&sendb=1&frm=0&url=https%3A%2F%2Fgcp-cheet-4407-ontariofarmer.gdev.postmedia.digital%2F&tiba=Home%20%7C%20Ontario%20Farmer&async=1&fmt=3&is_vtc=1&random=2444570078&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::2003 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Feb 2022 14:41:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

/
www.google.ca/pagead/1p-conversion/580448699/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/580448699/?random=1827434592&cv=9&fst=1644849713400&num=1&value=0&label=FmJTCMOu_N8BELvj45QC&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO...
https://www.google.com/pagead/1p-conversion/580448699/?random=1827434592&cv=9&fst=1644849713400&num=1&value=0&label=FmJTCMOu_N8BELvj45QC&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_...
https://www.google.ca/pagead/1p-conversion/580448699/?random=1827434592&cv=9&fst=1644849713400&num=1&value=0&label=FmJTCMOu_N8BELvj45QC&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_a...

42 B
64 B

86ms
51ms

Image
image/gif

2607:f8b0:4006:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-conversion/580448699/?random=1827434592&cv=9&fst=1644849713400&num=1&value=0&label=FmJTCMOu_N8BELvj45QC&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg290&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fgcp-cheet-4407-ontariofarmer.gdev.postmedia.digital%2F&tiba=Home%20%7C%20Ontario%20Farmer&auid=335390189.1644849712&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=CNPgGw&is_vtc=1&ocp_id=MWoKYo6oKdDy_gSFiKDoBw&cid=CAQSKQCNIrLMrNLye87meWERX4MOdSoKtAjS4JMMSEGtAC3GsLQ413kqsuKE&eitems=ChAIgJiokAYQnfrV4_fqgoxOEh0AaVBoS8hL3_KLK9Rs34IcdcZKLIAqSAaVNwMekg&random=1970433870&resp=GooglemKTybQhCsO&ipr=y&prhg=0

Requested by

Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/

Protocol

Server

2607:f8b0:4006:80f::2003 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Feb 2022 14:41:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 14 Feb 2022 14:41:54 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/gif
location: https://www.google.ca/pagead/1p-conversion/580448699/?random=1827434592&cv=9&fst=1644849713400&num=1&value=0&label=FmJTCMOu_N8BELvj45QC&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg290&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fgcp-cheet-4407-ontariofarmer.gdev.postmedia.digital%2F&tiba=Home%20%7C%20Ontario%20Farmer&auid=335390189.1644849712&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=CNPgGw&is_vtc=1&ocp_id=MWoKYo6oKdDy_gSFiKDoBw&cid=CAQSKQCNIrLMrNLye87meWERX4MOdSoKtAjS4JMMSEGtAC3GsLQ413kqsuKE&eitems=ChAIgJiokAYQnfrV4_fqgoxOEh0AaVBoS8hL3_KLK9Rs34IcdcZKLIAqSAaVNwMekg&random=1970433870&resp=GooglemKTybQhCsO&ipr=y&prhg=0
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 controltag.js.a1705c5ac5f06cf0c202ff70908fc042 Show response
cdn.krxd.net/ctjs/ Frame A7E4 259 KB
83 KB 60ms
2ms Script
application/javascript 151.101.66.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.krxd.net/ctjs/controltag.js.a1705c5ac5f06cf0c202ff70908fc042
Requested by: Host: cdn.krxd.net
URL: https://cdn.krxd.net/controltag/uthtxmddg.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.66.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 58d6350da5588a52d6baa4efc27a3362b4ee69dba3504fc762f934d7bb5d0bc4

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.krxd.net/partnerjs/xdi/proxy.3d2100fd7107262ecb55ce6847f01fa5.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-cdn-backend: 4FrRTvEr9h480D4BywjehZ--F_Controltag_S3
date: Mon, 14 Feb 2022 14:41:54 GMT
content-encoding: gzip
age: 16943024
x-amz-server-side-encryption: AES256
x-cache: HIT
x-cache-hits: 1404226
content-length: 84509
x-served-by: cache-yul12829-YUL
last-modified: Mon, 02 Aug 2021 12:06:17 GMT
x-timer: S1644849714.024046,VS0,VE0
etag: "a1705c5ac5f06cf0c202ff70908fc042"
content-type: application/javascript
via: 1.1 varnish
cache-control: public, max-age=315360000
accept-ranges: bytes
expires: Thu, 31 Jul 2031 12:06:16 GMT

GET
H2 200 / Show response
match.sharethrough.com/jwumXNuB/v1/ Frame E4C9 427 B
528 B 64ms
7ms Document
text/html 34.200.159.147
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&fv=1.0&a=cm&cm3ppd=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.200.159.147 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-200-159-147.compute-1.amazonaws.com
Software: /
Resource Hash: 05254fb47e6015a14628f7c169dde60489f8dd067efa6f2dabed1dc7a735a8b2

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

date: Mon, 14 Feb 2022 14:41:54 GMT
content-length: 427

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 3933 15 KB
6 KB 260ms
0ms Document
text/html 23.52.161.180
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3DPM_UID%26ex%3Dpubmatic.com&userIdMacro=PM_UID
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&fv=1.0&a=cm&cm3ppd=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.52.161.180 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-52-161-180.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

last-modified: Tue, 01 Feb 2022 06:38:00 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
server: Apache/2.2.15 (CentOS)
accept-ranges: bytes
content-encoding: gzip
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 5549
content-type: text/html; charset=UTF-8
cache-control: max-age=109419
expires: Tue, 15 Feb 2022 21:05:33 GMT
date: Mon, 14 Feb 2022 14:41:54 GMT
vary: Accept-Encoding

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame 1F12 281 B
554 B 190ms
26ms Document
text/html 23.57.136.222
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&fv=1.0&a=cm&cm3ppd=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.57.136.222 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-57-136-222.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
ETag: "402b2-119-5d32342a551c0"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Mon, 14 Feb 2022 14:41:54 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H3

200

cm Show response
u.openx.net/w/1.0/ Frame 11F8
Redirect Chain

https://u.openx.net/w/1.0/cm?id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX...

722 B
481 B

66ms
47ms

Document
text/html

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&fv=1.0&a=cm&cm3ppd=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/17.1.0 /
Resource Hash: b3b2fe5485d65c182c4ba3575926094557e36d2d096cc9515d972a70e04f709e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

vary: Accept, Accept-Encoding
server: OXGW/17.1.0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Mon, 14 Feb 2022 14:41:54 GMT
content-type: text/html
content-length: 462
content-encoding: gzip
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

Redirect headers

server: OXGW/17.1.0
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
date: Mon, 14 Feb 2022 14:41:54 GMT
content-length: 0
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame 021A
Redirect Chain

https://ib.adnxs.com/getuid?https://s.amazon-adsystem.com/ecm3?id=$UID&ex=districtm
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID%26ex%3Ddistrictm
https://s.amazon-adsystem.com/ecm3?id=5894217850497717679&ex=districtm

43 B
556 B

94ms
36ms

Document
image/gif

209.54.180.3
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?id=5894217850497717679&ex=districtm

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&fv=1.0&a=cm&cm3ppd=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.180.3 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

Server: Server
Date: Mon, 14 Feb 2022 14:41:54 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
x-amz-rid: D6M7N0Q6WT8HF54SHD1Y
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Permissions-Policy: interest-cohort=()

Redirect headers

Server: nginx/1.17.9
Date: Mon, 14 Feb 2022 14:41:54 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Location: https://s.amazon-adsystem.com/ecm3?id=5894217850497717679&ex=districtm
AN-X-Request-Uuid: 97050f97-841f-4f5b-a6cc-f6d0ab634054
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 671.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame F28C
Redirect Chain

https://ib.adnxs.com/getuid?https://s.amazon-adsystem.com/ecm3?id=$UID&ex=appnexus.com
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID%26ex%3Dappnexus.com
https://s.amazon-adsystem.com/ecm3?id=5894217850497717679&ex=appnexus.com

43 B
556 B

98ms
37ms

Document
image/gif

209.54.180.3
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?id=5894217850497717679&ex=appnexus.com

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&fv=1.0&a=cm&cm3ppd=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.180.3 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

Server: Server
Date: Mon, 14 Feb 2022 14:41:54 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
x-amz-rid: 381A12P260B5W5RM8T4N
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Permissions-Policy: interest-cohort=()

Redirect headers

Server: nginx/1.17.9
Date: Mon, 14 Feb 2022 14:41:54 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Location: https://s.amazon-adsystem.com/ecm3?id=5894217850497717679&ex=appnexus.com
AN-X-Request-Uuid: 58555edc-b34d-44be-957c-114b97e77437
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 671.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com

GET
H/1.1

200
OK

amazon Show response
ap.lijit.com/beacon/ Frame 7821
Redirect Chain

https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com
https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1

1 KB
1 KB

44ms
37ms

Document
text/html

23.92.190.74
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&fv=1.0&a=cm&cm3ppd=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.92.190.74 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: a7bb2422616e7f36f583314c7fa3e33007f29f9b3dea91e85dee59395659def0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

Server: nginx
Date: Mon, 14 Feb 2022 14:41:54 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Vary: Accept-Encoding
Expires: Fri, 20 Mar 2009 00:00:00 GMT
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Pragma: no-cache
P3P: CP="CUR ADM OUR NOR STA NID"
X-Powered-By: raptor
Content-Encoding: gzip
X-Sovrn-Pod: ad_ap4ewr1

Redirect headers

Server: nginx
Date: Mon, 14 Feb 2022 14:41:54 GMT
Content-Length: 0
Expires: Fri, 20 Mar 2009 00:00:00 GMT
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Pragma: no-cache
P3P: CP="CUR ADM OUR NOR STA NID"
Location: https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
X-Powered-By: raptor
X-Sovrn-Pod: ad_ap4ewr1

GET
H2

200

index.html Show response
cdn.districtm.io/ids/ Frame 68B4
Redirect Chain

https://cdn.districtm.io/ids/?sellerid=10002&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Ddmx.com%26id%3D%7BUID%7D
https://cdn.districtm.io/ids/index.html?sellerid=10002&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Ddmx.com%26id%3D%7BUID%7D

116 B
313 B

95ms
40ms

Document
text/html

104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.districtm.io/ids/index.html?sellerid=10002&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Ddmx.com%26id%3D%7BUID%7D
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&fv=1.0&a=cm&cm3ppd=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.68.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f752ad8cf812a358129aac3fd9784b0baf6f19899eb49116f08a1afab1fa133e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

date: Mon, 14 Feb 2022 14:41:54 GMT
content-type: text/html
cf-ray: 6dd70f5a781be6c8-EWR
age: 31690
last-modified: Thu, 20 May 2021 02:18:27 GMT
via: 1.1 dffe9476e426d3cb9c316316cb30d40e.cloudfront.net (CloudFront)
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-amz-cf-id: uxQGCdbH-clyOv8B7utU_bv9sMLTorELzR9_b2Ai6afMIVt4NZeFkA==
x-amz-cf-pop: EWR53-C1
x-cache: Hit from cloudfront
vary: Accept-Encoding
server: cloudflare
content-encoding: br

Redirect headers

date: Mon, 14 Feb 2022 14:41:54 GMT
location: https://cdn.districtm.io/ids/index.html?sellerid=10002&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Ddmx.com%26id%3D%7BUID%7D
cf-ray: 6dd70f594e7fe6c8-EWR
cache-control: max-age=3600
expires: Mon, 14 Feb 2022 15:41:54 GMT
vary: Accept-Encoding
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame 6C14
Redirect Chain

https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID
https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID
https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=657918283301527424755

43 B
556 B

36ms
36ms

Document
image/gif

209.54.180.3
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=657918283301527424755

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-sharethrough_pm-db5_rbd_ox-db5_dm_an-db5_sovrn_dmx_3lift&fv=1.0&a=cm&cm3ppd=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.180.3 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

Server: Server
Date: Mon, 14 Feb 2022 14:41:54 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
x-amz-rid: Z3737PWQ4DSX9B7VZY9T
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Permissions-Policy: interest-cohort=()

Redirect headers

date: Mon, 14 Feb 2022 14:41:54 GMT
content-length: 0
location: https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=657918283301527424755
cache-control: no-cache, no-store, must-revalidate
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame E4C9 43 B
556 B 129ms
31ms Image
image/gif 209.54.180.3
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=sharethrough.com&id=e7c0abdf-9fb3-4781-beae-0b49ea731a1b

Requested by

Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.180.3 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 14 Feb 2022 14:41:54 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: AQCWD3DK39BNSJ0417EV
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

v1
match.sharethrough.com/sync/ Frame E4C9
Redirect Chain

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=1
https://secure.adnxs.com/getuid?https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&source_user_id=$UID
https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&source_user_id=5894217850497717679

68 B
262 B

53ms
26ms

Image
image/png

34.200.159.147
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&source_user_id=5894217850497717679
Requested by: Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Protocol: H2
Server: 34.200.159.147 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-200-159-147.compute-1.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:54 GMT
content-length: 68
content-type: image/png

Redirect headers

Pragma: no-cache
Date: Mon, 14 Feb 2022 14:41:54 GMT
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 564.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: de295880-95f3-4fce-b18f-79722e1b75b5
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&source_user_id=5894217850497717679
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

v1
match.sharethrough.com/sync/ Frame E4C9
Redirect Chain

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=2
https://secure.adnxs.com/getuid?https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&source_user_id=$UID
https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&source_user_id=5894217850497717679

68 B
262 B

70ms
44ms

Image
image/png

34.200.159.147
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&source_user_id=5894217850497717679
Requested by: Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Protocol: H2
Server: 34.200.159.147 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-200-159-147.compute-1.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:54 GMT
content-length: 68
content-type: image/png

Redirect headers

Pragma: no-cache
Date: Mon, 14 Feb 2022 14:41:54 GMT
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 564.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: 15c0d87e-47d0-47fd-94b8-bffe70270e95
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&source_user_id=5894217850497717679
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

v1
match.sharethrough.com/sync/ Frame E4C9
Redirect Chain

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=3
https://bttrack.com/pixel/cookiesync?source=d0afdff5-c51e-4a8d-b07b-b52a29015170&secure=1
https://match.sharethrough.com/sync/v1?source_id=FGhqNjC2WnFmmvNpTL32LMME&source_user_id=d9293377-3f47-447d-b3ae-2102ba9fdff9

68 B
262 B

68ms
41ms

Image
image/png

34.200.159.147
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=FGhqNjC2WnFmmvNpTL32LMME&source_user_id=d9293377-3f47-447d-b3ae-2102ba9fdff9
Requested by: Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Protocol: H2
Server: 34.200.159.147 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-200-159-147.compute-1.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:54 GMT
content-length: 68
content-type: image/png

Redirect headers

X-ServerName: Track002-dc3
Pragma: no-cache
Date: Mon, 14 Feb 2022 14:41:54 GMT
X-AspNetMvc-Version: 5.2
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
P3P: CP="CAO DSP COR ADMo DEVo PSAo PSDo HISo IVAo IVDo OUR IND OTC"
Location: https://match.sharethrough.com/sync/v1?source_id=FGhqNjC2WnFmmvNpTL32LMME&source_user_id=d9293377-3f47-447d-b3ae-2102ba9fdff9
Cache-Control: private,no-cache
Content-Type: text/html; charset=utf-8
Content-Length: 246
Expires: -1

GET
H2

200

v1
match.sharethrough.com/sync/ Frame E4C9
Redirect Chain

https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=4
https://secure.adnxs.com/getuid?https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&source_user_id=$UID
https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&source_user_id=5894217850497717679

68 B
262 B

70ms
43ms

Image
image/png

34.200.159.147
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&source_user_id=5894217850497717679
Requested by: Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Protocol: H2
Server: 34.200.159.147 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-200-159-147.compute-1.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://match.sharethrough.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:54 GMT
content-length: 68
content-type: image/png

Redirect headers

Pragma: no-cache
Date: Mon, 14 Feb 2022 14:41:54 GMT
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 564.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: 0361b5fc-de73-4462-9c7e-6eb4a5245b75
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&source_user_id=5894217850497717679
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 42fb57ac-2013-45a6-8dad-332d53e17c1b Show response
consumer.krxd.net/consent/get/ Frame A7E4 224 B
328 B 63ms
25ms Script
text/javascript 151.101.130.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://consumer.krxd.net/consent/get/42fb57ac-2013-45a6-8dad-332d53e17c1b?idt=device&dt=kxcookie&callback=Krux.ns.postmedia.kxjsonp_consent_get_0
Requested by: Host: cdn.krxd.net
URL: https://cdn.krxd.net/ctjs/controltag.js.a1705c5ac5f06cf0c202ff70908fc042
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.130.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 96362b68e295798f86ac2f74d8fe6d7f0e19eba030a0722150cb9869eefa64ca

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.krxd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:54 GMT
via: 1.1 varnish
age: 0
x-served-by: consumer-a010-ash-prod.krxd.net, cache-yul12820-YUL
vary: Accept-Encoding
x-cache: MISS, MISS
content-type: text/javascript; charset=UTF-8
content-encoding: gzip
cache-control: max-age=1800
x-age: 0
accept-ranges: bytes
x-timer: S1644849714.419519,VS0,VE19
content-length: 187
x-cache-hits: 0, 0

POST
H3 200 / Show response
www.facebook.com/tr/ Frame 7608 0
18 B 90ms
60ms Document
text/plain 2a03:2880:f112:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
Origin: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/

Response headers

content-type: text/plain
access-control-allow-origin: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600
priority: u=0
date: Mon, 14 Feb 2022 14:41:54 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 1F12 32 KB
10 KB 32ms
19ms Script
text/html 23.57.136.222
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.57.136.222 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-57-136-222.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: e96d905773462b51270d6131f2119f7fd6d4aa67d3b57fcb048b66ce8b3ea6c8

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Mon, 14 Feb 2022 14:41:54 GMT
Content-Encoding: gzip
Last-Modified: Wed, 15 Dec 2021 23:04:16 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=43797
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9704
Expires: Tue, 15 Feb 2022 02:51:51 GMT

GET
H2 200 idsync.d5cb6b96.js Show response
cdn.districtm.io/ids/ Frame 68B4 3 KB
2 KB 73ms
47ms Script
application/javascript 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.districtm.io/ids/idsync.d5cb6b96.js
Requested by: Host: cdn.districtm.io
URL: https://cdn.districtm.io/ids/index.html?sellerid=10002&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Ddmx.com%26id%3D%7BUID%7D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.68.69 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aebd50af0cd8da2f314a52e2088788775d1a441bd674ef9379578e7bc1b5ad50

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/ids/index.html?sellerid=10002&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Ddmx.com%26id%3D%7BUID%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:54 GMT
via: 1.1 697118bcd171d3b8a0299bf4ce5a8604.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 145837
cf-polished: origSize=3302
x-cache: Hit from cloudfront
cf-bgj: minify
content-encoding: br
last-modified: Thu, 20 May 2021 02:18:27 GMT
server: cloudflare
etag: W/"74ede07ef946dc2316f86b2661cf2dd3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=172800
x-amz-cf-pop: JFK51-C1
cf-ray: 6dd70f5caa9de6c8-EWR
x-amz-cf-id: lwQ1lEw9tGsIlt1UY6HrsjBk2yAp9q3IbjALvHkHmH0V-8_svMWTYw==
expires: Wed, 16 Feb 2022 14:41:54 GMT

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame 7821 43 B
556 B 62ms
49ms Image
image/gif 209.54.180.3
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=1148e8991e154b90d192d108&ex=sovrn.com&gdpr=0&gdpr_consent=

Requested by

Host: ap.lijit.com
URL: https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.180.3 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 14 Feb 2022 14:41:54 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: Y4AB4JJS49QZTCEC2X6V
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 7821
Redirect Chain

https://sync.1rx.io/usersync2/sovrn?gdpr=0&gdpr_consent=
https://sync.1rx.io/usersync2/sovrn?zcc=1&cb=1644849714831
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=5825804547
https://sync.1rx.io/usersync/tradedesk/c2da4108-b919-40cc-a8d8-9255d4db5b3e
https://sync.targeting.unrulymedia.com/csync/RX-708fe789-db7e-474d-b017-6e1fe43364b9-005?redir=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D56%263pid%3DRX-708fe789-db7e-474d-b017-6e1fe43364b9-005
https://ce.lijit.com/merge?pid=56&3pid=RX-708fe789-db7e-474d-b017-6e1fe43364b9-005

43 B
2 KB

23ms
21ms

Image
image/gif

63.251.114.182
INTERNAP-2BLK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=56&3pid=RX-708fe789-db7e-474d-b017-6e1fe43364b9-005
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Protocol: HTTP/1.1
Server: 63.251.114.182 , United States, ASN12181 (INTERNAP-2BLK, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 14 Feb 2022 14:41:55 GMT
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap7ewr1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Date: Mon, 14 Feb 2022 14:41:55 GMT
Server: Tengine
ETag: RX708fe789db7e474db0176e1fe43364b9005
Transfer-Encoding: chunked
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Location: https://ce.lijit.com/merge?pid=56&3pid=RX-708fe789-db7e-474d-b017-6e1fe43364b9-005
Connection: keep-alive
Content-Type: text/html

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 7821
Redirect Chain

https://pixel-eu.rubiconproject.com/exchange/sync.php?p=sovrn-onscroll&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=83&3pid=KZMT1V8E-1O-5H7Z&gdpr=0

43 B
1 KB

29ms
28ms

Image
image/gif

63.251.114.182
INTERNAP-2BLK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=83&3pid=KZMT1V8E-1O-5H7Z&gdpr=0
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Protocol: HTTP/1.1
Server: 63.251.114.182 , United States, ASN12181 (INTERNAP-2BLK, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 14 Feb 2022 14:41:55 GMT
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap7ewr1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://ce.lijit.com/merge?pid=83&3pid=KZMT1V8E-1O-5H7Z&gdpr=0
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 0163a7456b0a5605e8b1fb1d4fba3e4d
Expires: 0

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 7821
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D12%263pid%3D%24UID&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=12&3pid=5894217850497717679&gdpr=0&gdpr_consent=

43 B
837 B

500ms
18ms

Image
image/gif

63.251.114.182
INTERNAP-2BLK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=12&3pid=5894217850497717679&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Protocol: HTTP/1.1
Server: 63.251.114.182 , United States, ASN12181 (INTERNAP-2BLK, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 14 Feb 2022 14:41:55 GMT
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap7ewr1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 14 Feb 2022 14:41:54 GMT
X-Proxy-Origin: 149.56.153.183; 149.56.153.183; 564.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: 73949081-9400-4180-88c9-126dbfc3051a
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ce.lijit.com/merge?pid=12&3pid=5894217850497717679&gdpr=0&gdpr_consent=
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 7821
Redirect Chain

https://um.simpli.fi/lj_match?r=1644849714310&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=2&3pid=00909A6B55AB4796A6C21D838F770B8D

43 B
1 KB

30ms
28ms

Image
image/gif

63.251.114.182
INTERNAP-2BLK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=2&3pid=00909A6B55AB4796A6C21D838F770B8D
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Protocol: HTTP/1.1
Server: 63.251.114.182 , United States, ASN12181 (INTERNAP-2BLK, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 14 Feb 2022 14:41:55 GMT
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap7ewr1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

date: Mon, 14 Feb 2022 14:41:55 GMT
x-content-type-options: nosniff
server: nginx
location: https://ce.lijit.com/merge?pid=2&3pid=00909A6B55AB4796A6C21D838F770B8D
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 138
expires: Sun, 13 Feb 2022 14:41:55 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 7821
Redirect Chain

https://rtb.mfadsrvr.com/sync?ssp=sovrn&gdpr=0&gdpr_consent=
https://rtb.mfadsrvr.com/ul_cb/sync?ssp=sovrn&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=87&3pid=64bc7537-2bbe-43ac-836a-f804e904695e

43 B
854 B

210ms
25ms

Image
image/gif

63.251.114.182
INTERNAP-2BLK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=87&3pid=64bc7537-2bbe-43ac-836a-f804e904695e
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Protocol: HTTP/1.1
Server: 63.251.114.182 , United States, ASN12181 (INTERNAP-2BLK, US),
Reverse DNS
Software: nginx / raptor
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 14 Feb 2022 14:41:55 GMT
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap7ewr1
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

location: //ce.lijit.com/merge?pid=87&3pid=64bc7537-2bbe-43ac-836a-f804e904695e
date: Mon, 14 Feb 2022 14:41:54 GMT
cache-control: no-cache, no-store, must-revalidate
alt-svc: clear
content-length: 0
via: 1.1 google

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame 11F8 43 B
556 B 61ms
48ms Image
image/gif 209.54.180.3
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=openx.com&id=a9a8246f-36da-8e7a-b7b4-7c9a57e4423f

Requested by

Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.180.3 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 14 Feb 2022 14:41:54 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: 54RBE09SR6BQ4CEXVHGC
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

ny75r2x0
sync-tm.everesttech.net/ct/upi/pid/ Frame 11F8
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=YgpqMgAGHw5hqwAy

85 B
165 B

15ms
14ms

Image
image/png

151.101.130.49
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=YgpqMgAGHw5hqwAy
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Protocol: H2
Server: 151.101.130.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Feb 2022 14:41:54 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
age: 391
x-served-by: cache-yul12834-YUL
x-cache: HIT
content-type: image/png
cache-control: no-cache
accept-ranges: bytes
x-timer: S1644849715.882458,VS0,VE0
content-length: 85
x-cache-hits: 4766

Redirect headers

pragma: no-cache
date: Mon, 14 Feb 2022 14:41:54 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1644849715.736189,VS0,VE16
x-served-by: cache-yul12834-YUL
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
location: https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=YgpqMgAGHw5hqwAy
cache-control: no-cache
accept-ranges: bytes
access-control-allow-origin: *
content-length: 0
x-cache-hits: 0

GET
H2 200 65b93e56-badc-a7c9-466d-e8f8c0804496
pr-bh.ybp.yahoo.com/sync/openx/ Frame 11F8 43 B
991 B 133ms
26ms Image
image/gif 2600:1f18:4e9:5a01:4fe8:190f:17d4:b6af
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/openx/65b93e56-badc-a7c9-466d-e8f8c0804496?gdpr=0

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a01:4fe8:190f:17d4:b6af Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:54 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 11F8
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=f17e5812-2a70-3580-77ba-fe0d3fd789df&gdpr=0
https://match.adsrvr.org/track/cmb/openx?oxid=f17e5812-2a70-3580-77ba-fe0d3fd789df&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=c2da4108-b919-40cc-a8d8-9255d4db5b3e&ttd_puid=f17e5812-2a70-3580-77ba-fe0d3fd789df

43 B
62 B

43ms
30ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=c2da4108-b919-40cc-a8d8-9255d4db5b3e&ttd_puid=f17e5812-2a70-3580-77ba-fe0d3fd789df
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/17.1.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Feb 2022 14:41:55 GMT
via: 1.1 google
server: OXGW/17.1.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 14 Feb 2022 14:41:54 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=c2da4108-b919-40cc-a8d8-9255d4db5b3e&ttd_puid=f17e5812-2a70-3580-77ba-fe0d3fd789df
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 293

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 11F8 170 B
502 B 142ms
43ms Image
image/png 142.251.32.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZGQxMThiZDgtZTMwNy02YjI0LTYyNWEtYTRiNGY1MzU0N2Jm

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.32.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Feb 2022 14:41:54 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 11F8
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEEKHh1VU2wuzFMiUeaY9Qjw&google_cver=1

43 B
180 B

77ms
0ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEEKHh1VU2wuzFMiUeaY9Qjw&google_cver=1
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/17.1.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Feb 2022 14:41:54 GMT
via: 1.1 google
server: OXGW/17.1.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 14 Feb 2022 14:41:54 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEEKHh1VU2wuzFMiUeaY9Qjw&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 3933 2 KB
2 KB 174ms
24ms Script
text/html 8.28.7.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=76646219&p=156011&s=165626&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3DPM_UID%26ex%3Dpubmatic.com&userIdMacro=PM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: ddb51dc062a5142ba07138c94ac5b984ab0a8e7c1eb6260702e8cb558babf41a

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:54 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 1569
content-type: text/html; charset=UTF-8

POST
H2 204 users Show response
dmx.districtm.io/s/v1/ Frame 1FD0 0
542 B 77ms
55ms XHR
text/plain 104.16.68.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/s/v1/users

Requested by

Host: cdn.districtm.io
URL: https://cdn.districtm.io/ids/idsync.d5cb6b96.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.68.69 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://cdn.districtm.io/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 14 Feb 2022 14:41:54 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: DELETE, GET, OPTIONS, POST
access-control-allow-origin: https://cdn.districtm.io
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 6dd70f5e6cc6e6c8-EWR
access-control-allow-headers: Origin, Content-Type

OPTIONS
H2 204 users
dmx.districtm.io/s/v1/ Frame 0
0 203ms
101ms Preflight 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/s/v1/users

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://cdn.districtm.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Mon, 14 Feb 2022 14:41:54 GMT
cf-ray: 6dd70f5da95453dd-YYZ
access-control-allow-origin: https://cdn.districtm.io
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
access-control-allow-headers: Origin, Content-Type
access-control-allow-methods: DELETE, GET, OPTIONS, POST
access-control-max-age: 14400
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare

GET
H2

204

usermatch.gif
beacon.krxd.net/ Frame A7E4
Redirect Chain

https://usermatch.krxd.net/um/v2?partner=google
https://cm.g.doubleclick.net/pixel?google_cm&google_nid=krux_digital&google_hm=T3FZVDBOYlY
https://beacon.krxd.net/usermatch.gif?google_gid=CAESEDkCxXvXAY4QMLhRe_P8IZY&google_cver=1

0
337 B

226ms
19ms

Image
text/plain

52.22.124.154
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?google_gid=CAESEDkCxXvXAY4QMLhRe_P8IZY&google_cver=1
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Server: 52.22.124.154 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-22-124-154.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.krxd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:55 GMT
cache-control: private, no-cache, no-store
x-request-time: D=22 t=1644849715
x-served-by: beacon-n036-ash-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma: no-cache
date: Mon, 14 Feb 2022 14:41:54 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://beacon.krxd.net/usermatch.gif?google_gid=CAESEDkCxXvXAY4QMLhRe_P8IZY&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 291
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

204

usermatch.gif
beacon.krxd.net/ Frame A7E4
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=krux_digital&google_cm&google_hm=T3FZVDBOYlY
https://beacon.krxd.net/usermatch.gif?google_gid=CAESEDkCxXvXAY4QMLhRe_P8IZY&google_cver=1

0
337 B

479ms
22ms

Image
text/plain

52.22.124.154
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?google_gid=CAESEDkCxXvXAY4QMLhRe_P8IZY&google_cver=1
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Server: 52.22.124.154 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-22-124-154.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.krxd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:55 GMT
cache-control: private, no-cache, no-store
x-request-time: D=26 t=1644849715
x-served-by: beacon-n022-ash-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma: no-cache
date: Mon, 14 Feb 2022 14:41:54 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://beacon.krxd.net/usermatch.gif?google_gid=CAESEDkCxXvXAY4QMLhRe_P8IZY&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 291
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 379708.gif
idsync.rlcdn.com/ Frame A7E4 42 B
450 B 132ms
41ms Image
image/gif 35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/379708.gif?partner_uid=OqYT0NbV
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.krxd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 14 Feb 2022 14:41:54 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

GET
H2

204

usermatch.gif
beacon.krxd.net/ Frame A7E4
Redirect Chain

https://stags.bluekai.com/site/26357?id=OqYT0NbV&redir=https://beacon.krxd.net/usermatch.gif?_kuid%3DOqYT0NbV%26partner%3Dbluekai%26bk_uuid%3D%24_BK_UUID
https://beacon.krxd.net/usermatch.gif?_kuid=OqYT0NbV&partner=bluekai&bk_uuid=$_BK_UUID

0
337 B

432ms
19ms

Image
text/plain

52.22.124.154
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?_kuid=OqYT0NbV&partner=bluekai&bk_uuid=$_BK_UUID
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Server: 52.22.124.154 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-22-124-154.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.krxd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:55 GMT
cache-control: private, no-cache, no-store
x-request-time: D=48 t=1644849715
x-served-by: beacon-n003-ash-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Location: https://beacon.krxd.net/usermatch.gif?_kuid=OqYT0NbV&partner=bluekai&bk_uuid=$_BK_UUID
Date: Mon, 14 Feb 2022 14:41:54 GMT
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"

GET
H2 200 p
sb.scorecardresearch.com/ Frame A7E4 64 B
440 B 28ms
26ms Image
image/gif 13.33.46.48
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/p?c1=9&c2=8188709&cs_xi=OqYT0NbV&rn=1644849715
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.46.48 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-33-46-48.ewr52.r.cloudfront.net
Software: /
Resource Hash: 831b0d6cde4541d363bb7a67eb49010fc5fd717dda4b9c3187dd3207b1da56cd

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.krxd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:54 GMT
via: 1.1 bc6981f82440e44448ee5dd3577bf4f4.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR52-C1
etag: W/"40-jHLN3x5dWpBzaQm4lkBmDWvrjrg"
x-cache: Miss from cloudfront
content-type: image/gif; charset=utf-8
content-length: 64
x-amz-cf-id: 3rruwooTVBbtpZ-eJKprmMwAhS60-o9NAQr9Umnm7z91r8SflpGmjg==

GET
H2

204

usermatch.gif
beacon.krxd.net/ Frame A7E4
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/NC4WTmcy?redir=https%3A%2F%2Fbeacon.krxd.net%2Fusermatch.gif%3Fpartner_id%3Dcb276571-e0d9-4438-9fd4-80a1ff034b01%26puid%3D%24%7BTM_USER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/NC4WTmcy?redir=https%3A%2F%2Fbeacon.krxd.net%2Fusermatch.gif%3Fpartner_id%3Dcb276571-e0d9-4438-9fd4-80a1ff034b01%26puid%3D%24%7BTM_USER_ID%7D&_test=YgpqMg...
https://beacon.krxd.net/usermatch.gif?partner_id=cb276571-e0d9-4438-9fd4-80a1ff034b01&puid=YgpqMgAGHgJiRgAy&_test=YgpqMgAGHgJiRgAy

0
338 B

475ms
18ms

Image
text/plain

52.22.124.154
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?partner_id=cb276571-e0d9-4438-9fd4-80a1ff034b01&puid=YgpqMgAGHgJiRgAy&_test=YgpqMgAGHgJiRgAy
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Server: 52.22.124.154 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-22-124-154.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.krxd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:55 GMT
cache-control: private, no-cache, no-store
x-request-time: D=35 t=1644849715
x-served-by: beacon-n006-ash-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma: no-cache
date: Mon, 14 Feb 2022 14:41:54 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1644849715.882505,VS0,VE0
x-served-by: cache-yul12834-YUL
x-cache: HIT
location: https://beacon.krxd.net/usermatch.gif?partner_id=cb276571-e0d9-4438-9fd4-80a1ff034b01&puid=YgpqMgAGHgJiRgAy&_test=YgpqMgAGHgJiRgAy
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2

204

usermatch.gif
beacon.krxd.net/ Frame A7E4
Redirect Chain

https://usermatch.krxd.net/um/v2?partner=beeswax
https://match.prod.bidr.io/cookie-sync/krux?partner_user_id=OqYT0NbV
https://match.prod.bidr.io/cookie-sync/krux?partner_user_id=OqYT0NbV&_bee_ppp=1
https://beacon.krxd.net/usermatch.gif?partner=beeswax&partner_uid=AAB4sU7EFNQAAH6IC2NkfA

0
337 B

32ms
32ms

Image
text/plain

52.22.124.154
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?partner=beeswax&partner_uid=AAB4sU7EFNQAAH6IC2NkfA
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Server: 52.22.124.154 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-22-124-154.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.krxd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:55 GMT
cache-control: private, no-cache, no-store
x-request-time: D=60 t=1644849716
x-served-by: beacon-n020-ash-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location: https://beacon.krxd.net/usermatch.gif?partner=beeswax&partner_uid=AAB4sU7EFNQAAH6IC2NkfA
Date: Mon, 14 Feb 2022 14:41:55 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0
strict-transport-security: max-age=2592000; includeSubDomains

GET
H2

204

usermatch.gif
beacon.krxd.net/ Frame A7E4
Redirect Chain

https://usermatch.krxd.net/um/v2?partner=mediamath
https://sync.mathtag.com/sync/img?mt_exid=10031&mt_exuid=OqYT0NbV&redirect=https://beacon.krxd.net/usermatch.gif?partner%3Dmediamath%26partner_id%3D%5BMM_UUID%5D
https://beacon.krxd.net/usermatch.gif?partner=mediamath&partner_id=b0c1620a-6a33-4a00-8d09-8d3972873d75

0
337 B

26ms
25ms

Image
text/plain

52.22.124.154
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?partner=mediamath&partner_id=b0c1620a-6a33-4a00-8d09-8d3972873d75
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Server: 52.22.124.154 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-22-124-154.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.krxd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:55 GMT
cache-control: private, no-cache, no-store
x-request-time: D=31 t=1644849715
x-served-by: beacon-n016-ash-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Date: Mon, 14 Feb 2022 14:41:55 GMT
Server: MT3 4133 baa842e master ord-pixel-x58 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://beacon.krxd.net/usermatch.gif?partner=mediamath&partner_id=b0c1620a-6a33-4a00-8d09-8d3972873d75
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Mon, 14 Feb 2022 14:41:54 GMT

GET
H/1.1 200
OK tag.aspx Show response
ml314.com/ Frame A7E4 27 KB
12 KB 564ms
53ms Script
application/javascript 54.85.224.115
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/tag.aspx?1412022
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.85.224.115 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-85-224-115.compute-1.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 300b9ba11e041384aafe746b81adbac891f04890e6d71728d572df9073610076

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.krxd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Mon, 14 Feb 2022 14:41:54 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: public, max-age=86400
transfer-encoding: chunked
Connection: keep-alive

GET
H2

200

g.js
aa.agkn.com/adscores/ Frame A7E4
Redirect Chain

https://usermatch.krxd.net/um/v2?partner=neustar
https://aa.agkn.com/adscores/g.js?sid=9212244187&_kdpid=OqYT0NbV

43 B
655 B

576ms
97ms

Image
image/gif

2600:9000:202c:fa00:1a:609a:6780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aa.agkn.com/adscores/g.js?sid=9212244187&_kdpid=OqYT0NbV
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Server: 2600:9000:202c:fa00:1a:609a:6780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AAWebServer /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.krxd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Feb 2022 14:41:55 GMT
via: 1.1 f912c5a5865a58aaaad9710240b6d2f2.cloudfront.net (CloudFront)
server: AAWebServer
x-amz-cf-pop: EWR52-C2
access-control-allow-methods: GET, POST, OPTIONS
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
x-cache: Miss from cloudfront
content-type: image/gif
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type
content-length: 43
x-amz-cf-id: aWaEmTEPjGNh30oo7AldFXWtdIhxLzLy2XdIHOa5SN3QVrVy17gBPg==
expires: 0

Redirect headers

location: https://aa.agkn.com/adscores/g.js?sid=9212244187&_kdpid=OqYT0NbV
date: Mon, 14 Feb 2022 14:41:54 GMT
x-cache-hits: 0
x-age: 0
content-length: 0
x-cache: MISS
x-served-by: usermatch-a007-ash-prod.krxd.net

GET
H2

204

usermatch.gif
beacon.krxd.net/ Frame A7E4
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=183716&cb=https%3A%2F%2Fbeacon.krxd.net%2Fusermatch.gif%3Fpartner%3Dcasale%26partner_uid%3D__UID__
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fbeacon.krxd.net%2Fusermatch.gif%3Fpartner%3Dcasale%26partner_uid%3D__UID__&s=183716&C=1
https://beacon.krxd.net/usermatch.gif?partner=casale&partner_uid=YgpqM.NJRzZAP61od8rrawAA%26465

0
337 B

32ms
25ms

Image
text/plain

52.22.124.154
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?partner=casale&partner_uid=YgpqM.NJRzZAP61od8rrawAA%26465
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Server: 52.22.124.154 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-22-124-154.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.krxd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:55 GMT
cache-control: private, no-cache, no-store
x-request-time: D=23 t=1644849715
x-served-by: beacon-n006-ash-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Pragma: no-cache
Date: Mon, 14 Feb 2022 14:41:55 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://beacon.krxd.net/usermatch.gif?partner=casale&partner_uid=YgpqM.NJRzZAP61od8rrawAA%26465
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 283
Expires: Mon, 14 Feb 2022 14:41:55 GMT

GET
H2

204

usermatch.gif
beacon.krxd.net/ Frame A7E4
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=salesforce
https://beacon.krxd.net/usermatch.gif?partner=stackadapt&partner_uid=m4mZh7rQSnts18eK7qhf75U4mbc

0
337 B

506ms
20ms

Image
text/plain

52.22.124.154
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?partner=stackadapt&partner_uid=m4mZh7rQSnts18eK7qhf75U4mbc
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Server: 52.22.124.154 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-22-124-154.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.krxd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:55 GMT
cache-control: private, no-cache, no-store
x-request-time: D=29 t=1644849715
x-served-by: beacon-n007-ash-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Location: https://beacon.krxd.net/usermatch.gif?partner=stackadapt&partner_uid=m4mZh7rQSnts18eK7qhf75U4mbc
Date: Mon, 14 Feb 2022 14:41:54 GMT
Connection: keep-alive
Content-Length: 123
Content-Type: text/html; charset=utf-8

GET
H2

204

usermatch.gif
beacon.krxd.net/ Frame A7E4
Redirect Chain

https://usermatch.krxd.net/um/v2?partner=triplelift&gdpr=0&cmp_cs=&us_privacy=undefined
https://eb2.3lift.com/xuid?mid=3587&xuid=OqYT0NbV&dongle=13b2&rdir=https://beacon.krxd.net/usermatch.gif?partner%3Dtriplelift%26partner_uid%3D$UID&gdpr=0&cmp_cs=&us_privacy=undefined
https://beacon.krxd.net/usermatch.gif?partner=triplelift&partner_uid=657918283301527424755

0
337 B

237ms
21ms

Image
text/plain

52.22.124.154
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?partner=triplelift&partner_uid=657918283301527424755
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Server: 52.22.124.154 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-22-124-154.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.krxd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:55 GMT
cache-control: private, no-cache, no-store
x-request-time: D=26 t=1644849714
x-served-by: beacon-n038-ash-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location: https://beacon.krxd.net/usermatch.gif?partner=triplelift&partner_uid=657918283301527424755
date: Mon, 14 Feb 2022 14:41:54 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H/1.1 200
OK khaos.jpg
token.rubiconproject.com/ Frame 1F12 284 B
921 B 559ms
24ms Image
image/jpg 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/khaos.jpg?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 284
X-RPHost: 19ea072139d67f7022c6e463249c998e
Content-Type: image/jpg

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 68B4
Redirect Chain

https://dmx.districtm.io/s/v1/users/10002
https://s.amazon-adsystem.com/ecm3?ex=dmx.com&id=eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJzaWQiOjEwMDAyLCJ1c3IiOiJxZ1llc2dZYk1qVTJXblJzWVZFeGVqQjJiV3RPVjNjMGNGaG5PVzVCVWtZMSJ9.pNv0JKm0HNkB6VP4balmUA...

43 B
556 B

50ms
31ms

Image
image/gif

209.54.180.3
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=dmx.com&id=eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJzaWQiOjEwMDAyLCJ1c3IiOiJxZ1llc2dZYk1qVTJXblJzWVZFeGVqQjJiV3RPVjNjMGNGaG5PVzVCVWtZMSJ9.pNv0JKm0HNkB6VP4balmUAof1Px1fgU35-O0hDlD_k1WlrxN1owB_HFf8njzDIzudIfrvDylqVCuDKubtJDxQw

Requested by

Host: cdn.districtm.io
URL: https://cdn.districtm.io/ids/index.html?sellerid=10002&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Ddmx.com%26id%3D%7BUID%7D

Protocol

HTTP/1.1

Server

209.54.180.3 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 14 Feb 2022 14:41:55 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: DNCBSTQKBFCA25KTTJKA
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

date: Mon, 14 Feb 2022 14:41:54 GMT
cf-cache-status: DYNAMIC
server: cloudflare
location: https://s.amazon-adsystem.com/ecm3?ex=dmx.com&id=eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJzaWQiOjEwMDAyLCJ1c3IiOiJxZ1llc2dZYk1qVTJXblJzWVZFeGVqQjJiV3RPVjNjMGNGaG5PVzVCVWtZMSJ9.pNv0JKm0HNkB6VP4balmUAof1Px1fgU35-O0hDlD_k1WlrxN1owB_HFf8njzDIzudIfrvDylqVCuDKubtJDxQw
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: DELETE, GET, OPTIONS, POST
access-control-allow-origin: https://cdn.districtm.io
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 6dd70f5e3c98e6c8-EWR
access-control-allow-headers: Origin, Content-Type
content-length: 0

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012201141909000/ Frame BF60 220 KB
61 KB 450ms
14ms Script
text/javascript 2607:f8b0:4006:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012201141909000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020901.js?31064847

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d8ade0d94aaf4b3d52776b75609e8d1c31995677a0a033a6fa2408425da07740

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 33593
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 61542
x-xss-protection: 0
server: sffe
date: Mon, 14 Feb 2022 05:22:02 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "00d9ef7efeb287da"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 14 Feb 2023 05:22:02 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012201141909000/v0/ Frame BF60 16 KB
6 KB 480ms
51ms Script
text/javascript 2607:f8b0:4006:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012201141909000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020901.js?31064847

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cb696ecd7c4f31fdd7c7c1cc37e8efc29614fbcbadf74f455aa496d72ce33250

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 33593
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5698
x-xss-protection: 0
server: sffe
date: Mon, 14 Feb 2022 05:22:02 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "919adc590e0ff503"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 14 Feb 2023 05:22:02 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012201141909000/v0/ Frame BF60 96 KB
29 KB 482ms
54ms Script
text/javascript 2607:f8b0:4006:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012201141909000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020901.js?31064847

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc83fe6d180fd859f448bacd040799bf379ee7e0d9b1e6c3f19499c1c4358864

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 33593
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29570
x-xss-protection: 0
server: sffe
date: Mon, 14 Feb 2022 05:22:02 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "c52208c2e07002d5"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 14 Feb 2023 05:22:02 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012201141909000/v0/ Frame BF60 5 KB
2 KB 488ms
60ms Script
text/javascript 2607:f8b0:4006:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012201141909000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020901.js?31064847

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ea29de07cdb14f2c6c59c06fdcd4ec30c2030b3ba8ee6a0aa325085496b9a94d

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 33593
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1851
x-xss-protection: 0
server: sffe
date: Mon, 14 Feb 2022 05:22:02 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "76a8c96b6aaec2c9"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 14 Feb 2023 05:22:02 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012201141909000/v0/ Frame BF60 42 KB
13 KB 489ms
61ms Script
text/javascript 2607:f8b0:4006:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012201141909000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020901.js?31064847

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a7d040d5e84706dac2d471ad33830bd0ae361ca06e53e72e817701478c6d5afa

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 33593
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13611
x-xss-protection: 0
server: sffe
date: Mon, 14 Feb 2022 05:22:02 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "7aefe3fe93cc7383"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 14 Feb 2023 05:22:02 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame BF60 6 KB
669 B 98ms
47ms Stylesheet
text/css 2607:f8b0:4006:822::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:300|Roboto:400,500&lang=en

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020901.js?31064847

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::200a Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2ddefcdc9f260c5ffeb93fed110fe9d929028226f9a2d8a4934ea52b546e9640

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 14 Feb 2022 13:16:46 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 14 Feb 2022 14:41:55 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 14 Feb 2022 14:41:55 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame BF60 4 KB
618 B 99ms
48ms Stylesheet
text/css 2607:f8b0:4006:822::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,500&text=

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020901.js?31064847

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::200a Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2e8fa2037c41372ddc72ea1e08a477ba37998b54b5416b8cff0554fa5b865e27

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 14 Feb 2022 13:18:45 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 14 Feb 2022 14:41:55 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 14 Feb 2022 14:41:55 GMT

GET
H2 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/14343191523858671001/ Frame BF60 31 KB
31 KB 440ms
13ms Image
image/jpeg 2607:f8b0:4006:80c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/14343191523858671001/downsize_200k_v1?sqp=4sqPyQSWAUKTAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-MhoI2gMQ-AEYASABLQAAAD8w2gM4-AFFAACAPw&rs=AOga4qnlkZlbWi5St7CLP6jLYvco8_vPUw

Requested by

Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

717dea50e50cd77ec4227232d4b4d28ca1f1ae85dd9e7afce28cd77dcccc0fee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 11 Feb 2022 13:32:36 GMT
x-content-type-options: nosniff
age: 263359
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31323
x-xss-protection: 0
last-modified: Wed, 22 Dec 2021 23:21:17 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 11 Feb 2023 13:32:36 GMT

GET
H2 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/8481278932046752674/ Frame BF60 10 KB
10 KB 464ms
38ms Image
image/jpeg 2607:f8b0:4006:80c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/8481278932046752674/downsize_200k_v1?sqp=4sqPyQR5QncIABIUDc3MzD4VAAAAQB0AAAAAJQAAAAAYACIKDQAAgD8VAACAPypPCFoQAR0AALRCIAEoATAGOANAgMLXL0gAUABYAGBacAJ4AIABAIgBAJABAJ0BAACAP6ABAKgBALABgK3iBLgB____________AcUBLbKdPg&rs=AOga4qkz1j3bLgUz5fO2xQIcvax7LYbGZg

Requested by

Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a24811582ae5fcdc525a5238db02725522c69b0dd30d0210c5f7b3fb47a9517c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:39:18 GMT
x-content-type-options: nosniff
age: 342157
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9916
x-xss-protection: 0
last-modified: Wed, 22 Dec 2021 23:21:17 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 10 Feb 2023 15:39:18 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame BF60 0
0 146ms
131ms Image
text/html 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=Cmm7DMWoKYqGPGebwzgWI6ZfoBbjAuKFohK3DztAP29keEAEg4pn9D2B9oAHp_fXPA8gBBuACAKgDAcgDCqoEngJP0KyXvi1pBH4HGkeGwobIztuUxM0bQt-Y0UpAHDNyyMpgeShqgG0xwXbBWES7l4TVPMvey-b1W6R8qplADpLVY6gRzGQfJlp0kIpJOOyny5tI8mXkBjahvz0Fp2yX0L6tM2twQXmttr2tuUjUxYUFlhvuADHRi3-xRnvU_6I0oqlcsW23S3evafds9qbl0MAuERRyOhvsHL0YNwmJYWMGHMBsjmxhC_pRXLojVjlr9JgrdB_ab8DrYdtSuRMV5VTm27WolUWUhkrTxHxm2hzQvsM20J8vU6gz6FPLPE2fZxc8Jk_HDQ_t-TMSJzRWAzMbSFfJdYxvQax0PFtTY_0l6OUqXkPOKbN2aIu6-ud0NYFkJcaickCzltEF-VUZwASL09-R6gPgBAGSBQQIBBgBkgUECAUYBKAGN4AHgbef0wGoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G9gHAfIHBBCniwrSCAcIiGEQARgdgAoDyAsB2BMMiBQB0BUBgBcBshceChwIABIUcHViLTU2MTEwNTM2NjI2MTMzOTAYzfUR&sigh=aewlDp_OzOw&uach_m=[UACH]&template_id=492
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.40.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga25s80-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

GET
H3 204 l
www.google.com/ads/measurement/ Frame BF60 0
0 81ms
66ms Image
text/html 2607:f8b0:4006:823::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSdc9YQ_2kWosCQ7pTMnXB3IWeJmVCAGTBlBNAg07orPER0O8Z062S4f72nrCzaBFn0YKDKzUGPuXKA82rxUrG-iGGSSA
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:823::2004 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

GET
H2 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame BF60 2 KB
3 KB 437ms
11ms Image
image/png 2607:f8b0:4006:80c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 17:24:30 GMT
x-content-type-options: nosniff
server: cafe
age: 76645
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 14819457070020093239
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Mon, 14 Feb 2022 17:24:30 GMT

GET
H2 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame BF60 295 B
399 B 437ms
12ms Image
image/png 2607:f8b0:4006:80c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 00:17:40 GMT
x-content-type-options: nosniff
server: cafe
age: 51855
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 426692510519060060
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Tue, 15 Feb 2022 00:17:40 GMT

GET
H2

200

match Show response
c1.adform.net/serving/cookie/ Frame 7081
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&cid=F821B65A-E9C3-4E67-BB4B-F972CC37748C
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=F821B65A-E9C3-4E67-BB4B-F972CC37748C

35 B
468 B

29ms
18ms

Document
image/gif

185.167.164.37
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=F821B65A-E9C3-4E67-BB4B-F972CC37748C

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3DPM_UID%26ex%3Dpubmatic.com&userIdMacro=PM_UID

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.167.164.37 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Mon, 14 Feb 2022 14:41:55 GMT
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate, no-transform
pragma: no-cache
expires: -1
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
strict-transport-security: max-age=31536000; includeSubDomains

Redirect headers

server: nginx
date: Mon, 14 Feb 2022 14:41:55 GMT
content-length: 0
location: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=F821B65A-E9C3-4E67-BB4B-F972CC37748C
cache-control: no-cache, no-store, must-revalidate, no-transform
pragma: no-cache
expires: -1
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 3325
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YgpqMgAGHgJiRgAy&gdpr=0&gdpr_consent=

1 B
547 B

303ms
86ms

Document
text/html

104.36.113.107
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YgpqMgAGHgJiRgAy&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3DPM_UID%26ex%3Dpubmatic.com&userIdMacro=PM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.113.107 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

server: nginx
date: Mon, 14 Feb 2022 14:41:54 GMT
content-type: text/html; charset=utf-8
content-length: 1
x-lat: sfopug019:0:390
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: no-store, no-cache, private

Redirect headers

server: Varnish
retry-after: 0
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YgpqMgAGHgJiRgAy&gdpr=0&gdpr_consent=
accept-ranges: bytes
date: Mon, 14 Feb 2022 14:41:55 GMT
via: 1.1 varnish
x-served-by: cache-yul12834-YUL
x-cache: HIT
x-cache-hits: 0
x-timer: S1644849715.250177,VS0,VE0
cache-control: no-cache
pragma: no-cache
content-length: 0

GET
H/1.1 200
OK ecm3 Show response
s.amazon-adsystem.com/ Frame 4093 43 B
556 B 34ms
32ms Document
image/gif 209.54.180.3
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?id=F821B65A-E9C3-4E67-BB4B-F972CC37748C&ex=pubmatic.com

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.180.3 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/

Response headers

Server: Server
Date: Mon, 14 Feb 2022 14:41:55 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
x-amz-rid: Q1PNS6GN451DNZJX9TS0
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Permissions-Policy: interest-cohort=()

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 3933
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=-CG2WunDTme7S_lyzDd0jA%3D%3D
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=

15 KB
15 KB

64ms
34ms

Image
text/html

23.52.161.180
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3DPM_UID%26ex%3Dpubmatic.com&userIdMacro=PM_UID
Protocol: H2
Server: 23.52.161.180 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-52-161-180.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:55 GMT
content-encoding: gzip
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
server: Apache/2.2.15 (CentOS)
etag: "1300708-3de4-5d6ef246ef4cf"
vary: Accept-Encoding
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=109418
accept-ranges: bytes
content-type: text/html; charset=UTF-8
content-length: 5549
expires: Tue, 15 Feb 2022 21:05:33 GMT

Redirect headers

pragma: no-cache
date: Mon, 14 Feb 2022 14:41:55 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 272
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

px
p.adsymptotic.com/d/ Frame 3933
Redirect Chain

https://idsync.rlcdn.com/420486.gif?partner_uid=F821B65A-E9C3-4E67-BB4B-F972CC37748C
https://pippio.com/api/sync?pid=5324&it=1&iv=fa3e0846cfeb4db2f758ad78d8643b5ca133b87d645aa7ba53830631f9278015791426b5417dce21&_=2
https://p.adsymptotic.com/d/px?_pid=13553&_psign=9e62e5c043ecadc9479a0ccac401dd7d

43 B
97 B

50ms
49ms

Image
image/gif

104.18.98.194
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.adsymptotic.com/d/px?_pid=13553&_psign=9e62e5c043ecadc9479a0ccac401dd7d
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3DPM_UID%26ex%3Dpubmatic.com&userIdMacro=PM_UID
Protocol: H2
Server: 104.18.98.194 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:55 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 6dd70f63296ecacc-YYZ
p3p: CP='NON DSP COR CONi OUR BUS CNT'
content-type: image/gif
content-length: 43

Redirect headers

date: Mon, 14 Feb 2022 14:41:55 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://p.adsymptotic.com/d/px?_pid=13553&_psign=9e62e5c043ecadc9479a0ccac401dd7d
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: clear
content-length: 0

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame 3933
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=b8e2620a-6a33-4d00-8981-0409f94f7352

0
261 B

81ms
29ms

Image
text/plain

8.28.7.84
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=b8e2620a-6a33-4d00-8981-0409f94f7352
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3DPM_UID%26ex%3Dpubmatic.com&userIdMacro=PM_UID
Protocol: H2
Server: 8.28.7.84 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:53 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date: Mon, 14 Feb 2022 14:41:55 GMT
Server: MT3 4133 baa842e master ord-pixel-x22 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=b8e2620a-6a33-4d00-8981-0409f94f7352
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Mon, 14 Feb 2022 14:41:54 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 3933
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=RjgyMUI2NUEtRTlDMy00RTY3LUJCNEItRjk3MkNDMzc3NDhD&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

42 B
111 B

122ms
24ms

Image
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3DPM_UID%26ex%3Dpubmatic.com&userIdMacro=PM_UID
Protocol: H2
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:55 GMT
cache-control: no-store, no-cache, private
x-lat: njrpug011:0:3475
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Mon, 14 Feb 2022 14:41:55 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 3933
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEFWtj5GUgon5KZmlmrVp4og&google_cver=1

42 B
592 B

121ms
23ms

Image
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEFWtj5GUgon5KZmlmrVp4og&google_cver=1
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3DPM_UID%26ex%3Dpubmatic.com&userIdMacro=PM_UID
Protocol: H2
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:55 GMT
cache-control: no-store, no-cache, private
x-lat: njrpug010:0:3234
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Mon, 14 Feb 2022 14:41:55 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEFWtj5GUgon5KZmlmrVp4og&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 379
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 3933
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:942897D38EDA4012AFD570B96A4D99AA

42 B
225 B

22ms
20ms

Image
image/gif

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:942897D38EDA4012AFD570B96A4D99AA
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3DPM_UID%26ex%3Dpubmatic.com&userIdMacro=PM_UID
Protocol: H2
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:55 GMT
cache-control: no-store, no-cache, private
x-lat: njrpug013:0:747
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

date: Mon, 14 Feb 2022 14:41:55 GMT
x-content-type-options: nosniff
server: nginx
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:942897D38EDA4012AFD570B96A4D99AA
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 138
expires: Sun, 13 Feb 2022 14:41:55 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 3933
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=3691721727429404894&gdpr=0&gdpr_consent=&us_privacy=

1 B
324 B

86ms
85ms

Image
text/html

104.36.113.107
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=3691721727429404894&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3DPM_UID%26ex%3Dpubmatic.com&userIdMacro=PM_UID
Protocol: H2
Server: 104.36.113.107 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 09:36:24 GMT
cache-control: no-store, no-cache, private
x-lat: sfopug024:0:644
server: nginx
content-type: text/html; charset=utf-8
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=3691721727429404894&gdpr=0&gdpr_consent=&us_privacy=
pragma: no-cache
date: Mon, 14 Feb 2022 14:41:54 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 3933
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=c2da4108-b919-40cc-a8d8-9255d4db5b3e

42 B
311 B

173ms
87ms

Image
image/gif

104.36.113.107
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=c2da4108-b919-40cc-a8d8-9255d4db5b3e
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3DPM_UID%26ex%3Dpubmatic.com&userIdMacro=PM_UID
Protocol: H2
Server: 104.36.113.107 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:54 GMT
cache-control: no-store, no-cache, private
x-lat: sfopug006:0:697
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Mon, 14 Feb 2022 14:41:55 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=c2da4108-b919-40cc-a8d8-9255d4db5b3e
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 313

GET
DATA 200
OK truncated
/ Frame BF60 209 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 896afed5377d5c6cdcafe98bc6c7b28d9d1b48bd7ce218a7ddb70fb4666b8dea

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ Frame BF60 15 KB
15 KB 59ms
22ms Font
font/woff2 2607:f8b0:4006:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300|Roboto:400,500&lang=en

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2003 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 14:35:30 GMT
x-content-type-options: nosniff
age: 518785
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 08 Feb 2023 14:35:30 GMT

GET
H3 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame BF60 16 KB
16 KB 57ms
24ms Font
font/woff2 2607:f8b0:4006:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300|Roboto:400,500&lang=en

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2003 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Wed, 09 Feb 2022 19:45:15 GMT
x-content-type-options: nosniff
age: 413800
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:21 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 09 Feb 2023 19:45:15 GMT

GET
H2 200 jload Show response
pixel.adsafeprotected.com/ Frame 1D33 47 KB
14 KB 162ms
52ms Script
application/javascript 52.44.16.134
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.adsafeprotected.com/jload?anId=928934&campId=5x5&pubId=4811995650&chanId=21809871911&placementId=5900230719&pubCreative=138379291044&pubOrder=2975178441&cb=472998217&custom=index&custom2=1&adsafe_par&impId=3f2c8dd4-8da4-11ec-a4ac-022945e664bf
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.44.16.134 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-44-16-134.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 47aaa888ff9ed9b1a14a203b0a6fbc4d92b35dfeb6bed53d009972153c3df6a1

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Feb 2022 14:41:55 GMT
content-encoding: gzip
x-server-name: app19.va.303net.net
content-type: application/javascript;charset=utf-8
access-control-allow-origin: pixel.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame AC46 0
0 178ms
117ms Fetch
image/gif 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvdJtdTtdljLKJykAuFdctrhprCv7KY_gPKJwMcwFvFSHy8O6_kb0gpMkjKTT7XVmtrhufk780J-HkIVuSyFd5c3siupYKQCKIfghy9peLU6a-5DJM9ZdIDqKibiotYOOQaVulDqSOZ-cVC8wsw9mRWS5D0r9cVlxZE4lklPSFbcOpbgTxbC_TcyEZRFCfknJHKy74F4K_7sjFfxSOha9mBmXoeVHroIb2CTDLbh3_zvR-Dk6yZEjqTK71_oKXh2So2O09-D2JiiPu0PigtsCNgsG3jE01yjhNokFUTputBsLe79tpRPIPxz1LwFs2Vmc-b8z_a9Pqsu8qbOTU852uSGM02mCAWjYO39WwvCmsc5VnBxBWW1rqzyzh8Eg&sai=AMfl-YT-9DKpjJMyFTtcm-1cXHqZmJnRs4NL_gFXDj1dCcnHMSqIVxEcCZR8klVTBv_e--ttaLALqgKruWG_PDhqUdu_svlAB8LceFRNlXiWqbFRo5vfnDtbYoANSR1lLggh&sig=Cg0ArKJSzHDcVkxmZr8xEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s80-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 14 Feb 2022 14:41:55 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 11059141 Show response
ib.3lift.com/dtj/Promoted_By_Desktop/ Frame AC46 6 KB
3 KB 184ms
16ms Script
application/javascript 99.84.125.69
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ib.3lift.com/dtj/Promoted_By_Desktop/11059141?ct=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjssWTLpJAKa8TDZ0-iwt8aGYcRmfuHcttJ5bYsSHmL-BMf2SYK9TCT-CKJO_C4obO3GmoWxw3E0R9gMKXgSDqG_Xm8m6oVpiTVBfjjx9GWL7wKpMeEdnvbVpxp4OcX8ZnO0-oiyOrPYDjfyCMkEdkOS_AaFgbUIC8r0ORUkXZER9gY7eY3vK9tIlY2ZU_oi-TCubIW4DPQX5sVOCUfev252DpwkbpI5VpFPlXOTzrhPVI2AVInJO53YAE3ZGiuPtl-F8HcG9mDd3FIBdvKZup9Z05LKOHwjsk2TOfn8pizfP6OhVoQD9oTN90fdqh6lnuILVgNc4iCU8H7_R0j1Jf5KRKHME5ibA89ge0qINS0NhxEwwvRzZKcfkhA%2526sai%253DAMfl-YTeunGIUgbKnSx0s3jSISGPUOpqpXRwHrsD9khNfle5sxMesUaw5MAl0ZVa4mVP4826ES3AIbZ5tJXikUliz7QEXCxZJppBkgfU8ykpdnqApbgNR3pJJsX3ApTc31Qj%2526sig%253DCg0ArKJSzHH74DKM-b3_EAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020901.js?31064847
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.125.69 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-125-69.ewr52.r.cloudfront.net
Software: /
Resource Hash: 28ccdeaf1c5104e943728d922b8734153f7e57bd6762b4c7b28eec454cccd86b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:34:13 GMT
via: 1.1 25b4c4372feadf7e1722c01c8c9eeea0.cloudfront.net (CloudFront)
age: 638
etag: "0fcb964ba406624ed46b17b8540833c8"
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=900
x-amz-cf-pop: EWR52-C3
content-encoding: gzip
content-length: 2676
x-amz-cf-id: oFPHLplWecbKnI405stCK9Han7fEw4JTOQUOUCMN1tlC13sJ48jRRw==

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame AC46 124 KB
38 KB 206ms
38ms Script
text/javascript 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020901.js?31064847

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

096ebe5196b95f66c1c0b9f3dcea9e6e3f40f2d55cd5933af5e4942adb232593

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38562
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1644410386637351"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 14 Feb 2022 14:41:55 GMT

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012201141909000/ Frame D2CC 220 KB
60 KB 95ms
59ms Script
text/javascript 2607:f8b0:4006:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012201141909000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020901.js?31064847

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d8ade0d94aaf4b3d52776b75609e8d1c31995677a0a033a6fa2408425da07740

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 33593
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 61542
x-xss-protection: 0
server: sffe
date: Mon, 14 Feb 2022 05:22:02 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "00d9ef7efeb287da"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 14 Feb 2023 05:22:02 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012201141909000/v0/ Frame D2CC 16 KB
6 KB 93ms
69ms Script
text/javascript 2607:f8b0:4006:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012201141909000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020901.js?31064847

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cb696ecd7c4f31fdd7c7c1cc37e8efc29614fbcbadf74f455aa496d72ce33250

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 33593
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5698
x-xss-protection: 0
server: sffe
date: Mon, 14 Feb 2022 05:22:02 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "919adc590e0ff503"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 14 Feb 2023 05:22:02 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012201141909000/v0/ Frame D2CC 96 KB
29 KB 96ms
73ms Script
text/javascript 2607:f8b0:4006:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012201141909000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020901.js?31064847

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc83fe6d180fd859f448bacd040799bf379ee7e0d9b1e6c3f19499c1c4358864

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 33593
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29570
x-xss-protection: 0
server: sffe
date: Mon, 14 Feb 2022 05:22:02 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "c52208c2e07002d5"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 14 Feb 2023 05:22:02 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012201141909000/v0/ Frame D2CC 5 KB
2 KB 98ms
74ms Script
text/javascript 2607:f8b0:4006:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012201141909000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020901.js?31064847

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ea29de07cdb14f2c6c59c06fdcd4ec30c2030b3ba8ee6a0aa325085496b9a94d

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 33593
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1851
x-xss-protection: 0
server: sffe
date: Mon, 14 Feb 2022 05:22:02 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "76a8c96b6aaec2c9"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 14 Feb 2023 05:22:02 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012201141909000/v0/ Frame D2CC 42 KB
13 KB 98ms
75ms Script
text/javascript 2607:f8b0:4006:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012201141909000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020901.js?31064847

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a7d040d5e84706dac2d471ad33830bd0ae361ca06e53e72e817701478c6d5afa

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 33593
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13611
x-xss-protection: 0
server: sffe
date: Mon, 14 Feb 2022 05:22:02 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "7aefe3fe93cc7383"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 14 Feb 2023 05:22:02 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame D2CC 6 KB
669 B 85ms
69ms Stylesheet
text/css 2607:f8b0:4006:822::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:300|Roboto:400,500&lang=en

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020901.js?31064847

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::200a Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2ddefcdc9f260c5ffeb93fed110fe9d929028226f9a2d8a4934ea52b546e9640

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 14 Feb 2022 13:24:50 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 14 Feb 2022 14:41:55 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 14 Feb 2022 14:41:55 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame D2CC 4 KB
618 B 85ms
69ms Stylesheet
text/css 2607:f8b0:4006:822::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,500&text=

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020901.js?31064847

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::200a Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2e8fa2037c41372ddc72ea1e08a477ba37998b54b5416b8cff0554fa5b865e27

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 14 Feb 2022 13:14:22 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 14 Feb 2022 14:41:55 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 14 Feb 2022 14:41:55 GMT

GET
H2 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/14343191523858671001/ Frame D2CC 31 KB
31 KB 53ms
31ms Image
image/jpeg 2607:f8b0:4006:80c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020901.js?31064847

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

717dea50e50cd77ec4227232d4b4d28ca1f1ae85dd9e7afce28cd77dcccc0fee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 11 Feb 2022 13:32:36 GMT
x-content-type-options: nosniff
age: 263359
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31323
x-xss-protection: 0
last-modified: Wed, 22 Dec 2021 23:21:17 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 11 Feb 2023 13:32:36 GMT

GET
H2 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/8481278932046752674/ Frame D2CC 10 KB
10 KB 67ms
44ms Image
image/jpeg 2607:f8b0:4006:80c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020901.js?31064847

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a24811582ae5fcdc525a5238db02725522c69b0dd30d0210c5f7b3fb47a9517c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:39:18 GMT
x-content-type-options: nosniff
age: 342157
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9916
x-xss-protection: 0
last-modified: Wed, 22 Dec 2021 23:21:17 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 10 Feb 2023 15:39:18 GMT

GET
H2 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame D2CC 2 KB
3 KB 69ms
47ms Image
image/png 2607:f8b0:4006:80c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020901.js?31064847

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 17:24:30 GMT
x-content-type-options: nosniff
server: cafe
age: 76645
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 14819457070020093239
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Mon, 14 Feb 2022 17:24:30 GMT

GET
H2 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame D2CC 295 B
353 B 70ms
48ms Image
image/png 2607:f8b0:4006:80c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020901.js?31064847

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 00:17:40 GMT
x-content-type-options: nosniff
server: cafe
age: 51855
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 426692510519060060
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Tue, 15 Feb 2022 00:17:40 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame D2CC 0
0 145ms
130ms Image
text/html 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C8AqLMWoKYqKPGebwzgWI6ZfoBbjAuKFohK3DztAP29keEAEg4pn9D2B9oAHp_fXPA8gBBuACAKgDAcgDCqoEoQJP0FYUSvgM5gFGrzv_X19wglfiskgnWOF919vhNG5gPzwaTZZzWSj4jiK-yLj-RGcgluGbSUok7C7z7beWeW7YCB9l9TgddFW5BTLZRIQkBIHjxPinA3-RH2HgyY_B45JLAKLvlVojth6LQ500mP2PXFY8B1BKIXKDlejldOXn-PCq8onqGVACGGw160AUI2Bo72Uwppab89vsra5FOU6M7O7YgtSgoBXM_Yqve95TRuAbw7iiRzuao_RozviAc0WPM3LVJblBqiO-Eq5liO9W8pES41QpI4ve5t-hX1jaRF_YjCpG7aPDFABq6FpUHU8eneJmYqLVQEx9UAAUR82Y3_i1R1NNnTqAdBMgC6YdG9y6Ex4VGoDTeSS2agCCFee1wASL09-R6gPgBAGSBQQIBBgBkgUECAUYBKAGN4AHgbef0wGoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G9gHAfIHBBCniwrSCAcIiGEQARgdgAoDyAsB2BMMiBQB0BUBgBcBshceChwIABIUcHViLTU2MTEwNTM2NjI2MTMzOTAYzfUR&sigh=HiembON4L44&uach_m=[UACH]&template_id=492
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.40.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga25s80-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

GET
H3 204 l
www.google.com/ads/measurement/ Frame D2CC 0
0 86ms
71ms Image
text/html 2607:f8b0:4006:823::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRu90kzDEOAvimIWU5TObIf4ocDsb6c3wbO7LG7GcN3NSFt1KY6a7SxyYZ_B2QGxED8n6kBth24MG5ipySNPCz1mgUrfw
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:823::2004 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

POST
H3 204 csi
csi.gstatic.com/ 0
17 B 154ms
82ms Ping
image/gif 2607:f8b0:4001:c15::78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&top=1&puid=2~kzmt1tg4&c=2001621828581984&e=31064847%2C31061691%2C31061693&ctx=1&met.3=808.2yc~598.2yc~598.2yc~52.2yc~705.2yc~808.2yd~598.2yd~598.2yd~52.2yd~705.2yd~808.2yd~598.2yd~598.2yd~52.2yd~705.2yd~808.2yd~598.2yd~598.2yd~52.2yd~705.2yd~808.2yd~598.2yd~598.2yd~52.2yd~705.2yd~808.2yd~598.2yd~598.2yd~52.2yd~705.2yd~808.2yd~598.2yd~598.2yd~52.2yd~705.2yd~808.2yd~598.2yd~598.2yd~52.2yd~705.2yd~808.2yd~598.2yd~598.2yd~52.2yd~705.2yd~808.2yd~598.2yd~598.2yd~52.2yd~705.2yd~808.2yd~598.2yd~598.2yd~52.2yd~705.2yd~808.2yd~598.2yd~598.2yd~52.2yd~705.2yd~808.2yd~598.2yd~598.2yd~52.2yd~705.2yd~808.2ye~598.2ye~598.2ye~52.2ye~705.2ye~808.2ye~598.2ye~598.2ye~52.2ye~705.2ye~808.2ye~598.2ye~705.2ye~808.2ye~598.2ye~705.2ye~808.2ye~598.2ye~705.2ye~808.2ye~598.2ye~705.2ye~808.2ye~598.2ye~705.2ye~808.2yf~598.2yf~705.2yf~808.2yf~598.2yf~705.2yf~808.2yf~598.2yf~705.2yf~808.2yf~598.2yf~705.2yf~808.2yf~598.2yf~705.2yf~808.2yf~598.2yf~705.2yf~808.2yf~598.2yf~705.2yf~808.2yf~598.2yf~705.2yf~808.2yf~598.2yf~705.2yf~808.2yf~598.2yf~705.2yf~808.2yf~598.2yf~705.2yf~808.2yf~598.2yf~705.2yf~808.2yf~598.2yf~705.2yf~646.47v_1~800.47x~800.47x~800.483~800.483~800.483~598.483~709.483~598.487~709.487~291.496~653.49d_b~801.49o~825.49s~801.49s~355.49s~825.49s~708.49t~825.49v~598.49w~598.49w~598.49w~598.49w~598.49w~598.49w~598.49w~598.49w~598.49w~579.49w~597.49w~598.49w~579.49w~597.49w~355.49w~708.49w_1~598.49w~54.49w~708.49w~863.49y~680.49y~646.4ad~646.4ae~646.4ae~646.4af~646.4af~646.4af~800.4ah~800.4ah~800.4ah~800.4ah~800.4ah~800.4ah~800.4ah~800.4ah~800.4ah~800.4ah~800.4ah~800.4ah~800.4d2_1~800.4d4~800.4d4~800.4d4~800.4d4~800.4d4~800.4d4~800.4d5~800.4d5~800.4d5~800.4d5~800.4d5~800.4d6~800.4d6~800.4d6~800.4d6~800.4d7~800.4d7~598.4d7~709.4d7~598.4d9~709.4d9~598.4da~709.4da~598.4dc~709.4dc~598.4dd~709.4dd~598.4de~709.4de~801.4df~825.4df~598.4df~709.4df~598.4df~709.4df~598.4df~709.4df~598.4df~709.4df~598.4df~709.4df~598.4df~709.4df~801.4dn~355.4dn_2~825.4dn_2~708.4dt~708.4du~598.4du~54.4du~708.4du~291.4i3~291.4i3~291.4i3~653.4i8_z~801.4j7~825.4j7~801.4j9~355.4j9~825.4j9~708.4j9~825.4j9~598.4j9~598.4j9~598.4j9~598.4j9~598.4j9~598.4j9~598.4j9~598.4j9~598.4j9~579.4j9~597.4ja~598.4ja~579.4ja~597.4ja~355.4ja~708.4j9~598.4ja~54.4ja~708.4ja~291.4ja~653.4jd_9~801.4jm~825.4jn~801.4jn~355.4jn~825.4jn~708.4jn~825.4jo~598.4jo~598.4jo~598.4jo~598.4jo~598.4jo~598.4jo~598.4jo~598.4jo~598.4jo~579.4jo~597.4jo~598.4jo~579.4jo~597.4jo~355.4jo~708.4jo~598.4jo~54.4jo~708.4jo~291.4jp~646.4jq~646.4jq~646.4jr~646.4jr~800.4js~800.4js~800.4js~800.4js~800.4js~800.4js~800.4js~800.4js~800.4lx~800.4ly~800.4ly~800.4ly~800.4ly~800.4ly~800.4ly~800.4ly~800.4ly~800.4ly~800.4lz~800.4lz~598.4lz~709.4lz~598.4m0~709.4m0~598.4m1~709.4m1~598.4m2~709.4m2~801.4m3~825.4m3~801.4m3~825.4m3~598.4m3~709.4m3~598.4m3~709.4m3~598.4m3~709.4m3&met.9=7_19.0~7_20.0~7_21.0~7_22.0~7_23.0~7_24.0~7_25.0~7_26.0~7_27.0~7_28.0~7_29.0~7_30.0~7_31.0~7_32.0~7_33.0~7_34.0~7_35.0~7_36.0~4_19.47v~5_19.497~5_25.4de~5_21.4i4~5_20.4ja~5_27.4m0~5_29.4m2&met.7=CBsQCMAB0Yv6nAg~CDsQBxgBIM4IKM4IMNAJOIIBQNIISNYIUNYIWJQJYOkIaJQJcMAJeMnWAYABndQBiAHGggWwAQG4AQPAAeLN6pYJ~CBsQByDQCDhfwAGH0_WlDQ~CBsQByDRCDhxwAGe0_6yDQ~CBsQByDRCDhTwAHU_7-YCw~CBIQBxgBINEIKNEIMMAJOG9A1AhI1ghQ1ghYjglg6Ahojglwvwl4-QeAAc0FiAGtNKoBJgoUUm9ib3RvK0NvbmRlbnNlZDo3MDAKDlJvYm90bzo0MDAsNzAwsAEBuAEDwAHWx7vICg~CBsQCiDVCDi6AcAB6__R-Q8~CBsQCiDhCDhRwAHJ4s2LAw~CBsQByDiCDhuwAG6oJ6dDA~CBsQByDiCDhvwAHM9bCtCQ~CBsQBiDvCDhzwAH427HLDw~CBsQBiDvCDiwAcAB5avZ4A0~CBsQBiDwCDh6wAGB8NqtCg~CBsQBiD6CDhywAHrmISkCQ~CBsQBiD6CDhzwAHB4-L3Dw~CBsQCiD6CDh0wAHvyMHsAg~CBsQCiD6CDh6wAGK-72yBw~CBMQAhgBII0KKI0KMOAKOFNQkQpYwgpgpApoxApw2gp4gH6AAdR7iAHUe6oBDAoGcm9ib3RvEB0YArABAbgBA8AB6tK8RA~CBMQAhgBII4KKI4KMN8LONEBaMQKcNsLeNh8gAGseogBrHqqARUKD3JvYm90b2NvbmRlbnNlZBAYGAKwAQG4AQPAAcaXye8H~CBMQAhgBII4KKI4KMO8KOGFoxApw4Ap49HyAAch6iAHIeqoBDAoGcm9ib3RvEB0YArABAbgBA8ABkqzw6AI~CBsQBSDYDThawAGNgv6PDw~CBsQChgBIPINKPINMOIPOPABwAHVntOmDA~CBsQCiDzDTitAcAB0Zihlwk~CBsQCiCmDjitAcABgIuqrQw~CBsQCiC3DjixAcABkd6VhgY~CA4QChgBINcOKNcOMN4POIcBaIEPcKMPeKO-B4AB97sHiAHIpxawAQG4AQPAAfKI1awM~CDwQDRgBIIUPKIUPMOkPOGVQiw9Yqw9giw9owA9w6A94oQOAAXWIAYIBsAEBuAEDwAHo1K_NCQ~CBsQDSCdDzhpwAHc16HUDA~CBsQDSCdDziaAcABg8KIygs~CBsQDSC0DzjQAcAB__Hq5go~CBsQCiCIEDhWwAGlte_EBQ~CBsQCiCJEDhvwAGEwJivAQ~CBsQCiCKEDhgwAHU4MnWBw~CBsQCiCMEDhfwAGT6aWLBg~CBsQCiCMEDhqwAG8ksfdDQ~CBsQCiCNEDhwwAH879e9AQ~CBsQCiCOEDhrwAHjt8u0Ag~CBsQCiCOEDhvwAGxnrPTBQ~CBsQCiCPEDh0wAGCr-qxAg~CBsQBSCdEDigAcAB_tTTgA4~CBsQDSClEDjBAcABh4fq4wg~CBsQDSClEDikAcABh4fq4wg~CBsQBiDEEDhKwAGyuIL1BA~CBsQBiDHEDiAAcAByd-DgAM~CBsQBiDHEDiOAcABhPGyugs~CBsQBiDIEDinAcAB4JyXrQs~CBsQBiDIEDhbwAG0vrS7BQ~CBsQBiDJEDhbwAGpqqi2Ag~CBsQBiDJEDitAcAB7OeTvw8~CBsQBiDJEDiVAcABzO7OkwE~CBsQBiDJEDijAcABiKKHlAI~CBsQBiDJEDhuwAG64ZLTAg~CBsQDSD6ETiUAcAB7L7xrgc~CBsQDSChEzjvA8AB6KCHsQQ~CCgQChgBIKQTKKQTMOsTOEZoqRNwzxN40rYBgAGmtAGIAd3eA7ABAbgBA8ABm-H6cA~CBsQCiC_EziBAcABjJSRzQg~CBsQChgBIPoWKPoWMLgYOL8BQJsXSKAXUKAXWPEXYL4XaP0XcK8YeNB2gAGkdIgBs7YCsAEBuAEDwAHtvYS8Cw~CBsQCiCpFziCAcAB0eKixAg~CBsQCiCrFzhuwAH0sr-_BA~CBsQCiCyFziIAcABud-4tAs~CBsQDSC_GDirAcAB7L7xrgc~CBsQBiDkGDhQwAHV2LT9Dw~CC8QBxgBIPQaKPQaMPgbOIQBQPUaSPYaUPYaWKsbYIwbaLIbcPgbeJADgAFkiAFrsAEBuAEDwAHxkeiaCQ~CC8QBxgBIPUaKPUaMIccOJIBQPYaSPgaUPgaWNEbYI4baNsbcIYceJADgAFkiAFrsAEBuAEDwAGb_4nHBw~CBsQARgBIPQdKPQdMLIfOL4BwAGkoPylBw~CBsQBSDcGzgywAGUzKHYCg~CBsQBSDDHDgvwAH3hsWzBQ~CBsQBRgBIP4dKP4dMJgfOJkBQKIeSLMeULMeWOgeYMgeaOkecJEfeNAagAGkGIgBzi-wAQG4AQPAAYSa28AI~CBsQCiD1HjiQAsAB8_WNtwo~CBsQCiCTHzioAcABlrXf4AQ~CCgQChgBIJgfKJgfMMIhOKoCQKMfSKYfUKYfWPYfYLwfaNAgcMIheLsKgAGPCIgB1RGwAQG4AQPAAY-KkNEO~CBsQChgBINkfKNkfMMshOPIBUIggWJEhYJEgaJwhcMkheIIMgAHWCYgBuQ-wAQG4AQPAAeP9lu8B~CBsQBiCdIDjPAsABmsul_gQ~CBsQCiCcIDjRAsAB7LKQ_Q4~CBsQBiDZIjizAcAB7tP9mwo~CBsQBiDYIjjVAsABsuTP-gs~CBsQBhgBINoiKNoiMN8lOIYDQNojSO8jUO8jWOckYIUkaIYlcN8leNYCgAEqiAEqsAEBuAEDwAHZsJX5AQ~CBsQBhgBINoiKNoiMOElOIcDQNojSO4jUO4jWOgkYIUkaIYlcOAleNYCgAEqiAEqsAEBuAEDwAHchJORBQ~CCgQBhgBII4jKJ4oMP8oOPEFUKEoWL8oYKEoaMAocPQoeNYCgAEqiAEqkAGOI5gBgSewAQG4AQPAAc6W7eQK&qqid.1=COHrgde2__UCFWa4swodiPQFXQ&qqid.2=COLrgde2__UCFWa4swodiPQFXQ&qqid.3=CJLP-9a2__UCFWa4swodiPQFXQ&qqid.4=COTrgde2__UCFWa4swodiPQFXQ&qqid.5=CJTP-9a2__UCFWa4swodiPQFXQ&qqid.6=CJXP-9a2__UCFWa4swodiPQFXQ&qqid.7=CJbP-9a2__UCFWa4swodiPQFXQ&qqid.8=COjrgde2__UCFWa4swodiPQFXQ&qqid.9=CJjP-9a2__UCFWa4swodiPQFXQ&qqid.10=COrrgde2__UCFWa4swodiPQFXQ&qqid.11=CJrP-9a2__UCFWa4swodiPQFXQ
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4001:c15::78 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Feb 2022 14:41:55 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame D2CC 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 17341481438e0354f5ed4ac607f6d2fea8765db44b6e2e4beee68028f464fc5a

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ Frame D2CC 15 KB
15 KB 22ms
21ms Font
font/woff2 2607:f8b0:4006:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300|Roboto:400,500&lang=en

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2003 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 14:35:30 GMT
x-content-type-options: nosniff
age: 518785
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 08 Feb 2023 14:35:30 GMT

GET
H3 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame D2CC 16 KB
16 KB 37ms
36ms Font
font/woff2 2607:f8b0:4006:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300|Roboto:400,500&lang=en

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81d::2003 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Wed, 09 Feb 2022 19:45:15 GMT
x-content-type-options: nosniff
age: 413800
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:21 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 09 Feb 2023 19:45:15 GMT

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 1F12
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=a9us&khaos=KZMT1V8E-1O-5H7Z
https://s.amazon-adsystem.com/ecm3?id=KZMT1V8E-1O-5H7Z&ex=d-rubiconproject.com&status=ok

43 B
556 B

33ms
32ms

Image
image/gif

209.54.180.3
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=KZMT1V8E-1O-5H7Z&ex=d-rubiconproject.com&status=ok

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east

Protocol

HTTP/1.1

Server

209.54.180.3 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 14 Feb 2022 14:41:55 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: AVPG3D1QCR0RR2E8A6RR
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://s.amazon-adsystem.com/ecm3?id=KZMT1V8E-1O-5H7Z&ex=d-rubiconproject.com&status=ok
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 0228ab361cece0438ff9eb16e4e5890e
Expires: 0

GET
H/1.1 200
OK utsync.ashx Show response
ml314.com/ Frame A7E4 270 B
1 KB 34ms
34ms Script
application/javascript 54.85.224.115
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=748&ct=js&pi=&fp=&clid=&if=1&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fcdn.krxd.net%2Fpartnerjs%2Fxdi%2Fproxy.3d2100fd7107262ecb55ce6847f01fa5.html%23!kxcid%3Duthtxmddg%26kxt%3Dhttps%253A%252F%252Fgcp-cheet-4407-ontariofarmer.gdev.postmedia.digital%26kxcl%3Dcdn%26kxp%3D&pv=1644849715691_dc4soe10a&bl=en-us&cb=2489527&return=https%3A%2F%2Fml314.com%2Fcsync.ashx%3Ffp%3DOqYT0NbV%26person_id%3D%5BPersonID%5D%26eid%3D748%26return%3Dhttps%253A%252F%252Fbeacon.krxd.net%252Fusermatch.gif%253Fpartner%253Dmadisonlogic%2526partner_uid%253D%5BPersonID%5D&ht=&d=&dc=&si=1644849715691_dc4soe10a&cid=&s=1600x1200&rp=https%3A%2F%2Fgcp-cheet-4407-ontariofarmer.gdev.postmedia.digital%2F
Requested by: Host: ml314.com
URL: https://ml314.com/tag.aspx?1412022
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.85.224.115 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-85-224-115.compute-1.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 06633938cf75300c8d1ff455b59d19123ff4245bf7b49d01595df96c87498b8d

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.krxd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 14 Feb 2022 14:41:55 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Vary: Accept-Encoding
p3P: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
Cache-Control: private
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Content-Length: 335
Expires: 0

GET
H2 200 bundle.js Show response
ib.3lift.com/rev/e0fe24527bfcc9eed4763b29ecf9b752e4f172b0/dist/ Frame AC46 246 KB
79 KB 28ms
27ms Script
application/javascript 99.84.125.69
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ib.3lift.com/rev/e0fe24527bfcc9eed4763b29ecf9b752e4f172b0/dist/bundle.js
Requested by: Host: ib.3lift.com
URL: https://ib.3lift.com/dtj/Promoted_By_Desktop/11059141?ct=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjssWTLpJAKa8TDZ0-iwt8aGYcRmfuHcttJ5bYsSHmL-BMf2SYK9TCT-CKJO_C4obO3GmoWxw3E0R9gMKXgSDqG_Xm8m6oVpiTVBfjjx9GWL7wKpMeEdnvbVpxp4OcX8ZnO0-oiyOrPYDjfyCMkEdkOS_AaFgbUIC8r0ORUkXZER9gY7eY3vK9tIlY2ZU_oi-TCubIW4DPQX5sVOCUfev252DpwkbpI5VpFPlXOTzrhPVI2AVInJO53YAE3ZGiuPtl-F8HcG9mDd3FIBdvKZup9Z05LKOHwjsk2TOfn8pizfP6OhVoQD9oTN90fdqh6lnuILVgNc4iCU8H7_R0j1Jf5KRKHME5ibA89ge0qINS0NhxEwwvRzZKcfkhA%2526sai%253DAMfl-YTeunGIUgbKnSx0s3jSISGPUOpqpXRwHrsD9khNfle5sxMesUaw5MAl0ZVa4mVP4826ES3AIbZ5tJXikUliz7QEXCxZJppBkgfU8ykpdnqApbgNR3pJJsX3ApTc31Qj%2526sig%253DCg0ArKJSzHH74DKM-b3_EAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.125.69 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-125-69.ewr52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e2ed6f4144d1c12483676cbd0bbb32aa7b23d7b7f54709176c16c782ca668dfe

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 18 Jan 2022 20:38:56 GMT
content-encoding: gzip
last-modified: Tue, 18 Jan 2022 20:27:26 GMT
server: AmazonS3
age: 2311380
etag: "5c3d88435f7bf18aebb1be8c86371794"
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 25b4c4372feadf7e1722c01c8c9eeea0.cloudfront.net (CloudFront)
cache-control: max-age=31536000, immutable
x-amz-cf-pop: EWR52-C3
accept-ranges: bytes
content-length: 80392
x-amz-cf-id: Vpr42OB2tFQ2mnnBgCE-M1csIyZtkidgGCesPYQbCKc5L-4xiNIzGg==

GET
DATA 200
OK truncated
/ Frame AC46 207 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 863572474ec6b36dd0349e5b41b10992e39a208aabbe5af1e3a3ca1443ecb327

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 main.gr.19.8.285.js Show response
static.adsafeprotected.com/ Frame 1D33 43 B
293 B 80ms
17ms Script
image/gif 2600:9000:202c:de00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/main.gr.19.8.285.js
Requested by: Host: pixel.adsafeprotected.com
URL: https://pixel.adsafeprotected.com/jload?anId=928934&campId=5x5&pubId=4811995650&chanId=21809871911&placementId=5900230719&pubCreative=138379291044&pubOrder=2975178441&cb=472998217&custom=index&custom2=1&adsafe_par&impId=3f2c8dd4-8da4-11ec-a4ac-022945e664bf
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:202c:de00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 78a100131e7307c7f41d002b24b358c9ee7f690a16b73938ae787e9769e08ecc

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 15:03:20 GMT
via: 1.1 f912c5a5865a58aaaad9710240b6d2f2.cloudfront.net (CloudFront)
server: AmazonS3
age: 85114
x-cache: Hit from cloudfront
content-type: image/gif
location: /skeleton.js
x-amz-cf-pop: EWR52-C2
content-length: 43
x-amz-cf-id: 4hneplYHc6RjpfLBD9oEl7TRStgZaHh-Lr91Mmf9n9kBr_61Btvihw==

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 1F12
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEFLiJuMLeQLXrqWcz-muprw&google_cver=1

42 B
775 B

783ms
29ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEFLiJuMLeQLXrqWcz-muprw&google_cver=1
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 42
X-RPHost: e1bddfc34a927e97bda010c0d8a62b62
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Mon, 14 Feb 2022 14:41:55 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEFLiJuMLeQLXrqWcz-muprw&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 1F12
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=9&redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D4222%26nid%3D1512%26put%3D%5BMM_UUID%5D
https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=b0c1620a-6a33-4a00-8d09-8d3972873d75&expires=28

42 B
775 B

780ms
25ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=b0c1620a-6a33-4a00-8d09-8d3972873d75&expires=28
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 42
X-RPHost: 84e0f527cd81a00b0210e20b4ee7ed94
Content-Type: image/gif

Redirect headers

Date: Mon, 14 Feb 2022 14:41:55 GMT
Server: MT3 4133 baa842e master ord-pixel-x21 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=b0c1620a-6a33-4a00-8d09-8d3972873d75&expires=28
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Mon, 14 Feb 2022 14:41:54 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1F12
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ODBmNzRlMjBlMzFhZjBhMDA4OTQ4MDZkMjAzNGM2ODgxNjhiZTUwNQ

170 B
188 B

64ms
63ms

Image
image/png

142.251.32.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ODBmNzRlMjBlMzFhZjBhMDA4OTQ4MDZkMjAzNGM2ODgxNjhiZTUwNQ

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east

Protocol

Server

142.251.32.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Feb 2022 14:41:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ODBmNzRlMjBlMzFhZjBhMDA4OTQ4MDZkMjAzNGM2ODgxNjhiZTUwNQ
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 84e0f527cd81a00b0210e20b4ee7ed94
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1F12
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1pNVDFWOEUtMU8tNUg3Wg==

170 B
188 B

46ms
45ms

Image
image/png

142.251.32.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1pNVDFWOEUtMU8tNUg3Wg==

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east

Protocol

Server

142.251.32.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Feb 2022 14:41:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1pNVDFWOEUtMU8tNUg3Wg==
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 4f2e9ddc15e6cc2c3861f8e2683d2514
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 1F12
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D191940%26nid%3D3778%26put%3D%24%7BUSER_ID%7D
https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=YgpqMgAGHgJiRgAy

42 B
775 B

792ms
27ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=YgpqMgAGHgJiRgAy
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 42
X-RPHost: 9a0c641c0479142b55591fdf2031b15f
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Mon, 14 Feb 2022 14:41:55 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1644849716.954691,VS0,VE0
x-served-by: cache-yul12834-YUL
x-cache: HIT
location: https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=YgpqMgAGHgJiRgAy
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 1F12
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=c2da4108-b919-40cc-a8d8-9255d4db5b3e&gdpr=0&gdpr_consent=&expires=30

42 B
775 B

783ms
28ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=c2da4108-b919-40cc-a8d8-9255d4db5b3e&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 42
X-RPHost: 78008fe701b681dce86a72fc23cacc40
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Mon, 14 Feb 2022 14:41:55 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=c2da4108-b919-40cc-a8d8-9255d4db5b3e&gdpr=0&gdpr_consent=&expires=30
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 289

GET
H2

204

v1
ads.yahoo.com/cms/ Frame 1F12
Redirect Chain

https://token.rubiconproject.com/token?pid=26594
https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KZMT1V8E-1O-5H7Z&sigv=1&esig=2~55caa742bf18ebd3fb6ea70a65f0d3ec6d907920

0
194 B

550ms
31ms

Image
text/plain

2001:4998:14:800::1001
YAHOO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KZMT1V8E-1O-5H7Z&sigv=1&esig=2~55caa742bf18ebd3fb6ea70a65f0d3ec6d907920

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east

Protocol

Server

2001:4998:14:800::1001 , United States, ASN14777 (YAHOO, US),

Reverse DNS

Software

ATS /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:56 GMT
cache-control: no-store
x-content-type-options: nosniff
server: ATS
strict-transport-security: max-age=15552000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block

Redirect headers

Location: https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KZMT1V8E-1O-5H7Z&sigv=1&esig=2~55caa742bf18ebd3fb6ea70a65f0d3ec6d907920
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: d3682eda7e5cb79782b1d5475f50e8fc
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2 200 709414.gif
id.rlcdn.com/ Frame 1F12 42 B
300 B 43ms
41ms Image
image/gif 35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/709414.gif
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 14 Feb 2022 14:41:55 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

GET
H3

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame BF60
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
0

52ms
50ms

Image
text/html

2607:f8b0:4006:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: H3
Server: 2607:f8b0:4006:817::2002 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Redirect headers

date: Mon, 14 Feb 2022 14:41:55 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame D2CC
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
0

44ms
43ms

Image
text/html

2607:f8b0:4006:817::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: H3
Server: 2607:f8b0:4006:817::2002 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Redirect headers

date: Mon, 14 Feb 2022 14:41:56 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/14343191523858671001/ Frame D2CC 31 KB
31 KB 106ms
21ms Image
image/jpeg 2607:f8b0:4006:80c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012201141909000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

717dea50e50cd77ec4227232d4b4d28ca1f1ae85dd9e7afce28cd77dcccc0fee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 11 Feb 2022 13:32:36 GMT
x-content-type-options: nosniff
age: 263360
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31323
x-xss-protection: 0
last-modified: Wed, 22 Dec 2021 23:21:17 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 11 Feb 2023 13:32:36 GMT

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/8481278932046752674/ Frame D2CC 10 KB
10 KB 116ms
34ms Image
image/jpeg 2607:f8b0:4006:80c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012201141909000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a24811582ae5fcdc525a5238db02725522c69b0dd30d0210c5f7b3fb47a9517c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 15:39:18 GMT
x-content-type-options: nosniff
age: 342158
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9916
x-xss-protection: 0
last-modified: Wed, 22 Dec 2021 23:21:17 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 10 Feb 2023 15:39:18 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame D2CC 2 KB
2 KB 102ms
20ms Image
image/png 2607:f8b0:4006:80c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012201141909000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 17:24:30 GMT
x-content-type-options: nosniff
server: cafe
age: 76646
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 14819457070020093239
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Mon, 14 Feb 2022 17:24:30 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame D2CC 295 B
319 B 100ms
18ms Image
image/png 2607:f8b0:4006:80c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012201141909000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 00:17:40 GMT
x-content-type-options: nosniff
server: cafe
age: 51856
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 426692510519060060
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Tue, 15 Feb 2022 00:17:40 GMT

GET
H2

204

usermatch.gif
beacon.krxd.net/ Frame A7E4
Redirect Chain

https://ml314.com/csync.ashx?fp=OqYT0NbV&person_id=3625135823814918189&eid=748&return=https%3A%2F%2Fbeacon.krxd.net%2Fusermatch.gif%3Fpartner%3Dmadisonlogic%26partner_uid%3D3625135823814918189
https://beacon.krxd.net/usermatch.gif?partner=madisonlogic&partner_uid=3625135823814918189

0
337 B

26ms
25ms

Image
text/plain

52.22.124.154
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?partner=madisonlogic&partner_uid=3625135823814918189
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Server: 52.22.124.154 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-22-124-154.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.krxd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:56 GMT
cache-control: private, no-cache, no-store
x-request-time: D=45 t=1644849717
x-served-by: beacon-n020-ash-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Date: Mon, 14 Feb 2022 14:41:55 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: text/html; charset=utf-8
Location: https://beacon.krxd.net/usermatch.gif?partner=madisonlogic&partner_uid=3625135823814918189
Cache-Control: private
Connection: keep-alive
Content-Length: 211
Expires: Tue, 15 Feb 2022 09:41:56 GMT

GET
H2 200 adserving Show response
tlx.3lift.com/web/ Frame D319 1 KB
1 KB 656ms
29ms Script
application/javascript 34.228.175.203
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/web/adserving?inv_code=Promoted_By_Desktop&referrer=https%3A%2F%2Fgcp-cheet-4407-ontariofarmer.gdev.postmedia.digital%2F&rev=e0fe245&fe=0&ft=1&cb=5171092498&tid=11059141&n=1

Requested by

Host: ib.3lift.com
URL: https://ib.3lift.com/rev/e0fe24527bfcc9eed4763b29ecf9b752e4f172b0/dist/bundle.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.228.175.203 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-228-175-203.compute-1.amazonaws.com

Software

Resource Hash

f100912f8a6732f8d7d8680566430431d0cd951abba8843eb2095dc4e8d0aef9

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Feb 2022 14:41:56 GMT
content-encoding: gzip
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
cache-control: no-cache, no-store, must-revalidate
content-type: application/javascript; charset=utf-8
content-length: 638
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

GET
H2 200 optout_check Show response
beacon.krxd.net/ 82 B
241 B 23ms
23ms Script
text/javascript 52.22.124.154
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://beacon.krxd.net/optout_check?callback=Krux.ns.postmedia.kxjsonp_optOutCheck
Requested by: Host: cdn.krxd.net
URL: https://cdn.krxd.net/ctjs/controltag.js.a1705c5ac5f06cf0c202ff70908fc042
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.22.124.154 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-22-124-154.compute-1.amazonaws.com
Software: /
Resource Hash: 3fb015dbe0e42160bbce28c41584d2ad50cb77cb8ceda5288c7806fc1dfa158c

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:56 GMT
cache-control: private, max-age=0, s-max-age=0
x-request-time: D=46 t=1644849716
x-served-by: beacon-n030-ash-prod.krxd.net
content-type: text/javascript

GET
H2 200 get Show response
cdn.krxd.net/userdata/ 364 B
512 B 30ms
30ms Script
text/javascript 151.101.66.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.krxd.net/userdata/get?pub=42fb57ac-2013-45a6-8dad-332d53e17c1b&technographics=1&callback=Krux.ns.postmedia.kxjsonp_userdata
Requested by: Host: cdn.krxd.net
URL: https://cdn.krxd.net/ctjs/controltag.js.a1705c5ac5f06cf0c202ff70908fc042
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.66.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 893e568928ce7d0c6ad75198ebae881ff2b16c75a34fd5050892360edb95a0e5

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-cdn-backend: 4FrRTvEr9h480D4BywjehZ--F_userdata_ash_prod_krxd_net___UserData_Service_V2
date: Mon, 14 Feb 2022 14:41:56 GMT
content-encoding: gzip
age: 0
x-served-by: userdata-a018-ash-prod.krxd.net, cache-yul12829-YUL
vary: Accept-Encoding
x-cache: MISS, MISS
content-type: text/javascript
via: 1.1 varnish
cache-control: private, max-age=1800
x-age: 0
accept-ranges: bytes
x-timer: S1644849716.255794,VS0,VE20
content-length: 284
x-cache-hits: 0, 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame AC46 0
0 86ms
85ms Fetch
image/gif 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvNT6YHejb-kK09SgpD_YRjJEF-IzgSV4P08KZ-xMwKcQUNDAOBPtWjmUswaECjryzNcgOYMRQX_rERztx8UEfza0eHpIIhSDojkYGOVixjXc3jxxSkNQ7_CQ7BGtpO0qPlTwP5-civUpNVVyu4wAwdJ-65d4R6jqcpM3OSoyM-WJ7U7D5MUODKDQfdyZNNHw5lb94Ngteerm4hssPysWLX4jOyHhGxuRBbFERWI9O7XfQ7gfYSQEh9H8W0KKxIRme7Vh1u1NCvxj-i8zUV4kamzUDms5dUTJb-7fkoLaE9bKq3ttLTM6a9zOBi1FNYqjkH3MvahbRPokOCwSvV2c0fE3h83VuoFF9FUOY5-ShdqJ4FQW9G1-99yDjdcQtd&sai=AMfl-YSfOuHTWyInoSLJxVcXuxDaAVLVw6q6cEPF_gYvCIay9h2zsxkbi2FAybSS9hmSg12KoFKzuSMMC5WtBLM2ANOn7Q3ALzNAa0_ZAXQ9KDeOai6Wyd5crSXfR8Ge14xj&sig=Cg0ArKJSzK3f4l-yIgrjEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s80-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 14 Feb 2022 14:41:56 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Mon, 14 Feb 2022 14:41:56 GMT

GET
H3 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame AC46 60 KB
23 KB 22ms
20ms Script
text/javascript 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s80-in-f2.1e100.net

Software

cafe /

Resource Hash

0da1b7b795d8ed531c47ff870de07dfa167e2e7870be41c339bc05888c0c1900

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:09:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1940
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23078
x-xss-protection: 0
server: cafe
etag: 14764030400761178073
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Mon, 14 Feb 2022 15:09:36 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame BF60 0
17 B 78ms
78ms Ping
image/gif 2607:f8b0:4001:c15::78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?s=ampad&ctx=2&puid=1~1644849716347&c=2001621828581984&qqid=COHrgde2__UCFWa4swodiPQFXQ&rt=any.link.9.ft.30.v.9w.a.1bpu.1bhi~any.script.9.dw.2.1x.0.0.4mm.4ea~any.script.a.ey.13.1z.0.0.n1q.mte~any.script.a.e3.1.25.0.0.1nr.1ff~any.script.b.e5.3.26.0.0.aqf.ai3~any.link.b.3e.7.1c.z.0.q5.ht~any.link.b.3e.6.1c.0.0.oq.ge~any.img.f.da.p.y.9n.5.oef.o63~any.img.g.db.2.1n.0.0.7vs.7ng~any.img.h.4k.50.0.0.0.0.0~any.img.h.2m.33.0.0.0.0.0~any.img.h.ci.1.w.0.0.25u.1xi~any.img.i.ci.1.x.0.0.gj.87~any.css.75.20.d.m.10.0.cc4.c3s~any.css.76.1x.9.o.0.0.cik.ca8~any.img.us.1g.w9.0.0.0.0.0&met.a4a=dcl.2~ol.~nvs.1644849714925~ini.1644849716348
Requested by: Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012201141909000/v0/amp-analytics-0.1.mjs
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4001:c15::78 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 14 Feb 2022 14:41:56 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame D2CC 0
17 B 88ms
88ms Ping
image/gif 2607:f8b0:4001:c15::78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?s=ampad&ctx=2&puid=1~1644849716356&c=2001621828581984&qqid=COLrgde2__UCFWa4swodiPQFXQ&rt=any.link.5.5x.1p.1y.0.0.1bpu.1bhi~any.script.5.4p.4.24.0.0.4mm.4ea~any.script.5.5f.q.28.0.0.n1q.mte~any.script.6.4r.1.29.0.0.1nr.1ff~any.script.6.5g.p.2a.0.0.aqf.ai3~any.link.6.58.v.1x.0.0.q5.ht~any.link.7.59.v.1y.0.0.oq.ge~any.img.8.3v.e.12.0.0.oef.o63~any.img.8.3x.3.1f.0.0.7vs.7ng~any.img.9.3x.1.1i.0.0.25u.1xi~any.img.9.3x.1.1j.0.0.gj.87~any.img.b.5z.6a.0.0.0.0.0~any.img.b.4d.4n.0.0.0.0.0~any.css.99.15.i.l.0.0.cc4.c3s~any.css.99.16.3.10.0.0.cik.ca8~any.img.jr.3j.l.l.0.0.oef.o63~any.img.jt.3i.9.y.0.0.7vs.7ng~any.img.jt.2w.1.k.0.0.25u.1xi~any.img.ju.2u.1.j.1z.0.gj.87&met.a4a=dcl.0~ol.697~nvs.1644849715288~ini.1644849716357
Requested by: Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012201141909000/v0/amp-analytics-0.1.mjs
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4001:c15::78 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 14 Feb 2022 14:41:56 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 42fb57ac-2013-45a6-8dad-332d53e17c1b Show response
consumer.krxd.net/consent/get/ 224 B
311 B 30ms
29ms Script
text/javascript 151.101.130.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://consumer.krxd.net/consent/get/42fb57ac-2013-45a6-8dad-332d53e17c1b?idt=device&dt=kxcookie&callback=Krux.ns.postmedia.kxjsonp_consent_get_1
Requested by: Host: cdn.krxd.net
URL: https://cdn.krxd.net/ctjs/controltag.js.a1705c5ac5f06cf0c202ff70908fc042
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.130.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 8ac4cb4f755fac2317f123d4ec0b6dafdd732641ede757298fc921ccc1d3df41

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:56 GMT
via: 1.1 varnish
age: 0
x-served-by: consumer-a012-ash-prod.krxd.net, cache-yul12820-YUL
vary: Accept-Encoding
x-cache: MISS, MISS
content-type: text/javascript; charset=UTF-8
content-encoding: gzip
cache-control: max-age=1800
x-age: 0
accept-ranges: bytes
x-timer: S1644849716.471196,VS0,VE19
content-length: 188
x-cache-hits: 0, 0

GET
H2 204 pixel.gif
beacon.krxd.net/ 0
337 B 34ms
27ms Image
text/plain 52.22.124.154
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/pixel.gif?source=smarttag&fired=report&confid=uthtxmddg&_kpid=42fb57ac-2013-45a6-8dad-332d53e17c1b&_kcp_s=communities&_kcp_d=postmedia.digital&_knifr=8&_kua_kx_tz=0&geo_country=ca&geo_region=qc&geo_dma=124462&_kua_kx_lang=en-us&_kua_kx_tech_browser_language=en-us&_kua_mpid=3109303702368661980&_kua_ad_light_user=false&_kua_kx_tech_browser=Chrome%209&_kua_kx_tech_manufacturer=Microsoft%20Corporation&_kua_kx_tech_device=Computer&_kua_kx_tech_os=Windows%2010&_kua_kx_geo_country=ca&_kua_kx_geo_region=qc&_kua_kx_geo_dma=124462&_kpa_domain=postmedia.digital&_kpa_page_type=index&_kpa_communities_page_type=index&_kpa_main_category=index&_kpa_env=test&_kpa_view_type=HTML&_kpa_paywall_whitelist=false&t_navigation_type=0&t_dns=0&t_tcp=31&t_http_request=-1&t_http_response=84&t_content_ready=1588&t_window_load=0&t_redirect=0&interchange_ran=false&userdata_was_requested=true&userdata_did_respond=true&store_user_after=w459tbqef&userdata_user=OqYT0NbV%2Cw459tbqef&sview=1&kplt0=41818&kplt1=42920&kplt2=42921&kplt3=42922&kplt4=44981&kplt5=45977&kplt6=46302&jsonp_requests=https%3A%2F%2Fconsumer.krxd.net%2Fconsent%2Fget%2F42fb57ac-2013-45a6-8dad-332d53e17c1b%2C358%2Chttps%3A%2F%2Fbeacon.krxd.net%2Foptout_check%2C505%2Chttps%3A%2F%2Fcdn.krxd.net%2Fuserdata%2Fget%2C505%2Chttps%3A%2F%2Fconsumer.krxd.net%2Fconsent%2Fget%2F42fb57ac-2013-45a6-8dad-332d53e17c1b%2C297
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.22.124.154 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-22-124-154.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:56 GMT
cache-control: private, no-cache, no-store
x-request-time: D=64 t=1644849716
x-served-by: beacon-n037-ash-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

POST
H3 204 csi
csi.gstatic.com/ Frame AC46 0
17 B 124ms
123ms Ping
image/gif 2607:f8b0:4001:c15::78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~kzmt1w6b&chm=1&c=2001621828581984&ctx=2&qqid=CJLP-9a2__UCFWa4swodiPQFXQ&met.6=6.1_CgggNioECAgSAAoKGDcgXSoECAISAAoPGO4DIE4qCAgBEgQQATABCgsYrwYgXioECAgSAAoLGLMHIDkqBAgCEgAKCxiNCCA2KgQICBIA
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4001:c15::78 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Feb 2022 14:41:56 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame AC46 0
17 B 79ms
79ms Ping
image/gif 2607:f8b0:4001:c15::78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=2~kzmt1w6k&chm=1&c=2001621828581984&ctx=2&qqid=CJLP-9a2__UCFWa4swodiPQFXQ&met.4=fb.s~lb.fv~ol.so~idt.-lu~dt.-1m2&met.3=734.kl~749.sh_7~734.sp~736.u7~735.vg_2~740.x8_1~734.y7~734.110~734.15p~113.16e_2~112.16d_3~246.16k_2&met.1=1.kzmt1uzy~14.1~15.1~16.1~17.1~18.1~19.1~20.sg~21.sp~22.gf~23.gf&met.7=CCIQBBgBICAoIDDgATjAAWhqcOABeKwCsAEBuAED~CBsQCiAjOPMB~CCoQChgBICMoIzDCAjifAg~CBsQCiDdAzg2~CCIQBBgBIIcIKIcIMN8IOFhoiQhw3gh4rAKwAQG4AQM~CCgQChgBINsIKNsIMPYIOBto3Qhw8gh40rYBgAGmtAGIAd3eA7ABAbgBAw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4001:c15::78 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Feb 2022 14:41:56 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 13 KB
10 KB 131ms
45ms XHR
application/json 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022020901&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020901.js?31064847

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dd38f17fd0cce6709e3eb74db1cafeaf76150717126c9aee9fd30362fb23e7ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 14 Feb 2022 14:41:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9891
x-xss-protection: 0

GET
H2 200 r
eb2.3lift.com/ 37 B
139 B 27ms
27ms Image
image/gif 35.71.139.29
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/r?inv_code=Promoted_By_Desktop&aid=11870724055702907300990&rev=e0fe245&ss=0&bc=0.0&pr=un&brid=1&bmid=0&advid=46559&clid=10660788&biid=0&tid=11059141&adid=&bcud=0&ts=1644849716&caid=11014947&unid=0&domain=gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital&ref=https%253A%252F%252Fgcp-cheet-4407-ontariofarmer.gdev.postmedia.digital%252F&rr=creative&fid=1&rb=0&g=0&cb=60980
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:56 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif

GET
H2 200 lp Show response
img.3lift.com/ Frame 0EE6 120 B
412 B 78ms
18ms Script
text/plain 143.204.143.124
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://img.3lift.com/lp?width=334&height=258&url=%2F%2Fimages.3lift.com%2F15221614.jpg&logo_exclude=&v=15
Requested by: Host: ib.3lift.com
URL: https://ib.3lift.com/rev/e0fe24527bfcc9eed4763b29ecf9b752e4f172b0/dist/bundle.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.143.124 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-143-124.ewr52.r.cloudfront.net
Software: /
Resource Hash: e64a35469e5e943866d38eececaf67dc98d02af2786076a33bbac5aa15f173f3

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 11:07:17 GMT
via: 1.1 784a91ee0539c02263f0e03f7760900c.cloudfront.net (CloudFront)
last-modified: Mon, 14 Feb 2022 11:07:17 GMT
age: 12879
x-cache: Hit from cloudfront
content-type: text/plain; charset=utf-8
cache-control: public, max-age=86400
x-amz-cf-pop: EWR52-C2
content-length: 120
x-amz-cf-id: v0RbP7n2ASPTWa2wMdrkYL9F2NXP2o2i0e-CMaSQV7VDiu9sLmHV7A==

GET
H2 200 /
img.3lift.com/ Frame AC46 27 KB
27 KB 78ms
18ms Image
image/jpeg 143.204.143.124
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.3lift.com/?width=334&height=258&url=%2F%2Fimages.3lift.com%2F15221614.jpg&logo_exclude=&v=15
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.143.124 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-143-124.ewr52.r.cloudfront.net
Software: /
Resource Hash: c19f104f71391238db367f28c1fde806e07b3c3674367f8c0511559fdd5c23cc

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 08:56:23 GMT
via: 1.1 784a91ee0539c02263f0e03f7760900c.cloudfront.net (CloudFront)
age: 21173
etag: "ea829b94f12d1b15c0a6e429973e2b41"
x-cache: Hit from cloudfront
content-type: image/jpeg
cache-control: public, max-age=86400
x-amz-cf-pop: EWR52-C2
content-length: 27387
x-amz-cf-id: o8aPH5t1WCFOGFl8LV_c2G_KVw5Lasg2NFl4E4zrxRxAXwsJwIqdwA==

GET
H2 200 OBA_TRANS.png
ib.3lift.com/static/buttons/edaa/ Frame AC46 3 KB
3 KB 21ms
17ms Image
image/png 99.84.125.69
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ib.3lift.com/static/buttons/edaa/OBA_TRANS.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.125.69 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-125-69.ewr52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2fd4c3ae6afc2b4026d9f0b64b8ff1110ecfcf47b90bc988c06e844b3921cbf6

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sat, 12 Feb 2022 06:17:48 GMT
via: 1.1 25b4c4372feadf7e1722c01c8c9eeea0.cloudfront.net (CloudFront)
last-modified: Thu, 05 Aug 2021 17:23:36 GMT
server: AmazonS3
age: 203049
etag: "ddf020e069f1706b72b7698b28fede09"
x-cache: Hit from cloudfront
content-type: image/png
cache-control: max-age=604800,s-maxage=604800,public
x-amz-cf-pop: EWR52-C3
accept-ranges: bytes
content-length: 3125
x-amz-cf-id: U5ZxziCnMxfKtvzIJh1yuw3A4J4UOYXSutZfrxoQ5ru3Id5PVDbJkg==

GET
H2 200 OBA_UK.png
ib.3lift.com/static/buttons/edaa/ Frame AC46 3 KB
4 KB 21ms
18ms Image
image/png 99.84.125.69
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ib.3lift.com/static/buttons/edaa/OBA_UK.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.125.69 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-125-69.ewr52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 08285afd2f0c11a2a9d89f00dce769479e4d164e62caa39eceea9f1eb551afa9

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Wed, 09 Feb 2022 03:56:40 GMT
via: 1.1 25b4c4372feadf7e1722c01c8c9eeea0.cloudfront.net (CloudFront)
last-modified: Thu, 05 Aug 2021 17:23:31 GMT
server: AmazonS3
age: 470717
etag: "7ceab27af00fa466072a3c3360041755"
x-cache: Hit from cloudfront
content-type: image/png
cache-control: max-age=604800,s-maxage=604800,public
x-amz-cf-pop: EWR52-C3
accept-ranges: bytes
content-length: 3518
x-amz-cf-id: uQLyE8W7P3n7xDCzz291WIxv-5OUcIvr2PwzEGy70E9oJn8ZoH0_5A==

GET
H2 200 ribn-postmedia.min.js Show response
assets.ribn.com/v2/production/ 13 KB
4 KB 70ms
19ms Script
application/javascript 2600:9000:2140:9600:7:75d4:e40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.ribn.com/v2/production/ribn-postmedia.min.js
Requested by: Host: gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2140:9600:7:75d4:e40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c81cab8c63d469329c0e0724770c6c8622f0d5d1fb8b6f919b6d7dddfadba190

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 23:11:10 GMT
content-encoding: br
last-modified: Wed, 01 Sep 2021 18:06:03 GMT
server: AmazonS3
age: 55847
etag: W/"baaa6497dd2dea88d8fdb6d6cca08cf2"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 6e24e95f882f20707346a032d1fa2948.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR52-C1
x-amz-cf-id: gYg629K0D79XhYVj3sS40ksP6FBChJiKrb8tgk_SvIUcPQFR3THXcg==

GET
H2

200

cs.js Show response
sb.scorecardresearch.com/internal-c2/default/
Redirect Chain

https://sb.scorecardresearch.com/c2/10276888/cs.js
https://sb.scorecardresearch.com/internal-c2/default/cs.js

0
349 B

19ms
17ms

Script
application/javascript

13.33.46.48
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.scorecardresearch.com/internal-c2/default/cs.js
Protocol: H2
Server: 13.33.46.48 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-33-46-48.ewr52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:38:41 GMT
via: 1.1 bc6981f82440e44448ee5dd3577bf4f4.cloudfront.net (CloudFront)
etag: "d41d8cd98f00b204e9800998ecf8427e"
last-modified: Mon, 01 Mar 2021 20:42:20 GMT
server: AmazonS3
age: 196
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-pop: EWR52-C1
accept-ranges: bytes
content-length: 0
x-amz-cf-id: vp63EDl2x3-UtxxeYIkmWF5mQi02TdukyeNopNBC2pPOylKtIkzpag==

Redirect headers

date: Mon, 14 Feb 2022 14:41:56 GMT
via: 1.1 bc6981f82440e44448ee5dd3577bf4f4.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR52-C1
vary: Accept
x-cache: Miss from cloudfront
content-type: text/plain; charset=utf-8
location: /internal-c2/default/cs.js
content-length: 48
x-amz-cf-id: bDKZmC5_rTUKIgIcmpkN6TszglXPHyYtaF-C7s2rGYYTQ5X5TzUQiQ==

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
442 B 134ms
82ms Image
image/gif 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_stats&su=gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital&doc=complete&pg_h=5988&pg_w=1600&pg_hs=5988&c=18&aa_c=0&av_h=141.111&av_w=1168.222&av_a=223618.889&s=12.875&all_s=12.875&b=325.750&all_b=325.750&d=0.424&all_d=0.424&ard=0.420&all_ard=0.420&dt=d

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Feb 2022 14:41:56 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
img.3lift.com/ 27 KB
27 KB 21ms
21ms Image
image/jpeg 143.204.143.124
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.3lift.com/?width=334&height=258&url=%2F%2Fimages.3lift.com%2F15221614.jpg&logo_exclude=&v=15
Requested by: Host: ib.3lift.com
URL: https://ib.3lift.com/rev/e0fe24527bfcc9eed4763b29ecf9b752e4f172b0/dist/bundle.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.143.124 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-143-124.ewr52.r.cloudfront.net
Software: /
Resource Hash: c19f104f71391238db367f28c1fde806e07b3c3674367f8c0511559fdd5c23cc

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 08:56:23 GMT
via: 1.1 784a91ee0539c02263f0e03f7760900c.cloudfront.net (CloudFront)
age: 21173
etag: "ea829b94f12d1b15c0a6e429973e2b41"
x-cache: Hit from cloudfront
content-type: image/jpeg
cache-control: public, max-age=86400
x-amz-cf-pop: EWR52-C2
content-length: 27387
x-amz-cf-id: Z5u7O2233yq36bTnH8VK7j7VUcjGdVJ_rNchZezZM1Z-udJMjZSc4g==

GET
H2 200 aop
eb2.3lift.com/ 37 B
139 B 24ms
23ms Image
image/gif 35.71.139.29
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/aop?inv_code=Promoted_By_Desktop&aid=11870724055702907300990&rev=e0fe245&ss=0&bc=0.0&pr=un&brid=1&bmid=0&advid=46559&clid=10660788&biid=0&tid=11059141&adid=&bcud=0&ts=1644849716&caid=11014947&unid=0&domain=gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital&ref=https%253A%252F%252Fgcp-cheet-4407-ontariofarmer.gdev.postmedia.digital%252F&rr=creative&fid=1&rb=0&g=0&cb=92563
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:56 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif

GET
H2 200 OBA_TRANS.png
ib.3lift.com/static/buttons/edaa/ 3 KB
3 KB 20ms
17ms Image
image/png 99.84.125.69
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ib.3lift.com/static/buttons/edaa/OBA_TRANS.png
Requested by: Host: ib.3lift.com
URL: https://ib.3lift.com/rev/e0fe24527bfcc9eed4763b29ecf9b752e4f172b0/dist/bundle.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.125.69 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-125-69.ewr52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2fd4c3ae6afc2b4026d9f0b64b8ff1110ecfcf47b90bc988c06e844b3921cbf6

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sat, 12 Feb 2022 06:17:48 GMT
via: 1.1 25b4c4372feadf7e1722c01c8c9eeea0.cloudfront.net (CloudFront)
last-modified: Thu, 05 Aug 2021 17:23:36 GMT
server: AmazonS3
age: 203049
etag: "ddf020e069f1706b72b7698b28fede09"
x-cache: Hit from cloudfront
content-type: image/png
cache-control: max-age=604800,s-maxage=604800,public
x-amz-cf-pop: EWR52-C3
accept-ranges: bytes
content-length: 3125
x-amz-cf-id: qszTKgaYmlljyWqnQDtpdqJej-t1Hny_8cOrvVC-9sJ7wB1ZzpE32A==

GET
H2 200 OBA_UK.png
ib.3lift.com/static/buttons/edaa/ 3 KB
4 KB 19ms
18ms Image
image/png 99.84.125.69
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ib.3lift.com/static/buttons/edaa/OBA_UK.png
Requested by: Host: ib.3lift.com
URL: https://ib.3lift.com/rev/e0fe24527bfcc9eed4763b29ecf9b752e4f172b0/dist/bundle.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.125.69 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-125-69.ewr52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 08285afd2f0c11a2a9d89f00dce769479e4d164e62caa39eceea9f1eb551afa9

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Wed, 09 Feb 2022 03:56:40 GMT
via: 1.1 25b4c4372feadf7e1722c01c8c9eeea0.cloudfront.net (CloudFront)
last-modified: Thu, 05 Aug 2021 17:23:31 GMT
server: AmazonS3
age: 470717
etag: "7ceab27af00fa466072a3c3360041755"
x-cache: Hit from cloudfront
content-type: image/png
cache-control: max-age=604800,s-maxage=604800,public
x-amz-cf-pop: EWR52-C3
accept-ranges: bytes
content-length: 3518
x-amz-cf-id: yE7RToPKwadiwhNewQuWFEHglUED4d0oClJNOE5tQUK4_xvSm6m7Hw==

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 38ms
36ms Script
text/javascript 2607:f8b0:4006:80c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020901.js?31064847

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 14 Feb 2022 14:41:56 GMT

GET
H2 200 ev1
eb2.3lift.com/ 37 B
139 B 25ms
24ms Image
image/gif 35.71.139.29
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/ev1?inv_code=Promoted_By_Desktop&aid=11870724055702907300990&rev=e0fe245&ss=0&bc=0.0&pr=%24%7BAUCTION_PRICE%7D&brid=1&bmid=0&advid=46559&clid=10660788&biid=0&tid=11059141&adid=&bcud=0&ts=1644849716&caid=11014947&unid=0&cepos=0&ceid=15221614&cb=32495
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:56 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 48C3 13 KB
5 KB 20ms
20ms Document
text/html 2607:f8b0:4006:80c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5046
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sun, 13 Feb 2022 18:39:47 GMT
expires: Mon, 13 Feb 2023 18:39:47 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
content-type: text/html
age: 72130
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame DCF3 783 B
537 B 44ms
43ms Document
text/html 2607:f8b0:4006:823::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2004 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

41745da52edd20cfbc5f6cbfa3d38d3bc1dfa3f95232cf19095c87f542d89290

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-To9UIzHfqB9Yu8b6xYGLzQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Mon, 14 Feb 2022 14:41:57 GMT
date: Mon, 14 Feb 2022 14:41:57 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-To9UIzHfqB9Yu8b6xYGLzQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 515
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame 3933 0
260 B 157ms
20ms Script
text/plain 104.36.115.114
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=156011&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3DPM_UID%26ex%3Dpubmatic.com&userIdMacro=PM_UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.115.114 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:57 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

POST
H2 202 events Show response
jssdks.mparticle.com/v3/JS/us1-a9588c0ddc27594cabd152e47ffe27ee/ 41 B
285 B 138ms
22ms Fetch
application/json 2a04:4e42:600::645
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://jssdks.mparticle.com/v3/JS/us1-a9588c0ddc27594cabd152e47ffe27ee/events
Requested by: Host: jssdkcdns.mparticle.com
URL: https://jssdkcdns.mparticle.com/js/v2/us1-a9588c0ddc27594cabd152e47ffe27ee/mparticle.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42:600::645 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Kestrel /
Resource Hash: 82d7b687d5b84fd239f947b6aecc33dbfdc4feb21b9f9dff7ac2d8c33bcc66ce

Request headers

Accept: text/plain;charset=UTF-8
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 14 Feb 2022 14:41:57 GMT
content-encoding: gzip
server: Kestrel
x-timer: S1644849717.287246,VS0,VE15
x-origin-name: 7arPuRjnqGEhiMyprEtnLk--F_us1_origin
x-served-by: cache-yul12822-YUL
vary: Accept-Encoding
x-cache: MISS
content-type: application/json
access-control-allow-origin: *
accept-ranges: bytes
via: 1.1 varnish
x-cache-hits: 0

GET
H3 200 3he9SSTPTzffGJDQBOTZcvp_zoO7E8v038ekVtZ_6Vg.js Show response
pagead2.googlesyndication.com/bg/ Frame 48C3 35 KB
13 KB 57ms
27ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/3he9SSTPTzffGJDQBOTZcvp_zoO7E8v038ekVtZ_6Vg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

de17bd4924cf4f37df1890d004e4d972fa7fce83bb13cbf4dfc7a456d67fe958

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 07:30:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 112293
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13552
x-xss-protection: 0
last-modified: Tue, 08 Feb 2022 16:08:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 13 Feb 2023 07:30:24 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame AC46 42 B
64 B 106ms
78ms Fetch
image/gif 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstbr813rn-9yYl3aq89uvVTJZbyABm8nGnZ03B4UGZzbk2N08isXY46lg9-aauWw9dh4asJMhYE2ZLW_VgNv8QU3FvlnvREYJy64I4dWV0a-n_bswkM&sig=Cg0ArKJSzJtCGxDey382EAE&id=lidar2&mcvt=1009&p=1112,765,1117,770&mtos=1009,1009,1009,1009,1009&tos=1009,0,0,0,0&v=20220209&bin=7&avms=nio&bs=1600,1200&mc=1&app=0&itpl=19&adk=1840685615&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0%3D&vs=4&r=v&rst=1644849715246&rpt=1025&isd=0&lsd=0&met=ce&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Feb 2022 14:41:57 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame DCF3 0
0 88ms
86ms Image
text/html 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022020901&jk=2001621828581984&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:80d::2002 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame BF60 42 B
64 B 84ms
83ms Image
image/gif 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsue42gLrUpgimv2x-WK_teZzyNkuDmuCKSTT1kY7_jYKaFaEb3K6jYGYhqS_E34gHPbVHjyjlp2yPUHRYaOhOVBIP-BCFubMo01cA0c3bTLaKA0P8U&sai=AMfl-YS6Ww-S74dwvifSNKEOMeAoHd66o9r-SDQUEh8jRiBsblgcRmRG6PsykSJ5VOt2swTCa2IxzveXxC-J7Wui4cxkH2dJiXe91GRfoe3t0JS1Lawkc-Kfhv5Dx4W4x7YQ&sig=Cg0ArKJSzBi_ctwRFT8KEAE&id=ampim&o=315,108&d=970,250&ss=1600,1200&bs=1600,1200&mcvt=1008&mtos=0,0,0,1008,1008&tos=0,0,0,1008,0&tfs=1417&tls=2425&g=100&h=100&tt=2425&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&adk=625928897

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Feb 2022 14:41:57 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame D2CC 42 B
64 B 88ms
83ms Image
image/gif 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuR8ihgWLZRehEG5yr99HusYU5gbruGbtXhJOyH-PEFGBuTj4rMYs19Popg18zvzU4SKsVKp5ZrmX8gZ4K1YEg_P3OTSAMMe2T40tODCQ2uRuBWsQU&sai=AMfl-YQ-Fo2PEzj6xHxj_esYIfVIpcKQD03kPk_3cBKkyTDoX6QyBjKQjiCJxkwhaMeaCWpWVcXGoHLYMr0V3MXopBQ6DXFGuZoWUa-jxe2YnP1ZKCx6XyJKBDsDJInUZUVV&sig=Cg0ArKJSzBVgx2HSCkCCEAE&id=ampim&o=315,441&d=970,250&ss=1600,1200&bs=1600,1200&mcvt=1020&mtos=0,0,0,1020,1020&tos=0,0,0,1020,0&tfs=1065&tls=2085&g=100&h=100&tt=2085&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&adk=1960150758

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Feb 2022 14:41:57 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 48C3 0
9 B 19ms
18ms Image
text/plain 2607:f8b0:4006:80c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?bZHwoQ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:80c::2001 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:57 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

POST
H3 204 csi
csi.gstatic.com/ 0
17 B 82ms
81ms Ping
image/gif 2607:f8b0:4001:c15::78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&top=1&puid=3~kzmt1v3w&c=2001621828581984&e=31064847%2C31061691%2C31061693&ctx=1&met.3=598.4m5~709.4m5~801.4m5~355.4m5~825.4m5~801.4m5~355.4m5~825.4m5~708.4m6~708.4m6~708.4m6~708.4m6~598.4m7~54.4m7~708.4m7~598.4m7~54.4m7~708.4m7~291.4px~291.4px~646.4q0~646.4q0_1~646.4q1~646.4q1~646.4q2~646.4q2~646.4q2~800.4q3~800.4q3~800.4q3~800.4q3~800.4q3~800.4q4~800.4q4~800.4q4~800.4q4~800.4q4~800.4q4~800.4q4~800.4q4~800.4q4~800.4q9~800.4q9~800.4qa~800.4qa~800.4qa~800.4qa~800.4qa~800.4qa~800.4qa~800.4qa~800.4qa~800.4qa~800.4qa~800.4qa~800.4qa~800.4qa~800.4qa~800.4qa~800.4qa~800.4qa~800.4qb~598.4qb~709.4qb~598.4qd~709.4qd~598.4qd~709.4qd~598.4qf~709.4qf~598.4qf~709.4qf~598.4qg~709.4qg~598.4qg~709.4qg~801.4qh~825.4qh~801.4qh~825.4qh~801.4qh~825.4qh~598.4qh~709.4qh~598.4qh~709.4qh~598.4qh~709.4qh~598.4qh~709.4qh~598.4qh~709.4qh~598.4qh~709.4qh~598.4qh~709.4qh~801.4qi~355.4qi~825.4qi~801.4qi~355.4qi~825.4qi~801.4qi~355.4qi~825.4qi~708.4qj~708.4qj~708.4qj~708.4qk~708.4qk~708.4qk~598.4qk~54.4qk~708.4qk~598.4qk~54.4qk~708.4qk~598.4qk~54.4qk~708.4qk~647.4qp_1~863.4ss~680.4ss~863.4ss~863.4ss~863.4ss~863.4ss~863.4ss~680.4ss~680.4ss~863.4st~863.4st~863.4st~863.4st~863.4st~863.4st~291.4v1~291.4v1~291.4v1~291.4v1~774.52q~844.52q~598.52q~579.52q~597.52q~710.52q_1~844.52r~863.53v~680.53v~824.53v~824.53v~863.53v~863.53v~863.53v~863.53v~863.53v~680.53v~680.53v~863.53v~863.53v~863.53v~863.53v~863.53v~863.53v~783.53w~598.53w~598.53w~716.53w~774.5av~844.5av~598.5av~579.5av~597.5av~710.5av~844.5av~863.5ax~680.5ax~824.5ax~824.5ax~863.5ax~863.5ax~863.5ax~863.5ax~863.5ax~680.5ax~680.5ax~863.5ax~863.5ax~863.5ax~863.5ax~863.5ax~863.5ax~863.5ax~680.5ax~824.5ax~824.5ax~863.5ax~863.5ax~863.5ax~863.5ax~863.5ax~680.5ax~680.5ax~863.5ax~863.5ax~863.5ax~863.5ax~863.5ax~863.5ax~863.5ay~680.5az~863.5az~863.5az~863.5az~863.5az~863.5az~680.5az~680.5az~824.5az~824.5az~863.5az~863.5az~863.5az~863.5az~863.5az~863.5az~863.5az~680.5az~863.5az~863.5az~863.5az~863.5az~863.5az~680.5az~680.5az~824.5az~824.5az~863.5az~863.5az~863.5az~863.5az~863.5az~863.5az~774.5cv~844.5cv~598.5cv~579.5cv~597.5cv~710.5cv~844.5cv~863.5d3~680.5d4~863.5d4~863.5d4~863.5d4~863.5d4~863.5d4~680.5d4~824.5d4~824.5d4~680.5d4~863.5d4~863.5d4~863.5d4~863.5d4~863.5d4~863.5d4~783.5dm~598.5dm~598.5dm~716.5dm~783.5dm~598.5dm~598.5dm~716.5dm~863.5do~680.5do~824.5do~824.5do~863.5do~863.5do~863.5do~863.5do~863.5do~680.5do~680.5do~863.5do~863.5dp~863.5dp~863.5dp~863.5dp~863.5dp~863.5dp~680.5dp~824.5dp~824.5dp~863.5dp~863.5dp~863.5dp~863.5dp~863.5dp~680.5dp~680.5dp~863.5dp~863.5dq~863.5dq~863.5dq~863.5dq~863.5dq~863.5ds~680.5ds~824.5ds~824.5ds~863.5ds~863.5ds~863.5ds~863.5ds~863.5ds~680.5ds~680.5ds~863.5ds~863.5ds~863.5ds~863.5ds~863.5ds~863.5ds~863.5ej~680.5ej~863.5ej~863.5ej~863.5ej~863.5ej~863.5ej~680.5ej~680.5ej~824.5ej~824.5ej~863.5ej~863.5ej~863.5ej~863.5ej~863.5ej~863.5ej~863.5ek~680.5ek~863.5ek~863.5ek~863.5ek~863.5ek~863.5ek~680.5ek~680.5ek~824.5ek~824.5ek~863.5ek~863.5ek~863.5ek~863.5ek~863.5ek~863.5ek~863.5ek~680.5ek~863.5ek~863.5ek~863.5ek~863.5ek~863.5ek~680.5ek~680.5ek~824.5el~824.5el~863.5el~863.5el~863.5el~863.5el~863.5el~863.5el~863.5el~680.5el~863.5el~863.5el~863.5el~863.5el~863.5el~680.5el~680.5el~824.5el~824.5el~863.5el~863.5el~863.5el~863.5el~863.5el~863.5el~863.5o8~680.5o8~863.5o8~863.5o8~863.5o8~863.5o8~863.5o8~680.5o8~680.5o8~863.5o8~863.5o8~863.5o9~863.5o9~863.5o9~863.5o9~94.5q6~947.5rg~573.5rg~598.5rg~598.5rg~598.5rg~598.5rg~598.5rg~598.5rg~598.5rg~598.5rg~598.5rg~598.5rg~598.5rg~598.5rg~598.5rg~598.5rg~598.5rg~598.5rg~598.5rg~598.5rg~113.5rd_9~49.5td~49.5te~49.5te~49.5te~49.5te~50.5te~598.5vs~598.5vs~715.5vs~49.5xd~49.5xd~49.5xd~49.5xd~49.5xd~50.5xe~49.62v~49.62v~49.62v~49.62v~49.62v~50.62v~49.63l~49.63l~49.63l~49.63l~49.63l~50.63l~863.64i~680.64i~863.64i~863.64i~863.64i~863.64i~863.64i~680.64i~680.64i~863.64i~863.64i~863.64i~863.64i~863.64i~863.64i~863.658~680.658~824.658~824.658~863.658~863.658~863.658~863.658~863.658~680.658~680.658~863.658~863.658~863.658~863.658~863.658~863.658~863.65p~680.65p~863.65p~863.65p~863.65p~863.65q~863.65q~680.65q~680.65q~824.65q~824.65q~863.65q~863.65q~863.65q~863.65q~863.65q~863.65q~598.65r~598.65r~715.65r~598.65s~598.65s~715.65s~49.65s~49.65t~49.65t~49.65t~49.65t~50.65t~49.65t~49.65t~49.65t~49.65t~49.65t~50.65t~49.6ap~49.6ap~49.6aq~49.6aq~49.6aq~50.6aq~49.6aq~49.6aq~49.6aq~49.6aq~49.6aq~50.6aq~49.6aq~49.6ar~49.6ar~49.6ar~49.6ar~50.6ar&met.9=5_31.4qd~5_33.4qf~5_35.4qg~6_20.52q~6_21.5av~6_19.5cv&met.7=CA8QDRgBIO4dKO4dMPAqOIINaPAdcJ8qeM6YA4ABopYDiAHU3COwAQG4AQPAAb_emusG~CBsQBSDcKDhkwAGy5M_6Cw~CBsQARgBINwuKNwuMJEwOLUBwAGkoPylBw~CBsQBiChMDgywAGplbuFCA~CBsQCiC6NTgYwAHA_LyPCQ~CBsQCiC7NTgfwAHNjob0Ag~CBsQCiCPNzghwAGWtd_gBA~CBsQBiDCOTgswAGvm8iSDA~CBsQCDiBOsAB0Yv6nAg~CBsQBiCJOjgcwAGJmv6yBg~CBsQCiDbOjgTwAGEkbHLCQ~CBsQCiCnOjhJwAHXkY_NDw~CCcQDRgBIIE6KIE6MIo7OIoBQIg6SIg6UIg6WMo6YJw6aNM6cIg7eM9PgAGjTYgB4GWwAQG4AQPAAfPyy64L~CBsQBiD7OjgYwAH64YrFBw~CBsQBiD_OjgYwAHW5oPDDQ~CBsQBiCFOzgVwAGXuM62BA~CBsQBiCFOzgWwAGJuJ_wCw~CBsQBiCSOzgewAHuw4LDDQ~CBwQBhgBILE6KLE6MLw7OIoBULo6WOk6YM06aOo6cLs7eKwCsAEBuAEDwAGUhOK1Dg~CCcQChgBIJE7KJE7MLs7OCrAAeLBm9oF~CCcQBRgBINE7KNE7MMg9OPcBwAGZlZ-gCw~CBsQBRgBINk7KNk7MOE9OIgCwAHPxtriAQ~&met.1=1.kzmt1qhs~6.x~7.z~8.z~9.z~10.1u~11.1b~12.1u~13.sg~14.us~15.sk~16.184~17.184~18.184~19.5q6~20.5q6~21.5q9~22.19v~23.19v&met.10=1_21.IIs7EOOnBAjqtwYYgJh1KAE&qqid.12=COzrgde2__UCFWa4swodiPQFXQ&qqid.13=CJzP-9a2__UCFWa4swodiPQFXQ&qqid.14=CO7rgde2__UCFWa4swodiPQFXQ&qqid.15=CJ7P-9a2__UCFWa4swodiPQFXQ&qqid.16=CPDrgde2__UCFWa4swodiPQFXQ&qqid.17=CKDP-9a2__UCFWa4swodiPQFXQ&qqid.18=CPLrgde2__UCFWa4swodiPQFXQ
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4001:c15::78 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Feb 2022 14:41:57 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ev
eb2.3lift.com/ 37 B
139 B 25ms
24ms Image
image/gif 35.71.139.29
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/ev?inv_code=Promoted_By_Desktop&aid=11870724055702907300990&rev=e0fe245&ss=0&bc=0.0&pr=%24%7BAUCTION_PRICE%7D&brid=1&bmid=0&advid=46559&clid=10660788&biid=0&tid=11059141&adid=&bcud=0&ts=1644849716&caid=11014947&unid=0&cepos=0&ceid=15221614&cb=48768
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 14 Feb 2022 14:41:57 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 84ms
83ms Image
image/gif 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gpt_2022020901&jk=2001621828581984&bg=!KCulK2_NAAbAtJCDwLQ7ACkAdvg8WtkeMotm3alUcd45jN9zYj0Mpmevic4cA60ijFVbvcs70hD59QIAAAGQUgAAAARoAQeZAuSi62aYPlleP8FVUK1psup4OB9bX3gq0yM4ciqvS8tBvxkfQECVz7re7gb7yV6MpV8OGuX7i4pG6eiZ6oKBOhsyjYP8zv9X7k9cHgFOb-HBXjkTrlr2_HsYbnAJYmYdzhlNZnInCN1DbSE4dcjeyVY_GgeO6vU95UtLPyVWXDG_jCcoPPRXI-e5ooludyrIwDgkzf9DO2lmYUYpMyGmia_AfysTEOMeLb9hRJFd-MBMlBNz5Ok5Qr_UQuU6rOFA_P4jnj_6b0qPLBJXKTu9qdbTJuD5RodbF6bY4XFDV3Q76nZXF2rFFVSaUZ_26Nmr3WgDtAqfn6Xf8peNp6YPzL_cOF7GlP-oXUqF1TNH5Y4Sl8ca4Y__jDtdQ2kXpSTZsy1x5cD7qqSDE5L9jTlgnVMT5O3fcGE2B2cqBwGICTZPQd6lCuCUwwSOTacTigSi5S4-JhEwut4CwU-9-FDh8rRE1rhm4_45tyc1BLk8PRr1g-TIQJVHeLxk_z4S48B6q-JbV8tFKziJu_LJcKGN7kznmiYzGUumE6Iv7v4_YDKYrglKgcpGh4K51O9MpKFarRlvlR-gAdhm06q0llqVXZJX2QwVYV4RmEC3GOWTinYfeD5VfAfyY4Y6Aill4acvTLO9HxzgjwcfpsjPFdqflr6_fvkHHT5QJYRrqvItDRHbVXBkyz7NcYfQBaoeK1iHszZbrkedRXSfX1PzVeV0TTbEp-NO1eOjypj0U2OTGwmG8grsvTTp1Z9SqxlOB0z7MD0705Gec_7rqIGg_8vuJR7URhnMCc9T-aysc5qWmP9boexIkFMp94eRgTVu5XGpra8VHJ2ssHrBU7T85wdl4cMAWVJYAxe7q2ku7joRPbTBs8GfsqZIEhO7WiEF2LytKUXTLzVfu51kVykdRsk-qvVPc1XhvNwggLr4xWyD61nhbmO809vaFqpvJlToGsNnAd_YAhKdAFOmrkoVXHHQBRcfkApC7Q

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Feb 2022 14:41:58 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

88 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

96 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/	1970-01-20 01:04:14	Name: x-id Value: {"data":{"id":"awly58p0ubuhomew0foknu1hqmmauf9d","updated":1644849711181},"exp":604800000,"ts":1644849711227,"mac":1731591395}
gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/	1970-01-20 00:54:10	Name: __adblocker Value: false
.postmedia.digital/	1970-01-20 03:03:45	Name: _gcl_au Value: 1.1.335390189.1644849712
.scorecardresearch.com/	1970-01-20 18:10:57	Name: UID Value: 1E5b53bc7ac731e4a8a1d671644849712
d395dw5zk780j2.cloudfront.net/	1970-01-20 01:04:14	Name: x-id Value: {"data":{"id":"awly58p0ubuhomew0foknu1hqmmauf9d","updated":1644849711181},"exp":604800000,"ts":1644849712436,"mac":1732575428}
gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/	1970-01-20 01:04:14	Name: political-ad-opt-out Value: {"data":false,"exp":604800000,"ts":1644849712532,"mac":712769891}
gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/	1970-01-20 00:54:11	Name: sailthru_pageviews Value: 1
.amazon-adsystem.com/	1970-01-20 06:23:55	Name: ad-id Value: AxLhkk7zHUT2iXSxeLCjG0g
.amazon-adsystem.com/	1970-01-21 21:49:50	Name: ad-privacy Value: 0
.postmedia.digital/	1970-01-20 09:39:45	Name: mprtcl-v4_767FC2FC Value: {'gs':{'ie':1\|'dt':'us1-a9588c0ddc27594cabd152e47ffe27ee'\|'av':'1.0.0'\|'cgid':'03082509-daa7-430e-adc6-89f57e8d172e'\|'das':'e0b0b67b-5a71-4e9f-97b4-3d61e52e4801'\|'csm':'WyIzMTA5MzAzNzAyMzY4NjYxOTgwIl0='\|'sid':'A4BF9C8B-DBAD-4438-B7A8-1F4ADE1C677B'\|'les':1644849712607\|'ssd':1644849711704}\|'l':1\|'3109303702368661980':{'fst':1644849712033\|'ui':'eyIwIjoiYXdseTU4cDB1YnVob21ldzBmb2tudTFocW1tYXVmOWQifQ=='}\|'cu':'3109303702368661980'}
gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/	1970-01-20 09:39:45	Name: sailthru_visitor Value: 4cf476d7-7c79-48b9-a218-6972f4b5963f
.linkedin.com/	1970-01-20 03:03:45	Name: li_sugr Value: 20fd700a-ca2d-4991-98a6-a14e18612ecb
.ads.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.linkedin.com/	1970-01-20 18:26:03	Name: bcookie Value: "v=2&39c4c8b3-61b2-42de-8db4-6900529e0573"
.linkedin.com/	1970-01-20 00:55:36	Name: lidc Value: "b=OGST03:s=O:r=O:a=O:p=O:g=2590:u=1:x=1:i=1644849713:t=1644936113:v=2:sig=AQGSDCO3j4HERFXQ7u2PQefzrgDF9ia5"
.sharethrough.com/	1970-01-20 09:39:45	Name: stx_user_id Value: e7c0abdf-9fb3-4781-beae-0b49ea731a1b
.yahoo.com/	1970-01-20 09:40:07	Name: A3 Value: d=AQABBDFqCmICEHkuWwQFqw6Bk7EikLIuuN4FEgEBAQG7C2IUYgAAAAAA_eMAAA&S=AQAAAhVIEvohrk_TC0Sbhe69hSA
.dotomi.com/	1970-01-20 00:54:09	Name: DotomiTest Value: 2c922427c08111fd
sync.srv.stackadapt.com/	1970-01-20 09:39:45	Name: sa-user-id Value: s%3A0-9b899987-bad0-4a7b-6cd7-c78aeea85fef.8QYldVxW8f9xNFr%2BsGuCX%2BOzEncAUbmXtZwbfKyWw1Y
.srv.stackadapt.com/	1970-01-20 09:39:45	Name: sa-user-id-v2 Value: s%3Am4mZh7rQSnts18eK7qhf75U4mbc.gBCfMWRMgEUGmprL9oqDd3bVM8nFBqRrJFuFd7Ntj9I
.acuityplatform.com/	1970-01-20 09:39:45	Name: auid Value: 647146259108
.acuityplatform.com/	1970-01-20 09:39:45	Name: aum Value: "OikKAfqbdXNlck1hdGNoQnlVc2VyTWF0Y2hpbmdJZE1hcPqCMTM3+o11c2VyTWF0Y2hpbmdJZCQEkpFsYXN0RHJvcFRpbWVNaWxsaXMlAT8+FW0UtJhsYXN0U3VjY2Vzc2Z1bE1hdGNoTWlsbGlzJQE/PhVtFLSPdGhpcmRQYXJ0eVVzZXJJZCH7+4Z2ZXJzaW9uwvs="
.postmedia.digital/	1970-01-20 03:03:45	Name: _fbp Value: fb.1.1644849713825.1599502105
.linkedin.com/	1970-01-20 01:37:21	Name: UserMatchHistory Value: AQLc5Ao8MT_ztQAAAX74rtKHT8_lypOEpxBx4mHpBd3mr5zLnlFugILA0P9mKdgGJHDwG1tdoTEXxA
.linkedin.com/	1970-01-20 01:37:21	Name: AnalyticsSyncHistory Value: AQKRlViw_EZ2iAAAAX74rtKHzwliMBO_JjMs71LIdba36jSGqC_MnW0dYmd-lXszAZn9yLwYoxHFqbJBCr8IDw
.t.co/	1970-01-20 18:25:21	Name: muc_ads Value: 0dc0dab1-72a0-4cda-b7e8-5ea97a1c8309
.twitter.com/	1970-01-20 18:25:21	Name: personalization_id Value: "v1_UrW1IcEaUJqz1ZLlkc/Jhw=="
.analytics.yahoo.com/	1970-01-20 09:41:12	Name: IDSYNC Value: 191l~238e
.doubleclick.net/	1970-01-20 18:25:21	Name: IDE Value: AHWqTUmPokeGs-yqzPUybSX2mmThQd0AdcAa7onlX7zUZGI60L5JCjzqvnIbcmHS
.facebook.com/	1970-01-20 03:03:45	Name: fr Value: 0uYmufUZ4ntHcMqDd..BiCmoy...1.0.BiCmoy.
.lijit.com/	1970-01-20 09:39:45	Name: ljt_reader Value: 1148e8991e154b90d192d108
.adnxs.com/	1970-01-20 03:03:45	Name: uuid2 Value: 5894217850497717679
.openx.net/	1970-01-20 09:39:45	Name: i Value: 22d2674b-83f7-0a77-2d6c-36e55bf0ba22\|1644849714
.3lift.com/	1970-01-20 03:03:45	Name: tluid Value: 657918283301527424755
.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.www.linkedin.com/	1970-01-20 18:26:03	Name: bscookie Value: "v=1&2022021414415475ed4535-8a56-4202-8d0b-b69dbd91484aAQFDKhlE4346sMNJrYrOrw0C_IFeiWSQ"
.lijit.com/	1970-01-20 09:39:45	Name: ljtrtbexp Value: eJyrVjJSsjI0MzEzMLU0NjTRUbIwRuObo%2FJNzVD5hij6awGJJhAc
.krxd.net/	1970-01-20 05:13:21	Name: _kuid_ Value: OqYT0NbV
.openx.net/	1970-01-20 01:15:45	Name: pd Value: v2\|1644849714\|vMgakWgyiK
.bttrack.com/	1970-01-20 03:03:45	Name: GLOBALID Value: 2uKlc8-sIBd987FnX4bCnOT4AwkBJyj4cXc4nQvJIUMIR0NpCIjGr4SzZGOvmY2pJGr2AiEQ95QC4TM1
.everesttech.net/	1970-01-20 09:39:45	Name: everest_g_v2 Value: g_surferid~YgpqMgAGHgJiRgAy
.pubmatic.com/	1970-01-20 03:03:45	Name: KADUSERCOOKIE Value: F821B65A-E9C3-4E67-BB4B-F972CC37748C
.pubmatic.com/	1970-01-20 03:03:45	Name: chkChromeAb67Sec Value: 1
.pubmatic.com/	1970-01-20 00:55:36	Name: pi Value: 156011:2
.pubmatic.com/	1970-01-20 03:03:45	Name: DPSync3 Value: 1646006400%3A201_197%7C1645401600%3A164%7C1644883200%3A174
.pubmatic.com/	1970-01-20 03:03:45	Name: SyncRTB3 Value: 1646006400%3A13_22_54_220_21%7C1645401600%3A2
.adsrvr.org/	1970-01-20 09:39:45	Name: TDID Value: c2da4108-b919-40cc-a8d8-9255d4db5b3e
.mfadsrvr.com/	1970-01-20 18:25:21	Name: tuuid Value: 64bc7537-2bbe-43ac-836a-f804e904695e
.mfadsrvr.com/	1970-01-20 18:25:21	Name: c Value: 1644849714
.mfadsrvr.com/	1970-01-20 18:25:21	Name: tuuid_lu Value: 1644849714
.postmedia.digital/	1970-01-20 10:15:45	Name: __gads Value: ID=81c9f942c13f7d30-22062abef0b300ec:T=1644849713:S=ALNI_MZUJb4bIXJpuUqyfUYGpwIMWNoNjA
.mfadsrvr.com/	1970-01-20 18:25:21	Name: ssh Value: !sovrn,1644849714
.districtm.io/	1970-01-20 01:20:04	Name: _dm_uid Value: eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJzaWQiOjEwMDAwLCJ1c3IiOiJxZ2E0QWJJR0d6STFObHAwYkdGUk1Yb3dkbTFyVGxkM05IQllaemx1UVZKR05ib0dJQWlYVGhJYlFVRkJSMXBTZWpSVlRVUnJNWGRPU0V4MmFVNUJRVUZCUVVGQnVnWVJDS1pPRWd3Mk5EY3hORFl5TlRreE1EaTZCaUFJcWs0U0cyMDBiVnBvTjNKUlUyNTBjekU0WlVzM2NXaG1OelZWTkcxaVk3b0dBd2l1VHJvR0F3aXdUcm9HTVFqSlRoSXNlUzFsVUcxb1NWOUdSVEoxUjFnMFgxOHdkRXQwU2pjeFMzUmtVbk5zTUV0T1pVNWtOV1JGYUVVdGZrRT0iLCJpYXQiOjE2NDQ4NDk3MTR9.5uHrcyV-mxBzyVYVXPAFUBZANJbZBwCKNj1WobKMWsICzoNOPfwNgFGLrWISywx2_zgILYzr_q1PbobMfi6k7w
.openx.net/	1970-01-20 01:15:45	Name: univ_id Value: 537072971\|c2da4108-b919-40cc-a8d8-9255d4db5b3e\|1644849715192754
.rlcdn.com/	1970-01-20 09:39:45	Name: rlas3 Value: LR12ZbenEc2Vnd7jCLiUn+UT59W4/WiHd9xEzEnf7eU=
.rlcdn.com/	1970-01-20 02:20:33	Name: pxrc Value: CLPUqZAGEgUI6EcQAA==
.lijit.com/	1970-01-20 09:39:45	Name: _ljtrtb_12 Value: 5894217850497717679
.lijit.com/	1970-01-20 09:39:45	Name: _ljtrtb_87 Value: 64bc7537-2bbe-43ac-836a-f804e904695e
.casalemedia.com/	1970-01-20 09:39:45	Name: CMID Value: YgpqM.NJRzZAP61od8rrawAA
.casalemedia.com/	1970-01-20 03:03:45	Name: CMPS Value: 465
.mathtag.com/	1970-01-20 10:20:04	Name: uuid Value: b0c1620a-6a33-4a00-8d09-8d3972873d75
.1rx.io/	1970-01-20 09:39:45	Name: _rxuuid Value: %7B%22rx_uuid%22%3A%22RX-708fe789-db7e-474d-b017-6e1fe43364b9-005%22%2C%22nxtrdr%22%3Afalse%7D
.adform.net/	1970-01-20 01:34:28	Name: C Value: 1
.simpli.fi/	1970-01-20 09:41:12	Name: suid Value: 942897D38EDA4012AFD570B96A4D99AA
.turn.com/	1970-01-20 05:13:21	Name: uid Value: 3691721727429404894
.adsymptotic.com/	1970-01-20 03:03:45	Name: U Value: c80322a6b8ec05e3dbbf3291754319a0
.agkn.com/	1970-01-20 09:39:45	Name: ab Value: 0001%3A%2FpG6xPXWqWsYvBPwgKJHKFCWg98qaKGa
.adform.net/	1970-01-20 02:20:33	Name: uid Value: 2106881588248205963
.casalemedia.com/	1970-01-20 03:03:45	Name: CMPRO Value: 465
.casalemedia.com/	1970-01-20 00:55:36	Name: CMST Value: YgpqM2IKajMA
.pippio.com/	1970-01-20 09:39:45	Name: did Value: 4KPU0W4FzGgtLPAb
.pippio.com/	1970-01-20 09:39:45	Name: didts Value: 1644849715
.pippio.com/	1970-01-20 02:20:33	Name: nnls Value:
.pippio.com/	1970-01-20 02:20:33	Name: pxrc Value: CLPUqZAGEgUI3k4QAA==
.pubmatic.com/	1970-01-20 01:37:21	Name: KRTBCOOKIE_80 Value: 22987-CAESEFWtj5GUgon5KZmlmrVp4og&KRTB&16514-CAESEFWtj5GUgon5KZmlmrVp4og&KRTB&23025-CAESEFWtj5GUgon5KZmlmrVp4og
.pubmatic.com/	1970-01-20 01:37:21	Name: KRTBCOOKIE_148 Value: 19421-uid:942897D38EDA4012AFD570B96A4D99AA
.rubiconproject.com/	1970-01-20 09:39:45	Name: khaos Value: KZMT1V8E-1O-5H7Z
.bidr.io/	1970-01-20 10:22:39	Name: bito Value: AAB4sU7EFNQAAH6IC2NkfA
.bidr.io/	1970-01-20 10:22:39	Name: bitoIsSecure Value: ok
.lijit.com/	1970-01-20 09:39:45	Name: _ljtrtb_2 Value: 00909A6B55AB4796A6C21D838F770B8D
.pubmatic.com/	1970-01-20 01:37:21	Name: KRTBCOOKIE_218 Value: 4056-YgpqMgAGHgJiRgAy&KRTB&22978-YgpqMgAGHgJiRgAy&KRTB&23194-YgpqMgAGHgJiRgAy&KRTB&23209-YgpqMgAGHgJiRgAy
.pubmatic.com/	1970-01-20 03:03:45	Name: PUBMDCID Value: 1
.pubmatic.com/	1970-01-20 01:37:21	Name: KRTBCOOKIE_377 Value: 6810-c2da4108-b919-40cc-a8d8-9255d4db5b3e&KRTB&22918-c2da4108-b919-40cc-a8d8-9255d4db5b3e&KRTB&23031-c2da4108-b919-40cc-a8d8-9255d4db5b3e
.pubmatic.com/	1970-01-20 01:37:21	Name: KRTBCOOKIE_22 Value: 14911-3691721727429404894
.pubmatic.com/	1970-01-20 01:37:21	Name: PugT Value: 1644831384
.ml314.com/	1970-01-20 00:54:09	Name: u Value: aHR0cHM6Ly9jZG4ua3J4ZC5uZXQvcGFydG5lcmpzL3hkaS9wcm94eS4zZDIxMDBmZDcxMDcyNjJlY2I1NWNlNjg0N2YwMWZhNS5odG1sIyFreGNpZD11dGh0eG1kZGcma3h0PWh0dHBzJTNBJTJGJTJGZ2NwLWNoZWV0LTQ0MDctb250YXJpb2Zhcm1lci5nZGV2LnBvc3RtZWRpYS5kaWdpdGFsJmt4Y2w9Y2RuJmt4cD0=
.ml314.com/	1970-01-20 09:39:45	Name: pi Value: 3625135823814918189
.lijit.com/	1970-01-20 09:39:45	Name: _ljtrtb_83 Value: KZMT1V8E-1O-5H7Z
.targeting.unrulymedia.com/	1970-01-20 09:39:45	Name: _rxuuid Value: %7B%22rx_uuid%22%3A%22RX-708fe789-db7e-474d-b017-6e1fe43364b9-005%22%7D
.lijit.com/	1970-01-20 09:39:45	Name: ljtrtb Value: eJwVyjsOwjAQANG7uGalXXu%2FdDEBISFEgyjSxZFzCcTdcdo3802U0zmJB2cyF%2BQwI1OLdEpHQQyMSavIVNlCJ71kmr34zQyrz2PzMr7H8nzTx69AL5C7LYfbcOW2mRSD3FoHLusGXnSF3ZF7IGtIT78%2Fuogelg%3D%3D
.lijit.com/	1970-01-20 09:39:45	Name: _ljtrtb_56 Value: RX-708fe789-db7e-474d-b017-6e1fe43364b9-005
.adsrvr.org/	1970-01-20 09:39:45	Name: TDCPM Value: CAESFAoFb3BlbngSCwjCkc3bxfS3OhAFEhcKCHB1Ym1hdGljEgsI_r_S3cX0tzoQBRIWCgdydWJpY29uEgsI2rev5cX0tzoQBRgBIAIoAjILCP631Yrc9Lc6EAU4AVoIcHVibWF0aWNgAg..
.mathtag.com/	1970-01-20 01:37:21	Name: mt_mop Value: 9:1644849716
.doubleclick.net/	1970-01-20 00:54:13	Name: DSID Value: NO_DATA
.rubiconproject.com/	1970-01-20 09:39:45	Name: audit Value: 1\|VQFk1uM2oQ38oqHzLEd7DDGXOFRhCjC96w/G6SjJ9UweECEUBMheiovrE5L010HudNMjP0CnXh8kEa5N2k7U1SEEFoCDRlfY/fl9UxTBA2Leyn67Fk55GTLRtArIGR0C5cmAxi7+9V1o8946LEpae7I6MvHFbommQFKVeOFbq+8FZ4h6FHG7TqZr5ZVxLWDe
.pubmatic.com/	1970-01-20 01:37:21	Name: SPugT Value: 1644849717

10 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'interest-cohort'.
other	warning	URL: https://www.googleadservices.com/pagead/conversion_async.js(Line 71) Message: Unrecognized feature: 'attribution-reporting'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'interest-cohort'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'interest-cohort'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'interest-cohort'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'interest-cohort'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'interest-cohort'.
other	warning	URL: https://cdn.ampproject.org/rtv/012201141909000/v0/amp-ad-exit-0.1.mjs Message: Unrecognized feature: 'attribution-reporting'.
other	warning	URL: https://cdn.ampproject.org/rtv/012201141909000/v0/amp-ad-exit-0.1.mjs Message: Unrecognized feature: 'attribution-reporting'.
security	error	URL: https://gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital/ Message: Refused to execute script from 'https://static.adsafeprotected.com/main.gr.19.8.285.js' because its MIME type ('image/gif') is not executable.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

52648fa4f34196b9c4176788bfe49daf.safeframe.googlesyndication.com
aa.agkn.com
ad.turn.com
ads.pubmatic.com
ads.yahoo.com
adservice.google.ca
adservice.google.com
ak.sail-horizon.com
analytics.twitter.com
ap.lijit.com
api.sail-personalize.com
assets.ribn.com
auth.lrcontent.com
beacon.krxd.net
bttrack.com
c.amazon-adsystem.com
c1.adform.net
cdn.adsafeprotected.com
cdn.ampproject.org
cdn.districtm.io
cdn.krxd.net
ce.lijit.com
cm.g.doubleclick.net
connect.facebook.net
consumer.krxd.net
csi.gstatic.com
d395dw5zk780j2.cloudfront.net
districtm-match.dotomi.com
dmx.districtm.io
dmx.us-east-34.districtm.io
eb2.3lift.com
eus.rubiconproject.com
fem.prod.postmedia.digital
fonts.googleapis.com
fonts.gstatic.com
gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital
googleads.g.doubleclick.net
hb.districtm.io
ib.3lift.com
ib.adnxs.com
id.rlcdn.com
identity.mparticle.com
idsync.rlcdn.com
image2.pubmatic.com
image4.pubmatic.com
image6.pubmatic.com
img.3lift.com
jssdkcdns.mparticle.com
jssdks.mparticle.com
match.adsrvr.org
match.prod.bidr.io
match.sharethrough.com
ml314.com
p.adsymptotic.com
pagead2.googlesyndication.com
pippio.com
pixel-eu.rubiconproject.com
pixel-us-east.rubiconproject.com
pixel.adsafeprotected.com
pixel.rubiconproject.com
pr-bh.ybp.yahoo.com
px.ads.linkedin.com
px4.ads.linkedin.com
rtb.mfadsrvr.com
s.amazon-adsystem.com
sb.scorecardresearch.com
secure.adnxs.com
securepubads.g.doubleclick.net
simage2.pubmatic.com
simage4.pubmatic.com
smartcdn.gprod.postmedia.digital
smartcdn.prod.postmedia.digital
snap.licdn.com
ssum-sec.casalemedia.com
stags.bluekai.com
static.ads-twitter.com
static.adsafeprotected.com
sync-tm.everesttech.net
sync.1rx.io
sync.mathtag.com
sync.srv.stackadapt.com
sync.targeting.unrulymedia.com
t.co
tlx.3lift.com
token.rubiconproject.com
tpc.googlesyndication.com
u.openx.net
um.simpli.fi
ums.acuityplatform.com
ups.analytics.yahoo.com
us-u.openx.net
usermatch.krxd.net
www.facebook.com
www.google.ca
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.googletagservices.com
www.linkedin.com
www.npttech.com
104.16.190.66
104.16.68.69
104.18.98.194
104.244.42.131
104.244.42.133
104.36.113.107
104.36.115.109
104.36.115.114
107.178.254.65
108.174.10.14
13.33.46.106
13.33.46.124
13.33.46.48
142.250.176.194
142.251.32.98
142.251.40.130
143.204.137.197
143.204.143.124
143.204.143.94
146.75.32.157
151.101.130.133
151.101.130.49
151.101.66.133
173.223.56.123
185.167.164.37
192.132.33.46
199.127.204.142
2001:4998:14:800::1001
209.54.180.3
213.19.162.80
216.200.232.253
23.52.161.180
23.52.162.21
23.57.136.222
23.92.190.74
2600:141b:13::17d7:82d1
2600:1f18:4e9:5a01:4fe8:190f:17d4:b6af
2600:9000:202c:de00:8:48e:53c0:93a1
2600:9000:202c:fa00:1a:609a:6780:93a1
2600:9000:2140:9600:7:75d4:e40:93a1
2600:9000:2140:b000:8:f216:eb80:93a1
2606:4700:10::6816:48e8
2606:4700:3037::6815:3c3f
2606:ae80:1451:12::1720
2607:f8b0:4001:c15::78
2607:f8b0:4006:806::2008
2607:f8b0:4006:80b::2001
2607:f8b0:4006:80c::2001
2607:f8b0:4006:80c::2002
2607:f8b0:4006:80d::2002
2607:f8b0:4006:80f::2002
2607:f8b0:4006:80f::2003
2607:f8b0:4006:817::2002
2607:f8b0:4006:81d::2003
2607:f8b0:4006:81f::2001
2607:f8b0:4006:820::2002
2607:f8b0:4006:822::200a
2607:f8b0:4006:823::2004
2620:112:f002:bbbb::21
2620:1ec:22::14
2a03:2880:f012:8:face:b00c:0:1
2a03:2880:f112:83:face:b00c:0:25de
2a04:4e42:200::645
2a04:4e42:600::645
3.225.49.60
34.149.157.221
34.200.159.147
34.228.175.203
34.73.194.24
34.95.11.30
34.98.64.218
35.173.74.115
35.190.60.146
35.207.24.140
35.71.131.137
35.71.139.29
52.22.124.154
52.44.16.134
52.45.33.138
54.175.198.118
54.85.224.115
63.251.114.182
68.67.160.74
68.67.179.113
69.173.151.100
69.90.254.78
75.126.248.142
8.28.7.81
8.28.7.84
99.83.154.140
99.84.125.52
99.84.125.69
05254fb47e6015a14628f7c169dde60489f8dd067efa6f2dabed1dc7a735a8b2
06633938cf75300c8d1ff455b59d19123ff4245bf7b49d01595df96c87498b8d
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
08285afd2f0c11a2a9d89f00dce769479e4d164e62caa39eceea9f1eb551afa9
0878df8b9a030066f26276aab6a4e36e509b480ec37fdac609ec3037611267d4
096ebe5196b95f66c1c0b9f3dcea9e6e3f40f2d55cd5933af5e4942adb232593
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0da1b7b795d8ed531c47ff870de07dfa167e2e7870be41c339bc05888c0c1900
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
166b32472bd35ab18cf94e37efd5055f293406d30ffac183474318140b45ebf2
17341481438e0354f5ed4ac607f6d2fea8765db44b6e2e4beee68028f464fc5a
1aefec411441da454a39e812f8300125bfd117abc33f50f98c124419314da704
1be02b0ab5187f9c9837e30461f2fa049d651ebdf831418de6c0d4a593b55317
1bfd3e9890809a2eefa255f6ec0d3f93697b8b0e49cea7b804c5b75c274f4068
238a7b88a5b7237a3fde744d5b7a0d8deafbe118e52453771e9e1872cac1b41f
23d00276404c2322c5d3bb27f5e930b67f81bc964189b36b028ab1521a5929db
27bcdc67e32fef9bdd86b785b1bafadd7f6915c49f6b49bed86bfbddf414b2f8
28ccdeaf1c5104e943728d922b8734153f7e57bd6762b4c7b28eec454cccd86b
29184c416fa3c5ffcbc4baf96ffe14c8d5fe2a0ff451da9d40b7109960ba3c2f
2987df61c80f5e13507666bcb5e2805b7c766a6e3e4f664d4bd557848839e60c
2afcabe2eb6314148dfd9dfdec1333b973d97d0780cc08fddab8501afbb013e9
2ddefcdc9f260c5ffeb93fed110fe9d929028226f9a2d8a4934ea52b546e9640
2e02ca5eec746266c9dcb0ed96178d2a77e8c7adc7f3b34d9c18c97ad842a87b
2e8fa2037c41372ddc72ea1e08a477ba37998b54b5416b8cff0554fa5b865e27
2f1021d1120c46f59533cf98a9c17e794b3aa55257ded087e7081f2d6275c388
2fd4c3ae6afc2b4026d9f0b64b8ff1110ecfcf47b90bc988c06e844b3921cbf6
300b9ba11e041384aafe746b81adbac891f04890e6d71728d572df9073610076
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
36a3464ca902ebef3790af8b964ac63c52d562e50efb6b0a986b493c4048a1b0
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
39874e19af66fa05a8e943e773c81187cb7437bb3cb0076df6defb9381d32911
3bcfa04dbc2db44af54bd72a0f7b98912368f16f525729a1b9b673f62ca7e5c9
3c59439b4ea6905545d0a5f41278422ee0d3bb3d370b4b8eaea35f306a9e1f63
3fb015dbe0e42160bbce28c41584d2ad50cb77cb8ceda5288c7806fc1dfa158c
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390
40e562e806ce113ae7879d0dd76db82797b5c274794751c260381f2c8b283641
41745da52edd20cfbc5f6cbfa3d38d3bc1dfa3f95232cf19095c87f542d89290
42cb48fcecb9f09d629e736d1ca8a7eb9c37c8e493b140d071fa92396897b333
47aaa888ff9ed9b1a14a203b0a6fbc4d92b35dfeb6bed53d009972153c3df6a1
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032
4ad3ad6be0cf00486a36397b122abf89c949c7e8feca91688be40fb251267704
4da3e3aa30b5b06390d7e7e3fcfb16d648909eb429d161c2748bd6d79a7ec5fb
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5702be858374d0c1b9cfa6164335204df766faceb85311b0311cc81b77041708
58491987638abe530d4f17c432c180273c708c169db08e55d664d5214fc04cdf
5853621d02d975fba45c91907a09fec43c635c608a30f31ecd9b85342693b41d
58d6350da5588a52d6baa4efc27a3362b4ee69dba3504fc762f934d7bb5d0bc4
5bfee1a430ede5828fcb00547e58f4121e6758b35517b4ee1b5387067a2e65e9
5e2aab555cbfbe4f398bc031f658fd37c078428446a48154a9e9301fe01b72d9
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824
61a9435112cb68acc5f8da27798416ac4082a71a8ee5d392fb39c30185e4bc73
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
64e548443b4d7ad00948e92ee6c042ba44028c9f86b8dc87c6085702046516e6
65bdb0f68bb734a9ee0412aeb1d9898bd4098339efd43b8356acf19b3d8c3ad5
68a335c0d87dce935fee1811892070e78c514828d50bfe2ae21fde739ec1002c
6902e79f7c8a801e6c1e25c65fd4dcf30034a12d12dad3286d2f0af4457c9b0c
709932d262282e65073a8940fc09fc3fffbeb13682a8190bf8a1e96fc2c59888
717dea50e50cd77ec4227232d4b4d28ca1f1ae85dd9e7afce28cd77dcccc0fee
7538e8f23fac8278c6027d8865bd1240514a3ff64b2c0af3b8ed3583e8ecce6b
76a237b880fbfc8ac655e91dcf5c9af3b44ccc506c69328409b4047d72519eea
7720a0f40d088f144d749c07f075b8dfdc84afd25900a59045fe6c29d0fc5090
78a100131e7307c7f41d002b24b358c9ee7f690a16b73938ae787e9769e08ecc
79485ec11dc7d9fe27462a6cd37fa698a55c25bc2f5a31189455a4ffe82c61c7
79c381d0b010da04e31a1da615ecb7b142984a8fa33f080485a2c109ce064f15
7fb15552a88b764ca42963e71136255cecf99c6bccc6fdc68fbe0f930a516cb7
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
82d7b687d5b84fd239f947b6aecc33dbfdc4feb21b9f9dff7ac2d8c33bcc66ce
831b0d6cde4541d363bb7a67eb49010fc5fd717dda4b9c3187dd3207b1da56cd
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
863572474ec6b36dd0349e5b41b10992e39a208aabbe5af1e3a3ca1443ecb327
893e568928ce7d0c6ad75198ebae881ff2b16c75a34fd5050892360edb95a0e5
896afed5377d5c6cdcafe98bc6c7b28d9d1b48bd7ce218a7ddb70fb4666b8dea
8a4fd9dc6db644313269ca0055f0cef11c1361c8879480f45393332ae2c8e027
8ac4cb4f755fac2317f123d4ec0b6dafdd732641ede757298fc921ccc1d3df41
8ddf9e8fa96d1bbbeaf292ca94fc082dde61e4a6be90c87f8b2609fd88edbd4d
92a8e061fc76bf12e807a8f159367dbfa7dc016fbcbc6db28475b64e02139822
96362b68e295798f86ac2f74d8fe6d7f0e19eba030a0722150cb9869eefa64ca
975a64dc9bbc5e1884ba8ca2e76d9b2791d16d5c9f3619bf30477cd21a8636d2
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
9b7ef2236c9f1cff8eba706ef2a3a30d932e2e3390e9e2c8a0c203ab5b5b4260
a1d526b82510b4038b635164e9c3e25c729503fb22589194cb617eb4dbb68681
a24811582ae5fcdc525a5238db02725522c69b0dd30d0210c5f7b3fb47a9517c
a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
a7bb2422616e7f36f583314c7fa3e33007f29f9b3dea91e85dee59395659def0
a7d040d5e84706dac2d471ad33830bd0ae361ca06e53e72e817701478c6d5afa
aa8c4f5924fd06cbaf5c65fac729f0c3207d1f70534b07fc0915948c41b29d6e
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a
adaf81788242f9c48cc12172354c5df3e22fdcbcd2c3979dd83b419bb59e3db7
aebd50af0cd8da2f314a52e2088788775d1a441bd674ef9379578e7bc1b5ad50
aebf0e0d15c0130fbe1375e3d5daff30441efea4c2545cc9f69cea6c13bab3a9
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b3b2fe5485d65c182c4ba3575926094557e36d2d096cc9515d972a70e04f709e
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f
bed79e22634d48c6e53d084c7dc1ac8e7ed34377df61478f7020d89248124ea1
c1613fae297f062becb2e3f0a24314be2a09ba5809d48bd1a2ea5eacb95e18ca
c19f104f71391238db367f28c1fde806e07b3c3674367f8c0511559fdd5c23cc
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c4cf4079ec71eea0051719d77dad827e876accf52dff47dbb7822f06d628fed4
c6d4675d324e5b40ed5fe0f15dfc55855a7d6389232ce7c981062d99b80d366c
c81cab8c63d469329c0e0724770c6c8622f0d5d1fb8b6f919b6d7dddfadba190
ca157b8a9c98a19c0446a974ea642d13e3b3398f328d312fd474df9f63c45fe9
cae0ae2d67aac89367108586ebd25e00afc5d0f8110e6eb71b8d274037f7a5d8
cb0c81a0e7ee6b45a21865507c1ad9bb2232c7006567a386031fcb2ec9ea186b
cb52c26eedfd62b0b0eec89b1705d7f4d0906c043c6bb62a0a16f1214fb75e8c
cb696ecd7c4f31fdd7c7c1cc37e8efc29614fbcbadf74f455aa496d72ce33250
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
cc83fe6d180fd859f448bacd040799bf379ee7e0d9b1e6c3f19499c1c4358864
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d06ae5e97e495832fc4526c3e93d7e9440f1faf5f77669b41678c9d564a25faf
d5f7c1c0cbec2c27d4165db4cd06b7780f477fc9161008bde67c7a9d62b223aa
d8ade0d94aaf4b3d52776b75609e8d1c31995677a0a033a6fa2408425da07740
d984a247beba5abcd72a6b6dd131ae1767b6d0cc76ad1223b33e8e3d5a7e05c0
dbdefe0cf576913616228702b9911f12d016fe54c45e4632c120a057d30b88c4
dd38f17fd0cce6709e3eb74db1cafeaf76150717126c9aee9fd30362fb23e7ce
ddb51dc062a5142ba07138c94ac5b984ab0a8e7c1eb6260702e8cb558babf41a
de17bd4924cf4f37df1890d004e4d972fa7fce83bb13cbf4dfc7a456d67fe958
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e2ed6f4144d1c12483676cbd0bbb32aa7b23d7b7f54709176c16c782ca668dfe
e39c093bb7e5ecc532c3523c4deb01b6159aa538fd8d587705c987cb9a791469
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e64a35469e5e943866d38eececaf67dc98d02af2786076a33bbac5aa15f173f3
e79c1c1a140e6afb861074c70392db54cc65a06050de2a69162ab94eb95b0516
e96d905773462b51270d6131f2119f7fd6d4aa67d3b57fcb048b66ce8b3ea6c8
ea29de07cdb14f2c6c59c06fdcd4ec30c2030b3ba8ee6a0aa325085496b9a94d
ea32733a0810a064a05057e4a86787f509bc7ad26b825c8284526c98cb123473
ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152
ec5048fe0002a0fd7fdc7141ffd02691784cd09dc8f1adee6783c86d8d5604cb
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f100912f8a6732f8d7d8680566430431d0cd951abba8843eb2095dc4e8d0aef9
f62f21e013d1dfa2015a7b2cf91d3619944ed308e3be879f9ca5d2fc132c1c70
f709a1b342d481f0abc9c55d87f77025b129543e8104f331dc708c1caf64ccf3
f752ad8cf812a358129aac3fd9784b0baf6f19899eb49116f08a1afab1fa133e
f7914b4836b5815c4b3dcd79c44fa3390dedf00785d79f90dc7f6c6f38c947c5
fb3a71bdda31c197c7c2ecf6bb0c391414c239e083db24276f25792ff3239d25
fe3cd3089faea77abfd92708efafcb5af900dead2bea4d8655a5b879cefc0f05
fed785a6a8ca96fb67230fec5d85f9c508db49f4075aa0ef284af56cd89813e3

gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital Open in urlscan Pro 34.95.11.30 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

249 Requests

80 %HTTPS

33 %IPv6

59 Domains

100 Subdomains

72 IPs

5 Countries

2372 kBTransfer

6728 kBSize

96 Cookies

13 Outgoing links

Page URL History

Redirected requests

249 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

gcp-cheet-4407-ontariofarmer.gdev.postmedia.digital Open in urlscan Pro
34.95.11.30 Public Scan

Screenshot
Live screenshot

Full Image

249
Requests

80 %
HTTPS

33 %
IPv6

59
Domains

100
Subdomains

72
IPs

5
Countries

2372 kB
Transfer

6728 kB
Size

96
Cookies

249 HTTP transactions
4 data transactions