secure.winred.com Open in urlscan Pro
104.19.211.89 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://click.email.rondesantis.com/?qs=e7bf2ffb5b0d6aa6179ffbfbb05fa158fffa17052a74678e84c96ba619611c8e3a000fa9690e59d9e7367858144d...
Effective URL:
https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-10-31_success...
Submission: On December 21 via api (December 21st 2023, 11:14:45 am UTC) from CA — Scanned from CA

Summary HTTP 57 Redirects Links 7 Behaviour Indicators

Summary

This website contacted 23 IPs in 2 countries across 20 domains to perform 57 HTTP transactions. The main IP is 104.19.211.89, located in and belongs to CLOUDFLARENET, US. The main domain is secure.winred.com. The Cisco Umbrella rank of the primary domain is 81536.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on February 21st 2023. Valid for: a year.

This is the only time secure.winred.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	13.110.197.228 13.110.197.228	14340 (SALESFORCE) (SALESFORCE)
1 9	104.19.211.89 104.19.211.89	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	172.253.122.97 172.253.122.97	15169 (GOOGLE) (GOOGLE)
3	151.101.128.176 151.101.128.176	54113 (FASTLY) (FASTLY)
4	142.251.167.95 142.251.167.95	15169 (GOOGLE) (GOOGLE)
2	18.67.17.108 18.67.17.108	16509 (AMAZON-02) (AMAZON-02)
1	104.16.56.101 104.16.56.101	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.17.25.14 104.17.25.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	142.251.163.154 142.251.163.154	15169 (GOOGLE) (GOOGLE)
2	31.13.66.19 31.13.66.19	32934 (FACEBOOK) (FACEBOOK)
1	34.117.162.98 34.117.162.98	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
4	172.253.63.139 172.253.63.139	15169 (GOOGLE) (GOOGLE)
2	104.16.249.69 104.16.249.69	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	34.111.186.1 34.111.186.1	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	172.253.63.154 172.253.63.154	15169 (GOOGLE) (GOOGLE)
3 4	172.253.122.99 172.253.122.99	15169 (GOOGLE) (GOOGLE)
6	142.251.163.94 142.251.163.94	15169 (GOOGLE) (GOOGLE)
1	216.239.38.181 216.239.38.181	15169 (GOOGLE) (GOOGLE)
1	104.19.212.89 104.19.212.89	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	54.186.23.98 54.186.23.98	16509 (AMAZON-02) (AMAZON-02)
2	54.192.51.43 54.192.51.43	16509 (AMAZON-02) (AMAZON-02)
3 3	142.251.167.156 142.251.167.156	15169 (GOOGLE) (GOOGLE)
1	52.35.126.53 52.35.126.53	16509 (AMAZON-02) (AMAZON-02)
1	31.13.66.35 31.13.66.35	32934 (FACEBOOK) (FACEBOOK)
57	23

1 13.110.197.228 (United States) 1 redirects

ASN14340 (SALESFORCE, US)
PTR: click.email.rondesantis.com

click.email.rondesantis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 104.19.211.89 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

secure.winred.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.253.122.97 (United States)

ASN15169 (GOOGLE, US)
PTR: bh-in-f97.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.128.176 (United States)

ASN54113 (FASTLY, US)

js.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.251.167.95 (United States)

ASN15169 (GOOGLE, US)
PTR: ww-in-f95.1e100.net

maps.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.67.17.108 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-67-17-108.yto50.r.cloudfront.net

d35ligi1n5bgzc.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.56.101 (None, )

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.25.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.251.163.154 (United States)

ASN15169 (GOOGLE, US)
PTR: wv-in-f154.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 31.13.66.19 (Ashburn, United States)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-01-iad3.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.117.162.98 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 98.162.117.34.bc.googleusercontent.com

pixel.byspotify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.253.63.139 (United States)

ASN15169 (GOOGLE, US)
PTR: bi-in-f139.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.16.249.69 (None, )

ASN13335 (CLOUDFLARENET, US)

gtm.winred.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.111.186.1 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 1.186.111.34.bc.googleusercontent.com

evnt.byspotify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.253.63.154 (United States)

ASN15169 (GOOGLE, US)
PTR: bi-in-f154.1e100.net

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.253.122.99 (United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: bh-in-f99.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.251.163.94 (United States)

ASN15169 (GOOGLE, US)
PTR: wv-in-f94.1e100.net

www.google.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.239.38.181 (United States)

ASN15169 (GOOGLE, US)

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.19.212.89 (None, )

ASN13335 (CLOUDFLARENET, US)

app.revv.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 54.186.23.98 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ip-54-186-23-98.stripe.com

q.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.192.51.43 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-54-192-51-43.yul62.r.cloudfront.net

m.stripe.network	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.251.167.156 (United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: ww-in-f156.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.35.126.53 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-35-126-53.us-west-2.compute.amazonaws.com

m.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 31.13.66.35 (Ashburn, United States)

ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-01-iad3.facebook.com

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	winred.com 1 redirects secure.winred.com — Cisco Umbrella Rank: 81536 gtm.winred.com — Cisco Umbrella Rank: 152554	194 KB
7	stripe.com js.stripe.com — Cisco Umbrella Rank: 1282 q.stripe.com — Cisco Umbrella Rank: 7730 m.stripe.com — Cisco Umbrella Rank: 1245	165 KB
6	google.ca www.google.ca — Cisco Umbrella Rank: 9252	814 B
5	google.com 3 redirects www.google.com — Cisco Umbrella Rank: 2 analytics.google.com — Cisco Umbrella Rank: 152	3 KB
5	doubleclick.net 3 redirects stats.g.doubleclick.net — Cisco Umbrella Rank: 75 googleads.g.doubleclick.net — Cisco Umbrella Rank: 33	4 KB
4	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 27	21 KB
4	googleapis.com maps.googleapis.com — Cisco Umbrella Rank: 357	176 KB
4	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 36	365 KB
3	byspotify.com pixel.byspotify.com — Cisco Umbrella Rank: 10581 evnt.byspotify.com — Cisco Umbrella Rank: 10539	7 KB
3	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 138	6 KB
2	stripe.network m.stripe.network — Cisco Umbrella Rank: 1361	16 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 168	91 KB
2	cloudfront.net d35ligi1n5bgzc.cloudfront.net	432 KB
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 98	185 B
1	revv.co app.revv.co — Cisco Umbrella Rank: 306523	1 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 204	4 KB
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 864	7 KB
1	rondesantis.com 1 redirects click.email.rondesantis.com — Cisco Umbrella Rank: 722621	455 B
0	adsrvr.org Failed js.adsrvr.org Failed
0	ads-twitter.com Failed static.ads-twitter.com Failed
57	20

	Domain	Requested by
9	secure.winred.com	1 redirects secure.winred.com
6	www.google.ca	secure.winred.com
4	www.google.com	3 redirects secure.winred.com
4	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com secure.winred.com
4	maps.googleapis.com	secure.winred.com maps.googleapis.com
4	www.googletagmanager.com	secure.winred.com www.googletagmanager.com
3	googleads.g.doubleclick.net	3 redirects
3	q.stripe.com	secure.winred.com
3	www.googleadservices.com	www.googletagmanager.com
3	js.stripe.com	secure.winred.com js.stripe.com
2	m.stripe.network	js.stripe.com m.stripe.network
2	stats.g.doubleclick.net	www.google-analytics.com www.googletagmanager.com
2	evnt.byspotify.com	pixel.byspotify.com
2	gtm.winred.com	www.googletagmanager.com
2	connect.facebook.net	secure.winred.com connect.facebook.net
2	d35ligi1n5bgzc.cloudfront.net	secure.winred.com
1	www.facebook.com	secure.winred.com
1	m.stripe.com	m.stripe.network
1	app.revv.co	secure.winred.com
1	analytics.google.com	www.googletagmanager.com
1	pixel.byspotify.com	secure.winred.com
1	cdnjs.cloudflare.com	secure.winred.com
1	static.cloudflareinsights.com	secure.winred.com
1	click.email.rondesantis.com	1 redirects
0	js.adsrvr.org Failed	www.googletagmanager.com
0	static.ads-twitter.com Failed	www.googletagmanager.com
57	26

This site contains links to these domains. Also see Links.

Domain
winred.com
rondesantis.com

Subject Issuer	Validity	Valid
secure.winred.com Cloudflare Inc ECC CA-3	`2023-02-21` - `2024-02-21`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
a.stripecdn.com DigiCert SHA2 Extended Validation Server CA	`2023-10-30` - `2024-01-25`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2023-10-10` - `2024-09-19`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-04-10` - `2024-04-09`	a year	crt.sh
www.googleadservices.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-09-29` - `2023-12-28`	3 months	crt.sh
pixel.byspotify.com GTS CA 1D4	`2023-11-06` - `2024-02-04`	3 months	crt.sh
prfx.byspotify.com GTS CA 1D4	`2023-11-11` - `2024-02-09`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.google.ca GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.stripe.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-12-20` - `2024-03-21`	3 months	crt.sh
m.stripe.com DigiCert TLS RSA SHA256 2020 CA1	`2023-10-05` - `2024-01-18`	3 months	crt.sh

This page contains 4 frames:

Primary Page: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_&first_name=Devaughn&last_name=Thompson&state=GA&city=Colquitt&zip=39837&email=devaughn.thompson@nutrien.com
Frame ID: D7F6D062F45D0B454B8104E4B61F0B36
Requests: 46 HTTP requests in this frame

Frame: https://secure.winred.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/main.js
Frame ID: C1A216F0FF13535EE74180FA65C58EF7
Requests: 2 HTTP requests in this frame

Frame: https://js.stripe.com/v3/m-outer-27c67c0d52761104439bb051c7856ab1.html
Frame ID: 83EA7A50DFD30F3DE64AAEE80AF0FE9C
Requests: 4 HTTP requests in this frame

Frame: https://m.stripe.network/inner.html
Frame ID: 56E7062DE394CD830E9BC3557F55062A
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Ron DeSantis for President | Grassroots Team

Page URL History Show full URLs

https://click.email.rondesantis.com/?qs=e7bf2ffb5b0d6aa6179ffbfbb05fa158fffa17052a74678e84c96ba619611c8e3a000fa9... HTTP 302
https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaig... Page URL

Detected technologies

Google Maps (Maps) Expand

Overall confidence: 100%
Detected patterns

//maps\.google(?:apis)?\.com/maps/api/js

Stripe (Payment Processors) Expand

Overall confidence: 100%
Detected patterns

js\.stripe\.com

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/ns\.html[^>]+></iframe>
googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Page Statistics

57
Requests

89 %
HTTPS

0 %
IPv6

20
Domains

26
Subdomains

23
IPs

2
Countries

1487 kB
Transfer

4197 kB
Size

24
Cookies

7 Outgoing links

These are links going to different origins than the main page.

URL: https://winred.com/terms/donor-terms/
Title: terms of use

Search URL Search Domain Scan URL

URL: https://winred.com/privacy
Title: privacy policy

Search URL Search Domain Scan URL

URL: https://rondesantis.com/privacy-policy/
Title: privacy policy

Search URL Search Domain Scan URL

URL: https://rondesantis.com/terms-of-use
Title: terms of use

Search URL Search Domain Scan URL

URL: https://rondesantis.com/mobile-terms
Title: mobile terms

Search URL Search Domain Scan URL

URL: https://winred.com/
Title: Powered by

Search URL Search Domain Scan URL

URL: https://winred.com/support/
Title: Questions about your charge? Go to our Support Center

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://click.email.rondesantis.com/?qs=e7bf2ffb5b0d6aa6179ffbfbb05fa158fffa17052a74678e84c96ba619611c8e3a000fa9690e59d9e7367858144dbe20955df7977699891677a7f600c9222718 HTTP 302
https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_&first_name=Devaughn&last_name=Thompson&state=GA&city=Colquitt&zip=39837&email=devaughn.thompson@nutrien.com Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 37

https://secure.winred.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
https://secure.winred.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/main.js

Request Chain 44

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11198202606/?random=110069996&cv=11&fst=1703157272032&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DDevaughn%26last_name%3DThompson%26state%3DGA%26city%3DColquitt%26zip%3D39837%26email%3Ddevaughn.thompson%40nutrien.com&label=M51RCOmQgKgYEO6F3Nsp&hn=www.googleadservices.com&frm=0&tiba=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&value=0&auid=1450445957.1703157272&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&ocp_id=Gx6EZZuIGt-doPMPy9Kz4Aw&sscte=1&crd=&eitems=ChEIgOGPrAYQqaDV3N2EjeKUARIdAA1yRZX-aqR1s73zUUOI1DXRQAPpKWCSZ8yYQus&pscrd=Ek9DaEVJZ09HUHJBWVEzOV9JcFpxVmxQcWxBUkltQUw0TG0ySHM0RllRTUg4b0cyenRETEJKYUI4TEYxVHVYdEl1cXduVk8xekVhekk2WU5VGlhDaEFJZ09HUHJBWVFqTnU4aXRYbTF0WTJFaTRBbk9ON2tQR05ucGdLd0F0MUhRT3JhWFhtQ0tYQWhHWHVPZDdMaER0ak1lZjRtZDdXSUF3ZF9nQ2d6T216IhMI24GYo7OggwMV3w5oCB1L6QzM HTTP 302
https://www.google.com/pagead/1p-conversion/11198202606/?random=110069996&cv=11&fst=1703157272032&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DDevaughn%26last_name%3DThompson%26state%3DGA%26city%3DColquitt%26zip%3D39837%26email%3Ddevaughn.thompson%40nutrien.com&label=M51RCOmQgKgYEO6F3Nsp&hn=www.googleadservices.com&frm=0&tiba=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&value=0&auid=1450445957.1703157272&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek9DaEVJZ09HUHJBWVEzOV9JcFpxVmxQcWxBUkltQUw0TG0ySHM0RllRTUg4b0cyenRETEJKYUI4TEYxVHVYdEl1cXduVk8xekVhekk2WU5VGlhDaEFJZ09HUHJBWVFqTnU4aXRYbTF0WTJFaTRBbk9ON2tQR05ucGdLd0F0MUhRT3JhWFhtQ0tYQWhHWHVPZDdMaER0ak1lZjRtZDdXSUF3ZF9nQ2d6T216IhMI24GYo7OggwMV3w5oCB1L6QzM&is_vtc=1&ocp_id=Gx6EZZuIGt-doPMPy9Kz4Aw&cid=CAQSGwAvHhf_0vdfdgkMYIm0ihoUkvkHe76neJX6-Q&eitems=ChEIgOGPrAYQqaDV3N2EjeKUARIdAA1yRZWjbWwmonL4ovs_BBiKefi_k_g9jav9qpU&random=1218506944 HTTP 302
https://www.google.ca/pagead/1p-conversion/11198202606/?random=110069996&cv=11&fst=1703157272032&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DDevaughn%26last_name%3DThompson%26state%3DGA%26city%3DColquitt%26zip%3D39837%26email%3Ddevaughn.thompson%40nutrien.com&label=M51RCOmQgKgYEO6F3Nsp&hn=www.googleadservices.com&frm=0&tiba=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&value=0&auid=1450445957.1703157272&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek9DaEVJZ09HUHJBWVEzOV9JcFpxVmxQcWxBUkltQUw0TG0ySHM0RllRTUg4b0cyenRETEJKYUI4TEYxVHVYdEl1cXduVk8xekVhekk2WU5VGlhDaEFJZ09HUHJBWVFqTnU4aXRYbTF0WTJFaTRBbk9ON2tQR05ucGdLd0F0MUhRT3JhWFhtQ0tYQWhHWHVPZDdMaER0ak1lZjRtZDdXSUF3ZF9nQ2d6T216IhMI24GYo7OggwMV3w5oCB1L6QzM&is_vtc=1&ocp_id=Gx6EZZuIGt-doPMPy9Kz4Aw&cid=CAQSGwAvHhf_0vdfdgkMYIm0ihoUkvkHe76neJX6-Q&eitems=ChEIgOGPrAYQqaDV3N2EjeKUARIdAA1yRZWjbWwmonL4ovs_BBiKefi_k_g9jav9qpU&random=1218506944&ipr=y

Request Chain 45

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11263458299/?random=951719445&cv=11&fst=1703157272040&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DDevaughn%26last_name%3DThompson%26state%3DGA%26city%3DColquitt%26zip%3D39837%26email%3Ddevaughn.thompson%40nutrien.com&label=e3Q7CJi9neAYEPv36vop&hn=www.googleadservices.com&frm=0&tiba=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&value=0&auid=1450445957.1703157272&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&ocp_id=Gx6EZYCLGruZoPMP772xsAs&sscte=1&crd=&eitems=ChEIgOGPrAYQqaDV3N2EjeKUARIdAA1yRZXYsy9ztzVqh7PC_dP3PontDQPrWpy-0GQ&pscrd=Ek9DaEVJZ09HUHJBWVEzOV9JcFpxVmxQcWxBUkltQUw0TG0ySHM0RllRTUg4b0cyenRETEJKYUI4TEYxVHVYdEl1cXduVk8xekVhekk2WU5VGlhDaEFJZ09HUHJBWVFqTnU4aXRYbTF0WTJFaTRBbk9ON2tKeUdyN0dsNWNHeFdHWXNybHpxblpTT1J4ZFhySXVzZW1oN1dIMFlZTkpBQmdHek5mMWROYlg5IhMIwISYo7OggwMVuwxoCB3vXgy2 HTTP 302
https://www.google.com/pagead/1p-conversion/11263458299/?random=951719445&cv=11&fst=1703157272040&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DDevaughn%26last_name%3DThompson%26state%3DGA%26city%3DColquitt%26zip%3D39837%26email%3Ddevaughn.thompson%40nutrien.com&label=e3Q7CJi9neAYEPv36vop&hn=www.googleadservices.com&frm=0&tiba=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&value=0&auid=1450445957.1703157272&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek9DaEVJZ09HUHJBWVEzOV9JcFpxVmxQcWxBUkltQUw0TG0ySHM0RllRTUg4b0cyenRETEJKYUI4TEYxVHVYdEl1cXduVk8xekVhekk2WU5VGlhDaEFJZ09HUHJBWVFqTnU4aXRYbTF0WTJFaTRBbk9ON2tKeUdyN0dsNWNHeFdHWXNybHpxblpTT1J4ZFhySXVzZW1oN1dIMFlZTkpBQmdHek5mMWROYlg5IhMIwISYo7OggwMVuwxoCB3vXgy2&is_vtc=1&ocp_id=Gx6EZYCLGruZoPMP772xsAs&cid=CAQSGwAvHhf_0GeMjxsVIcliA32GpIKVgLxolLukUA&eitems=ChEIgOGPrAYQqaDV3N2EjeKUARIdAA1yRZWioQM0GMbpopT95AXY_qGJQk8ACAzJ4wI&random=2894654084 HTTP 302
https://www.google.ca/pagead/1p-conversion/11263458299/?random=951719445&cv=11&fst=1703157272040&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DDevaughn%26last_name%3DThompson%26state%3DGA%26city%3DColquitt%26zip%3D39837%26email%3Ddevaughn.thompson%40nutrien.com&label=e3Q7CJi9neAYEPv36vop&hn=www.googleadservices.com&frm=0&tiba=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&value=0&auid=1450445957.1703157272&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek9DaEVJZ09HUHJBWVEzOV9JcFpxVmxQcWxBUkltQUw0TG0ySHM0RllRTUg4b0cyenRETEJKYUI4TEYxVHVYdEl1cXduVk8xekVhekk2WU5VGlhDaEFJZ09HUHJBWVFqTnU4aXRYbTF0WTJFaTRBbk9ON2tKeUdyN0dsNWNHeFdHWXNybHpxblpTT1J4ZFhySXVzZW1oN1dIMFlZTkpBQmdHek5mMWROYlg5IhMIwISYo7OggwMVuwxoCB3vXgy2&is_vtc=1&ocp_id=Gx6EZYCLGruZoPMP772xsAs&cid=CAQSGwAvHhf_0GeMjxsVIcliA32GpIKVgLxolLukUA&eitems=ChEIgOGPrAYQqaDV3N2EjeKUARIdAA1yRZWioQM0GMbpopT95AXY_qGJQk8ACAzJ4wI&random=2894654084&ipr=y

Request Chain 46

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11188077750/?random=195060796&cv=11&fst=1703157272025&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DDevaughn%26last_name%3DThompson%26state%3DGA%26city%3DColquitt%26zip%3D39837%26email%3Ddevaughn.thompson%40nutrien.com&label=tNBiCNPx_KIYELaJ8tYp&hn=www.googleadservices.com&frm=0&tiba=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&value=0&auid=1450445957.1703157272&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&ocp_id=Gx6EZd-HGt22oPMPtoOZwAw&sscte=1&crd=&eitems=ChEIgOGPrAYQqaDV3N2EjeKUARIdAA1yRZWpChG3pWC83k8lJyo9gzRw12yZ9DAXjZc&pscrd=Ek9DaEVJZ09HUHJBWVEzOV9JcFpxVmxQcWxBUkltQUw0TG0ySHM0RllRTUg4b0cyenRETEJKYUI4TEYxVHVYdEl1cXduVk8xekVhekk2WU5VGlhDaEFJZ09HUHJBWVFqTnU4aXRYbTF0WTJFaTRBbk9ON2tNZTN3eVVaZXJGUlBpVXZad2Ewa3Q3LXZOM0V0dlkxV2tnTGhrQkhEV2R4SUdxdjF1ZTZ2TkdhIhMIn4GYo7OggwMVXRtoCB22QQbI HTTP 302
https://www.google.com/pagead/1p-conversion/11188077750/?random=195060796&cv=11&fst=1703157272025&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DDevaughn%26last_name%3DThompson%26state%3DGA%26city%3DColquitt%26zip%3D39837%26email%3Ddevaughn.thompson%40nutrien.com&label=tNBiCNPx_KIYELaJ8tYp&hn=www.googleadservices.com&frm=0&tiba=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&value=0&auid=1450445957.1703157272&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek9DaEVJZ09HUHJBWVEzOV9JcFpxVmxQcWxBUkltQUw0TG0ySHM0RllRTUg4b0cyenRETEJKYUI4TEYxVHVYdEl1cXduVk8xekVhekk2WU5VGlhDaEFJZ09HUHJBWVFqTnU4aXRYbTF0WTJFaTRBbk9ON2tNZTN3eVVaZXJGUlBpVXZad2Ewa3Q3LXZOM0V0dlkxV2tnTGhrQkhEV2R4SUdxdjF1ZTZ2TkdhIhMIn4GYo7OggwMVXRtoCB22QQbI&is_vtc=1&ocp_id=Gx6EZd-HGt22oPMPtoOZwAw&cid=CAQSGwAvHhf_K7BFPz7H7E6U12stKRzCtuyLzaHfQg&eitems=ChEIgOGPrAYQqaDV3N2EjeKUARIdAA1yRZWZSBICFeNC4dLnO1qkla68DQUKTHM9aqk&random=2160532932 HTTP 302
https://www.google.ca/pagead/1p-conversion/11188077750/?random=195060796&cv=11&fst=1703157272025&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DDevaughn%26last_name%3DThompson%26state%3DGA%26city%3DColquitt%26zip%3D39837%26email%3Ddevaughn.thompson%40nutrien.com&label=tNBiCNPx_KIYELaJ8tYp&hn=www.googleadservices.com&frm=0&tiba=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&value=0&auid=1450445957.1703157272&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek9DaEVJZ09HUHJBWVEzOV9JcFpxVmxQcWxBUkltQUw0TG0ySHM0RllRTUg4b0cyenRETEJKYUI4TEYxVHVYdEl1cXduVk8xekVhekk2WU5VGlhDaEFJZ09HUHJBWVFqTnU4aXRYbTF0WTJFaTRBbk9ON2tNZTN3eVVaZXJGUlBpVXZad2Ewa3Q3LXZOM0V0dlkxV2tnTGhrQkhEV2R4SUdxdjF1ZTZ2TkdhIhMIn4GYo7OggwMVXRtoCB22QQbI&is_vtc=1&ocp_id=Gx6EZd-HGt22oPMPtoOZwAw&cid=CAQSGwAvHhf_K7BFPz7H7E6U12stKRzCtuyLzaHfQg&eitems=ChEIgOGPrAYQqaDV3N2EjeKUARIdAA1yRZWZSBICFeNC4dLnO1qkla68DQUKTHM9aqk&random=2160532932&ipr=y

57 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request fewer-desantis-emails Show response
secure.winred.com/desantis/
Redirect Chain

https://click.email.rondesantis.com/?qs=e7bf2ffb5b0d6aa6179ffbfbb05fa158fffa17052a74678e84c96ba619611c8e3a000fa9690e59d9e7367858144dbe20955df7977699891677a7f600c9222718
https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_&first_name=Devaughn&last...

29 KB
8 KB

400ms
344ms

Document
text/html

104.19.211.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_&first_name=Devaughn&last_name=Thompson&state=GA&city=Colquitt&zip=39837&email=devaughn.thompson@nutrien.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.211.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2da556b9f01bf1ba9fe68a179705263b3999ed1a369706f1e8b2b46d8adfea11

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate, private, max-age=0
cf-cache-status: DYNAMIC
cf-ray: 838fb3b0ebe27145-YUL
content-encoding: br
content-type: text/html; charset=utf-8
date: Thu, 21 Dec 2023 11:14:31 GMT
server: cloudflare
strict-transport-security: max-age=0; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-rack-cors: miss; no-origin
x-request-id: 1ce6cbbc-178c-4cad-a867-5a755a62ab48
x-revv-cache: Miss from Revv
x-robots-tag: noindex, nofollow, noarchive
x-runtime: 0.152094
x-xss-protection: 1; mode=block

Redirect headers

Cache-Control: private
Connection: close
Content-Length: 429
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Dec 2023 11:14:30 GMT
Location: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_&first_name=Devaughn&last_name=Thompson&state=GA&city=Colquitt&zip=39837&email=devaughn.thompson@nutrien.com

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 440 KB
98 KB 396ms
80ms Script
application/javascript 172.253.122.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_&first_name=Devaughn&last_name=Thompson&state=GA&city=Colquitt&zip=39837&email=devaughn.thompson@nutrien.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

a5e2f8d85a8c6e754c5a67c730bd13882d9ac511ad3926201358d3aacbd178ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 11:14:31 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 99727
x-xss-protection: 0
last-modified: Thu, 21 Dec 2023 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 21 Dec 2023 11:14:31 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 268 KB
89 KB 375ms
60ms Script
application/javascript 172.253.122.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-M4TW6TX

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

08e64936e50d3729bb36288040035bf307bf11b49fea0087e50d4552816e209c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 11:14:31 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 90441
x-xss-protection: 0
last-modified: Thu, 21 Dec 2023 09:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 21 Dec 2023 11:14:31 GMT

GET
H2 200 / Show response
js.stripe.com/v3/ 579 KB
161 KB 1064ms
15ms Script
text/javascript 151.101.128.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.128.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

bed4ed406073398f8e51812a543b3c5994642624f948b20d407d801fbaf4aeab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Thu, 21 Dec 2023 11:14:32 GMT
via: 1.1 varnish
age: 44
x-cache: HIT
content-length: 164700
x-request-id: bb2aa3f3-f36b-459b-b68f-5dbc3749ab28
x-served-by: cache-yul12821-YUL
last-modified: Wed, 20 Dec 2023 18:45:16 GMT
server: Fastly
etag: "18c673a7660d3e6fbaca6b286e3a557e"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 6

GET
H2 200 landing_page-b5085350195c50801834c19cd56b1cabc8b9ea2b81e3a74f8486f6b3e2ae2898.css
secure.winred.com/assets/ 219 KB
34 KB 46ms
42ms Stylesheet
text/css 104.19.211.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/assets/landing_page-b5085350195c50801834c19cd56b1cabc8b9ea2b81e3a74f8486f6b3e2ae2898.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.211.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

961951e588ed2cbd0dadda321becf5c4d27451bb0896262f86e7d922da5794ca

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_&first_name=Devaughn&last_name=Thompson&state=GA&city=Colquitt&zip=39837&email=devaughn.thompson@nutrien.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 11:14:31 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
x-amz-version-id: 4RBMbG_c3G5laVKEwPaykYWu8oOdV56f
cf-cache-status: HIT
x-amz-request-id: 68E4GC48GEC5PG11
age: 4590
cf-polished: origSize=227667
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-amz-id-2: dotNDpVIZ2rbXXoFfGRn/2HCkDZlwzFr0evT8VfFkGRLV9QhJrOlrHHH6sac2LxNMlhUwajrjCk=
cf-bgj: minify
last-modified: Tue, 28 Nov 2023 01:42:36 GMT
server: cloudflare
etag: W/"57df3b6cebff9962c43c29347b45123f"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
cf-ray: 838fb3b349637145-YUL
expires: Thu, 21 Dec 2023 15:14:31 GMT

GET
H2 200 1693236734.css
secure.winred.com/stylesheets/rv_page_01h8mfbypgqb7dfk1mh2zg6nbb/ 9 KB
3 KB 164ms
161ms Stylesheet
text/css 104.19.211.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/stylesheets/rv_page_01h8mfbypgqb7dfk1mh2zg6nbb/1693236734.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.211.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d2a9df6a4cfce46a55fec3fbc9134896438d7a845e3ae841b0f9214f62988cf7

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_&first_name=Devaughn&last_name=Thompson&state=GA&city=Colquitt&zip=39837&email=devaughn.thompson@nutrien.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-rack-cors: miss; no-origin
date: Thu, 21 Dec 2023 11:14:31 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: MISS
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
x-request-id: e7749d5d-a7b4-4307-a3dc-2faf391ac7b1
x-runtime: 0.053240
last-modified: Thu, 21 Dec 2023 11:14:31 GMT
server: cloudflare
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
cache-control: public, max-age=31556952
cf-ray: 838fb3b349687145-YUL
expires: Fri, 20 Dec 2024 17:03:43 GMT

GET
H2 200 js Show response
maps.googleapis.com/maps/api/ 194 KB
65 KB 3165ms
78ms Script
text/javascript 142.251.167.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f95.1e100.net

Software

scaffolding on HTTPServer2 /

Resource Hash

ec288a0cc67336d66ec12f4e54dbee9fb7e3f39d248de4d35f93fb1797649746

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 11:14:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Accept-Language, Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66475
x-xss-protection: 0

GET
H2 200 application-landing-page-7ea440a608ae6761bd5abd3174137469ab09ceae7c9b01ceba0ceddb65802b52.js Show response
secure.winred.com/assets/ 486 KB
136 KB 61ms
59ms Script
application/javascript 104.19.211.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/assets/application-landing-page-7ea440a608ae6761bd5abd3174137469ab09ceae7c9b01ceba0ceddb65802b52.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.211.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bf15413499b81555136c08dd340efaf4b00a8eb7ac1067d558e70bf6fbbfb07f

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_&first_name=Devaughn&last_name=Thompson&state=GA&city=Colquitt&zip=39837&email=devaughn.thompson@nutrien.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 11:14:31 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
x-amz-version-id: dbzxATFmqrrik1B4lI2.BR2h86hlZo0z
cf-cache-status: HIT
x-amz-request-id: G0GPEXXFV144ZHXX
age: 4590
cf-polished: origSize=497469
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-amz-id-2: t/s249WK2qPEm5EXmbShnQ9zshbcnQfD2R2IbMGJFq9dld7pV7IHaEE/MtUAOpj3hFZgJg/+s8o=
cf-bgj: minify
last-modified: Tue, 28 Nov 2023 01:42:31 GMT
server: cloudflare
etag: W/"c9a1d576fe79597fb8399634c6208524"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 838fb3b3596b7145-YUL
expires: Thu, 21 Dec 2023 15:14:31 GMT

GET
H2 200 DZ3LCQO_FORq64tSsknePYk4yVRiej_zqQGggKXmGAc.png
d35ligi1n5bgzc.cloudfront.net/logos/logo_assets/000/657/064/large/ 14 KB
14 KB 1591ms
225ms Image
image/png 18.67.17.108
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d35ligi1n5bgzc.cloudfront.net/logos/logo_assets/000/657/064/large/DZ3LCQO_FORq64tSsknePYk4yVRiej_zqQGggKXmGAc.png
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_&first_name=Devaughn&last_name=Thompson&state=GA&city=Colquitt&zip=39837&email=devaughn.thompson@nutrien.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.17.108 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-67-17-108.yto50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b12d7b7e9f25c3b43fd866b5ca187f83b20b85e4da81adc57d951662bb001a5f

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 11:14:33 GMT
x-amz-version-id: HqacbrjTiuOEJ__Bhb__xt7pVUrABwED
via: 1.1 ed31b4e68abf63ec3ae0c1e539b4d67c.cloudfront.net (CloudFront)
last-modified: Sat, 24 Jun 2023 14:31:38 GMT
server: AmazonS3
x-amz-cf-pop: YTO50-P1
etag: "12c257318c236589e1c52c90ddc85a06"
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
content-type: image/png
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 14268
x-amz-cf-id: xHAUSVbTEqpvTe4hgikPSljp24mZ_KtEwOpIZejcG-i_0iswVn97LQ==

GET
H2 200 win-red-full-red-5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848.svg
secure.winred.com/assets/ 19 KB
7 KB 90ms
88ms Image
image/svg+xml 104.19.211.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.winred.com/assets/win-red-full-red-5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.211.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_&first_name=Devaughn&last_name=Thompson&state=GA&city=Colquitt&zip=39837&email=devaughn.thompson@nutrien.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 11:14:31 GMT
x-amz-version-id: f1JFLNaL.a2v3vTaKefRH3mKI0iL1aS2
x-content-type-options: nosniff
strict-transport-security: max-age=0; includeSubDomains
cf-cache-status: HIT
x-amz-request-id: E6EX8CWT7TQF5X9S
age: 4590
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-amz-id-2: N0Ryn0qIQjEbpd5iHH83VajCBoA9rdEl2LIs6IkBnReK0m4Yv5/H0WU/EChBfHJCBX+Q8xEnjIA=
last-modified: Tue, 28 Nov 2023 01:42:37 GMT
server: cloudflare
etag: W/"d31530d4186af669daf4f47099614593"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=14400
cf-ray: 838fb3b3596e7145-YUL
expires: Thu, 21 Dec 2023 15:14:31 GMT

GET
H3 200 email-decode.min.js Show response
secure.winred.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
895 B 19ms
19ms Script
application/javascript 104.19.211.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.211.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_&first_name=Devaughn&last_name=Thompson&state=GA&city=Colquitt&zip=39837&email=devaughn.thompson@nutrien.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 11:14:31 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
last-modified: Tue, 19 Dec 2023 14:09:38 GMT
server: cloudflare
content-encoding: gzip
etag: W/"6581a422-4d7"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript
cache-control: max-age=172800, public
cf-ray: 838fb3b3eb28715a-YUL
expires: Sat, 23 Dec 2023 11:14:31 GMT

GET
H2 200 v84a3a4012de94ce1a686ba8c167c359c1696973893317 Show response
static.cloudflareinsights.com/beacon.min.js/ 20 KB
7 KB 3425ms
101ms Script
text/javascript 104.16.56.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/v84a3a4012de94ce1a686ba8c167c359c1696973893317
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_&first_name=Devaughn&last_name=Thompson&state=GA&city=Colquitt&zip=39837&email=devaughn.thompson@nutrien.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.56.101 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101

Request headers

Referer: https://secure.winred.com/
Origin: https://secure.winred.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 11:14:35 GMT
content-encoding: gzip
last-modified: Tue, 10 Oct 2023 21:38:13 GMT
server: cloudflare
etag: W/"2023.10.0"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 838fb3c96c437150-YUL

GET
H2 200 WinRed_Background_%2813%29.png
d35ligi1n5bgzc.cloudfront.net/backgrounds/images/000/702/782/large/ 417 KB
418 KB 1216ms
56ms Image
image/png 18.67.17.108
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d35ligi1n5bgzc.cloudfront.net/backgrounds/images/000/702/782/large/WinRed_Background_%2813%29.png
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/stylesheets/rv_page_01h8mfbypgqb7dfk1mh2zg6nbb/1693236734.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.17.108 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-67-17-108.yto50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2f8a9cb94b4f434cd8efceb5a4b29a151180a3ca2e3f41278512b460387e815d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-amz-version-id: lvyWkSIXVxabEv.WOSgLlyYT7vA_.4Wo
date: Thu, 21 Dec 2023 10:44:39 GMT
via: 1.1 ed31b4e68abf63ec3ae0c1e539b4d67c.cloudfront.net (CloudFront)
x-amz-cf-pop: YTO50-P1
age: 1794
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 426992
last-modified: Sun, 20 Aug 2023 18:23:41 GMT
server: AmazonS3
etag: "ac9f12cca25816d71631a89ea3e3d334"
vary: Accept-Encoding
content-type: image/png
accept-ranges: bytes
x-amz-cf-id: ufVu6ExOhl1s-6Bt8PXBCdKE3Zk1UQjb-_zXUc1mpjsCctAdj2npow==

GET
H2 200 sha256.min.js Show response
cdnjs.cloudflare.com/ajax/libs/js-sha256/0.9.0/ 9 KB
4 KB 329ms
42ms Script
application/javascript 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/js-sha256/0.9.0/sha256.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7157511697db744d384a5a2a8646af23f3c90560abf93bb240fdd690b29a898a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Origin: https://secure.winred.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 11:14:32 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 2350005
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 2977
last-modified: Mon, 04 May 2020 16:11:50 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec6-2339"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MFd84K8GXAU9lljwgOTkCEJ4jNRbaPBjWwEqVGivnZ0thwhhf84l%2FQL22R5RmUI2tRQosDkwRj8fEgqwMPTdGPqj6nAU8gMal4qjwmCyh4Y95%2FcUKylJWUvn%2F63RYhReeMCz1FwA"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 838fb3b7ebcc33f7-YUL
expires: Tue, 10 Dec 2024 11:14:32 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 274 KB
91 KB 50ms
49ms Script
application/javascript 172.253.122.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-LDP16YY77N&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M4TW6TX

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

c819bc6a629e2035b0f3cd3ba70dc6db4db985d86d9cad75c11d03886e71f53d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 11:14:32 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 93040
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 21 Dec 2023 11:14:32 GMT

GET
H2 200 / Show response
www.googleadservices.com/pagead/conversion/11188077750/ 3 KB
2 KB 3420ms
60ms Script
text/javascript 142.251.163.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/11188077750/?random=1703157272025&cv=11&fst=1703157272025&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DDevaughn%26last_name%3DThompson%26state%3DGA%26city%3DColquitt%26zip%3D39837%26email%3Ddevaughn.thompson%40nutrien.com&label=tNBiCNPx_KIYELaJ8tYp&hn=www.googleadservices.com&frm=0&tiba=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&value=0&bttype=purchase&auid=1450445957.1703157272&uamb=0&uaw=0&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M4TW6TX

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f154.1e100.net

Software

cafe /

Resource Hash

2415c255e0c87006ed34d4eb328b15fbb456193ee3575f968dd2735062119c7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Dec 2023 11:14:35 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1830
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
www.googleadservices.com/pagead/conversion/11198202606/ 3 KB
2 KB 3416ms
59ms Script
text/javascript 142.251.163.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/11198202606/?random=1703157272032&cv=11&fst=1703157272032&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DDevaughn%26last_name%3DThompson%26state%3DGA%26city%3DColquitt%26zip%3D39837%26email%3Ddevaughn.thompson%40nutrien.com&label=M51RCOmQgKgYEO6F3Nsp&hn=www.googleadservices.com&frm=0&tiba=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&value=0&bttype=purchase&auid=1450445957.1703157272&uamb=0&uaw=0&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M4TW6TX

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f154.1e100.net

Software

cafe /

Resource Hash

2dabf381c1a29a6f23f2bfc556206441bd36d08307d88633977570e72d8da128

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Dec 2023 11:14:35 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1827
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET uwt.js
static.ads-twitter.com/ 0
0

GET
H2 200 / Show response
www.googleadservices.com/pagead/conversion/11263458299/ 3 KB
2 KB 3409ms
58ms Script
text/javascript 142.251.163.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/11263458299/?random=1703157272040&cv=11&fst=1703157272040&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DDevaughn%26last_name%3DThompson%26state%3DGA%26city%3DColquitt%26zip%3D39837%26email%3Ddevaughn.thompson%40nutrien.com&label=e3Q7CJi9neAYEPv36vop&hn=www.googleadservices.com&frm=0&tiba=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&value=0&bttype=purchase&auid=1450445957.1703157272&uamb=0&uaw=0&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M4TW6TX

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f154.1e100.net

Software

cafe /

Resource Hash

3ce02f2cdd52cdbfa28c3e9feb315f13a85d1d02cb78e5be82e1665f6e8d6c2b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Dec 2023 11:14:35 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1827
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET up_loader.1.1.0.js
js.adsrvr.org/ 0
0

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 202 KB
54 KB 7295ms
44ms Script
application/x-javascript 31.13.66.19
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

31.13.66.19 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-iad3.fbcdn.net

Software

Resource Hash

3e136e77083bfc6ef14ffc5abd19da89a82bf12fc0cda3c603e01582b93303c8

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), gamepad=(), keyboard-map=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Thu, 21 Dec 2023 11:14:39 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 54273
x-xss-protection: 0
reporting-endpoints
pragma: public
x-fb-debug: mku9lFFEetMSv6vLncFZa33cb+/Mf9hi3EVIVWRyrIWWyz+QTP/bJehi2dPaWCagUynEaFeTbEungcUcj4Whng==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 ping.min.js Show response
pixel.byspotify.com/ 32 KB
7 KB 305ms
17ms Script
application/javascript 34.117.162.98
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.byspotify.com/ping.min.js
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_&first_name=Devaughn&last_name=Thompson&state=GA&city=Colquitt&zip=39837&email=devaughn.thompson@nutrien.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.162.98 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 98.162.117.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 20c0114a672ac0b5b31a1c0100543a2306bf389816ab20774b66e8f7b30fb60c

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 10:42:33 GMT
content-encoding: gzip
via: 1.1 google
age: 1919
x-guploader-uploadid: ABPtcPoGlklN-CvXlTcIzOwDX_Q_OG7TMJAw3ho5egA5S43ZOets7nAixYNEN9ytLJ9q1XHMoOktCRI99n2WBm862cMO-A
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6158
last-modified: Wed, 11 Oct 2023 19:00:35 GMT
server: UploadServer
etag: "13069f74108a788c598831c3a4ff2cdf"
vary: Accept-Encoding
x-goog-generation: 1697050835633914
x-goog-hash: crc32c=We0+rw==, md5=EwafdBCKeIxZiDHDpP8s3w==
content-type: application/javascript;
cache-control: public, max-age=3600
x-goog-stored-content-length: 6158
accept-ranges: bytes
expires: Thu, 21 Dec 2023 11:42:33 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 259 KB
88 KB 52ms
50ms Script
application/javascript 172.253.122.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

1e8729ec843124534cb2402e706022ad2fcc0a7c9d99ed763712a1cad168ab67

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 11:14:32 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 89770
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 21 Dec 2023 11:14:32 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 321ms
29ms Script
text/javascript 172.253.63.139
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.139 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f139.1e100.net

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 21 Dec 2023 10:57:21 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 1031
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Thu, 21 Dec 2023 12:57:21 GMT

POST
H2 204 collect
www.google-analytics.com/g/ 0
172 B 110ms
46ms Ping
text/plain 172.253.63.139
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-LDP16YY77N&gtm=45je3bt0v9118533250z89118299598&_p=1703157271554&gcd=11l1l1l1l1&dma=0&cid=1679839209.1703157272&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1703157272&sct=1&seg=0&dl=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DDevaughn%26last_name%3DThompson%26state%3DGA%26city%3DColquitt%26zip%3D39837%26email%3Ddevaughn.thompson%40nutrien.com&dt=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=1185
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-LDP16YY77N&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.253.63.139 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bi-in-f139.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Dec 2023 11:14:32 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect Show response
gtm.winred.com/g/ 717 B
967 B 1287ms
213ms XHR
text/plain 104.16.249.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gtm.winred.com/g/collect?v=2&tid=G-X6H0114PDF&gtm=45je3bt0v867905447z872410129&_p=1703157271554&gcd=11l1l1l1l1&dma=0&cid=1679839209.1703157272&ul=en-us&sr=1600x1200&_fplc=0&ur=CA-QC&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&sst.uc=CA&sst.gse=1&sst.etld=google.ca&sst.gcd=11l1l1l1l1&sst.tft=1703157271554&_s=1&sid=1703157272&sct=1&seg=0&dl=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DDevaughn%26last_name%3DThompson%26state%3DGA%26city%3DColquitt%26zip%3D39837%26email%3Ddevaughn.thompson%40nutrien.com&dt=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&en=page_view&_fv=1&_ss=1&ep.pagepath=%2Fdesantis%2Ffewer-desantis-emails&ep.pagehostname=secure.winred.com&ep.parsedurl=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails&epn.load_time_sec=-1703157271&epn.event_fire_time=1703157272065&ep.event_uuid=3c5dd782-6f9e-438d-aa5c-05bb8bdc6ee3&ep.isVideoPage=f&ep.referrer=&tfd=1233&richsstsse

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.249.69 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5dd31b7a90474e2bffe784c7858e627731bed2249d05dd3a65bd282e05173207

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 11:14:33 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
server: cloudflare
strict-transport-security: max-age=0; includeSubDomains
vary: Accept-Encoding
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 838fb3bdf8c633fa-YUL
alt-svc: h3=":443"; ma=86400

OPTIONS
H2 200 /
evnt.byspotify.com/ Frame 0
0 86ms
48ms Preflight 34.111.186.1
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://evnt.byspotify.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.186.1 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 1.186.111.34.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://secure.winred.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-credentials: false
access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: https://secure.winred.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Thu, 21 Dec 2023 11:14:32 GMT
via: 1.1 google

POST
H2 200 / Show response
evnt.byspotify.com/ 2 B
97 B 67ms
66ms Fetch
application/json 34.111.186.1
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://evnt.byspotify.com/
Requested by: Host: pixel.byspotify.com
URL: https://pixel.byspotify.com/ping.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.186.1 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 1.186.111.34.bc.googleusercontent.com
Software: /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Accept: application/json
Referer: https://secure.winred.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 21 Dec 2023 11:14:32 GMT
via: 1.1 google
access-control-allow-methods: GET, POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: false
access-control-allow-headers: Content-Type, Accept
content-length: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

POST
H2 200 collect Show response
www.google-analytics.com/j/ 3 B
93 B 39ms
37ms XHR
text/plain 172.253.63.139
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=606170586&t=pageview&_s=1&dl=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3D%5BREDACTED%20NAME%5D%26last_name%3D%5BREDACTED%20NAME%5D%26state%3DGA%26city%3DColquitt%26zip%3D%5BREDACTED%20ZIP%5D%26email%3Ddevaughn.thom%5BREDACTED%20EMAIL%5Dien.com&ul=en-us&de=UTF-8&dt=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YCDAiEABBAAAACAEK~&jid=1007068999&gjid=1645627908&cid=1679839209.1703157272&tid=UA-73658561-7&_gid=854601229.1703157273&_slc=1&gtm=45He3bt0n71NTQZ9Nv72410129&cd61=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3D%5BREDACTED%20NAME%5D%26last_name%3D%5BREDACTED%20NAME%5D%26state%3DGA%26city%3DColquitt%26zip%3D%5BREDACTED%20ZIP%5D%26email%3Ddevaughn.thom%5BREDACTED%20EMAIL%5Dien.com&gcd=11l1l1l1l1&dma=0&z=177458177

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.139 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f139.1e100.net

Software

Golfe2 /

Resource Hash

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 21 Dec 2023 11:14:33 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
350 B 97ms
37ms XHR
text/plain 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-73658561-7&cid=1679839209.1703157272&jid=1007068999&gjid=1645627908&_gid=854601229.1703157273&_u=YCDAiEABBAAAAGAEK~&z=511841665

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f154.1e100.net

Software

Golfe2 /

Resource Hash

8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Thu, 21 Dec 2023 11:14:33 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
408 B 3148ms
56ms Image
image/gif 172.253.122.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-73658561-7&cid=1679839209.1703157272&jid=1007068999&_u=YCDAiEABBAAAAGAEK~&z=656392631

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f99.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Dec 2023 11:14:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.ca/ads/ 42 B
107 B 1958ms
42ms Image
image/gif 142.251.163.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-73658561-7&cid=1679839209.1703157272&jid=1007068999&_u=YCDAiEABBAAAAGAEK~&z=656392631

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f94.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Dec 2023 11:14:35 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
analytics.google.com/g/s/ 0
255 B 184ms
136ms Ping
text/plain 216.239.38.181
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/s/collect?dma=0&gtm=45j91e3b82v867905447z872410129z9867900975&_gsid=X6H0114PDFouJvnlR_1aDNtVwo-niyLQ
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.239.38.181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Dec 2023 11:14:35 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
56 B 37ms
37ms Ping
text/plain 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&dma=0&tid=G-X6H0114PDF&cid=bkYHtbuIXeLsAfeIrkGG1t8ebWlbXL234O4TGgmqTEc%3D.1703157272&gtm=45j91e3b82v867905447z872410129z9867900975&aip=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.253.63.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bi-in-f154.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Dec 2023 11:14:33 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.ca/ads/ 42 B
408 B 103ms
40ms Image
image/gif 142.251.163.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&dma=0&tid=G-X6H0114PDF&cid=bkYHtbuIXeLsAfeIrkGG1t8ebWlbXL234O4TGgmqTEc%3D.1703157272&gtm=45j91e3b82v867905447z872410129z9867900975&aip=1&z=1585657949

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f94.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Dec 2023 11:14:35 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204 Show response
maps.googleapis.com/maps/api/mapsjs/ 3 B
45 B 106ms
47ms XHR
application/json 142.251.167.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f95.1e100.net

Software

scaffolding on HTTPServer2 /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 11:14:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://secure.winred.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23
x-xss-protection: 0

GET
H2 200 current_with_info Show response
app.revv.co/api/v3/users/ 162 B
1 KB 136ms
93ms XHR
application/vnd.api+json 104.19.212.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.revv.co/api/v3/users/current_with_info?organization_token=rv_org_01h0fnp3d6597cwc8tt4vbst1j&redirect=https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_&first_name=Devaughn&last_name=Thompson&state=GA&city=Colquitt&zip=39837&email=devaughn.thompson@nutrien.com

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/assets/application-landing-page-7ea440a608ae6761bd5abd3174137469ab09ceae7c9b01ceba0ceddb65802b52.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.212.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

54408166db71aca34fc5b88fa27647edff94dcce0d58fa5d1f4d253e9c63938e

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://secure.winred.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

x-rack-cors-original-access-control-allow-origin: https://secure.winred.com
x-rack-cors: hit
date: Thu, 21 Dec 2023 11:14:35 GMT
x-rack-cors-original-access-control-max-age: 0
x-rack-cors-original-access-control-allow-credentials: true
strict-transport-security: max-age=0; includeSubDomains
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
content-encoding: br
x-rack-cors-original-access-control-allow-methods: GET, POST, OPTIONS
x-rack-cors-original-access-control-expose-headers
alt-svc: h3=":443"; ma=86400
x-request-id: 7e362dcc-6b28-4ee6-a711-bd37aaa74ccf
x-runtime: 0.009365
server: cloudflare
etag: W/"54408166db71aca34fc5b88fa27647ed"
access-control-max-age: 0
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/vnd.api+json
access-control-allow-origin: https://secure.winred.com
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
vary: Origin
cf-ray: 838fb3ca9e3b7157-YUL

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 30ms
29ms Image
image/gif 172.253.63.139
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=606170586&t=event&ni=0&_s=1&dl=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DDevaughn%26last_name%3DThompson%26state%3DGA%26city%3DColquitt%26zip%3D39837%26email%3Ddevaughn.thompson%40nutrien.com&ul=en-us&de=UTF-8&dt=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=petition%20landing%20page&ea=user%20session%20start&el=landing%20page%20settings&_u=aCDAiEABBAAAAGAEK~&jid=&gjid=&cid=1679839209.1703157272&tid=UA-73658561-7&_gid=854601229.1703157273&gtm=45He3bt0n71NTQZ9Nv72410129&cd41=anonymous&cd58=t&cd61=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DDevaughn%26last_name%3DThompson%26state%3DGA%26city%3DColquitt%26zip%3D39837%26email%3Ddevaughn.thompson%40nutrien.com&gcd=11l1l1l1l1&dma=0&z=245854628

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.139 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f139.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Dec 2023 09:30:27 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 6248
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3

200

main.js Show response
secure.winred.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/ Frame C1A2
Redirect Chain

https://secure.winred.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://secure.winred.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/main.js

7 KB
4 KB

40ms
39ms

Script
application/javascript

104.19.211.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/main.js

Requested by

Protocol

Server

104.19.211.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d4b818842aa4ca70984a8053592ca9080f8f0102c90a1f81f88ad6b9e7fcb4b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 11:14:35 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
content-encoding: br
server: cloudflare
vary: accept-encoding
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
cf-ray: 838fb3ca99f4715a-YUL
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Thu, 21 Dec 2023 11:14:35 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
server: cloudflare
vary: accept-encoding
location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/main.js
access-control-allow-origin: *
cache-control: max-age=300, public
cf-ray: 838fb3ca6989715a-YUL
alt-svc: h3=":443"; ma=86400

GET
H2 200 m-outer-27c67c0d52761104439bb051c7856ab1.html Show response
js.stripe.com/v3/ Frame 83EA 200 B
840 B 16ms
15ms Document
text/html 151.101.128.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/m-outer-27c67c0d52761104439bb051c7856ab1.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.128.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

351ffc2bdf381352dcd801be49be5018361119588eae077650260f9e162fe7b9

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 8949012
cache-control: max-age=31536000
content-encoding: br
content-length: 154
content-security-policy: base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://q.stripe.com/csp-report
content-security-policy-report-only: base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Thu, 21 Dec 2023 11:14:35 GMT
etag: "27c67c0d52761104439bb051c7856ab1"
last-modified: Fri, 08 Sep 2023 21:23:50 GMT
server: Fastly
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 1236372
x-content-type-options: nosniff
x-request-id: b8db8ecf-0400-4b08-9f81-9fccb9c6e27e
x-served-by: cache-yul12821-YUL

GET
H2 200 m-outer-6576085ca35ee42f2f484cda6763e4aa.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 83EA 631 B
527 B 17ms
17ms Script
text/javascript 151.101.128.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/m-outer-6576085ca35ee42f2f484cda6763e4aa.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/m-outer-27c67c0d52761104439bb051c7856ab1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.128.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

f0205495d259e89d99e6c4989147f8a65bef41513bfbe3e97251cd6fb6fa5947

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/m-outer-27c67c0d52761104439bb051c7856ab1.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Thu, 21 Dec 2023 11:14:35 GMT
via: 1.1 varnish
age: 8949012
x-cache: HIT
content-length: 399
x-request-id: 6e594f88-6e78-45f2-b63e-c810a90ed35e
x-served-by: cache-yul12821-YUL
last-modified: Fri, 08 Sep 2023 21:23:49 GMT
server: Fastly
etag: "70cacf09ae81711ac6dcbc5ee59750c4"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1178263

POST
H2 200 csp-report
q.stripe.com/ Frame 83EA 0
717 B 491ms
100ms Other
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Thu, 21 Dec 2023 11:14:35 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1703157275729297
x-envoy-upstream-service-time: 1
content-length: 0
x-stripe-bg-intended-route-color: green
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
cross-origin-opener-policy: same-origin
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
x-stripe-server-envoy-upstream-service-time-ms: 0
access-control-allow-origin: https://js.stripe.com
x-stripe-client-envoy-start-time-us: 1703157275729012
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-expose-headers: Server, Range, Content-Type
x-robots-tag: none
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires: 0

POST
H2 200 csp-report
q.stripe.com/ Frame 83EA 0
717 B 491ms
100ms Other
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Thu, 21 Dec 2023 11:14:35 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1703157275729237
x-envoy-upstream-service-time: 1
content-length: 0
x-stripe-bg-intended-route-color: green
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
cross-origin-opener-policy: same-origin
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
x-stripe-server-envoy-upstream-service-time-ms: 0
access-control-allow-origin: https://js.stripe.com
x-stripe-client-envoy-start-time-us: 1703157275728978
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-expose-headers: Server, Range, Content-Type
x-robots-tag: none
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
expires: 0

GET
H2 200 inner.html Show response
m.stripe.network/ Frame 56E7 930 B
2 KB 389ms
18ms Document
text/html 54.192.51.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.network/inner.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/m-outer-6576085ca35ee42f2f484cda6763e4aa.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.51.43 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-51-43.yul62.r.cloudfront.net

Software

Cloudfront /

Resource Hash

947ac0903521f5eceefc90637c066306a8ca67466ccc188bb0107fb7cfb532d1

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src https://m.stripe.network https://m.stripe.com; default-src 'none'; font-src https://m.stripe.network https://fonts.gstatic.com; form-action 'none'; frame-src https://m.stripe.network https://js.stripe.com; img-src https://m.stripe.network https://m.stripe.com https://b.stripecdn.com; script-src https://m.stripe.network 'sha256-/5Guo2nzv5n/w6ukZpOBZOtTJBJPSkJ6mhHpnBgm3Ls='; style-src https://m.stripe.network; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 33
cache-control: max-age=300, public
content-length: 930
content-security-policy: base-uri 'none'; connect-src https://m.stripe.network https://m.stripe.com; default-src 'none'; font-src https://m.stripe.network https://fonts.gstatic.com; form-action 'none'; frame-src https://m.stripe.network https://js.stripe.com; img-src https://m.stripe.network https://m.stripe.com https://b.stripecdn.com; script-src https://m.stripe.network 'sha256-/5Guo2nzv5n/w6ukZpOBZOtTJBJPSkJ6mhHpnBgm3Ls='; style-src https://m.stripe.network; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Thu, 21 Dec 2023 11:14:04 GMT
etag: "06bfcd88af438673a8bf9b845a11aa6e"
last-modified: Fri, 30 Jun 2023 14:32:28 GMT
server: Cloudfront
strict-transport-security: max-age=31556926; includeSubDomains; preload
vary: Accept-Encoding, Origin
via: 1.1 ac1cb1fdb7cf3984f94f9f190169eb3a.cloudfront.net (CloudFront)
x-amz-cf-id: Ops67EaQgzZzsTzCux4DvREJFGpcw85Va9LUkXPOL56y2EU9HUt1GA==
x-amz-cf-pop: YUL62-C2
x-cache: Hit from cloudfront
x-content-type-options: nosniff

POST
H3 200 838fb3b0ebe27145 Show response
secure.winred.com/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame C1A2 0
299 B 43ms
42ms XHR
text/plain 104.19.211.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/cdn-cgi/challenge-platform/h/g/jsd/r/838fb3b0ebe27145

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/cdn-cgi/challenge-platform/scripts/jsd/main.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.211.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 21 Dec 2023 11:14:35 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
content-encoding: br
server: cloudflare
content-type: text/plain; charset=UTF-8
cf-ray: 838fb3cb9bed715a-YUL
alt-svc: h3=":443"; ma=86400

GET
H3

200

/
www.google.ca/pagead/1p-conversion/11198202606/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11198202606/?random=110069996&cv=11&fst=1703157272032&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=160...
https://www.google.com/pagead/1p-conversion/11198202606/?random=110069996&cv=11&fst=1703157272032&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%...
https://www.google.ca/pagead/1p-conversion/11198202606/?random=110069996&cv=11&fst=1703157272032&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3...

42 B
64 B

45ms
45ms

Image
image/gif

142.251.163.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-conversion/11198202606/?random=110069996&cv=11&fst=1703157272032&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DDevaughn%26last_name%3DThompson%26state%3DGA%26city%3DColquitt%26zip%3D39837%26email%3Ddevaughn.thompson%40nutrien.com&label=M51RCOmQgKgYEO6F3Nsp&hn=www.googleadservices.com&frm=0&tiba=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&value=0&auid=1450445957.1703157272&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek9DaEVJZ09HUHJBWVEzOV9JcFpxVmxQcWxBUkltQUw0TG0ySHM0RllRTUg4b0cyenRETEJKYUI4TEYxVHVYdEl1cXduVk8xekVhekk2WU5VGlhDaEFJZ09HUHJBWVFqTnU4aXRYbTF0WTJFaTRBbk9ON2tQR05ucGdLd0F0MUhRT3JhWFhtQ0tYQWhHWHVPZDdMaER0ak1lZjRtZDdXSUF3ZF9nQ2d6T216IhMI24GYo7OggwMV3w5oCB1L6QzM&is_vtc=1&ocp_id=Gx6EZZuIGt-doPMPy9Kz4Aw&cid=CAQSGwAvHhf_0vdfdgkMYIm0ihoUkvkHe76neJX6-Q&eitems=ChEIgOGPrAYQqaDV3N2EjeKUARIdAA1yRZWjbWwmonL4ovs_BBiKefi_k_g9jav9qpU&random=1218506944&ipr=y

Requested by

Protocol

Server

142.251.163.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f94.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Dec 2023 11:14:36 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 21 Dec 2023 11:14:36 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://www.google.ca/pagead/1p-conversion/11198202606/?random=110069996&cv=11&fst=1703157272032&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DDevaughn%26last_name%3DThompson%26state%3DGA%26city%3DColquitt%26zip%3D39837%26email%3Ddevaughn.thompson%40nutrien.com&label=M51RCOmQgKgYEO6F3Nsp&hn=www.googleadservices.com&frm=0&tiba=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&value=0&auid=1450445957.1703157272&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek9DaEVJZ09HUHJBWVEzOV9JcFpxVmxQcWxBUkltQUw0TG0ySHM0RllRTUg4b0cyenRETEJKYUI4TEYxVHVYdEl1cXduVk8xekVhekk2WU5VGlhDaEFJZ09HUHJBWVFqTnU4aXRYbTF0WTJFaTRBbk9ON2tQR05ucGdLd0F0MUhRT3JhWFhtQ0tYQWhHWHVPZDdMaER0ak1lZjRtZDdXSUF3ZF9nQ2d6T216IhMI24GYo7OggwMV3w5oCB1L6QzM&is_vtc=1&ocp_id=Gx6EZZuIGt-doPMPy9Kz4Aw&cid=CAQSGwAvHhf_0vdfdgkMYIm0ihoUkvkHe76neJX6-Q&eitems=ChEIgOGPrAYQqaDV3N2EjeKUARIdAA1yRZWjbWwmonL4ovs_BBiKefi_k_g9jav9qpU&random=1218506944&ipr=y
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

/
www.google.ca/pagead/1p-conversion/11263458299/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11263458299/?random=951719445&cv=11&fst=1703157272040&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=160...
https://www.google.com/pagead/1p-conversion/11263458299/?random=951719445&cv=11&fst=1703157272040&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%...
https://www.google.ca/pagead/1p-conversion/11263458299/?random=951719445&cv=11&fst=1703157272040&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3...

42 B
64 B

54ms
54ms

Image
image/gif

142.251.163.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-conversion/11263458299/?random=951719445&cv=11&fst=1703157272040&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DDevaughn%26last_name%3DThompson%26state%3DGA%26city%3DColquitt%26zip%3D39837%26email%3Ddevaughn.thompson%40nutrien.com&label=e3Q7CJi9neAYEPv36vop&hn=www.googleadservices.com&frm=0&tiba=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&value=0&auid=1450445957.1703157272&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek9DaEVJZ09HUHJBWVEzOV9JcFpxVmxQcWxBUkltQUw0TG0ySHM0RllRTUg4b0cyenRETEJKYUI4TEYxVHVYdEl1cXduVk8xekVhekk2WU5VGlhDaEFJZ09HUHJBWVFqTnU4aXRYbTF0WTJFaTRBbk9ON2tKeUdyN0dsNWNHeFdHWXNybHpxblpTT1J4ZFhySXVzZW1oN1dIMFlZTkpBQmdHek5mMWROYlg5IhMIwISYo7OggwMVuwxoCB3vXgy2&is_vtc=1&ocp_id=Gx6EZYCLGruZoPMP772xsAs&cid=CAQSGwAvHhf_0GeMjxsVIcliA32GpIKVgLxolLukUA&eitems=ChEIgOGPrAYQqaDV3N2EjeKUARIdAA1yRZWioQM0GMbpopT95AXY_qGJQk8ACAzJ4wI&random=2894654084&ipr=y

Requested by

Protocol

Server

142.251.163.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f94.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Dec 2023 11:14:36 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 21 Dec 2023 11:14:36 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://www.google.ca/pagead/1p-conversion/11263458299/?random=951719445&cv=11&fst=1703157272040&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DDevaughn%26last_name%3DThompson%26state%3DGA%26city%3DColquitt%26zip%3D39837%26email%3Ddevaughn.thompson%40nutrien.com&label=e3Q7CJi9neAYEPv36vop&hn=www.googleadservices.com&frm=0&tiba=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&value=0&auid=1450445957.1703157272&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek9DaEVJZ09HUHJBWVEzOV9JcFpxVmxQcWxBUkltQUw0TG0ySHM0RllRTUg4b0cyenRETEJKYUI4TEYxVHVYdEl1cXduVk8xekVhekk2WU5VGlhDaEFJZ09HUHJBWVFqTnU4aXRYbTF0WTJFaTRBbk9ON2tKeUdyN0dsNWNHeFdHWXNybHpxblpTT1J4ZFhySXVzZW1oN1dIMFlZTkpBQmdHek5mMWROYlg5IhMIwISYo7OggwMVuwxoCB3vXgy2&is_vtc=1&ocp_id=Gx6EZYCLGruZoPMP772xsAs&cid=CAQSGwAvHhf_0GeMjxsVIcliA32GpIKVgLxolLukUA&eitems=ChEIgOGPrAYQqaDV3N2EjeKUARIdAA1yRZWioQM0GMbpopT95AXY_qGJQk8ACAzJ4wI&random=2894654084&ipr=y
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

/
www.google.ca/pagead/1p-conversion/11188077750/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11188077750/?random=195060796&cv=11&fst=1703157272025&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=160...
https://www.google.com/pagead/1p-conversion/11188077750/?random=195060796&cv=11&fst=1703157272025&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%...
https://www.google.ca/pagead/1p-conversion/11188077750/?random=195060796&cv=11&fst=1703157272025&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3...

42 B
64 B

45ms
45ms

Image
image/gif

142.251.163.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-conversion/11188077750/?random=195060796&cv=11&fst=1703157272025&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DDevaughn%26last_name%3DThompson%26state%3DGA%26city%3DColquitt%26zip%3D39837%26email%3Ddevaughn.thompson%40nutrien.com&label=tNBiCNPx_KIYELaJ8tYp&hn=www.googleadservices.com&frm=0&tiba=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&value=0&auid=1450445957.1703157272&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek9DaEVJZ09HUHJBWVEzOV9JcFpxVmxQcWxBUkltQUw0TG0ySHM0RllRTUg4b0cyenRETEJKYUI4TEYxVHVYdEl1cXduVk8xekVhekk2WU5VGlhDaEFJZ09HUHJBWVFqTnU4aXRYbTF0WTJFaTRBbk9ON2tNZTN3eVVaZXJGUlBpVXZad2Ewa3Q3LXZOM0V0dlkxV2tnTGhrQkhEV2R4SUdxdjF1ZTZ2TkdhIhMIn4GYo7OggwMVXRtoCB22QQbI&is_vtc=1&ocp_id=Gx6EZd-HGt22oPMPtoOZwAw&cid=CAQSGwAvHhf_K7BFPz7H7E6U12stKRzCtuyLzaHfQg&eitems=ChEIgOGPrAYQqaDV3N2EjeKUARIdAA1yRZWZSBICFeNC4dLnO1qkla68DQUKTHM9aqk&random=2160532932&ipr=y

Requested by

Protocol

Server

142.251.163.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f94.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Dec 2023 11:14:36 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 21 Dec 2023 11:14:36 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://www.google.ca/pagead/1p-conversion/11188077750/?random=195060796&cv=11&fst=1703157272025&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v9118299598&gcd=11l1l1l1l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DDevaughn%26last_name%3DThompson%26state%3DGA%26city%3DColquitt%26zip%3D39837%26email%3Ddevaughn.thompson%40nutrien.com&label=tNBiCNPx_KIYELaJ8tYp&hn=www.googleadservices.com&frm=0&tiba=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&value=0&auid=1450445957.1703157272&uamb=0&uaw=0&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek9DaEVJZ09HUHJBWVEzOV9JcFpxVmxQcWxBUkltQUw0TG0ySHM0RllRTUg4b0cyenRETEJKYUI4TEYxVHVYdEl1cXduVk8xekVhekk2WU5VGlhDaEFJZ09HUHJBWVFqTnU4aXRYbTF0WTJFaTRBbk9ON2tNZTN3eVVaZXJGUlBpVXZad2Ewa3Q3LXZOM0V0dlkxV2tnTGhrQkhEV2R4SUdxdjF1ZTZ2TkdhIhMIn4GYo7OggwMVXRtoCB22QQbI&is_vtc=1&ocp_id=Gx6EZd-HGt22oPMPtoOZwAw&cid=CAQSGwAvHhf_K7BFPz7H7E6U12stKRzCtuyLzaHfQg&eitems=ChEIgOGPrAYQqaDV3N2EjeKUARIdAA1yRZWZSBICFeNC4dLnO1qkla68DQUKTHM9aqk&random=2160532932&ipr=y
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 csp-report
q.stripe.com/ Frame 56E7 0
491 B 103ms
102ms Other
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload, max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://m.stripe.network/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Thu, 21 Dec 2023 11:14:35 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload, max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1703157275753803
x-envoy-upstream-service-time: 3
content-length: 0
x-stripe-bg-intended-route-color: green
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
cross-origin-opener-policy: same-origin
x-stripe-server-envoy-upstream-service-time-ms: 1
x-stripe-client-envoy-start-time-us: 1703157275752994
cache-control: max-age=0, no-cache, no-store, must-revalidate
x-robots-tag: none
expires: 0

GET
H2 200 out-4.5.43.js Show response
m.stripe.network/ Frame 56E7 87 KB
14 KB 23ms
23ms Script
text/javascript 54.192.51.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.network/out-4.5.43.js

Requested by

Host: m.stripe.network
URL: https://m.stripe.network/inner.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.51.43 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-51-43.yul62.r.cloudfront.net

Software

Cloudfront /

Resource Hash

e039e607c78306c7e029a7fd0ecdb14f86456f16e1a5ce65aa26b4fdf1d38a3c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://m.stripe.network/inner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 11:13:56 GMT
content-encoding: br
via: 1.1 ac1cb1fdb7cf3984f94f9f190169eb3a.cloudfront.net (CloudFront)
strict-transport-security: max-age=31556926; includeSubDomains; preload
last-modified: Fri, 30 Jun 2023 14:32:28 GMT
server: Cloudfront
age: 41
x-content-type-options: nosniff
etag: W/"69cb7809b5011312e716f29b3d19dce6"
x-amz-cf-pop: YUL62-C2
vary: Accept-Encoding, Origin
x-cache: Hit from cloudfront
content-type: text/javascript; charset=utf-8
cache-control: max-age=300, public
x-amz-cf-id: 9Tx-eJsmO69S-7rpU05qXJj17uaYZdrmscqdwB_ATHQ9vTAcW0Xv3w==

GET
H2 200 collect Show response
gtm.winred.com/g/ 317 B
331 B 320ms
320ms XHR
text/plain 104.16.249.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gtm.winred.com/g/collect?v=2&tid=G-X6H0114PDF&gtm=45je3bt0v867905447z872410129&_p=1703157271554&gcd=11l1l1l1l1&dma=0&cid=1679839209.1703157272&ul=en-us&sr=1600x1200&ur=CA-QC&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&sst.uc=CA&sst.gse=1&sst.etld=google.ca&sst.gcd=11l1l1l1l1&sst.tft=1703157271554&_s=2&sid=1703157272&sct=1&seg=0&dl=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3DDevaughn%26last_name%3DThompson%26state%3DGA%26city%3DColquitt%26zip%3D39837%26email%3Ddevaughn.thompson%40nutrien.com&dt=Ron%20DeSantis%20for%20President%20%7C%20Grassroots%20Team&en=user%20session%20start&ep.pagepath=%2Fdesantis%2Ffewer-desantis-emails&ep.pagehostname=secure.winred.com&ep.parsedurl=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails&epn.load_time_sec=-1703157271&epn.event_fire_time=1703157275227&ep.event_uuid=46a848c7-ba7d-478a-8aff-4f573638e4a7&ep.isVideoPage=f&ep.referrer=&ep.category=petition%20landing%20page&ep.action=user%20session%20start&ep.label=landing%20page%20settings&ep.customCSS=t&ep.usercategory=anonymous&_et=3044&tfd=4857&richsstsse

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.249.69 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a626e64837c3ffa65257956cf636fb166b96eef01ab52b56753a77eb804e4c6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 11:14:36 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
server: cloudflare
strict-transport-security: max-age=0; includeSubDomains
vary: Accept-Encoding
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 838fb3cde8e533fa-YUL
alt-svc: h3=":443"; ma=86400

POST
H2 200 6 Show response
m.stripe.com/ Frame 56E7 156 B
669 B 814ms
104ms XHR
application/json 52.35.126.53
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.com/6

Requested by

Host: m.stripe.network
URL: https://m.stripe.network/out-4.5.43.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.35.126.53 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-35-126-53.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

45c40d0f95113788447af9433023919be282397944c195a5bec17394dc2829f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://m.stripe.network/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-stripe-bg-intended-route-color: green
date: Thu, 21 Dec 2023 11:14:36 GMT
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1703157276585812
server: nginx
content-type: application/json;charset=utf-8
x-stripe-server-envoy-upstream-service-time-ms: 1
access-control-allow-origin: https://m.stripe.network
x-stripe-client-envoy-start-time-us: 1703157276585522
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 156

GET
H2 200 ga-audiences
www.google.ca/ads/ 42 B
107 B 43ms
42ms Image
image/gif 142.251.163.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f94.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Dec 2023 11:14:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 217670437796224 Show response
connect.facebook.net/signals/config/ 139 KB
36 KB 93ms
92ms Script
application/x-javascript 31.13.66.19
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/217670437796224?v=2.9.138&r=stable&domain=secure.winred.com

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

31.13.66.19 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-iad3.fbcdn.net

Software

Resource Hash

8073a0bcd589f248e2324d7ab4b35550c064976fab988e132bf34ff9ee264fc3

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), gamepad=(), keyboard-map=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Thu, 21 Dec 2023 11:14:39 GMT
document-policy: force-load-at-top
content-security-policy-report-only: default-src https: data: wss: blob: chrome-extension: 'unsafe-inline' 'unsafe-eval';report-uri https://www.facebook.com/csp/reporting/?minimize=0;require-trusted-types-for 'script';
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints
pragma: public
x-fb-debug: Nc47w9RvKcxfopCGXg8pMkaD6OGEfO8N2FgWX3pWqsFz9Zf3Gu1Sls/uCsJT+G/sODbCFtEiNsQuSnzRlwWjPA==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 340ms
29ms Image
text/plain 31.13.66.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=217670437796224&ev=PageView&dl=https%3A%2F%2Fsecure.winred.com%2Fdesantis%2Ffewer-desantis-emails%3Futm_source%3Dhs_sf%26utm_medium%3Dem_hf%26utm_campaign%3D2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_%26first_name%3D_removed_%26last_name%3D_removed_%26state%3DGA%26city%3DColquitt%26zip%3D39837%26email%3Ddevaughn.thompson%2540nutrien.com%26_filteredParams%3D%257B%2522unwantedParams%2522%253A%255B%2522first_name%2522%252C%2522last_name%2522%255D%252C%2522restrictedParams%2522%253A%255B%255D%257D&rl=&if=false&ts=1703157279504&sw=1600&sh=1200&v=2.9.138&r=stable&ec=0&o=4126&fbp=fb.1.1703157279499.388740401&cs_est=true&ler=empty&it=1703157279389&coo=false&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

31.13.66.35 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-iad3.facebook.com

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Thu, 21 Dec 2023 11:14:39 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 common.js Show response
maps.googleapis.com/maps-api-v3/api/js/55/4/ 256 KB
57 KB 31ms
30ms Script
text/javascript 142.251.167.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps-api-v3/api/js/55/4/common.js

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f95.1e100.net

Software

sffe /

Resource Hash

969dace001ef24f99f38bd00c5578b85ba9368e77a5667cfcaeaa29d2f57657b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 10:03:03 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4296
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57512
x-xss-protection: 0
last-modified: Mon, 04 Dec 2023 22:55:43 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="maps-api-js"
vary: Accept-Encoding, Origin
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 20 Dec 2024 10:03:03 GMT

GET
H2 200 util.js Show response
maps.googleapis.com/maps-api-v3/api/js/55/4/ 173 KB
54 KB 40ms
40ms Script
text/javascript 142.251.167.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps-api-v3/api/js/55/4/util.js

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f95.1e100.net

Software

sffe /

Resource Hash

e759dc710ec6d9f9438d5a77f834b247254512fb90cf520764ab591db32cf5cb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Thu, 21 Dec 2023 10:24:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3020
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 55175
x-xss-protection: 0
last-modified: Mon, 04 Dec 2023 22:55:43 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="maps-api-js"
vary: Accept-Encoding, Origin
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 20 Dec 2024 10:24:19 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Domain: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js

Verdicts & Comments Add Verdict or Comment

47 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

24 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
app.revv.co/api/v3/users	1970-01-21 02:41:57	Name: rvid Value: 701c546b-d1d1-4c40-bca8-2d3e2ba147dd
.winred.com/	1969-12-31 23:59:59	Name: _revv_v3_session Value: cTgrSGl0aEVnYnZ3U2dkaGxhRkZ2c1E2bUJTc2hFdFlTTlJ0d3JHYnNDYUtma2lKSSswOUxMSGFNaldzRVZZc0NmVjROajhFSTE4WGhsTjdDL2JxT2pRdjZsZkR1REVjTmhBOEo4MHE1WGE2NXdrQ0F3a2NhSzYvN0wxTkV5azh0WmtZNEVUb0xOWjAwOFpndVc1RUREaFN5alpQZWgyMCtsd3k5WU9jV3pMZnM1WTRUMnU1MmEwN2wxZXlqVnBaNjBQNWhzZWxXZEVpSFJzZk4xcjlBTVJwWG42NXZWMGhzeC9vYzVaSjgvNFQ5YTNLT2hESVVFVWQvcXEwYnpwZFFLSXNDS2lmemJNU21WVDN0OUdVT01xb21lVlhBSldEaVVGUTgwbTdJZnR5L2plcG1tZmNZOGFXaGtydEd5d0tDaHB4RjZyemdjV1Zzb2RTSkdUZ05oOEpDRzV1OVlwdEdXcXBMNW52UzRvPS0tUWNLRTR3OWM4MktLVlZoL043VVltUT09--cc9648414c382ec251bd7558a3341885cdbf8fe6
.secure.winred.com/	1970-01-20 17:05:59	Name: __cf_bm Value: 9ihvkY91dvrG9FhqRSgBR7LZOAp_rCp2bMnfyhOIcsU-1703157271-1-AcbJtNysUit/7/quwPtJFJPfG80sq0EHnKOw/aFefr0epxCJnUx4+AMpAPw2F68Y2a/SMhDcbPc52sHP0FBToe8=
.winred.com/	1970-01-20 19:15:33	Name: _gcl_au Value: 1.1.1450445957.1703157272
.winred.com/	1970-01-21 02:41:57	Name: _ga_LDP16YY77N Value: GS1.1.1703157272.1.0.1703157272.0.0.0
secure.winred.com/	1970-01-21 01:51:33	Name: __spdt Value: a8137ebe4a3d440aa3b93dcfd8796197
.winred.com/	1970-01-21 02:41:57	Name: _ga Value: GA1.2.1679839209.1703157272
.winred.com/	1970-01-20 17:07:23	Name: _gid Value: GA1.2.854601229.1703157273
.winred.com/	1970-01-20 17:05:57	Name: _dc_gtm_UA-73658561-7 Value: 1
.winred.com/	1970-01-21 02:41:57	Name: FPID Value: FPID2.2.bkYHtbuIXeLsAfeIrkGG1t8ebWlbXL234O4TGgmqTEc%3D.1703157272
.winred.com/	1970-01-20 17:07:09	Name: FPLC Value: qfr8piD9knoBxVUtWvjfSwUM9DaZrBh0xLLj9nLbkIgu1sIGCNwvxQ2EfV1zfMwPkjn%2BAAc44g2bYWT0l4cReJ84H%2F4OlV2BqPEo3uXvOpDBVSw6ptg0jcE7lXdDEw%3D%3D
.winred.com/	1970-01-20 17:05:59	Name: FPGSID Value: 1.1703157273.1703157273.G-X6H0114PDF.ouJvnlR_1aDNtVwo-niyLQ
.winred.com/	1970-01-21 02:41:57	Name: _ga_X6H0114PDF Value: GS1.1.1703157272.1.0.1703157275.0.0.0
secure.winred.com/	1969-12-31 23:59:59	Name: origin_url Value: https://secure.winred.com/desantis/fewer-desantis-emails?utm_source=hs_sf&utm_medium=em_hf&utm_campaign=2023-10-31_success-over-decline_ha_aud0469_em0819_lp1547_rds_172040_&first_name=Devaughn&last_name=Thompson&state=GA&city=Colquitt&zip=39837&email=devaughn.thompson@nutrien.com
.revv.co/	1969-12-31 23:59:59	Name: _revv_v3_session Value: MUt0Z24rajVSRGcrM2hLWGNjOTJXM0xaV2FOMnJkelFSSWc0L0FhOGNJYUE3dyt6QmxlVThDV2lYZy9vMStTUERHOWZzczdBNldCTlBqSTQ1Uzg2aEE9PS0teXo3ZUpKY2htK1BkaGNtWUFwRzhvdz09--2c652523f0a85799d993721f343d1ba9a0926b51
.revv.co/	1970-01-20 17:05:59	Name: __cf_bm Value: iW6zC53rtqM6kpPAmjeu5xhutQDvPZr1KNh5TSclDx0-1703157275-1-AdBgU1NR8jGMMUJoCH3EdvP8FfocxkAeVmfULdWAE6AffHF49eyj27rkVfOTE+CmTtEjozd2skQHOtV2TPlfF6g=
secure.winred.com/	1969-12-31 23:59:59	Name: sso_tries Value: 1
secure.winred.com/	1970-01-21 02:41:57	Name: rvid Value: 701c546b-d1d1-4c40-bca8-2d3e2ba147dd
.secure.winred.com/	1970-01-21 01:51:33	Name: cf_clearance Value: .iujOGGNsbuJRH4S6jPqYK..GFCgphGD7.Z_zG_KF30-1703157275-0-2-992c3fc7.1e97b427.5ab8e270-0.2.1703157275
.doubleclick.net/	1970-01-20 17:05:58	Name: test_cookie Value: CheckForPermission
m.stripe.com/	1970-01-21 02:41:57	Name: m Value: 48616b4b-1c8a-4825-ade7-c2544d919a03a24eea
.secure.winred.com/	1970-01-21 01:51:33	Name: __stripe_mid Value: e183aa5a-eb26-47cf-b2a0-a28a3a5632f4cc254d
.secure.winred.com/	1970-01-20 17:05:59	Name: __stripe_sid Value: 417484c9-92c4-4c27-a358-68f4f0000fb1c6e3f0
.winred.com/	1970-01-20 19:15:33	Name: _fbp Value: fb.1.1703157279499.388740401

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self'".

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

analytics.google.com
app.revv.co
cdnjs.cloudflare.com
click.email.rondesantis.com
connect.facebook.net
d35ligi1n5bgzc.cloudfront.net
evnt.byspotify.com
googleads.g.doubleclick.net
gtm.winred.com
js.adsrvr.org
js.stripe.com
m.stripe.com
m.stripe.network
maps.googleapis.com
pixel.byspotify.com
q.stripe.com
secure.winred.com
static.ads-twitter.com
static.cloudflareinsights.com
stats.g.doubleclick.net
www.facebook.com
www.google-analytics.com
www.google.ca
www.google.com
www.googleadservices.com
www.googletagmanager.com
js.adsrvr.org
static.ads-twitter.com
104.16.249.69
104.16.56.101
104.17.25.14
104.19.211.89
104.19.212.89
13.110.197.228
142.251.163.154
142.251.163.94
142.251.167.156
142.251.167.95
151.101.128.176
172.253.122.97
172.253.122.99
172.253.63.139
172.253.63.154
18.67.17.108
216.239.38.181
31.13.66.19
31.13.66.35
34.111.186.1
34.117.162.98
52.35.126.53
54.186.23.98
54.192.51.43
08e64936e50d3729bb36288040035bf307bf11b49fea0087e50d4552816e209c
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
1e8729ec843124534cb2402e706022ad2fcc0a7c9d99ed763712a1cad168ab67
20c0114a672ac0b5b31a1c0100543a2306bf389816ab20774b66e8f7b30fb60c
2415c255e0c87006ed34d4eb328b15fbb456193ee3575f968dd2735062119c7d
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
2da556b9f01bf1ba9fe68a179705263b3999ed1a369706f1e8b2b46d8adfea11
2dabf381c1a29a6f23f2bfc556206441bd36d08307d88633977570e72d8da128
2f8a9cb94b4f434cd8efceb5a4b29a151180a3ca2e3f41278512b460387e815d
351ffc2bdf381352dcd801be49be5018361119588eae077650260f9e162fe7b9
3ce02f2cdd52cdbfa28c3e9feb315f13a85d1d02cb78e5be82e1665f6e8d6c2b
3e136e77083bfc6ef14ffc5abd19da89a82bf12fc0cda3c603e01582b93303c8
45c40d0f95113788447af9433023919be282397944c195a5bec17394dc2829f2
54408166db71aca34fc5b88fa27647edff94dcce0d58fa5d1f4d253e9c63938e
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848
5dd31b7a90474e2bffe784c7858e627731bed2249d05dd3a65bd282e05173207
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101
7157511697db744d384a5a2a8646af23f3c90560abf93bb240fdd690b29a898a
8073a0bcd589f248e2324d7ab4b35550c064976fab988e132bf34ff9ee264fc3
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50
947ac0903521f5eceefc90637c066306a8ca67466ccc188bb0107fb7cfb532d1
961951e588ed2cbd0dadda321becf5c4d27451bb0896262f86e7d922da5794ca
969dace001ef24f99f38bd00c5578b85ba9368e77a5667cfcaeaa29d2f57657b
a5e2f8d85a8c6e754c5a67c730bd13882d9ac511ad3926201358d3aacbd178ed
a626e64837c3ffa65257956cf636fb166b96eef01ab52b56753a77eb804e4c6a
b12d7b7e9f25c3b43fd866b5ca187f83b20b85e4da81adc57d951662bb001a5f
bed4ed406073398f8e51812a543b3c5994642624f948b20d407d801fbaf4aeab
bf15413499b81555136c08dd340efaf4b00a8eb7ac1067d558e70bf6fbbfb07f
c819bc6a629e2035b0f3cd3ba70dc6db4db985d86d9cad75c11d03886e71f53d
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
d2a9df6a4cfce46a55fec3fbc9134896438d7a845e3ae841b0f9214f62988cf7
d4b818842aa4ca70984a8053592ca9080f8f0102c90a1f81f88ad6b9e7fcb4b1
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e039e607c78306c7e029a7fd0ecdb14f86456f16e1a5ce65aa26b4fdf1d38a3c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e759dc710ec6d9f9438d5a77f834b247254512fb90cf520764ab591db32cf5cb
ec288a0cc67336d66ec12f4e54dbee9fb7e3f39d248de4d35f93fb1797649746
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0205495d259e89d99e6c4989147f8a65bef41513bfbe3e97251cd6fb6fa5947

secure.winred.com Open in urlscan Pro 104.19.211.89 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

57 Requests

89 %HTTPS

0 %IPv6

20 Domains

26 Subdomains

23 IPs

2 Countries

1487 kBTransfer

4197 kBSize

24 Cookies

7 Outgoing links

Page URL History

Redirected requests

57 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

secure.winred.com Open in urlscan Pro
104.19.211.89 Public Scan

Screenshot
Live screenshot

Full Image

57
Requests

89 %
HTTPS

0 %
IPv6

20
Domains

26
Subdomains

23
IPs

2
Countries

1487 kB
Transfer

4197 kB
Size

24
Cookies

57 HTTP transactions
0 data transactions