pro.oxfordincomeletter.com Open in urlscan Pro
192.135.136.168 Public Scan

Software

Google Tag Manager /

Resource Hash

22617a3cd41dee2c326d5acea813ae42bfe9a21f56e8b89fdee0ac9b270044a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:40 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 68269
x-xss-protection: 0
last-modified: Sat, 23 Oct 2021 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 23 Oct 2021 03:15:40 GMT

GET
H2 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ 16 KB
16 KB 69ms
20ms Font
font/woff2 142.250.185.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Merriweather:ital,wght@0,700;1,700&family=Source+Sans+Pro:ital,wght@0,400;0,600;0,700;0,900;1,400;1,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

efb3cdc5e4582fd67dffab6fc6e5062074ce3f8c51747346af944e97749dc309

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://pro.oxfordincomeletter.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 22 Oct 2021 06:12:31 GMT
x-content-type-options: nosniff
age: 75789
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 15948
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:10:32 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 22 Oct 2022 06:12:31 GMT

GET
H2 200 u-4n0qyriQwlOrhSvowK_l52xwNZWMf6.woff2
fonts.gstatic.com/s/merriweather/v25/ 19 KB
19 KB 110ms
61ms Font
font/woff2 142.250.185.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/merriweather/v25/u-4n0qyriQwlOrhSvowK_l52xwNZWMf6.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Merriweather:ital,wght@0,700;1,700&family=Source+Sans+Pro:ital,wght@0,400;0,600;0,700;0,900;1,400;1,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ecaf445d3f1e63f15b6e423e287813a5675461cc9454184d0b49123b286cea4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://pro.oxfordincomeletter.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 22 Oct 2021 02:50:38 GMT
x-content-type-options: nosniff
age: 87902
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 19696
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:22:18 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 22 Oct 2022 02:50:38 GMT

GET
H2 200 6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ 15 KB
16 KB 94ms
45ms Font
font/woff2 142.250.185.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Merriweather:ital,wght@0,700;1,700&family=Source+Sans+Pro:ital,wght@0,400;0,600;0,700;0,900;1,400;1,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

24f7e397faec79e62c37ff2f00b170f6dc1557fb46ac169f9f1897a9d641dd03

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://pro.oxfordincomeletter.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 21 Oct 2021 12:44:42 GMT
x-content-type-options: nosniff
age: 138658
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 15764
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:10:17 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Fri, 21 Oct 2022 12:44:42 GMT

GET
H2 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ 16 KB
16 KB 103ms
55ms Font
font/woff2 142.250.185.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Merriweather:ital,wght@0,700;1,700&family=Source+Sans+Pro:ital,wght@0,400;0,600;0,700;0,900;1,400;1,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a9950fa5ca9cf47072770900d259bcf6778aa1119652d2e706d5eb92df254199

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://pro.oxfordincomeletter.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 18 Oct 2021 17:27:37 GMT
x-content-type-options: nosniff
age: 380883
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 16112
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:10:09 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Tue, 18 Oct 2022 17:27:37 GMT

GET
H2 200 6xKydSBYKcSV-LCoeQqfX1RYOo3iu4nwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ 15 KB
15 KB 86ms
38ms Font
font/woff2 142.250.185.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3iu4nwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Merriweather:ital,wght@0,700;1,700&family=Source+Sans+Pro:ital,wght@0,400;0,600;0,700;0,900;1,400;1,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4ba0f48573cc9e7e9c073582fa327ed9682680e5e00a667c138881cc5709739d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://pro.oxfordincomeletter.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 22 Oct 2021 05:08:23 GMT
x-content-type-options: nosniff
age: 79637
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 15324
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:10:40 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 22 Oct 2022 05:08:23 GMT

GET
H2 200 fa07dx1uzu.json Show response
fast.wistia.com/embed/medias/ 76 KB
28 KB 8ms
8ms Script
text/javascript 151.101.66.110
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.com/embed/medias/fa07dx1uzu.json?callback=wistiajson1

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.66.110 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

5aca5af8d733c500076eed0bbe2f3e2fe2661fe20c613800725a71e66fd5199c

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:40 GMT
content-encoding: br
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
age: 67277
x-cache: HIT, HIT
p3p: CP="CURi ADMa DEVa IVAa IVDa CONi OUR IND DSP CAO COR"
vary: Accept-Encoding,X-Forwarded-Proto,X-ECMA-Override
content-length: 28283
x-request-id: f5b8b4ef2df66ae4605293822d6e3cef
x-served-by: cache-dca17772-DCA, cache-hhn4036-HHN
x-runtime: 0.072748
access-control-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
x-timer: S1634958941.624658,VS0,VE1
etag: W/"5aca5af8d733c500076eed0bbe2f3e2f"
x-download-options: noopen
strict-transport-security: max-age=0
content-type: text/javascript; charset=utf-8
via: 1.1 varnish (Varnish/6.0), 1.1 varnish, 1.1 varnish
cache-control: public, no-cache
x-browser: chrome
x-browser-version: 93
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1, 1

GET
H2 200 wistia-mux.js Show response
fast.wistia.com/assets/external/ 92 KB
24 KB 6ms
6ms Script
application/javascript 151.101.66.110
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.com/assets/external/wistia-mux.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.66.110 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

6b2b48ca0a09e592b566062a53b111ebc09d2a34a1f04a3b05b00eba9e9760b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:40 GMT
content-encoding: br
vary: Accept-Encoding
age: 1260
x-cache: HIT, HIT
content-length: 24815
x-served-by: cache-dca17777-DCA, cache-hhn4036-HHN
access-control-allow-origin: *
x-browser-version: 93
last-modified: Fri, 22 Oct 2021 18:08:10 GMT
x-timer: S1634958941.624872,VS0,VE0
etag: "6172fe0a-60ef"
strict-transport-security: max-age=0
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=3600
x-browser: chrome
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1, 23

GET
H/1.1 200
OK index.html Show response
portrait-tracker.s3.amazonaws.com/ Frame CBE5 2 KB
2 KB 100ms
100ms Document
text/html 52.217.224.233
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://portrait-tracker.s3.amazonaws.com/index.html
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.224.233 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 5ee751181a92cf6d2531e6a3db04c385b52b835e6b9a977fe5da9a6dad7ae5b6

Request headers

Host: portrait-tracker.s3.amazonaws.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

x-amz-id-2: v56c8kdMKKzsWRlcYnb72KEjdl0MiV9GVg5KNKxfc7IFYjnELPiOUpnNA6DtDU+W1f8sosENP5A=
x-amz-request-id: 5TCMQ5Q1GZB2AYPF
Date: Sat, 23 Oct 2021 03:15:41 GMT
Last-Modified: Mon, 20 Sep 2021 14:58:54 GMT
ETag: "3901af45178e824780ab44d4d3aac075"
x-amz-version-id: Rcd5U5QarfiWjyeqgFy3uki5SfUHDF6C
Accept-Ranges: bytes
Content-Type: text/html
Server: AmazonS3
Content-Length: 1953

GET
H2 200 captions.js Show response
fast.wistia.com/assets/external/ 162 KB
27 KB 7ms
6ms Script
application/javascript 151.101.66.110
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.com/assets/external/captions.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.66.110 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

4974446145a917190b705f6575a0dba54fafa0acead60a10d226edb25aa60816

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:40 GMT
content-encoding: br
vary: Accept-Encoding
age: 1259
x-cache: HIT, HIT
content-length: 27304
x-served-by: cache-dca17761-DCA, cache-hhn4036-HHN
access-control-allow-origin: *
x-browser-version: 93
last-modified: Fri, 22 Oct 2021 18:08:10 GMT
x-timer: S1634958941.695784,VS0,VE0
etag: "6172fe0a-6aa8"
strict-transport-security: max-age=0
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=3600
x-browser: chrome
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 2, 8

GET
H2 200 fa07dx1uzu.json Show response
fast.wistia.com/embed/captions/ 140 KB
43 KB 101ms
100ms Script
text/javascript 151.101.66.110
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.com/embed/captions/fa07dx1uzu.json?callback=wistiajson2

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.66.110 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

88d3b8fe59e5a88b413fe60386adedb716aeeda8f9ee09bc192115f06f399963

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:40 GMT
content-encoding: br
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
age: 3
x-cache: HIT, MISS
p3p: CP="CURi ADMa DEVa IVAa IVDa CONi OUR IND DSP CAO COR"
vary: Accept-Encoding,X-Forwarded-Proto,Accept-Language
content-length: 43134
x-request-id: 465add0a69bf8a455de41d2f03a9d9a9
x-served-by: cache-dca17753-DCA, cache-hhn4036-HHN
x-runtime: 0.060749
access-control-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
x-timer: S1634958941.731297,VS0,VE94
etag: W/"88d3b8fe59e5a88b413fe60386adedb7"
x-download-options: noopen
strict-transport-security: max-age=0
content-type: text/javascript; charset=utf-8
via: 1.1 varnish (Varnish/6.0), 1.1 varnish, 1.1 varnish
cache-control: public, no-cache
x-browser: chrome
x-browser-version: 93
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1, 0

GET
H/1.1 200
OK 9208e8f4fb913f1bab1f85b25b49d48d.webp
embedwistia-a.akamaihd.net/deliveries/ 148 KB
148 KB 181ms
12ms Image
image/webp 92.123.195.28
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://embedwistia-a.akamaihd.net/deliveries/9208e8f4fb913f1bab1f85b25b49d48d.webp?image_crop_resized=1920x1080
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 92.123.195.28 , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a92-123-195-28.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: ca5cdb970cfc816c8e7d271693c21aeee58d9ff6d2111f11ccbd363bdba1f4f5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 23 Oct 2021 03:15:40 GMT
Access-Control-Request-Method: *
surrogate-key: 9208e8f4fb913f1bab1f85b25b49d48d thumbnail-delivery
Last-Modified: Thu, 23 Sep 2021 17:29:07 UTC
Access-Control-Allow-Methods: GET, HEAD, OPTIONS
Content-Type: image/webp
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Origin, Content-Type, Accept, Server, x-amz-version-id, X-Cache
Cache-Control: max-age=30227349
content-disposition: inline
Connection: keep-alive
Accept-Ranges: none
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
Content-Length: 151448

GET
H/1.1 200
OK WBRKXA00 Show response
pro.oxfordincomeletter.com/p/effortattributes/extractEffortattributes/ 747 B
1 KB 116ms
116ms XHR
application/json 192.135.136.168
14WEST-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pro.oxfordincomeletter.com/p/effortattributes/extractEffortattributes/WBRKXA00

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.135.136.168 , United States, ASN11372 (14WEST-AS, US),

Reverse DNS

Software

Resource Hash

afea74943b3dc591c3bd417429c55e87f9dc9ad5e39ba712e282a5778ac19960

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

Pragma: no-cache
X-NewRelic-ID: Uw8EVVVTGwcGV1VUDwEP
Accept-Encoding: gzip, deflate, br
Host: pro.oxfordincomeletter.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Site: same-origin
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: empty
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Cookie: 1872196=2206428; BIGipServerIRIS_PROD_HTTPS_POOL=!uAgbjUYaCWhvtfJj65n2UeQdagOpw6/zQAp6UnRQH+Joq6cDDpa1bJUwil2Ap0esxOZ53CeIMOX/uB4=; WBRKXA00=; seerses=e
Connection: keep-alive
Sec-Fetch-Mode: cors
X-NewRelic-ID: Uw8EVVVTGwcGV1VUDwEP
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 23 Oct 2021 03:15:40 GMT
Referrer-Policy: no-referrer-when-downgrade
X-NewRelic-App-Data: PxQAWFVXCwMTUFdRAwcPVlwTGhE1AwE2QgNWEVlbQFtcCxYsZyIcJwJQWBMSIkxHQg0DF0NURCULX0JBDQoPB0JNfRpMSlVRRyBfB14TRyMQQkUIBBZMVkNGTVIZARtWSgEEAVBRW1AcTwlOGgsNAQVTf1gIIndbIHQBJV9BFFVRCBIHag==
Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private
Content-Length: 747

GET
H2 200 fe8cd8a4-2193-442c-b6f5-cbd2d8861b0e Show response
c.lytics.io/api/personalize/9c32784e3cc4888a693a7988ad64c63d/user/_uid/ 28 KB
5 KB 156ms
156ms Script
application/json 104.26.2.22
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.lytics.io/api/personalize/9c32784e3cc4888a693a7988ad64c63d/user/_uid/fe8cd8a4-2193-442c-b6f5-cbd2d8861b0e?segments=true&fields=pub_circulation_status,su_list_email_status,bi_ltv&mergestate=true&state=%7B%22_uid%22%3A%22fe8cd8a4-2193-442c-b6f5-cbd2d8861b0e%22%2C%22_sesstart%22%3A%221%22%2C%22_tz%22%3A0%2C%22_ul%22%3A%22en-US%22%2C%22_sz%22%3A%221600x1200%22%2C%22_nmob%22%3A%22t%22%2C%22_device%22%3A%22desktop%22%2C%22url%22%3A%22pro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue%22%2C%22_v%22%3A%223.0.24%22%7D&ts=1634958940791&callback=u_197356829269726980

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.2.22 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0b0d25543b79f9626477c5490e2bcd5dd8fa9d12552238090cf424d821c4df6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

cf-ray: 6a27cd63fa3c65e0-LHR
date: Sat, 23 Oct 2021 03:15:40 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000;
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fi4PnzizN7GkcwvrpVPxZ9xHtJpYzgAgGjXFVlwNQtJ54jigur51S06cbw0%2BWnLTkWdEwY%2FTt%2BJ9j%2BK1k55S%2FN3KEsVXJDinS90pAUkjXg%2FPXRZw3EQj4oB1kOm1"}],"group":"cf-nel","max_age":604800}
content-encoding: br
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Cookie, *

GET
H2 200 9c32784e3cc4888a693a7988ad64c63d
c.lytics.io/c/ 35 B
534 B 125ms
124ms Image
image/gif 104.26.2.22
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.lytics.io/c/9c32784e3cc4888a693a7988ad64c63d?_e=pv&_sesstart=1&_tz=0&_ul=en-US&_sz=1600x1200&_ts=1634958940785&_nmob=t&_device=desktop&url=pro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&_v=3.0.24&_uid=fe8cd8a4-2193-442c-b6f5-cbd2d8861b0e&_getid=t

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.2.22 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:40 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-methods: GET, POST
content-length: 35
pragma: no-cache
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000;
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=534b717FxBDpODD2wiXxPvQgp9YfhZDW%2B09lkQCid0Hc5IfbQd62g0YS1tnnt51EEbnkqcOwwtqTuqAWq5Qk2YMn1WxdSInfImkQ%2BFS8CToeACU7tJArw4Ow0RIf"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cf-ray: 6a27cd63fa3d65e0-LHR
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Cookie, *
expires: 0

POST
H2 200 GetLyticsUserData Show response
dnzkifeab6.execute-api.us-east-1.amazonaws.com/Prod/ 76 B
580 B 336ms
336ms XHR
application/json 143.204.215.89
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dnzkifeab6.execute-api.us-east-1.amazonaws.com/Prod/GetLyticsUserData
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.89 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-89.fra53.r.cloudfront.net
Software: /
Resource Hash: 674d1ff7419bdf7f1dafd4a41db01a4feb1d802122213ecc456dd43f72791984

Request headers

Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json

Response headers

date: Sat, 23 Oct 2021 03:15:41 GMT
via: 1.1 89cb19c6f2c9ed0983294d3b12e80e43.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA53-C1
x-amzn-requestid: 331c58b9-6f33-4965-bc64-72dfe32b4165
access-control-allow-methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
content-type: application/json
access-control-allow-origin: *
x-amzn-trace-id: Root=1-61737e5d-73ac9eba2359e3ba2950aa0e;Sampled=0
x-cache: Miss from cloudfront
x-amz-apigw-id: HpCunFyqoAMFaCQ=
content-length: 76
x-amz-cf-id: _g4CWJjp_fMVGs7Egc1u1T1pmLxMHODJQT-qyvr64yJ9PKmyxyni4w==
access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token

OPTIONS
H2 200 GetLyticsUserData
dnzkifeab6.execute-api.us-east-1.amazonaws.com/Prod/ Frame 0
0 318ms
279ms Preflight
application/json 143.204.215.89
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dnzkifeab6.execute-api.us-east-1.amazonaws.com/Prod/GetLyticsUserData
Protocol: H2
Server: 143.204.215.89 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-89.fra53.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://pro.oxfordincomeletter.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

content-type: application/json
content-length: 3
date: Sat, 23 Oct 2021 03:15:41 GMT
x-amzn-requestid: bf2abc00-eb39-482d-a2d5-ed0ac18d0f74
access-control-allow-origin: *
access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token
x-amz-apigw-id: HpCukFpuIAMFb7Q=
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
x-cache: Miss from cloudfront
via: 1.1 89cb19c6f2c9ed0983294d3b12e80e43.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA53-C1
x-amz-cf-id: Bt46eZZiu4mxK6MIOpm9haNV9q6E2OzFopNvNOWwbA-zZCPkndP4Gg==

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 124 KB
48 KB 28ms
27ms Script
application/javascript 216.58.212.136
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-4H7QL840N8&l=dataLayer&cx=c

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.136 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f3e6828b85a4cde24ef43878f410da0f0b89bff2d4bef623c4f3c5841917dc74

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:40 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 49456
x-xss-protection: 0
expires: Sat, 23 Oct 2021 03:15:40 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 70ms
20ms Script
text/javascript 142.250.185.78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

fc27aed7787a4f63d2feba50e6bc6122ac3c5479456d40c0a445899a08ad92f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 19 Oct 2021 16:47:48 GMT
server: Golfe2
age: 4506
date: Sat, 23 Oct 2021 02:00:34 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 19887
expires: Sat, 23 Oct 2021 04:00:34 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 193 KB
49 KB 35ms
35ms Script
application/javascript 216.58.212.136
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-NKXCSCL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.136 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d889e4e4db7faca6fc00a84693394cbf225aed8473e807da3fcf9e40a10cd589

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:40 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 50183
x-xss-protection: 0
last-modified: Sat, 23 Oct 2021 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 23 Oct 2021 03:15:40 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 218 KB
67 KB 38ms
38ms Script
application/javascript 216.58.212.136
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WP5R8BX

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.136 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

dc2fb94862f6813d4a0b0eeb9f499faefcfa83858567f8cd71ba8d4d0cbe3acd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:40 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 68818
x-xss-protection: 0
last-modified: Sat, 23 Oct 2021 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 23 Oct 2021 03:15:40 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 34 KB
10 KB 58ms
28ms Script
application/javascript 13.107.21.200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.107.21.200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: d891455e32c9a425e36e190047b1f58abeb7e3709eff687134ddea7ac9cfdd3b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:40 GMT
content-encoding: gzip
last-modified: Wed, 06 Oct 2021 19:11:47 GMT
x-msedge-ref: Ref A: 4AAE72E503E4438CB003FC760B12A256 Ref B: FRA31EDGE0514 Ref C: 2021-10-23T03:15:40Z
etag: "805b72e6bad71:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 10001

POST
H2 200 portrait Show response
c.lytics.io/c/9c32784e3cc4888a693a7988ad64c63d/ Frame 826E 0
298 B 129ms
129ms Document
text/html 104.26.2.22
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.lytics.io/c/9c32784e3cc4888a693a7988ad64c63d/portrait

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.2.22 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000;

Request headers

:method: POST
:authority: c.lytics.io
:scheme: https
:path: /c/9c32784e3cc4888a693a7988ad64c63d/portrait
content-length: 2324
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
origin: https://pro.oxfordincomeletter.com
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
accept-encoding: gzip, deflate, br
cookie: seerid=fe8cd8a4-2193-442c-b6f5-cbd2d8861b0e
Upgrade-Insecure-Requests: 1
Origin: https://pro.oxfordincomeletter.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Sat, 23 Oct 2021 03:15:41 GMT
content-type: text/html
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Cookie, *
access-control-allow-methods: GET, POST
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
expires: 0
pragma: no-cache
strict-transport-security: max-age=63072000;
via: 1.1 google
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hEpZIcMFlMLcRu72jq6ejQw1E041%2B8fif8UlBCOzuSrMhU0QwPeE%2Ba3iO1%2BRPR0NhF5WxHxsYz2IcFinyU%2BJEiyWvXLFM6n2ouQcTNtR6UFi%2FP7RlJ8XByEo0sed"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 6a27cd64db0365e0-LHR
content-encoding: br

GET
H2 200 cm
trc.taboola.com/sg/lytics/1/ 43 B
230 B 36ms
14ms Image
image/gif 151.101.65.44
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trc.taboola.com/sg/lytics/1/cm?redirect=https%3A%2F%2Fc.lytics.io%2Fc%2Fprovider%2Ftaboola%3Ftaboola_id%3D%3CTUID%3E%26_uid%3Dfe8cd8a4-2193-442c-b6f5-cbd2d8861b0e%26account_id%3D9c32784e3cc4888a693a7988ad64c63d
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 0d9762a1a60deef8aa093c473ad27c38eed77184d6940e7df06d89d77cbd3e94

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-vcl-time-ms: 9
pragma: no-cache
date: Sat, 23 Oct 2021 03:15:40 GMT
via: 1.1 varnish
server: nginx
x-timer: S1634958941.978795,VS0,VE9
x-served-by: cache-hhn4021-HHN
x-cache: MISS
cache-control: no-cache, no-store
accept-ranges: bytes
x-cache-hits: 0

POST
H2 204 collect
www.google-analytics.com/g/ 0
178 B 37ms
37ms Ping
text/plain 142.250.185.78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-4H7QL840N8&gtm=2oeak0&_p=2036662425&sr=1600x1200&ul=en-us&cid=1585725103.1634958941&_s=1&dl=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&dt=The%20Oxford%20Club&sid=1634958940&sct=1&seg=0&en=page_view&_fv=1&_nsi=1&_ss=1&ep.clientid=01075474-f10b-4c46-b242-8e4d27a90973&ep.storage=none
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-4H7QL840N8&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.185.78 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s48-in-f14.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:15:40 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://pro.oxfordincomeletter.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 15322609.js Show response
bat.bing.com/p/action/ 0
111 B 30ms
30ms Script
text/plain 13.107.21.200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/p/action/15322609.js
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.107.21.200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ARR/3.0
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

access-control-allow-origin: *
date: Sat, 23 Oct 2021 03:15:40 GMT
cache-control: private,max-age=1800
x-msedge-ref: Ref A: 1420E1ED76E448769AE2769D78E93142 Ref B: FRA31EDGE0514 Ref C: 2021-10-23T03:15:40Z
x-powered-by: ARR/3.0
x-cache: CONFIG_NOCACHE

GET
H2 204 0
bat.bing.com/action/ 0
151 B 30ms
30ms Image
text/plain 13.107.21.200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=15322609&Ver=2&mid=8e4be9cd-dafc-4ec8-853e-db8264ac8d91&sid=8081fee033af11ec812cfdb623060f3d&vid=8082239033af11eca51c037da1b61611&vids=1&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=The%20Oxford%20Club&p=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&r=&lt=2924&evt=pageLoad&msclkid=N&sv=1&rn=473892
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.107.21.200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Sat, 23 Oct 2021 03:15:40 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: 5C2315B1E853459EB73F532DD7F6D9E0 Ref B: FRA31EDGE0514 Ref C: 2021-10-23T03:15:40Z
x-cache: CONFIG_NOCACHE
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 tfa.js Show response
cdn.taboola.com/libtrc/unip/1246441/ 74 KB
25 KB 15ms
6ms Script
application/javascript 151.101.65.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.taboola.com/libtrc/unip/1246441/tfa.js
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: be68fc7b9e696fe1d0c94d496e1efaae80fdff6c91f90846a05986b05bad2974

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-version-id: 1BOr.DF6FafTrAv2TKnVw0VPmpsYauuQ
content-encoding: gzip
etag: "8bfd817205717cb831fcf2d56bfcef7f"
age: 3
x-cache: HIT
x-amz-replication-status: COMPLETED
content-length: 24755
x-amz-id-2: NxoI/p8uIU1n656ooHkOjYQOjAFpF6EwFuIfy+fjz9T9G1tZD+lsP3dBfL6WZpOp4iox/OsJ/Dg=
x-served-by: cache-hhn4021-HHN
last-modified: Mon, 09 Aug 2021 10:25:51 GMT
server: AmazonS3
x-timer: S1634958941.035005,VS0,VE1
date: Sat, 23 Oct 2021 03:15:41 GMT
vary: Accept-Encoding
x-amz-request-id: YMDK2BY78SAWRDRY
via: 1.1 varnish
cache-control: private,max-age=14401
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
abp: 34
x-cache-hits: 1

GET
H2 200 ld.js Show response
static.criteo.net/js/ld/ 41 KB
14 KB 302ms
16ms Script
text/javascript 178.250.2.130
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.criteo.net/js/ld/ld.js
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.130 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: nginx /
Resource Hash: a1fddf4d5fec5f577b977db5c16c6582c1768324262382650fce903a37d73ab6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:41 GMT
content-encoding: gzip
last-modified: Tue, 05 Oct 2021 08:29:00 GMT
server: nginx
etag: W/"615c0ccc-a373"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 24 Oct 2021 03:15:41 GMT

GET
H2 200 pixel.js Show response
cdn.mediago.io/js/ 50 KB
50 KB 147ms
7ms Script
application/javascript 143.204.98.33
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mediago.io/js/pixel.js
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.33 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-33.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3619564fcb70044c9486cd9e1e6cd1608298be072b370e86245a8e94c40326bf

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-version-id: null
via: 1.1 9eb0e845437929074828e0cf53f179af.cloudfront.net (CloudFront)
last-modified: Fri, 19 Mar 2021 06:31:13 GMT
server: AmazonS3
age: 44372
etag: "b9096ce53c2981aca3018eae3e1bed09"
x-cache: Hit from cloudfront
content-type: application/javascript
date: Fri, 22 Oct 2021 15:01:32 GMT
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-length: 50770
x-amz-cf-id: hmAjZHKa1ekgCDFA2z9XGvODiqRfv6-eqX01QoRRZER5Lhdw86L30Q==

GET
H2 200 a-03e6.min.js Show response
b-code.liadm.com/ 26 KB
10 KB 49ms
7ms Script
application/javascript 18.66.97.53
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://b-code.liadm.com/a-03e6.min.js
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.53 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: ZIO-Http /
Resource Hash: c2617f22bd868fb2c199b2ccaf6df1cf44cb86bfd98427ce79447ca498adf9e3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 22 Oct 2021 08:09:12 GMT
via: 1.1 83f1b8f73f37458f38e2ee1fc0b9e68d.cloudfront.net (CloudFront)
server: ZIO-Http
age: 68789
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=86400
x-amz-cf-pop: FRA56-P2
content-encoding: gzip
x-amz-cf-id: qXgK7n9J4GU-orqXUY6Q62kudhiOTmrHEJ_GscMYZihaC2bTtX7LkA==

GET
H2 200 theoxfordclub_lander.js Show response
cdn1.lockerdomecdn.com/tracking/ 745 B
1 KB 99ms
14ms Script
application/javascript 18.66.248.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn1.lockerdomecdn.com/tracking/theoxfordclub_lander.js
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.248.14 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 4181a1a1202754a6b3bf4bf86f8726fb51d396251654ad7c809f61f7f9664487

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-version-id: w.S.KZ5iqal8eH2fQrjJ8KmAu_HOoMbJ
via: 1.1 2c4f54cad5da50a372b086710d5ffc62.cloudfront.net (CloudFront)
last-modified: Fri, 08 Jan 2021 21:54:50 GMT
server: AmazonS3
x-amz-cf-pop: DUS51-P1
etag: "ba9cc8d3ba3137f302e0d39848e07850"
x-cache: Hit from cloudfront
content-type: application/javascript
date: Sat, 23 Oct 2021 03:15:41 GMT
accept-ranges: bytes
content-length: 745
x-amz-cf-id: zP_Xc7BjQRsfW9umaCrMVk9aX8YeMAnj08n0CsSwn2r8gNtnrvwqPw==

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 98 KB
26 KB 22ms
7ms Script
application/x-javascript 185.60.216.19
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.60.216.19 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

4b5e988359c30afd1d84b7a5118296f1fc33f4527d530b096ca27aa7fbfef99a

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 25969
x-xss-protection: 0
pragma: public
x-fb-debug: 9D3v9ZewaktrY+61nKdB9pFW5ljl5P7SEHiWDCzUBEIvjhkaVMPPhDWnzDv7Ac3SwCKmy2jDpcs8vp8k9qrVoQ==
x-fb-trip-id: 2050670934
x-frame-options: DENY
date: Sat, 23 Oct 2021 03:15:41 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 37 KB
15 KB 80ms
31ms Script
text/javascript 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

ea0ccf3eab05a27a83fdc3a0c60ede70d4d2f18bf8be6cbdcc221d43ad5686ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 14430
x-xss-protection: 0
server: cafe
etag: 16924264664223707549
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sat, 23 Oct 2021 03:15:41 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 14 KB
6 KB 39ms
6ms Script
application/javascript 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4da3e3aa30b5b06390d7e7e3fcfb16d648909eb429d161c2748bd6d79a7ec5fb

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:41 GMT
content-encoding: gzip
last-modified: Mon, 20 Sep 2021 23:58:10 GMT
etag: "8dc11b7ca1d5ed9ec3b1ab1beb621c75+gzip+gzip"
vary: Accept-Encoding,Host
x-tw-cdn: FT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-geo-cc_and_ra: DE-HE
cache-control: no-cache
x-cache: HIT, HIT
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
content-length: 5410
x-served-by: cache-iad-kcgs7200095-IAD, cache-fra19153-FRA

GET
H2 200 mgsensor.js Show response
a.mgid.com/ 12 KB
4 KB 136ms
108ms Script
application/javascript 104.19.133.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.mgid.com/mgsensor.js?d=1634958941046&source=gtm
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.133.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b127181486c082afd048feabd5f69153c3993ccccc57085e4018609ed68f43c3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:15:41 GMT
content-encoding: br
cf-cache-status: DYNAMIC
x-mg-request-uuid: d247206d-5289-4b0c-9d28-c1a54f4e4f2b
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
p3p: CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
content-type: application/javascript
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cf-ray: 6a27cd65be022163-DUS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
server: cloudflare

GET
H2 200 hotjar-925909.js Show response
static.hotjar.com/c/ 9 KB
3 KB 24ms
7ms Script
application/javascript 18.66.97.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-925909.js?sv=6

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.97.49 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

06700a581a344e55ed2950b8ad4be0f9c280da1327dd4cfabf0fee7c829f7c29

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:37 GMT
content-encoding: br
x-content-type-options: nosniff
cache-control: max-age=60
age: 4
etag: W/95e7d292ccab0d4a88866059967f9d72
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
x-cache-hit: 1
x-amz-cf-pop: FRA56-P2
x-amz-cf-id: CS23UP2dvQmyUMqgyb026RKX9fHrshK5i5nxmFxmur_SjJm28Qoxeg==
via: 1.1 985c0b2ec44bdebc7f24f26d1e427d31.cloudfront.net (CloudFront)

GET
H2 200 siteanalyze_6255350.js Show response
siteimproveanalytics.com/js/ 48 B
850 B 64ms
22ms Script
application/javascript 172.67.145.176
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://siteimproveanalytics.com/js/siteanalyze_6255350.js
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.145.176 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8708150ed307463ea1670f6644f73ec82e3b6e8d6ff95be629b1ba4727f31ac7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:41 GMT
content-encoding: gzip
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5063
cf-ray: 6a27cd65dba63a81-CDG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 68
x-amz-id-2: t2uDfNgqEDSwBByvHpWOpEkNp9f289PuN8APheSQidDr9Q2stQcUpOeh3veg8g5mJJJro/jRpGI=
last-modified: Fri, 23 Aug 2019 22:14:39 GMT
server: cloudflare
etag: "6ef42917cbd55a82896411683d106194"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zQILwXWrZY57rDNrOm8I4v6WWSz9AeQy1XJQ%2BbBcAuykcqfIxbVqhN4EP5LQY6q%2F0O%2FxAbF8CmCtZ%2BbBsKgJgC5h1Ep%2F%2FDmdidYdtgEQkJGXCp0vRNfMWFgRAUgfeYur%2FZ2MKEHSJBoD68g%3D"}],"group":"cf-nel","max_age":604800}
x-amz-request-id: QHW739YACP287ZT7
cache-control: max-age=86400, no-transform
accept-ranges: bytes
content-type: application/javascript; charset=utf-8

GET
H/1.1 200
OK obtp.js Show response
amplify.outbrain.com/cp/ 8 KB
3 KB 24ms
8ms Script
application/x-javascript 2.18.234.190
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://amplify.outbrain.com/cp/obtp.js
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.190 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-190.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 998d9415269d92557b561a936955f7590d5052865044a9191a528b5a36f3afc9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 23 Oct 2021 03:15:41 GMT
Content-Encoding: gzip
Last-Modified: Mon, 04 Oct 2021 12:12:10 GMT
Server: AkamaiNetStorage
ETag: "973e2603f46b719eecf8139c22b897a0:1633349530.816673"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=1200
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3150
Expires: Sat, 23 Oct 2021 03:35:41 GMT

GET
H2 200 setup.js Show response
at-api.tribeos.io/a/5e554fee6b742527f85286135595/ 272 KB
73 KB 200ms
110ms Script
application/javascript 172.67.71.170
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://at-api.tribeos.io/a/5e554fee6b742527f85286135595/setup.js
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.71.170 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d6f1b5f056c6c046b95445a24615abd8cdbb41a3242e94fbee1b650b66dab0a0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:41 GMT
content-encoding: br
cf-cache-status: STALE
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5071933
access-control-allow-methods: PUT, GET, POST, DELETE, OPTIONS, PATCH
last-modified: Wed, 25 Aug 2021 10:23:28 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2YgM8xev4pJMVGYUHnH9EV%2BeC40XF5kd8qb7a6BSFZOFAd9Q9YeCV8cJTmqtPpqTUAe%2Fo8vtU%2B06dEfK%2F3VOk%2Fybsjz7AGIWs6CSL9%2BhQzuQWl0msoAEuwBHDVm8%2ForsVTJG"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: Content-Range
cache-control: public, max-age=14400
access-control-allow-credentials: true
cf-ray: 6a27cd665fb23fea-CDG
access-control-allow-headers: authorization, Origin, X-Requested-With, Content-Type, Accept

GET
H2 200 ytc.js Show response
s.yimg.com/wi/ 15 KB
6 KB 62ms
18ms Script
application/javascript 87.248.118.22
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

87.248.118.22 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

b9e6c38b3493790e6525ba6715ad839211cab5db3ddc80c7f70f20f92679fee6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Sat, 23 Oct 2021 02:46:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1725
x-amz-server-side-encryption: AES256
vary: Origin, Accept-Encoding
content-length: 5639
x-amz-id-2: UJJJZI47UST4fBeP0SEv8+KgrHwofNl8LKd75mbZbStfjTy3Wsjrq7D8XDG43fHU8fpCX3099E0=
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Sat, 02 Jul 2022 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Thu, 27 May 2021 13:00:20 GMT
server: ATS
etag: "6de43f1c725d89777edaa2bc5d679ecb-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
x-amz-request-id: JF8FPGJ2S48C018V
x-xss-protection: 1; mode=block
cache-control: public,max-age=3600
x-amz-version-id: Bv0RNzsjZsSn6kGrZjdvdggYqc20u__d
accept-ranges: bytes
content-type: application/javascript

GET
H2 200 Bootstrap.js Show response
nexus.ensighten.com/choozle/10601/ 28 KB
9 KB 33ms
8ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/choozle/10601/Bootstrap.js
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: ae0883bbbe025eb521b7d73a647ff8e637f863801eb16bbbc4f94069bc17e483

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:41 GMT
content-encoding: gzip
last-modified: Tue, 04 May 2021 17:13:48 GMT
server: nginx
etag: W/"609180cc-6e77"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=300

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
420 B 63ms
20ms XHR
text/plain 142.251.5.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j94&tid=UA-148998105-6&cid=01075474-f10b-4c46-b242-8e4d27a90973&jid=1547953279&gjid=559513229&_gid=931646816.1634958941&_u=YKAAgAABAAAAAE~&z=1050605191

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.5.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wg-in-f155.1e100.net

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Sat, 23 Oct 2021 03:15:41 GMT
content-type: text/plain
access-control-allow-origin: https://pro.oxfordincomeletter.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 64ms
33ms XHR
text/plain 142.250.185.78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j94&a=2036662425&t=pageview&_s=1&dl=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&ul=en-us&de=UTF-8&dt=The%20Oxford%20Club&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YKDAAEABAAAAAG~&jid=981983878&gjid=1074340642&cid=1585725103.1634958941&tid=UA-112639049-5&_gid=1737979553.1634958941&_r=1&gtm=2wgak0WP5R8BX&z=1139343086

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:15:41 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://pro.oxfordincomeletter.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 55ms
33ms XHR
text/plain 142.250.185.78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j94&a=2036662425&t=pageview&_s=1&dl=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&ul=en-us&de=UTF-8&dt=The%20Oxford%20Club&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YKDAAEABAAAAAG~&jid=633073370&gjid=997063547&cid=1585725103.1634958941&tid=UA-148806141-1&_gid=1737979553.1634958941&_r=1&gtm=2wgak0WP5R8BX&z=1491415047

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:15:41 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://pro.oxfordincomeletter.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 48ms
26ms Image
image/gif 142.250.185.78
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j94&a=2036662425&t=pageview&_s=1&dl=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&ul=en-us&de=UTF-8&dt=The%20Oxford%20Club&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YKAAgAAB~&jid=1547953279&gjid=559513229&cid=01075474-f10b-4c46-b242-8e4d27a90973&tid=UA-148998105-6&_gid=931646816.1634958941&gtm=2wgak0KTM4C7C&cd1=WBRKXA00&cd2=1634958940474&cd3=fe8cd8a4-2193-442c-b6f5-cbd2d8861b0e&cd5=01075474-f10b-4c46-b242-8e4d27a90973&cd6=_855y1h8r2r3&cd7=BRK%20Forever&cd8=W%20-%20Internal%20Website&cd9=Website%20Link&cd10=WX%20-%20Website%20External&cd11=WEALTHRE&cd12=Subscription&cd13=promo%20page&cd14=ForeverTO49%20(Video)%20No%20Abandon&cd16=ForeverTO49%20(Video)&cd17=video&cd18=Website%20Link&cd19=BRK&cd20=FrontEnd&z=2121967535

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 22 Oct 2021 18:04:40 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 33061
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 json Show response
trc.taboola.com/1246441/trc/3/ 2 KB
1 KB 20ms
20ms Script
application/javascript 151.101.65.44
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://trc.taboola.com/1246441/trc/3/json?tim=1634958941128&data=%7B%22id%22%3A873%2C%22ii%22%3A%22%2Fp%2Fforeverto79brklt2yrdsosaosalttot%2Fwbrkxa00%22%2C%22it%22%3A%22video%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22vi%22%3A1634958941124%2C%22cv%22%3A%2220210809-3-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue%22%2C%22e%22%3Anull%2C%22cb%22%3A%22TFASC.trkCallback%22%2C%22qs%22%3A%22%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-tracking%22%2C%22s%22%3A0%2C%22uim%22%3A%22rbox-tracking%3Apub%3Doxfordclub-sc-sc%3Aabp%3D0%22%2C%22uip%22%3A%22rbox-tracking%22%2C%22orig_uip%22%3A%22rbox-tracking%22%7D%5D%2C%22mpv%22%3Atrue%2C%22supv%22%3Atrue%2C%22mpvd%22%3A%7B%22en%22%3A%22page_view%22%2C%22tim%22%3A1634958941127%2C%22ref%22%3Anull%2C%22item-url%22%3A%22https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue%22%2C%22tos%22%3A2%2C%22ssd%22%3A1%2C%22scd%22%3A100%2C%22supv%22%3Atrue%7D%7D&pubit=i
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 46ac87f4bba0d48259f767466cb04db94d51f353ed723f602ec9985be0b856d3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-vcl-time-ms: 14
date: Sat, 23 Oct 2021 03:15:41 GMT
content-encoding: gzip
server: nginx
x-timer: S1634958941.132953,VS0,VE14
x-served-by: cache-hhn4021-HHN
vary: Accept-Encoding
x-cache: MISS
p3p: policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin: *
access-control-allow-credentials: true
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
x-cache-hits: 0

GET
H3 200 383440592325124 Show response
connect.facebook.net/signals/config/ 305 KB
87 KB 106ms
98ms Script
application/x-javascript 185.60.216.19
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/383440592325124?v=2.9.47&r=stable

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

185.60.216.19 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

7c1d746bc3a687e360e8dab100bd8429ee643942efec81fb0984ac9190768b9c

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: QVgo2hR4A1Vn0XRrEdbhmBgKzNWVOPgHWBwao0RxzMrAxnc2qhJ4BxV0np7slcyY+Fcea5GbL9RIr3uUEV5vVQ==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Sat, 23 Oct 2021 03:15:41 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
472 B 85ms
31ms Image
image/gif 142.250.185.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j94&tid=UA-148998105-6&cid=01075474-f10b-4c46-b242-8e4d27a90973&jid=1547953279&_u=YKAAgAABAAAAAE~&z=331918360

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:15:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
472 B 83ms
34ms Image
image/gif 142.250.185.195
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j94&tid=UA-148998105-6&cid=01075474-f10b-4c46-b242-8e4d27a90973&jid=1547953279&_u=YKAAgAABAAAAAE~&z=331918360

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.195 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

server-52-222-236-74.fra56.r.cloudfront.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:15:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
25 B 48ms
23ms XHR
text/plain 142.251.5.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j94&tid=UA-112639049-5&cid=1585725103.1634958941&jid=981983878&gjid=1074340642&_gid=1737979553.1634958941&_u=YKDAAEABAAAAAG~&z=1811300130

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.5.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wg-in-f155.1e100.net

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Sat, 23 Oct 2021 03:15:41 GMT
content-type: text/plain
access-control-allow-origin: https://pro.oxfordincomeletter.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 modules.bff3b8d60820fc90decc.js Show response
script.hotjar.com/ 222 KB
59 KB 24ms
8ms Script
application/javascript 52.222.236.74
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.bff3b8d60820fc90decc.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.236.74 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

da4c70755f82ff615c0fd3cad94bf62b19a9d5c25ab87268097eaa9609098bec

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 21 Oct 2021 13:21:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 136475
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 59887
access-control-allow-origin: *
last-modified: Thu, 21 Oct 2021 13:20:57 GMT
etag: "e6ca8fed932ccfd7b742e0e3ecb6d422"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 d9bcd0a29e17b9290f8c9f1617335955.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA56-P4
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: Qy0ZD5KTdYaMivYCT_CxcoGKEQvUr-Zk-gm5YLL3_FqZ4H7dXEqNMg==

GET
H/1.1 200
OK cachedClickId Show response
tr.outbrain.com/ 35 B
239 B 348ms
96ms Script
application/javascript 64.202.112.95
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to

Full URL: https://tr.outbrain.com/cachedClickId?marketerId=00b7a913e0b9a7393b20d834711f3a1ceb,0040752ca591876c6ab7eb366d24329d4d
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.202.112.95 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: 1d348f9f803c95305f63def9d75fd50e79e54a375e1a4a888edbbea366845580

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 23 Oct 2021 03:15:41 GMT
content-encoding: gzip
X-TraceId: f7223d77936ff00ac2138521ad9fe602
Content-Length: 56
Content-Type: application/javascript

GET
H/1.1 200
OK unifiedPixel
tr.outbrain.com/ 43 B
256 B 337ms
85ms Image
image/gif 64.202.112.95
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.outbrain.com/unifiedPixel?marketerId=00b7a913e0b9a7393b20d834711f3a1ceb,0040752ca591876c6ab7eb366d24329d4d&obApiVersion=1.1&obtpVersion=1.5.2&name=PAGE_VIEW&dl=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&optOut=false&bust=011310224467222119
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.202.112.95 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: 33ca751ed175a163bef530ebdcdbd0a2d15997ccbcbf8d50a6f504e8ffac5a5c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 23 Oct 2021 03:15:41 GMT
Cache-Control: no-cache
X-TraceId: cd5c1f7703553928b2df912f323f7cc5
content-encoding: gzip
Content-Length: 60
Content-Type: image/gif;

GET
H3 200 ec.js Show response
www.google-analytics.com/plugins/ua/ 3 KB
1 KB 26ms
25ms Script
text/javascript 142.250.185.78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/ec.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 02:39:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1306
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sat, 23 Oct 2021 03:39:01 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
674 B 135ms
119ms Script
application/javascript 104.244.42.67
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=o2hf4&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=7204790a-2721-4e22-852f-f0a3280c97ff&tw_document_href=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&tpx_cb=twttr.conversion.loadPixels

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.67 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
x-response-time: 113
pragma: no-cache
last-modified: Sat, 23 Oct 2021 03:15:41 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: b3d51be45d36105f4f3360d107e91a8799802addfcd76c0567834b696d1db11f
x-transaction: aa22baedaa90dc97
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
234 B 121ms
120ms Script
application/javascript 104.244.42.67
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=o4a95&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=8d9da6cb-f833-45e0-a66c-59fe7ad1dec3&tw_document_href=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&tpx_cb=twttr.conversion.loadPixels

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.67 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
x-response-time: 113
pragma: no-cache
last-modified: Sat, 23 Oct 2021 03:15:41 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: b3d51be45d36105f4f3360d107e91a8799802addfcd76c0567834b696d1db11f
x-transaction: 08ae31089f85a8fc
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
471 B 129ms
112ms Image
image/gif 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=o2hf4&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=7204790a-2721-4e22-852f-f0a3280c97ff&tw_document_href=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 106
pragma: no-cache
last-modified: Sat, 23 Oct 2021 03:15:41 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 323cb1784881317c68a548bb3ac798baec7d3f5c6fe2777baa68ee6fb50117ba
x-transaction: 4b6898d7f538f5c6
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
120 B 122ms
113ms Image
image/gif 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=o4a95&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=8d9da6cb-f833-45e0-a66c-59fe7ad1dec3&tw_document_href=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 106
pragma: no-cache
last-modified: Sat, 23 Oct 2021 03:15:41 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 323cb1784881317c68a548bb3ac798baec7d3f5c6fe2777baa68ee6fb50117ba
x-transaction: eb6fbba3c1c46b8a
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/780296261/ 3 KB
1 KB 91ms
36ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/780296261/?random=1634958941151&cv=9&fst=1634958941151&num=1&label=y7pgCJrV4YwBEMXAifQC&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgak0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&tiba=The%20Oxford%20Club&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f01d1c954196c8435f19600ff1150baa9f773b35725dc7de6169a303f37d3817

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:15:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1201
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/665056240/ 3 KB
1 KB 48ms
36ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/665056240/?random=1634958941153&cv=9&fst=1634958941153&num=1&label=g1uXCMPu6dEBEPDnj70C&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgak0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&tiba=The%20Oxford%20Club&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

57b23c406c213257d434e33128387022b7c66e75706a59c9adb10edd0e012b8b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:15:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1201
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/757445324/ 3 KB
2 KB 46ms
35ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/757445324/?random=1634958941153&cv=9&fst=1634958941153&num=1&label=-SKMCMq43JYBEMzllukC&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgak0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&tiba=The%20Oxford%20Club&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0478d77b8af38fc177e23a59ebe1bb9809ed0589bb07f0ca5ac4d270e325cfa6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:15:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1199
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/707706541/ 3 KB
1 KB 42ms
41ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/707706541/?random=1634958941154&cv=9&fst=1634958941154&num=1&label=OO1KCIrRjqwBEK39utEC&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgak0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&tiba=The%20Oxford%20Club&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f2f17b3404eebb7ee66f423704356d2d91ef457b869592051273fa457f666f99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:15:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1200
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/780277278/ 2 KB
1 KB 36ms
35ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/780277278/?random=1634958941155&cv=9&fst=1634958941155&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgak0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&tiba=The%20Oxford%20Club&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f1f91bfbf0e8a3bc696ca9227e2906cfb888a137ddb4d8d5dcd4183bd651f329

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:15:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1150
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

/
www.google.de/pagead/1p-user-list/780266039/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/780266039/?random=1634958941155&cv=9&fst=1634958941155&num=1&fmt=3&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=16...
https://www.google.com/pagead/1p-user-list/780266039/?random=1634958941155&cv=9&fst=1634958000000&num=1&fmt=3&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_npl...
https://www.google.de/pagead/1p-user-list/780266039/?random=1634958941155&cv=9&fst=1634958000000&num=1&fmt=3&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplu...

42 B
64 B

35ms
35ms

Image
image/gif

142.250.185.195
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/780266039/?random=1634958941155&cv=9&fst=1634958000000&num=1&fmt=3&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgak0&sendb=1&frm=0&url=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&tiba=The%20Oxford%20Club&async=1&is_vtc=1&random=4070437912&resp=GooglemKTybQhCsO&ipr=y

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.195 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:15:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:15:41 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/gif
location: https://www.google.de/pagead/1p-user-list/780266039/?random=1634958941155&cv=9&fst=1634958000000&num=1&fmt=3&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgak0&sendb=1&frm=0&url=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&tiba=The%20Oxford%20Club&async=1&is_vtc=1&random=4070437912&resp=GooglemKTybQhCsO&ipr=y
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 10090329.json Show response
s.yimg.com/wi/config/ 2 B
451 B 54ms
20ms XHR
application/json 87.248.118.22
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/config/10090329.json

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

87.248.118.22 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 02:34:28 GMT
x-content-type-options: nosniff
age: 2473
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
x-amz-request-id: NWMMW2ENHKRBJWRC
x-amz-id-2: RI5UFeszXM0TQoERQRUUQWzNil6jAXUl0OLhwVnkGx5xT6PygWxNSu0QDtcJVI0M5JSz0+5aFtA=
referrer-policy: no-referrer-when-downgrade
server: ATS
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: public,max-age=3600
content-length: 2

GET
H2 200 10150636.json Show response
s.yimg.com/wi/config/ 46 B
426 B 54ms
20ms XHR
application/octet-stream 87.248.118.22
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/config/10150636.json

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

87.248.118.22 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

49ab5900241048e3f52a32cf9cf405ec5403001dceef55eba1f128b7809cef2b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 22 Oct 2021 11:42:47 GMT
x-content-type-options: nosniff
age: 55975
x-amz-server-side-encryption: AES256
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
x-amz-request-id: QE1KVE1H1VZWE0AJ
x-amz-id-2: xermVu1j/2jjw8Jd/6lvleKV56pq8WSLMeFs3NhKU4MuopCsNAOVdfb84gz3cXpisTfwNQRArrU=
accept-ranges: bytes
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Fri, 23 Sep 2022 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Wed, 18 Aug 2021 21:49:33 GMT
server: ATS
etag: "19b8572021b9e0a07b89bf86a82652ee"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
access-control-allow-methods: GET
x-amz-version-id: PCzhmtl0iZMXZ32Xz0RDQ5FGZ03eVIDB
access-control-allow-origin: *
x-xss-protection: 1; mode=block
content-length: 46
content-type: application/octet-stream

GET
H3 200 ga-audiences
www.google.com/ads/ 42 B
63 B 76ms
31ms Image
image/gif 142.250.185.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j94&tid=UA-112639049-5&cid=1585725103.1634958941&jid=981983878&_u=YKDAAEABAAAAAG~&z=588083474

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:15:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 34ms
34ms Image
image/gif 142.250.185.195
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j94&tid=UA-112639049-5&cid=1585725103.1634958941&jid=981983878&_u=YKDAAEABAAAAAG~&z=588083474

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.195 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

spdc.pbp.vip.ir2.yahoo.com

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:15:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 box-d09a446edefba0dcce5d5143e1840e9a.html Show response
vars.hotjar.com/ Frame 721A 2 KB
1 KB 22ms
6ms Document
text/html 18.66.112.107
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vars.hotjar.com/box-d09a446edefba0dcce5d5143e1840e9a.html
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.112.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 69ae95b7f73e2899d0c398ed4fb9faba242bbec4d0a58b182e4dd0e7808f01ac

Request headers

:method: GET
:authority: vars.hotjar.com
:scheme: https
:path: /box-d09a446edefba0dcce5d5143e1840e9a.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

content-type: text/html
content-length: 1044
date: Wed, 20 Oct 2021 07:15:05 GMT
accept-ranges: bytes
cache-control: max-age=31536000
content-encoding: br
etag: "63e08f928469ab67d9dac30c065ed182"
last-modified: Wed, 20 Oct 2021 07:15:01 GMT
x-amz-server-side-encryption: AES256
x-robots-tag: none
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 3517ce13630d84c5b14e88de469985cc.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
x-amz-cf-id: Xt7bR_8V7lMaLynHtigHHCwiRTa4x4uyRgV8oh92_A3HDJOXe4gtyg==
age: 244836

GET
H2 200 val Show response
trace.mediago.io/api/html/ Frame 7B89 12 KB
13 KB 213ms
154ms Document
text/html 143.204.98.19
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://trace.mediago.io/api/html/val?acid=null
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.19 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-19.fra50.r.cloudfront.net
Software: /
Resource Hash: 4cbf6dc99915177f6304fca1e7cbaf149e86e9871836362ef9ba56454c807765

Request headers

:method: GET
:authority: trace.mediago.io
:scheme: https
:path: /api/html/val?acid=null
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

content-type: text/html; charset=utf-8
date: Sat, 23 Oct 2021 03:15:41 GMT
x-cache: Miss from cloudfront
via: 1.1 f6c241b75ae7d21ac836339454ab90b8.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: did6_XH0hVNVcfdXxjoM1fCYIqAIBQ1KO6BsgCojfoh7RUE1vhTGjQ==

GET
H3 200 1x1.gif
a.mgid.com/ 43 B
435 B 120ms
106ms Image
image/gif 104.19.133.78
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.mgid.com/1x1.gif?id=444673&type=c&tg=&r=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&utmc=0&utmt=0&nv=1&utms=&utmcp=&utmm=&clid=&cmgid=0&cmtid=0&cmtuid=0&d=1634958941214
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.133.78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:15:41 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 6a27cd66bdd17180-DUS
p3p: CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H/1.1 200
OK sp.pl
sp.analytics.yahoo.com/ 43 B
964 B 135ms
43ms Image
image/gif 212.82.100.181
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Sat%2C%2023%20Oct%202021%2003%3A15%3A41%20GMT&n=0&b=The%20Oxford%20Club&.yp=10150636&f=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&enc=UTF-8&yv=1.10.1&tagmgr=gtm

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

212.82.100.181 , Switzerland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 23 Oct 2021 03:15:41 GMT
X-Content-Type-Options: nosniff
Age: 0
Connection: keep-alive
Content-Length: 43
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Referrer-Policy: strict-origin-when-cross-origin
Server: ATS
X-Frame-Options: DENY
Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
Strict-Transport-Security: max-age=31536000
Content-Type: image/gif
Cache-Control: no-cache, private, must-revalidate
Accept-Ranges: bytes
Expires: Sat, 23 Oct 2021 03:15:41 GMT

GET
H/1.1 200
OK sp.pl
sp.analytics.yahoo.com/ 43 B
964 B 138ms
45ms Image
image/gif 212.82.100.181
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&b=The%20Oxford%20Club&.yp=10090329&f=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&enc=UTF-8&yv=1.10.1&tagmgr=gtm

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

212.82.100.181 , Switzerland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

spdc.pbp.vip.ir2.yahoo.com

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 23 Oct 2021 03:15:41 GMT
X-Content-Type-Options: nosniff
Age: 0
Connection: keep-alive
Content-Length: 43
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Referrer-Policy: strict-origin-when-cross-origin
Server: ATS
X-Frame-Options: DENY
Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
Strict-Transport-Security: max-age=31536000
Content-Type: image/gif
Cache-Control: no-cache, private, must-revalidate
Accept-Ranges: bytes
Expires: Sat, 23 Oct 2021 03:15:41 GMT

POST
H2 200 visit-data Show response
in.hotjar.com/api/v2/client/sites/925909/ 146 B
323 B 93ms
32ms XHR
application/json 99.81.27.250
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://in.hotjar.com/api/v2/client/sites/925909/visit-data?sv=6
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.81.27.250 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-99-81-27-250.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: ab95872c4726727a3b09b1f8c28490c70b7e407e97fd93bbfb75a2ecc5faac36

Request headers

Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

date: Sat, 23 Oct 2021 03:15:41 GMT
content-encoding: br
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store
access-control-allow-credentials: true

GET
H2 204 925909 Show response
vc.hotjar.io/sessions/ 0
257 B 99ms
34ms XHR
text/plain 143.204.98.62
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vc.hotjar.io/sessions/925909?s=0.25&r=0.026692210358664203
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.62 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-62.fra50.r.cloudfront.net
Software: Python/3.7 aiohttp/3.5.4 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:41 GMT
via: 1.1 58bcd6f2e1bc29fb83f080f1743cfeca.cloudfront.net (CloudFront)
server: Python/3.7 aiohttp/3.5.4
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
access-control-allow-origin: *
cache-control: no-store
x-amz-cf-id: Sn5IGjxz2jYooal452PRwAquksG7yqpYIeue8Skyy-urqWK-j0-E-Q==

GET
H3 200 427462362080626 Show response
connect.facebook.net/signals/config/ 492 KB
144 KB 76ms
75ms Script
application/x-javascript 185.60.216.19
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/427462362080626?v=2.9.47&r=stable

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

185.60.216.19 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

2242b462d7e7f830ccabf1db18fd2f2ec04b98e446ac66c4bcdc875292a9a03b

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: V1bDZPPzq0b4IVdKpYw+L8mklwu/S65UyYMEjufEPtrvuZy0NrDMWj1hJ6sMog557ryzQBq1mHudIL+p1lWZBw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Sat, 23 Oct 2021 03:15:41 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
424 B 21ms
7ms Image
image/gif 157.240.20.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=383440592325124&ev=PageView&dl=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&rl=&if=false&ts=1634958941272&sw=1600&sh=1200&v=2.9.47&r=stable&ec=0&o=30&fbp=fb.1.1634958941271.1513136306&it=1634958941138&coo=false&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.20.35 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:41 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Sat, 23 Oct 2021 03:15:41 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/757445324/ 42 B
64 B 55ms
34ms Image
image/gif 142.250.185.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/757445324/?random=1634958941153&cv=9&fst=1634958000000&num=1&label=-SKMCMq43JYBEMzllukC&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgak0&sendb=1&frm=0&url=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&tiba=The%20Oxford%20Club&async=1&fmt=3&is_vtc=1&random=214222142&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:15:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.de/pagead/1p-user-list/757445324/ 42 B
64 B 69ms
37ms Image
image/gif 142.250.185.195
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/757445324/?random=1634958941153&cv=9&fst=1634958000000&num=1&label=-SKMCMq43JYBEMzllukC&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgak0&sendb=1&frm=0&url=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&tiba=The%20Oxford%20Club&async=1&fmt=3&is_vtc=1&random=214222142&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.195 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:15:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/780296261/ 42 B
64 B 51ms
31ms Image
image/gif 142.250.185.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/780296261/?random=1634958941151&cv=9&fst=1634958000000&num=1&label=y7pgCJrV4YwBEMXAifQC&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgak0&sendb=1&frm=0&url=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&tiba=The%20Oxford%20Club&async=1&fmt=3&is_vtc=1&random=2527830101&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:15:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.de/pagead/1p-user-list/780296261/ 42 B
64 B 69ms
38ms Image
image/gif 142.250.185.195
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/780296261/?random=1634958941151&cv=9&fst=1634958000000&num=1&label=y7pgCJrV4YwBEMXAifQC&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgak0&sendb=1&frm=0&url=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&tiba=The%20Oxford%20Club&async=1&fmt=3&is_vtc=1&random=2527830101&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.195 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:15:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/665056240/ 42 B
64 B 52ms
33ms Image
image/gif 142.250.185.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/665056240/?random=1634958941153&cv=9&fst=1634958000000&num=1&label=g1uXCMPu6dEBEPDnj70C&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgak0&sendb=1&frm=0&url=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&tiba=The%20Oxford%20Club&async=1&fmt=3&is_vtc=1&random=711816846&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:15:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.de/pagead/1p-user-list/665056240/ 42 B
64 B 67ms
36ms Image
image/gif 142.250.185.195
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/665056240/?random=1634958941153&cv=9&fst=1634958000000&num=1&label=g1uXCMPu6dEBEPDnj70C&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgak0&sendb=1&frm=0&url=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&tiba=The%20Oxford%20Club&async=1&fmt=3&is_vtc=1&random=711816846&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.195 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:15:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/780277278/ 42 B
64 B 32ms
31ms Image
image/gif 142.250.185.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/780277278/?random=1634958941155&cv=9&fst=1634958000000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgak0&sendb=1&frm=0&url=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&tiba=The%20Oxford%20Club&async=1&fmt=3&is_vtc=1&random=2255273127&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:15:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.de/pagead/1p-user-list/780277278/ 42 B
64 B 48ms
38ms Image
image/gif 142.250.185.195
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/780277278/?random=1634958941155&cv=9&fst=1634958000000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgak0&sendb=1&frm=0&url=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&tiba=The%20Oxford%20Club&async=1&fmt=3&is_vtc=1&random=2255273127&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.195 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:15:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/707706541/ 42 B
64 B 32ms
32ms Image
image/gif 142.250.185.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/707706541/?random=1634958941154&cv=9&fst=1634958000000&num=1&label=OO1KCIrRjqwBEK39utEC&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgak0&sendb=1&frm=0&url=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&tiba=The%20Oxford%20Club&async=1&fmt=3&is_vtc=1&random=2287227218&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:15:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.de/pagead/1p-user-list/707706541/ 42 B
64 B 46ms
37ms Image
image/gif 142.250.185.195
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/707706541/?random=1634958941154&cv=9&fst=1634958000000&num=1&label=OO1KCIrRjqwBEK39utEC&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgak0&sendb=1&frm=0&url=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&tiba=The%20Oxford%20Club&async=1&fmt=3&is_vtc=1&random=2287227218&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.195 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:15:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 3680 11 KB
5 KB 144ms
15ms Document
text/html 178.250.2.146
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?topUrl=pro.oxfordincomeletter.com&origin=onetag

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

9413ac70f0dfa293eae8e934799be6a1cde8cd96db876ce9bd127c41630847ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:method: GET
:authority: gum.criteo.com
:scheme: https
:path: /syncframe?topUrl=pro.oxfordincomeletter.com&origin=onetag
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

cache-control: private, max-age=3600
content-type: text/html; charset=utf-8
content-encoding: gzip
vary: Accept-Encoding
strict-transport-security: max-age=31536000
cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
server-processing-duration-in-ticks: 1847
set-cookie: uid=d130bbcb-fef6-41fa-ba69-eefd37085be3; expires=Thu, 17 Nov 2022 03:15:41 GMT; domain=.criteo.com; path=/; secure; samesite=none
date: Sat, 23 Oct 2021 03:15:40 GMT
content-length: 4683

GET
H2 200 serverComponent.php Show response
nexus.ensighten.com/choozle/10601/ 274 B
416 B 20ms
20ms Script
text/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/choozle/10601/serverComponent.php?r=9997146842.148357&namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/choozle/10601/code/&publishedOn=Tue%20May%2004%2017:13:48%20GMT%202021&ClientID=923&PageID=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 255c5c3d2a9258783bf9bae782d97f9f7eb6f6a0b07d4953a8735a82ea37edb7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:41 GMT
cache-control: no-cache, no-store
server: nginx
content-type: text/javascript
content-length: 274
expires: Sat, 23 Oct 2021 03:15:40 GMT

GET
H2 200 dc351ef2c1b360e6750940e41d872348.js Show response
nexus.ensighten.com/choozle/10601/code/ 2 KB
553 B 7ms
7ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/choozle/10601/code/dc351ef2c1b360e6750940e41d872348.js?conditionId0=421905
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: c1a3eadb48a1958597631aa02d82267a534882124011e5de97cbf2be2e490c56

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:41 GMT
content-encoding: gzip
last-modified: Tue, 20 Apr 2021 16:02:55 GMT
server: nginx
etag: W/"607efb2f-746"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000

GET
H3 200 2337243036594698 Show response
connect.facebook.net/signals/config/ 226 KB
68 KB 47ms
47ms Script
application/x-javascript 185.60.216.19
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/2337243036594698?v=2.9.47&r=stable

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

185.60.216.19 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

9a5802a33aa6c4d99c7f536c19a93283ff9fa11cec89b837d489dd1ead7caabf

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: VzJP4d0uj+YB2gQ573uURsBjfPGf8Yn0qVdokRm0GOY5d11mG8T2856BMteheFmYKqVThzkahHB+q7Ui3hxrPA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Sat, 23 Oct 2021 03:15:41 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 /
www.facebook.com/tr/ 44 B
91 B 16ms
7ms Image
image/gif 157.240.20.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=427462362080626&ev=PageView&dl=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&rl=&if=false&ts=1634958941436&sw=1600&sh=1200&v=2.9.47&r=stable&ec=0&o=30&fbp=fb.1.1634958941271.1513136306&it=1634958941138&coo=false&rqm=GET

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.20.35 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

ec2-34-206-124-188.compute-1.amazonaws.com

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:41 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
expires: Sat, 23 Oct 2021 03:15:41 GMT

GET
H2 200 pathfora.min.js Show response
c.lytics.io/static/ 101 KB
22 KB 37ms
37ms Script
text/javascript 104.26.2.22
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.lytics.io/static/pathfora.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.2.22 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3026705f0b903b7d393557aa659e53895313ccdc657e5118e8976a9254d2b00e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

cf-ray: 6a27cd682d7c65e0-LHR
date: Sat, 23 Oct 2021 03:15:41 GMT
via: 1.1 google
cf-cache-status: HIT
last-modified: Fri, 01 Oct 2021 22:29:24 GMT
server: cloudflare
age: 1451
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CEsHdosMKmOGmqNeBeQAcGJCODnicwlMldyiW2DPDuN%2F5eLM1qyCjXWrOE8aZ21wXs%2FUvjA%2FWdIRWnK1TkLuYbadeki%2FEiGEZQ4cBWrl71HMohBnSvymGMVL8flg"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript; charset=utf-8
cache-control: max-age=7200
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=63072000;
content-encoding: br

GET
H2

200

j Show response
rp.liadm.com/
Redirect Chain

https://rp.liadm.com/j?tna=v2.1.0&aid=a-03e6&wpn=lc-bundle&pu=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f...
https://rp.liadm.com/j?tna=v2.1.0&aid=a-03e6&wpn=lc-bundle&pu=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f...

13 B
589 B

93ms
93ms

XHR
application/json

34.206.124.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://rp.liadm.com/j?tna=v2.1.0&aid=a-03e6&wpn=lc-bundle&pu=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&duid=84f9f284006b--01fjnjb75fbkdzcs1j19ky7q5m&se=e30&dtstmp=1634958941476&n3pc=true

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.206.124.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

nginx/1.18.0 /

Resource Hash

efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:41 GMT
x-pixel-event-id: 9ca2753f-c648-4195-a5a9-593c187c3dbe
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
request-time: 1
vary: Origin
content-length: 13
x-xss-protection: 1; mode=block
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
server: nginx/1.18.0
x-frame-options: DENY
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/json
access-control-allow-origin: https://pro.oxfordincomeletter.com
access-control-allow-credentials: true
trace-id: 26afd01f357ecc8b

Redirect headers

date: Sat, 23 Oct 2021 03:15:41 GMT
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
server: nginx/1.18.0
vary: Origin
location: /j?tna=v2.1.0&aid=a-03e6&wpn=lc-bundle&pu=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&duid=84f9f284006b--01fjnjb75fbkdzcs1j19ky7q5m&se=e30&dtstmp=1634958941476&n3pc=true
x-frame-options: DENY
access-control-allow-origin: https://pro.oxfordincomeletter.com
x-xss-protection: 1; mode=block
x-permitted-cross-domain-policies: master-only
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
trace-id: 317c1da28f828e56
request-time: 0
content-length: 0
x-content-type-options: nosniff

GET
H3 200 2275199989273587 Show response
connect.facebook.net/signals/config/ 224 KB
67 KB 62ms
61ms Script
application/x-javascript 185.60.216.19
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/2275199989273587?v=2.9.47&r=stable

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

185.60.216.19 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

3b5ff3b4df2c343f0c504d2e28bb9a67991b2737859191ba10e35e3c3af45b86

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: h8P3AVNd5rpNak6oX32Kwg4bBY0HbrPPlHsXpnS6XMmW8yUpFoYCn27PQMs/sMUD8kFoR6UFqSusVs1/Dpq+tg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Sat, 23 Oct 2021 03:15:41 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 /
www.facebook.com/tr/ 44 B
88 B 7ms
7ms Image
image/gif 157.240.20.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=2337243036594698&ev=PageView&dl=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&rl=&if=false&ts=1634958941499&sw=1600&sh=1200&v=2.9.47&r=stable&ec=0&o=28&fbp=fb.1.1634958941271.1513136306&it=1634958941138&coo=false&rqm=GET

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.20.35 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:41 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
expires: Sat, 23 Oct 2021 03:15:41 GMT

GET
H2 200 pathfora.min.css
c.lytics.io/static/ 20 KB
4 KB 24ms
24ms Stylesheet
text/css 104.26.2.22
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.lytics.io/static/pathfora.min.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.2.22 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

58aa5964d6f5dc68b2180e943ea63b6031c0ba83e44d9815e724b10f2f615f9f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

cf-ray: 6a27cd687db765e0-LHR
date: Sat, 23 Oct 2021 03:15:41 GMT
via: 1.1 google
cf-cache-status: HIT
last-modified: Fri, 01 Oct 2021 22:31:15 GMT
server: cloudflare
age: 1451
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=e1kHU7fJpoXc1I%2BqGfGZzQPIaBjcdbAtp0jg7ghINjbMK5TUfM9G7yOx3dfzo4v7hQiRFpcDCGjwihgaJ%2F%2BIohzJD4XWGHnH2%2F39zPY6oaLepSCoxegNEJ1MMxTQ"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
cache-control: max-age=7200
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=63072000;
content-encoding: br

GET
H2 200 lytics_overrides.min.css
storage.googleapis.com/lioservices/2470-oxford-club/ 602 B
1 KB 92ms
26ms Stylesheet
text/css 142.250.185.176
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://storage.googleapis.com/lioservices/2470-oxford-club/lytics_overrides.min.css
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.185.176 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s51-in-f16.1e100.net
Software: UploadServer /
Resource Hash: 0efd1a0f2f52ed3d1bbd90257616b1f3f057163e50e3ed7d36af06ffa10b7b06

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 02:40:20 GMT
age: 2121
x-guploader-uploadid: ADPycduJRQwKAZK1lyo2dM7MfWFML6eJSm3bPkEmXh1-pJ5mi09ULhMxHMqTQmRTafeJCxlcd_KM8yJDom9MnE4ng-g
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 602
last-modified: Thu, 04 Oct 2018 21:47:26 GMT
server: UploadServer
etag: "9df2d5ae6031369aa6e0f3685608cd8c"
x-goog-hash: crc32c=VZEimQ==, md5=nfLVrmAxNpqm4PNoVgjNjA==
x-goog-generation: 1538689646128559
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=3600
x-goog-stored-content-length: 602
accept-ranges: bytes
content-type: text/css
expires: Sat, 23 Oct 2021 03:40:20 GMT

GET
H/1.1 200
OK Common.js Show response
pro.oxfordincomeletter.com/p/Scripts/ Frame 7B89 2 KB
1 KB 94ms
93ms Document
application/javascript 192.135.136.168
14WEST-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pro.oxfordincomeletter.com/p/Scripts/Common.js

Requested by

Host: cdn.mediago.io
URL: https://cdn.mediago.io/js/pixel.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.135.136.168 , United States, ASN11372 (14WEST-AS, US),

Reverse DNS

Software

Resource Hash

86034bbe69eebb0c08660ff7f0128dd0bd1d852176489ca3a3da7b49bd647cbd

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

Host: pro.oxfordincomeletter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Accept-Encoding: gzip, deflate, br
Cookie: 1872196=2206428; BIGipServerIRIS_PROD_HTTPS_POOL=!uAgbjUYaCWhvtfJj65n2UeQdagOpw6/zQAp6UnRQH+Joq6cDDpa1bJUwil2Ap0esxOZ53CeIMOX/uB4=; WBRKXA00=; seerses=e; seerid=fe8cd8a4-2193-442c-b6f5-cbd2d8861b0e; _ga_4H7QL840N8=GS1.1.1634958940.1.0.1634958940.0; _uetsid=8081fee033af11ec812cfdb623060f3d; _uetvid=8082239033af11eca51c037da1b61611; _gcl_au=1.1.1476574329.1634958941; _ga=GA1.2.1585725103.1634958941; _gid=GA1.2.1737979553.1634958941; _gat_UA-112639049-5=1; _gat_UA-148806141-1=1; _hjid=f5760bf8-55e3-4407-a87a-8a593d7d4df5; _hjFirstSeen=1; dv0qai26lg6v2y6kl7yyc36brextdvtt6u738f7=otn60f61ve; MgidSensorNVis=1; MgidSensorHref=https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true; _hjIncludedInPageviewSample=1; _hjAbsoluteSessionInProgress=1; _hjIncludedInSessionSample=1; _fbp=fb.1.1634958941271.1513136306; _li_dcdm_c=.oxfordincomeletter.com; _lc2_fpi=84f9f284006b--01fjnjb75fbkdzcs1j19ky7q5m; outbrain_cid_fetch=true
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

Cache-Control: no-cache
Content-Type: application/javascript
Content-Encoding: gzip
Last-Modified: Tue, 31 Mar 2020 05:43:09 GMT
Accept-Ranges: bytes
ETag: "1be39421f7d61:0"
Vary: Accept-Encoding
Referrer-Policy: no-referrer-when-downgrade
Date: Sat, 23 Oct 2021 03:15:40 GMT
Content-Length: 1140
Strict-Transport-Security: max-age=63072000; includeSubDomains

GET
H2 200 json Show response
gum.criteo.com/sid/ Frame 3680 465 B
538 B 15ms
14ms Fetch
application/json 178.250.2.146
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=onetag&domain=oxfordincomeletter.com&sn=ChromeSyncframe&so=0&topUrl=pro.oxfordincomeletter.com&cw=1&lsw=1

Requested by

Host: gum.criteo.com
URL: https://gum.criteo.com/syncframe?topUrl=pro.oxfordincomeletter.com&origin=onetag

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

a58e46de1b51f82fac7c48059c53153cfb9282f9df92f97c5965eb9280d5cbe8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/syncframe?topUrl=pro.oxfordincomeletter.com&origin=onetag
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
content-encoding: gzip
date: Sat, 23 Oct 2021 03:15:41 GMT
vary: Accept-Encoding
content-type: application/json; charset=utf-8
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 2547
expires: 0

GET
H2

200

event Show response
widget.us.criteo.com/
Redirect Chain

https://sslwidget.criteo.com/event?a=90311&v=5.8.0&p0=e%3Dexd%26site_type%3Dd&p1=e%3Dvp%26p%3D1&p2=e%3Ddis&adce=1&bundle=ZVuag183UWJFJTJCRHdrME1FSUZXWm5pdUclMkJXTEYwZzJYRVclMkZCWmdTV2ZkaW1RcXlkSlkl...
https://widget.us.criteo.com/event?a=90311&v=5.8.0&p0=e%3Dexd%26site_type%3Dd&p1=e%3Dvp%26p%3D1&p2=e%3Ddis&adce=1&bundle=ZVuag183UWJFJTJCRHdrME1FSUZXWm5pdUclMkJXTEYwZzJYRVclMkZCWmdTV2ZkaW1RcXlkSlkl...

7 KB
8 KB

283ms
102ms

Script
application/x-javascript

74.119.119.150
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL: https://widget.us.criteo.com/event?a=90311&v=5.8.0&p0=e%3Dexd%26site_type%3Dd&p1=e%3Dvp%26p%3D1&p2=e%3Ddis&adce=1&bundle=ZVuag183UWJFJTJCRHdrME1FSUZXWm5pdUclMkJXTEYwZzJYRVclMkZCWmdTV2ZkaW1RcXlkSlklMkZ5TmNNbHZUODZ2JTJCWkFFaWhaRTZQMTZaSmxDdzYzM0VVVFd1RUNUZEQ1bUl1ZmtwYWNZVktqdXNJUndWY3lvMkVjbnpSQjhLVU05eUk1RFlCeVB2T0FBR3NNWU8lMkZpRjVBWmVlQUhmcThqekZUN002OWJOMnRUa2FrMElBWDglM0Q&tld=oxfordincomeletter.com&dtycbr=30594
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 74.119.119.150 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: Kestrel /
Resource Hash: a58621c422217cd23cc096ba179a96884fb95e0e26bf368ad944764a2b802886

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:15:40 GMT
content-type: application/x-javascript
server: Kestrel
p3p: NON DSP COR CURa PSA PSD OUR BUS NAV STA
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 10751426
timing-allow-origin: *
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:15:41 GMT
server: Kestrel
location: https://widget.us.criteo.com/event?a=90311&v=5.8.0&p0=e%3Dexd%26site_type%3Dd&p1=e%3Dvp%26p%3D1&p2=e%3Ddis&adce=1&bundle=ZVuag183UWJFJTJCRHdrME1FSUZXWm5pdUclMkJXTEYwZzJYRVclMkZCWmdTV2ZkaW1RcXlkSlklMkZ5TmNNbHZUODZ2JTJCWkFFaWhaRTZQMTZaSmxDdzYzM0VVVFd1RUNUZEQ1bUl1ZmtwYWNZVktqdXNJUndWY3lvMkVjbnpSQjhLVU05eUk1RFlCeVB2T0FBR3NNWU8lMkZpRjVBWmVlQUhmcThqekZUN002OWJOMnRUa2FrMElBWDglM0Q&tld=oxfordincomeletter.com&dtycbr=30594
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 2508612
timing-allow-origin: *
content-length: 0
expires: 0

GET
H3 200 514616809480893 Show response
connect.facebook.net/signals/config/ 224 KB
67 KB 61ms
61ms Script
application/x-javascript 185.60.216.19
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/514616809480893?v=2.9.47&r=stable

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

185.60.216.19 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-atlas-shv-01-frt3.facebook.com

Software

Resource Hash

409bd9c147b10507f25bcbf98ae40438e6f2bf9b2b740785ba3fa527dfa31738

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: /D69I3bgbei+4Cqn0ZbB0MKffEgQMEFsw78PkGmNXbCR8a70lNgJeCtzJAlSIxhr0Xuu3iKQPJbdehJtCaZ0Ow==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Sat, 23 Oct 2021 03:15:41 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2

200

/
cx.atdmt.com/
Redirect Chain

https://www.facebook.com/tr/?id=2275199989273587&ev=PageView&dl=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c...
https://cx.atdmt.com/?c=17688530264914319646&f=AYxo1lm1YBcpfWYv-CL0Ny0bMDMJFIrF8YDJKVojZKcGJ-SqMgJefrpAGTOXOpn3rgRjKAusXnQiF0ms8nGz_HF8&id=2275199989273587&l=3&v=0

43 B
571 B

62ms
35ms

Image
image/gif

31.13.92.2
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cx.atdmt.com/?c=17688530264914319646&f=AYxo1lm1YBcpfWYv-CL0Ny0bMDMJFIrF8YDJKVojZKcGJ-SqMgJefrpAGTOXOpn3rgRjKAusXnQiF0ms8nGz_HF8&id=2275199989273587&l=3&v=0

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

31.13.92.2 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
x-fb-debug: UM3SWUmVk+HWBf0u4cDB0hP1uqBbC9gBYKseOi3VXlMpMDLtvybo6EMjbpU0vcDxU29hAGJ2apvgwEMhdPHJmg==
content-encoding: br
x-content-type-options: nosniff
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Sat, 23 Oct 2021 03:15:41 GMT
x-frame-options: DENY
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-fb-rlafr: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:15:41 GMT
server: proxygen-bolt
content-type: text/plain
location: https://cx.atdmt.com/?c=17688530264914319646&f=AYxo1lm1YBcpfWYv-CL0Ny0bMDMJFIrF8YDJKVojZKcGJ-SqMgJefrpAGTOXOpn3rgRjKAusXnQiF0ms8nGz_HF8&id=2275199989273587&l=3&v=0
cache-control: no-cache, no-store, must-revalidate
content-length: 0
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
expires: 0

GET
H2 200 config.js Show response
c.lytics.io/api/program/campaign/config/9c32784e3cc4888a693a7988ad64c63d/ 353 B
722 B 23ms
23ms Script
application/javascript 104.26.2.22
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c.lytics.io/api/program/campaign/config/9c32784e3cc4888a693a7988ad64c63d/config.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.2.22 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8144dd81871ff83480f71004b56e62a6cf2aa40cc9e3e1fa6c8f4a8a3bb6090f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:41 GMT
via: 1.1 google
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1871
content-encoding: br
last-modified: Sat, 23 Oct 2021 02:44:30 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63072000;
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dVzbp7smdSpeK%2BY%2F%2FWrC4RvuMdkaT0Y5RG9nZrjEogoGbzwp0KM3xCuq2%2B5jVfkyUKqjVV3nxjaI210uIqS8jyqx5WayUDFRn4UqYaqA%2Fgtc07z6ldKn2v2enTIg"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=7200
cf-ray: 6a27cd690e2165e0-LHR

GET
H3 200 434538323874406 Show response
connect.facebook.net/signals/config/ 305 KB
87 KB 68ms
67ms Script
application/x-javascript 185.60.216.19
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/434538323874406?v=2.9.47&r=stable

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

185.60.216.19 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

6c156b064b0196cc58d663f25816695c723f6bb9dffa64a2038e5ee7cc0a9631

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: b1/1HuM+t8Vkj1PvpLi8Z0sSulfUa4Atukb10xLd2WY3u3qgEaPrQ29YtSVYpS/Hv2lKhi6vwv4XSTj+s9WtGg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Sat, 23 Oct 2021 03:15:41 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 /
www.facebook.com/tr/ 44 B
88 B 7ms
7ms Image
image/gif 157.240.20.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=514616809480893&ev=PageView&dl=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&rl=&if=false&ts=1634958941654&sw=1600&sh=1200&v=2.9.47&r=stable&ec=0&o=28&fbp=fb.1.1634958941271.1513136306&it=1634958941138&coo=false&rqm=GET

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.20.35 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:41 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
expires: Sat, 23 Oct 2021 03:15:41 GMT

GET
H2 200 val Show response
trace.mediago.io/api/html/ Frame 0414 12 KB
13 KB 12ms
12ms Document
text/html 143.204.98.19
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://trace.mediago.io/api/html/val?acid=null
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.19 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-19.fra50.r.cloudfront.net
Software: /
Resource Hash: 4cbf6dc99915177f6304fca1e7cbaf149e86e9871836362ef9ba56454c807765

Request headers

:method: GET
:authority: trace.mediago.io
:scheme: https
:path: /api/html/val?acid=null
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

content-type: text/html; charset=utf-8
date: Sat, 23 Oct 2021 03:15:41 GMT
x-cache: Hit from cloudfront
via: 1.1 f6c241b75ae7d21ac836339454ab90b8.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: yFDnr-SoXYkyRwLdmaW8FgjFdN1m9rYTHAY5ZTnjjNUoekz0WeLtKQ==

GET
H3 200 334214824326985 Show response
connect.facebook.net/signals/config/ 492 KB
144 KB 97ms
96ms Script
application/x-javascript 185.60.216.19
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/334214824326985?v=2.9.47&r=stable

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

185.60.216.19 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

0d21869f9efb1f3d4d742123c0d82c0e7b5024cd35d965ebed8f9f0bae6d3c2d

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: A4ycoyJ2OX+zTX8MV+MyUyBDjoWnYbjmHAINXBcoVS8rqhMy/svV2yEM1h6bH9PK79CJRnzLiEUXJ0fMZ9jzSQ==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Sat, 23 Oct 2021 03:15:41 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 /
www.facebook.com/tr/ 44 B
88 B 8ms
7ms Image
image/gif 157.240.20.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=434538323874406&ev=PageView&dl=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&rl=&if=false&ts=1634958941747&sw=1600&sh=1200&v=2.9.47&r=stable&ec=0&o=30&fbp=fb.1.1634958941271.1513136306&it=1634958941138&coo=false&rqm=GET

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.20.35 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:41 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
expires: Sat, 23 Oct 2021 03:15:41 GMT

GET
H/1.1 200
OK Common.js Show response
pro.oxfordincomeletter.com/p/Scripts/ Frame 0414 2 KB
1 KB 94ms
93ms Document
application/javascript 192.135.136.168
14WEST-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pro.oxfordincomeletter.com/p/Scripts/Common.js

Requested by

Host: cdn.mediago.io
URL: https://cdn.mediago.io/js/pixel.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.135.136.168 , United States, ASN11372 (14WEST-AS, US),

Reverse DNS

Software

Resource Hash

86034bbe69eebb0c08660ff7f0128dd0bd1d852176489ca3a3da7b49bd647cbd

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

Host: pro.oxfordincomeletter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Accept-Encoding: gzip, deflate, br
Cookie: 1872196=2206428; BIGipServerIRIS_PROD_HTTPS_POOL=!uAgbjUYaCWhvtfJj65n2UeQdagOpw6/zQAp6UnRQH+Joq6cDDpa1bJUwil2Ap0esxOZ53CeIMOX/uB4=; WBRKXA00=; seerses=e; seerid=fe8cd8a4-2193-442c-b6f5-cbd2d8861b0e; _ga_4H7QL840N8=GS1.1.1634958940.1.0.1634958940.0; _uetsid=8081fee033af11ec812cfdb623060f3d; _uetvid=8082239033af11eca51c037da1b61611; _gcl_au=1.1.1476574329.1634958941; _ga=GA1.2.1585725103.1634958941; _gid=GA1.2.1737979553.1634958941; _gat_UA-112639049-5=1; _gat_UA-148806141-1=1; _hjid=f5760bf8-55e3-4407-a87a-8a593d7d4df5; _hjFirstSeen=1; dv0qai26lg6v2y6kl7yyc36brextdvtt6u738f7=otn60f61ve; MgidSensorNVis=1; MgidSensorHref=https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true; _hjIncludedInPageviewSample=1; _hjAbsoluteSessionInProgress=1; _hjIncludedInSessionSample=1; _fbp=fb.1.1634958941271.1513136306; _li_dcdm_c=.oxfordincomeletter.com; _lc2_fpi=84f9f284006b--01fjnjb75fbkdzcs1j19ky7q5m; outbrain_cid_fetch=true; cto_bundle=ZVuag183UWJFJTJCRHdrME1FSUZXWm5pdUclMkJXTEYwZzJYRVclMkZCWmdTV2ZkaW1RcXlkSlklMkZ5TmNNbHZUODZ2JTJCWkFFaWhaRTZQMTZaSmxDdzYzM0VVVFd1RUNUZEQ1bUl1ZmtwYWNZVktqdXNJUndWY3lvMkVjbnpSQjhLVU05eUk1RFlCeVB2T0FBR3NNWU8lMkZpRjVBWmVlQUhmcThqekZUN002OWJOMnRUa2FrMElBWDglM0Q
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

Cache-Control: no-cache
Content-Type: application/javascript
Content-Encoding: gzip
Last-Modified: Tue, 31 Mar 2020 05:43:09 GMT
Accept-Ranges: bytes
ETag: "1be39421f7d61:0"
Vary: Accept-Encoding
Referrer-Policy: no-referrer-when-downgrade
Date: Sat, 23 Oct 2021 03:15:41 GMT
Content-Length: 1140
Strict-Transport-Security: max-age=63072000; includeSubDomains

GET
H3 200 3743232669037879 Show response
connect.facebook.net/signals/config/ 305 KB
87 KB 145ms
144ms Script
application/x-javascript 185.60.216.19
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/3743232669037879?v=2.9.47&r=stable

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

185.60.216.19 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

36412271389a7e93dec92bcb875a34fcc6a977d4a9b6b5c521ec3df426b2c4e6

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: onQfhLnM5TL4XH4VEBkHf9ixkMjxXDqp+jUdVCPsg8TUdDYeLeBprx54Z/UnGxNs+Z7Tx/DzYQUIqBlElaeyiA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Sat, 23 Oct 2021 03:15:42 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 /
www.facebook.com/tr/ 44 B
88 B 7ms
7ms Image
image/gif 157.240.20.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=334214824326985&ev=PageView&dl=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&rl=&if=false&ts=1634958941873&sw=1600&sh=1200&v=2.9.47&r=stable&ec=0&o=30&fbp=fb.1.1634958941271.1513136306&it=1634958941138&coo=false&rqm=GET

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.20.35 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:41 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
expires: Sat, 23 Oct 2021 03:15:41 GMT

GET
H3 200 1762270674080693 Show response
connect.facebook.net/signals/config/ 307 KB
87 KB 77ms
76ms Script
application/x-javascript 185.60.216.19
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1762270674080693?v=2.9.47&r=stable

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

185.60.216.19 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

17f24b54a4a13fc2883ed410149e187bcae4a2cdcf3767ef06d94e585956d390

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: yt9QDvUoCOC91OL+KhA9McgnyJQN+YVxpi5TYy6ManTHhAPuhsH+6aBZowi4kw7iDtVFDDqKA6l3YywTVzHehA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Sat, 23 Oct 2021 03:15:42 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 /
www.facebook.com/tr/ 44 B
88 B 7ms
7ms Image
image/gif 157.240.20.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=3743232669037879&ev=PageView&dl=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&rl=&if=false&ts=1634958942032&sw=1600&sh=1200&v=2.9.47&r=stable&ec=0&o=30&fbp=fb.1.1634958941271.1513136306&it=1634958941138&coo=false&rqm=GET

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.20.35 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:42 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
expires: Sat, 23 Oct 2021 03:15:42 GMT

GET
H3 200 /
www.facebook.com/tr/ 44 B
88 B 8ms
8ms Image
image/gif 157.240.20.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1762270674080693&ev=PageView&dl=https%3A%2F%2Fpro.oxfordincomeletter.com%2Fp%2FFOREVERTO79BRKLT2YRDSOSAOSALTTOT%2FWBRKXA00%2F%3FFsid%3D619f3b6f-03a7-48d9-bd27-94932c1f79e9%26IsPreview%3DFalse%26coreg%3D%255b253323%255d%26MultivariateId%3D1876604%26oneClick%3Dtrue%26h%3Dtrue&rl=&if=false&ts=1634958942127&sw=1600&sh=1200&v=2.9.47&r=stable&ec=0&o=30&fbp=fb.1.1634958941271.1513136306&it=1634958941138&coo=false&rqm=GET

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.20.35 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:42 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
expires: Sat, 23 Oct 2021 03:15:42 GMT

POST
H3 200 / Show response
www.facebook.com/tr/ Frame F34A 0
15 B 7ms
7ms Document
text/plain 157.240.20.35
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.20.35 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: POST
:authority: www.facebook.com
:scheme: https
:path: /tr/
content-length: 2237
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
origin: https://pro.oxfordincomeletter.com
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
accept-encoding: gzip, deflate, br
cookie: fr=0Ykr5FNnZo6OhhQgN..Bhc35d..GFz.1.0.Bhc35d.
Upgrade-Insecure-Requests: 1
Origin: https://pro.oxfordincomeletter.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

content-type: text/plain
access-control-allow-origin: https://pro.oxfordincomeletter.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
date: Sat, 23 Oct 2021 03:15:42 GMT

POST
H3 200 / Show response
www.facebook.com/tr/ Frame 6C3D 0
15 B 8ms
7ms Document
text/plain 157.240.20.35
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.20.35 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: POST
:authority: www.facebook.com
:scheme: https
:path: /tr/
content-length: 2237
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
origin: https://pro.oxfordincomeletter.com
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
accept-encoding: gzip, deflate, br
cookie: fr=0Ykr5FNnZo6OhhQgN..Bhc35d..GFz.1.0.Bhc35d.
Upgrade-Insecure-Requests: 1
Origin: https://pro.oxfordincomeletter.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

content-type: text/plain
access-control-allow-origin: https://pro.oxfordincomeletter.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
date: Sat, 23 Oct 2021 03:15:42 GMT

POST
H3 200 / Show response
www.facebook.com/tr/ Frame B99E 0
15 B 8ms
7ms Document
text/plain 157.240.20.35
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.20.35 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: POST
:authority: www.facebook.com
:scheme: https
:path: /tr/
content-length: 2238
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
origin: https://pro.oxfordincomeletter.com
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
accept-encoding: gzip, deflate, br
cookie: fr=0Ykr5FNnZo6OhhQgN..Bhc35d..GFz.1.0.Bhc35d.
Upgrade-Insecure-Requests: 1
Origin: https://pro.oxfordincomeletter.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

content-type: text/plain
access-control-allow-origin: https://pro.oxfordincomeletter.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
date: Sat, 23 Oct 2021 03:15:42 GMT

POST
H3 200 / Show response
www.facebook.com/tr/ Frame 4D44 0
15 B 8ms
7ms Document
text/plain 157.240.20.35
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.20.35 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: POST
:authority: www.facebook.com
:scheme: https
:path: /tr/
content-length: 2238
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
origin: https://pro.oxfordincomeletter.com
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
accept-encoding: gzip, deflate, br
cookie: fr=0Ykr5FNnZo6OhhQgN..Bhc35d..GFz.1.0.Bhc35d.
Upgrade-Insecure-Requests: 1
Origin: https://pro.oxfordincomeletter.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

content-type: text/plain
access-control-allow-origin: https://pro.oxfordincomeletter.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
date: Sat, 23 Oct 2021 03:15:42 GMT

POST
H3 200 / Show response
www.facebook.com/tr/ Frame CF9B 0
15 B 8ms
7ms Document
text/plain 157.240.20.35
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.20.35 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: POST
:authority: www.facebook.com
:scheme: https
:path: /tr/
content-length: 2237
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
origin: https://pro.oxfordincomeletter.com
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
accept-encoding: gzip, deflate, br
cookie: fr=0Ykr5FNnZo6OhhQgN..Bhc35d..GFz.1.0.Bhc35d.
Upgrade-Insecure-Requests: 1
Origin: https://pro.oxfordincomeletter.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

content-type: text/plain
access-control-allow-origin: https://pro.oxfordincomeletter.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
date: Sat, 23 Oct 2021 03:15:42 GMT

POST
H3 200 / Show response
www.facebook.com/tr/ Frame 2F90 0
15 B 8ms
7ms Document
text/plain 157.240.20.35
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.20.35 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: POST
:authority: www.facebook.com
:scheme: https
:path: /tr/
content-length: 2237
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
origin: https://pro.oxfordincomeletter.com
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
accept-encoding: gzip, deflate, br
cookie: fr=0Ykr5FNnZo6OhhQgN..Bhc35d..GFz.1.0.Bhc35d.
Upgrade-Insecure-Requests: 1
Origin: https://pro.oxfordincomeletter.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

content-type: text/plain
access-control-allow-origin: https://pro.oxfordincomeletter.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
date: Sat, 23 Oct 2021 03:15:42 GMT

POST
H3 200 / Show response
www.facebook.com/tr/ Frame 04D7 0
15 B 9ms
7ms Document
text/plain 157.240.20.35
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.20.35 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: POST
:authority: www.facebook.com
:scheme: https
:path: /tr/
content-length: 2258
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
origin: https://pro.oxfordincomeletter.com
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
accept-encoding: gzip, deflate, br
cookie: fr=0Ykr5FNnZo6OhhQgN..Bhc35d..GFz.1.0.Bhc35d.
Upgrade-Insecure-Requests: 1
Origin: https://pro.oxfordincomeletter.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

content-type: text/plain
access-control-allow-origin: https://pro.oxfordincomeletter.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
date: Sat, 23 Oct 2021 03:15:42 GMT

POST
H3 200 / Show response
www.facebook.com/tr/ Frame 26C3 0
15 B 8ms
8ms Document
text/plain 157.240.20.35
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.20.35 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: POST
:authority: www.facebook.com
:scheme: https
:path: /tr/
content-length: 2238
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
origin: https://pro.oxfordincomeletter.com
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
accept-encoding: gzip, deflate, br
cookie: fr=0Ykr5FNnZo6OhhQgN..Bhc35d..GFz.1.0.Bhc35d.
Upgrade-Insecure-Requests: 1
Origin: https://pro.oxfordincomeletter.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

content-type: text/plain
access-control-allow-origin: https://pro.oxfordincomeletter.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
date: Sat, 23 Oct 2021 03:15:42 GMT

POST
H3 200 / Show response
www.facebook.com/tr/ Frame AC6F 0
15 B 8ms
8ms Document
text/plain 157.240.20.35
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.20.35 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: POST
:authority: www.facebook.com
:scheme: https
:path: /tr/
content-length: 2238
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
origin: https://pro.oxfordincomeletter.com
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
accept-encoding: gzip, deflate, br
cookie: fr=0Ykr5FNnZo6OhhQgN..Bhc35d..GFz.1.0.Bhc35d.
Upgrade-Insecure-Requests: 1
Origin: https://pro.oxfordincomeletter.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

content-type: text/plain
access-control-allow-origin: https://pro.oxfordincomeletter.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
date: Sat, 23 Oct 2021 03:15:42 GMT

POST
H3 200 / Show response
www.facebook.com/tr/ Frame CEE8 0
15 B 33ms
22ms Document
text/plain 157.240.20.35
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.20.35 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: POST
:authority: www.facebook.com
:scheme: https
:path: /tr/
content-length: 86458
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
origin: https://pro.oxfordincomeletter.com
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
accept-encoding: gzip, deflate, br
cookie: fr=0Ykr5FNnZo6OhhQgN..Bhc35d..GFz.1.0.Bhc35d.
Upgrade-Insecure-Requests: 1
Origin: https://pro.oxfordincomeletter.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

content-type: text/plain
access-control-allow-origin: https://pro.oxfordincomeletter.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
date: Sat, 23 Oct 2021 03:15:42 GMT

POST
H3 200 / Show response
www.facebook.com/tr/ Frame A9DC 0
15 B 34ms
25ms Document
text/plain 157.240.20.35
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.20.35 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: POST
:authority: www.facebook.com
:scheme: https
:path: /tr/
content-length: 86458
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
origin: https://pro.oxfordincomeletter.com
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
accept-encoding: gzip, deflate, br
cookie: fr=0Ykr5FNnZo6OhhQgN..Bhc35d..GFz.1.0.Bhc35d.
Upgrade-Insecure-Requests: 1
Origin: https://pro.oxfordincomeletter.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

content-type: text/plain
access-control-allow-origin: https://pro.oxfordincomeletter.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
date: Sat, 23 Oct 2021 03:15:42 GMT

POST
H3 200 / Show response
www.facebook.com/tr/ Frame 4640 0
15 B 30ms
28ms Document
text/plain 157.240.20.35
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.20.35 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: POST
:authority: www.facebook.com
:scheme: https
:path: /tr/
content-length: 86458
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
origin: https://pro.oxfordincomeletter.com
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
accept-encoding: gzip, deflate, br
cookie: fr=0Ykr5FNnZo6OhhQgN..Bhc35d..GFz.1.0.Bhc35d.
Upgrade-Insecure-Requests: 1
Origin: https://pro.oxfordincomeletter.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

content-type: text/plain
access-control-allow-origin: https://pro.oxfordincomeletter.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
date: Sat, 23 Oct 2021 03:15:42 GMT

GET
H2 200 playPauseLoadingControl.js Show response
fast.wistia.com/assets/external/ 59 KB
13 KB 7ms
7ms Script
application/javascript 151.101.66.110
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.com/assets/external/playPauseLoadingControl.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.66.110 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

5c0dae79785c9e089d1fe90ef85cc1d2ce86fe739c8b922ccff259ed2a75ac50

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:42 GMT
content-encoding: br
vary: Accept-Encoding
age: 1262
x-cache: HIT, HIT
content-length: 12640
x-served-by: cache-dca17725-DCA, cache-hhn4036-HHN
access-control-allow-origin: *
x-browser-version: 93
last-modified: Fri, 22 Oct 2021 18:08:10 GMT
x-timer: S1634958942.355919,VS0,VE0
etag: "6172fe0a-3160"
strict-transport-security: max-age=0
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=3600
x-browser: chrome
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1, 33

GET
H2 200 nr-spa-1211.min.js Show response
js-agent.newrelic.com/ 43 KB
16 KB 27ms
6ms Script
application/javascript 151.101.130.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://js-agent.newrelic.com/nr-spa-1211.min.js
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 539877722caad874241ab2ec930b7b4aaa5327a34984b64ad813f8a2998bb862

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-version-id: CLSa7QJ2hagEFCkLjcLamPCZ0EDdPlaV
content-encoding: gzip
etag: "a5ee6c68d7de5e7446d73910964b5c10"
x-amz-request-id: 7P24QENFJWH9MPY0
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 16260
x-amz-id-2: w9tbSzsulzIUpjCfcY1I4Ry340KouzFhxTIpcvI9ziJM3HnvH7QmVv/mcPAA/SBB1qkMT7NKyUM=
x-served-by: cache-hhn4021-HHN
last-modified: Mon, 27 Sep 2021 20:46:51 GMT
server: AmazonS3
x-timer: S1634958942.379292,VS0,VE0
date: Sat, 23 Oct 2021 03:15:42 GMT
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 varnish
cache-control: public, max-age=7200, stale-if-error=604800
accept-ranges: bytes
x-cache-hits: 1985

GET
H2 200 hls_video.js Show response
fast.wistia.com/assets/external/engines/ 393 KB
93 KB 6ms
6ms Script
application/javascript 151.101.66.110
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.com/assets/external/engines/hls_video.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.66.110 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

40545e036f49a43cd530edfa21f24fbd6d9b7307d39cb117a9eb6408d5ad73ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:42 GMT
content-encoding: br
vary: Accept-Encoding
age: 1261
x-cache: HIT, HIT
content-length: 94660
x-served-by: cache-dca17721-DCA, cache-hhn4036-HHN
access-control-allow-origin: *
x-browser-version: 93
last-modified: Fri, 22 Oct 2021 18:08:10 GMT
x-timer: S1634958942.358991,VS0,VE0
etag: "6172fe0a-171c4"
strict-transport-security: max-age=0
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
cache-control: public, max-age=3600
x-browser: chrome
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 2, 22

POST
H2 204 x Show response
distillery.wistia.com/ 0
96 B 321ms
98ms XHR
text/plain 54.86.117.43
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://distillery.wistia.com/x
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.86.117.43 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-86-117-43.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: *
date: Sat, 23 Oct 2021 03:15:42 GMT
cache-control: max-age=0, private, must-revalidate

GET
H2

200

397596.gif
idsync.rlcdn.com/ Frame A426
Redirect Chain

https://gum.criteo.com/sync?c=6&r=1&a=1&u=https%3A%2F%2Fidsync.rlcdn.com%2F397596.gif%3Fpartner_uid%3D%40USERID%40
https://idsync.rlcdn.com/397596.gif?partner_uid=ZzPAbm00RaK-zJaK1eeLcEUnAXzA0WaT

42 B
417 B

76ms
28ms

Image
image/gif

35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/397596.gif?partner_uid=ZzPAbm00RaK-zJaK1eeLcEUnAXzA0WaT
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 23 Oct 2021 03:15:42 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: clear
content-length: 42

Redirect headers

location: https://idsync.rlcdn.com/397596.gif?partner_uid=ZzPAbm00RaK-zJaK1eeLcEUnAXzA0WaT
strict-transport-security: max-age=31536000
cache-control: private, max-age=0, no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 2352
date: Sat, 23 Oct 2021 03:15:41 GMT
content-length: 197
content-type: text/html; charset=utf-8

GET
H2

200

cookiematch.aspx
dis.criteo.com/dis/rtb/google/ Frame A426
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_sc&google_ula=913071&google_hm=ay1nbzNoTVRTR3puNjU2SHFieUxxSVZpak51NUEzQ1g5WnVHdENYUQ
https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_ula=913071,0

43 B
341 B

16ms
16ms

Image
image/gif

178.250.2.151
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_ula=913071,0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.151 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: Kestrel /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:15:42 GMT
content-type: image/gif
server: Kestrel
p3p: CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA'
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 313091
timing-allow-origin: *
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:15:42 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_ula=913071,0
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 279
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET /
partner.mediawallahscript.com/ Frame A426 0
0

GET
H2 204 v1
ads.yahoo.com/cms/ Frame A426 0
298 B 180ms
18ms Image
text/plain 87.248.118.22
YAHOO-DEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.yahoo.com/cms/v1?esig=1~7315a025058f3128185459bfaf16e164414683fc&nwid=10000545908&sigv=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

87.248.118.22 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

spdc.pbp.vip.ir2.yahoo.com

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:42 GMT
cache-control: no-store
x-content-type-options: nosniff
server: ATS
strict-transport-security: max-age=15552000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK spp.pl
sp.analytics.yahoo.com/ Frame A426 43 B
964 B 46ms
45ms Image
image/gif 212.82.100.181
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/spp.pl?a=10001287818027&.yp=10028862&js=no

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

212.82.100.181 , Switzerland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 23 Oct 2021 03:15:42 GMT
X-Content-Type-Options: nosniff
Age: 0
Connection: keep-alive
Content-Length: 43
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Referrer-Policy: strict-origin-when-cross-origin
Server: ATS
X-Frame-Options: DENY
Expect-CT: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
Strict-Transport-Security: max-age=31536000
Content-Type: image/gif
Cache-Control: no-cache, private, must-revalidate
Accept-Ranges: bytes
Expires: Sat, 23 Oct 2021 03:15:42 GMT

GET
H/1.1 204
No Content sync
ups.analytics.yahoo.com/ups/58301/ Frame A426 0
735 B 45ms
10ms Image
text/plain 3.126.56.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58301/sync?_origin=1&uid=k-ecTlATSGzn656HqbyLqIVijNu5DANGDEjI7Pjg

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

3.126.56.137 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-126-56-137.eu-central-1.compute.amazonaws.com

Software

ATS/7.1.2.138 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 23 Oct 2021 03:15:42 GMT
Server: ATS/7.1.2.138
Connection: keep-alive
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1 200
OK cookie-sync
sync.outbrain.com/ Frame A426 0
476 B 378ms
85ms Image
text/plain 64.202.112.95
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=criteo&uid=k-gc-ZfTSGzn656HqbyLqIVijNu5A1SY2v8KvBww
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.202.112.95 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 23 Oct 2021 03:15:42 GMT
Cache-Control: no-cache
X-TraceId: 4ea7843071cad0b7fccade465e8b885a
Content-Length: 0

GET
H2 204 t.gif
cw.addthis.com/ Frame A426 0
426 B 330ms
123ms Image
text/plain 2.21.140.111
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cw.addthis.com/t.gif?pid=113&pdid=k-go3hMTSGzn656HqbyLqIVijNu5A3CX9ZuGtCXQ
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.21.140.111 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-21-140-111.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:15:42 GMT
cache-control: max-age=0, no-cache, no-store
expires: Sat, 23 Oct 2021 03:15:42 GMT

GET
H/1.1 200
OK Criteo
crb.kargo.com/api/v1/dsync/ Frame A426 43 B
360 B 53ms
7ms Image
image/gif 3.127.62.220
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://crb.kargo.com/api/v1/dsync/Criteo?exid=k-go3hMTSGzn656HqbyLqIVijNu5A3CX9ZuGtCXQ
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.127.62.220 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-127-62-220.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 23 Oct 2021 03:15:42 GMT
Vary: Origin
Content-Type: image/gif
Cache-Control: no-cache, no-store, must-revalidate, private, max-age=0
Connection: keep-alive
Krk-Reject-Reason: consent
Content-Length: 43
X-Accel-Expires: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1 204
No Content tap.php
pixel.rubiconproject.com/ Frame A426 0
239 B 49ms
13ms Image
image/gif 69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=6434&nid=2149&put=k-lUnyzzSGzn656HqbyLqIVijNu5CGfpg_96-fjQ&expires=30
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 4cdacfaa68e4ab216fffbcc107c5b898
Content-Type: image/gif

GET
H/1.1 200
OK setuid
secure.adnxs.com/ Frame A426 0
580 B 40ms
13ms Image
text/html 185.33.220.243
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/setuid?entity=52&code=k-9xcRezSGzn656HqbyLqIVijNu5ACZu6gTkarsA&seg=95287

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.243 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

722.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 23 Oct 2021 03:15:42 GMT
X-Proxy-Origin: 216.131.111.174; 216.131.111.174; 722.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: c07ecb0a-2ffb-4eec-bb16-e2232d2de46b
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

sync
x.bidswitch.net/ul_cb/ Frame A426
Redirect Chain

https://x.bidswitch.net/sync?dsp_id=46&user_id=k-9xcRezSGzn656HqbyLqIVijNu5ACZu6gTkarsA&expires=30&user_group=5
https://x.bidswitch.net/ul_cb/sync?dsp_id=46&user_id=k-9xcRezSGzn656HqbyLqIVijNu5ACZu6gTkarsA&expires=30&user_group=5

43 B
495 B

8ms
7ms

Image
image/gif

18.157.70.90
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/ul_cb/sync?dsp_id=46&user_id=k-9xcRezSGzn656HqbyLqIVijNu5ACZu6gTkarsA&expires=30&user_group=5
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.157.70.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-157-70-90.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 23 Oct 2021 03:15:42 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

Redirect headers

Location: https://x.bidswitch.net/ul_cb/sync?dsp_id=46&user_id=k-9xcRezSGzn656HqbyLqIVijNu5ACZu6gTkarsA&expires=30&user_group=5
Date: Sat, 23 Oct 2021 03:15:42 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H2 200 c.gif
c.bing.com/ Frame A426 42 B
311 B 38ms
29ms Image
image/gif 13.107.21.200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bing.com/c.gif?Red3=CTOMS_pd&cbid=k-9xcRezSGzn656HqbyLqIVijNu5ACZu6gTkarsA
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.107.21.200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:15:41 GMT
etag: "af5a8b34ac1d71:0"
last-modified: Thu, 14 Oct 2021 22:27:41 GMT
x-msedge-ref: Ref A: 918C0F02E5594FCDB3152D2072E94350 Ref B: FRA31EDGE0514 Ref C: 2021-10-23T03:15:42Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-type: image/gif
content-length: 42

GET
H2 200 pixelCt.tpmn
ad.tpmn.co.kr/ Frame A426 170 B
601 B 325ms
266ms Image
image/png 34.102.166.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad.tpmn.co.kr/pixelCt.tpmn?tpmn_nid=26a681017b4fdc02f3aef3aa921ede3e&tpmn_buid=k-YySvHjSGzn656HqbyLqIVijNu5DYh87lu575-w
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.166.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 132.166.102.34.bc.googleusercontent.com
Software: /
Resource Hash: 0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:15:42 GMT
content-encoding: gzip
vary: accept-encoding
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
content-type: image/png;charset=utf-8
alt-svc: clear
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 Pug
simage2.pubmatic.com/AdServer/ Frame A426 42 B
675 B 78ms
18ms Image
image/gif 185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:k-W49IKjSGzn656HqbyLqIVijNu5Aqtqwd2fub1w
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:42 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug022:0:340
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

xuid
eb2.3lift.com/ Frame A426
Redirect Chain

https://eb2.3lift.com/xuid?mid=2711&xuid=k-QxxnezSGzn656HqbyLqIVijNu5CE5nL54IvxTg&dongle=013b
https://eb2.3lift.com/xuid?ld=1&mid=2711&xuid=k-QxxnezSGzn656HqbyLqIVijNu5CE5nL54IvxTg&dongle=013b&gdpr=1&cmp_cs=&us_privacy=

37 B
351 B

8ms
8ms

Image
image/gif

76.223.111.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?ld=1&mid=2711&xuid=k-QxxnezSGzn656HqbyLqIVijNu5CE5nL54IvxTg&dongle=013b&gdpr=1&cmp_cs=&us_privacy=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.111.18 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:42 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location: /xuid?ld=1&mid=2711&xuid=k-QxxnezSGzn656HqbyLqIVijNu5CE5nL54IvxTg&dongle=013b&gdpr=1&cmp_cs=&us_privacy=
date: Sat, 23 Oct 2021 03:15:42 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H/1.1

200
OK

rum
r.casalemedia.com/ Frame A426
Redirect Chain

https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-R0VNjjSGzn656HqbyLqIVijNu5D5vCteoOAblg
https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-R0VNjjSGzn656HqbyLqIVijNu5D5vCteoOAblg&C=1

43 B
1 KB

15ms
15ms

Image
image/gif

2.21.141.232
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-R0VNjjSGzn656HqbyLqIVijNu5D5vCteoOAblg&C=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.21.141.232 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-21-141-232.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 23 Oct 2021 03:15:42 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sat, 23 Oct 2021 03:15:42 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 23 Oct 2021 03:15:42 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-R0VNjjSGzn656HqbyLqIVijNu5D5vCteoOAblg&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 296
Expires: Sat, 23 Oct 2021 03:15:42 GMT

GET
H2

200

k-L4nQYzSGzn656HqbyLqIVijNu5BkbW2CL651zw
an.yandex.ru/mapuid/criteois/ Frame A426
Redirect Chain

https://an.yandex.ru/mapuid/criteois/k-L4nQYzSGzn656HqbyLqIVijNu5BkbW2CL651zw
https://an.yandex.ru/mapuid/criteois/k-L4nQYzSGzn656HqbyLqIVijNu5BkbW2CL651zw?redir-setuniq=1

43 B
108 B

72ms
71ms

Image
image/gif

213.180.204.90
YANDEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/mapuid/criteois/k-L4nQYzSGzn656HqbyLqIVijNu5BkbW2CL651zw?redir-setuniq=1

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

213.180.204.90 , Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

bs.yandex.ru

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:15:42 GMT
content-encoding: gzip
last-modified: Sat, 23 Oct 2021 03:15:42 GMT
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
strict-transport-security: max-age=31536000
content-type: image/gif; charset=utf-8
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Sat, 23 Oct 2021 03:15:42 GMT

Redirect headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:15:42 GMT
content-encoding: gzip
last-modified: Sat, 23 Oct 2021 03:15:42 GMT
strict-transport-security: max-age=31536000
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
location: https://an.yandex.ru/mapuid/criteois/k-L4nQYzSGzn656HqbyLqIVijNu5BkbW2CL651zw?redir-setuniq=1
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Sat, 23 Oct 2021 03:15:42 GMT

GET
H2 200 sync
ad.as.amanad.adtdp.com/v1/ Frame A426 42 B
844 B 259ms
230ms Image
image/gif 13.225.82.103
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad.as.amanad.adtdp.com/v1/sync?dsp_id=4,5&uid=k-7BR1jjSGzn656HqbyLqIVijNu5BSBRRrOfrvHg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.82.103 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-82-103.fra2.r.cloudfront.net
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:15:42 GMT
via: 1.1 882f747f39885162595630c95dd0012d.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C2
x-amzn-trace-id: Root=1-00000000-000000000000000000000000
x-cache: Miss from cloudfront
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
content-length: 42
x-amz-cf-id: vblN2ru27urKUVIpf5TlCDpoKXZgBCHbPUChZY-u1fGebnSgeA9tCA==
expires: Thu, 01 Jan 1970 09:00:00 GMT

GET
H2 200 cksync.php
contextual.media.net/ Frame A426 46 B
867 B 63ms
28ms Image
image/gif 2.21.140.74
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=3&type=crt&ovsid=k-Y3CQZzSGzn656HqbyLqIVijNu5CxRK-np_6uZw

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.21.140.74 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-21-140-74.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

579a172ca2c700734ebcfa06d105a134f31ec2357660e58e0874cfdee8472fd4

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=604800
server: Apache
date: Sat, 23 Oct 2021 03:15:42 GMT
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control: max-age=0, no-cache, no-store
content-type: image/gif
content-length: 46
x-mnet-hl2: E
expires: Sat, 23 Oct 2021 03:15:42 GMT

GET
H2 200 um
criteo-sync.teads.tv/ Frame A426 23 B
172 B 158ms
34ms Image
image/gif 104.90.104.248
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://criteo-sync.teads.tv/um?eid=80&uid=k-_volSjSGzn656HqbyLqIVijNu5D-_ykRuCM4BA
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.90.104.248 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-90-104-248.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.6 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:15:42 GMT
cache-control: max-age=0, no-cache, no-store
expires: Sat, 23 Oct 2021 03:15:42 GMT
server: akka-http/10.2.6
content-length: 23
content-type: image/gif

GET
H2 200 pixel_sync
trends.revcontent.com/cm/ Frame A426 35 B
336 B 114ms
34ms Image
image/gif 52.48.179.1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trends.revcontent.com/cm/pixel_sync?bidder=151&bidder_uid=k-hxCP2zSGzn656HqbyLqIVijNu5CoEwRQg2eHDw
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.48.179.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-48-179-1.eu-west-1.compute.amazonaws.com
Software: / Express
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:42 GMT
x-powered-by: Express
content-length: 35
content-type: image/gif

GET
H2 200 /
sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/ Frame A426 0
231 B 45ms
13ms Image
text/plain 141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=k-q4vNfzSGzn656HqbyLqIVijNu5Ao3UGHduZYeg
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:42 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 12015

POST
H3 200 / Show response
www.facebook.com/tr/ Frame AA1C 0
15 B 33ms
32ms Document
text/plain 157.240.20.35
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.20.35 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

ec2-108-128-120-92.eu-west-1.compute.amazonaws.com

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: POST
:authority: www.facebook.com
:scheme: https
:path: /tr/
content-length: 86479
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
origin: https://pro.oxfordincomeletter.com
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
accept-encoding: gzip, deflate, br
cookie: fr=0Ykr5FNnZo6OhhQgN..Bhc35d..GFz.1.0.Bhc35d.
Upgrade-Insecure-Requests: 1
Origin: https://pro.oxfordincomeletter.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

content-type: text/plain
access-control-allow-origin: https://pro.oxfordincomeletter.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
date: Sat, 23 Oct 2021 03:15:42 GMT

GET
H2 200 blank.gif
fast.wistia.com/assets/images/ 1 KB
2 KB 20ms
6ms Image
image/gif 151.101.66.110
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fast.wistia.com/assets/images/blank.gif

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.66.110 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

a78759ea185fd0fa42ca9be1fc5bca4d3167a2836dc6c85e479a19dbf57fe2c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Origin: https://pro.oxfordincomeletter.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:42 GMT
via: 1.1 varnish, 1.1 varnish
vary: Accept-Encoding
age: 22861
x-cache: HIT, HIT
x-cache-hits: 1, 802
content-length: 1214
x-served-by: cache-dca17756-DCA, cache-hhn4030-HHN
x-browser-version: 93
last-modified: Fri, 22 Oct 2021 20:52:01 GMT
x-timer: S1634958942.456356,VS0,VE0
etag: "61732471-4be"
strict-transport-security: max-age=0
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=315360000, public
x-browser: chrome
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 fa07dx1uzu.vtt
fast.wistia.net/embed/captions/ 124 KB
125 KB 241ms
214ms TextTrack
text/vtt 151.101.194.110
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.net/embed/captions/fa07dx1uzu.vtt?language=eng

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.194.110 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

ce2a97bacbda7013ff938be4e13c1e7bc44fe10d5c171264e3c5d124be924f2e

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff

Request headers

Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Origin: https://pro.oxfordincomeletter.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:42 GMT
via: 1.1 varnish (Varnish/6.0), 1.1 varnish, 1.1 varnish
x-content-type-options: nosniff
x-permitted-cross-domain-policies: none
age: 3
x-cache: HIT, MISS
p3p: CP="CURi ADMa DEVa IVAa IVDa CONi OUR IND DSP CAO COR"
vary: Accept-Encoding,X-Forwarded-Proto,Accept-Language
content-length: 127000
x-request-id: bb198fb0e9bad71a4610c4a825493b4f
x-served-by: cache-dca17724-DCA, cache-hhn4050-HHN
x-runtime: 0.040493
referrer-policy: strict-origin-when-cross-origin
x-timer: S1634958943.579632,VS0,VE208
etag: W/"ce2a97bacbda7013ff938be4e13c1e7b"
x-download-options: noopen
strict-transport-security: max-age=0
content-type: text/vtt; charset=utf-8
access-control-allow-origin: *
cache-control: public, no-cache
x-browser: chrome
x-browser-version: 93
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1, 0

GET
H/1.1 200
OK roundtrip.js Show response
s.adroll.com/j/ 45 KB
15 KB 55ms
8ms Script
text/javascript 18.66.122.9
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/roundtrip.js
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 00a838051c95fd70f609e56b14160f3b11f9cc925ebf863b6b6d05aa05f18410

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

X-Amz-Version-Id: 20dI2pPzXWu4owz5yzq5GCZ31O2z_uNt
Content-Encoding: gzip
Etag: W/"42b7053581646365ea5fe1cf37686183"
X-Amz-Cf-Pop: FRA60-P2
X-Amz-Server-Side-Encryption: AES256
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Access-Control-Max-Age: 600
Connection: keep-alive
Access-Control-Allow-Origin: *
Last-Modified: Mon, 18 Oct 2021 20:57:17 GMT
Server: AmazonS3
Date: Sat, 23 Oct 2021 02:18:56 GMT
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: text/javascript
Via: 1.1 da4de4427d18bee1d3254f1bbdad25f2.cloudfront.net (CloudFront)
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Access-Control-Allow-Headers: *
X-Amz-Cf-Id: fu0NvTaI8ZVCQSQPAgL5ASkCaKT9DhUjR0IENzWC3YCRIf_VTNxctA==

GET
H/1.1 200
OK 65387c3314 Show response
bam-cell.nr-data.net/1/ 49 B
714 B 905ms
881ms Script
text/javascript 162.247.243.146
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bam-cell.nr-data.net/1/65387c3314?a=46346808,5284047&v=1211.ba193a8&to=YANVZUdYDxFXW0UMWllJemd2FiINWExUC0F0CVlFR1YNDlNKHilaVgJ0XltNBAxC&rst=4869&ck=1&ref=https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/&ap=32&be=2879&fe=4754&dc=2923&af=err,xhr,stn,ins,spa&perf=%7B%22timing%22:%7B%22of%22:1634958937600,%22n%22:0,%22f%22:2111,%22dn%22:2111,%22dne%22:2111,%22c%22:2111,%22ce%22:2111,%22rq%22:2112,%22rp%22:2332,%22rpe%22:2334,%22dl%22:2337,%22di%22:2923,%22ds%22:2923,%22de%22:2924,%22dc%22:4752,%22l%22:4753,%22le%22:4764%7D,%22navigation%22:%7B%7D%7D&fp=2939&fcp=2939&jsonp=NREUM.setToken
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.247.243.146 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dac715f087720dd7ff7067f5d2ec1988851fa93140ae8a9cbfaa15659dd7fd82

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 23 Oct 2021 03:15:43 GMT
Content-Encoding: gzip
CF-Cache-Status: DYNAMIC
Server: cloudflare
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, HEAD, OPTIONS
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
access-control-allow-credentials: true
CF-Ray: 6a27cd6f9d2afae5-DUS

GET
H2

200

cookiematch.aspx
dis.criteo.com/dis/rtb/appnexus/ Frame A426
Redirect Chain

https://secure.adnxs.com/seg?add=95287&redir=https%3A%2F%2Fsecure.adnxs.com%2Fgetuid%3Fhttps%3A%2F%2Fdis.criteo.com%2Fdis%2Frtb%2Fappnexus%2Fcookiematch.aspx%3Fappnxsid%3D%24UID
https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D95287%26redir%3Dhttps%253A%252F%252Fsecure.adnxs.com%252Fgetuid%253Fhttps%253A%252F%252Fdis.criteo.com%252Fdis%252Frtb%252Fappnexus%252Fcookiematch.as...
https://secure.adnxs.com/getuid?https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=$UID
https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=4474307222547923516

43 B
342 B

18ms
18ms

Image
image/gif

178.250.2.151
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=4474307222547923516
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.151 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: Kestrel /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 23 Oct 2021 03:15:42 GMT
content-type: image/gif
server: Kestrel
p3p: CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA'
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 2196884
timing-allow-origin: *
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 23 Oct 2021 03:15:42 GMT
X-Proxy-Origin: 216.131.111.174; 216.131.111.174; 722.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 7df1f000-52ae-4375-99ee-60e59b5cd14c
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=4474307222547923516
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

demconf.jpg
dpm.demdex.net/ Frame A426
Redirect Chain

https://gum.criteo.com/sync?c=8&r=1&a=1&u=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D28645%26dpuuid%3D%40USERID%40
https://dpm.demdex.net/ibs:dpid=28645&dpuuid=OMrC1Vn9s3r04FC-e_rF-pr4jkHa8Ua1
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=28645&dpuuid=OMrC1Vn9s3r04FC-e_rF-pr4jkHa8Ua1

42 B
945 B

32ms
32ms

Image
image/gif

108.128.120.92
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=28645&dpuuid=OMrC1Vn9s3r04FC-e_rF-pr4jkHa8Ua1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

108.128.120.92 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v019-0dce097b6.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: 50SwvgH1QF0=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-irl1-2-v019-0f0f8a4eb.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: GwJBnsrDRUI=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=28645&dpuuid=OMrC1Vn9s3r04FC-e_rF-pr4jkHa8Ua1
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H3-Q050 200 v2 Show response
embedwistia-a.akamaihd.net/deliveries/9b02c3de899297c57729075a6a319110ec37e63e.m3u8/ 126 KB
127 KB 55ms
23ms XHR
application/vnd.apple.mpegurl 92.123.195.28
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://embedwistia-a.akamaihd.net/deliveries/9b02c3de899297c57729075a6a319110ec37e63e.m3u8/v2
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 92.123.195.28 , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a92-123-195-28.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 9156c89516752ef0dc646a676fb0696fa919f4fe60e36c5fb3b26938a0a2d84c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:42 GMT
access-control-request-method: *
surrogate-key: 9b02c3de899297c57729075a6a319110ec37e63e-hls-segment purge-experiment-3e
last-modified: Mon, 05 Nov 2018 10:11:00 GMT
access-control-allow-headers: *
access-control-allow-methods: GET, HEAD, OPTIONS
content-type: application/vnd.apple.mpegurl
access-control-allow-origin: *
access-control-expose-headers: Server,range,Content-Length,Content-Range
cache-control: max-age=30517689
expires: Tue, 11 Oct 2022 08:23:51 GMT
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
content-length: 129219
quic-version: Q050

GET
H/1.1 200
OK sync
x.bidswitch.net/ Frame A426 43 B
220 B 8ms
7ms Image
image/gif 18.157.70.90
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?dsp_id=46&user_id=k-7M2VjjSGzn656HqbyLqIVijNu5Aq4Prs7PFRTA&expires=30&user_group=5
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.157.70.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-157-70-90.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 23 Oct 2021 03:15:42 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2 200 Pug
simage2.pubmatic.com/AdServer/ Frame A426 42 B
116 B 18ms
18ms Image
image/gif 185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwMjMmdGw9MTI5NjAw&piggybackCookie=uid:k-W49IKjSGzn656HqbyLqIVijNu5Aqtqwd2fub1w
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:42 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug005:0:387
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

POST
H3 200 / Show response
www.facebook.com/tr/ Frame 96A1 0
15 B 33ms
32ms Document
text/plain 157.240.20.35
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.20.35 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: POST
:authority: www.facebook.com
:scheme: https
:path: /tr/
content-length: 86459
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
origin: https://pro.oxfordincomeletter.com
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
accept-encoding: gzip, deflate, br
cookie: fr=0Ykr5FNnZo6OhhQgN..Bhc35d..GFz.1.0.Bhc35d.
Upgrade-Insecure-Requests: 1
Origin: https://pro.oxfordincomeletter.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true

Response headers

content-type: text/plain
access-control-allow-origin: https://pro.oxfordincomeletter.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
date: Sat, 23 Oct 2021 03:15:42 GMT

GET
H3-Q050 200 seg-1-v1-a1.ts Show response
embedwistia-a.akamaihd.net/deliveries/9b02c3de899297c57729075a6a319110ec37e63e.m3u8/v2/ 511 KB
512 KB 13ms
13ms XHR
video/mp2t 92.123.195.28
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://embedwistia-a.akamaihd.net/deliveries/9b02c3de899297c57729075a6a319110ec37e63e.m3u8/v2/seg-1-v1-a1.ts
Requested by: Host: pro.oxfordincomeletter.com
URL: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 92.123.195.28 , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a92-123-195-28.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: c4ee6e64f22407b19f1c3c3a3b04295141cb70f59c0e192957f3defdf4eb4c74

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pro.oxfordincomeletter.com/p/FOREVERTO79BRKLT2YRDSOSAOSALTTOT/WBRKXA00/?Fsid=619f3b6f-03a7-48d9-bd27-94932c1f79e9&IsPreview=False&coreg=%5b253323%5d&MultivariateId=1876604&oneClick=true&h=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 23 Oct 2021 03:15:42 GMT
access-control-request-method: *
surrogate-key: 9b02c3de899297c57729075a6a319110ec37e63e-hls-segment purge-experiment-3e
last-modified: Mon, 05 Nov 2018 10:11:00 GMT
access-control-allow-headers: *
access-control-allow-methods: GET, HEAD, OPTIONS
content-type: video/MP2T
access-control-allow-origin: *
access-control-expose-headers: Server,range,Content-Length,Content-Range
cache-control: max-age=30678120
expires: Thu, 13 Oct 2022 04:57:42 GMT
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
content-length: 523768
quic-version: Q050

POST
H3 200 / Show response
www.facebook.com/tr/ Frame 5301 0
15 B 31ms
30ms Document
text/plain 157.240.20.35
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.20.35 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS