www.thestar.com Open in urlscan Pro
99.84.42.91 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Submission: On January 26 via manual (January 26th 2022, 2:02:49 pm UTC) from CA — Scanned from CA

Summary HTTP 275 Redirects Links 18 Behaviour Indicators

Summary

This website contacted 83 IPs in 3 countries across 62 domains to perform 275 HTTP transactions. The main IP is 99.84.42.91, located in United States and belongs to AMAZON-02, US. The main domain is www.thestar.com. The Cisco Umbrella rank of the primary domain is 85549.
TLS certificate: Issued by Trustwave Organization Validation SHA... on September 20th 2021. Valid for: a year.

This is the only time www.thestar.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
32	99.84.42.91 99.84.42.91	16509 (AMAZON-02) (AMAZON-02)
10	99.84.125.59 99.84.125.59	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6812:451	13335 (CLOUDFLAR...) (CLOUDFLARENET)
16	23.41.169.149 23.41.169.149	16625 (AKAMAI-AS) (AKAMAI-AS)
1	13.225.214.17 13.225.214.17	16509 (AMAZON-02) (AMAZON-02)
1 1	2606:2800:220... 2606:2800:220:de:468:2285:c1:4a3	15133 (EDGECAST) (EDGECAST)
2	199.232.64.157 199.232.64.157	54113 (FASTLY) (FASTLY)
2	35.174.252.231 35.174.252.231	14618 (AMAZON-AES) (AMAZON-AES)
1	129.213.193.172 129.213.193.172	31898 (ORACLE-BM...) (ORACLE-BMC-31898)
8	13.225.63.104 13.225.63.104	16509 (AMAZON-02) (AMAZON-02)
5	2607:f8b0:400... 2607:f8b0:4006:81f::2008	15169 (GOOGLE) (GOOGLE)
6	34.96.102.137 34.96.102.137	15169 (GOOGLE) (GOOGLE)
1	35.241.9.51 35.241.9.51	15169 (GOOGLE) (GOOGLE)
2 4	68.67.178.15 68.67.178.15	29990 (ASN-APPNEX) (ASN-APPNEX)
5	34.107.254.252 34.107.254.252	15169 (GOOGLE) (GOOGLE)
1	13.225.66.81 13.225.66.81	16509 (AMAZON-02) (AMAZON-02)
1	34.193.47.203 34.193.47.203	14618 (AMAZON-AES) (AMAZON-AES)
7	20.49.104.19 20.49.104.19	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	23.41.168.244 23.41.168.244	16625 (AKAMAI-AS) (AKAMAI-AS)
11	104.16.190.66 104.16.190.66	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	104.244.42.133 104.244.42.133	13414 (TWITTER) (TWITTER)
2	2a03:2880:f01... 2a03:2880:f012:10c:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1 3	13.226.31.20 13.226.31.20	16509 (AMAZON-02) (AMAZON-02)
1	13.226.39.10 13.226.39.10	16509 (AMAZON-02) (AMAZON-02)
1	13.33.81.146 13.33.81.146	16509 (AMAZON-02) (AMAZON-02)
1	151.139.128.11 151.139.128.11	20446 (HIGHWINDS3) (HIGHWINDS3)
4	143.204.137.197 143.204.137.197	16509 (AMAZON-02) (AMAZON-02)
3	104.244.42.195 104.244.42.195	13414 (TWITTER) (TWITTER)
1	34.120.155.137 34.120.155.137	15169 (GOOGLE) (GOOGLE)
3 4	3.33.220.150 3.33.220.150	16509 (AMAZON-02) (AMAZON-02)
2	2607:f8b0:400... 2607:f8b0:4006:820::2002	15169 (GOOGLE) (GOOGLE)
3	2607:f8b0:400... 2607:f8b0:4006:81e::200e	15169 (GOOGLE) (GOOGLE)
2 3	2606:4700::68... 2606:4700::6810:7caf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	34.210.248.36 34.210.248.36	16509 (AMAZON-02) (AMAZON-02)
1	13.226.25.39 13.226.25.39	16509 (AMAZON-02) (AMAZON-02)
2	35.190.14.224 35.190.14.224	15169 (GOOGLE) (GOOGLE)
1	35.201.118.58 35.201.118.58	15169 (GOOGLE) (GOOGLE)
5	142.251.40.226 142.251.40.226	15169 (GOOGLE) (GOOGLE)
6	2606:4700:20:... 2606:4700:20::ac43:49b8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	2606:4700:20:... 2606:4700:20::681a:686	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:135e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2607:f8b0:402... 2607:f8b0:4023:1404::9c	15169 (GOOGLE) (GOOGLE)
1	54.144.144.142 54.144.144.142	14618 (AMAZON-AES) (AMAZON-AES)
5 5	151.101.130.49 151.101.130.49	54113 (FASTLY) (FASTLY)
2	34.73.194.24 34.73.194.24	396982 (GOOGLE-PR...) (GOOGLE-PRIVATE-CLOUD)
2 2	2606:ae80:145... 2606:ae80:1450:15::1720	25751 (VALUECLICK) (VALUECLICK)
1 1	69.90.254.78 69.90.254.78	13768 (COGECO-PEER1) (COGECO-PEER1)
2 2	185.184.10.30 185.184.10.30	203690 (RTB-HOUSE...) (RTB-HOUSE-ASH)
1 1	54.175.198.118 54.175.198.118	14618 (AMAZON-AES) (AMAZON-AES)
1	52.88.252.250 52.88.252.250	16509 (AMAZON-02) (AMAZON-02)
2	52.40.172.46 52.40.172.46	16509 (AMAZON-02) (AMAZON-02)
1 1	18.233.32.212 18.233.32.212	14618 (AMAZON-AES) (AMAZON-AES)
3	2a03:2880:f11... 2a03:2880:f112:182:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	2600:1400:b00... 2600:1400:b000:5a7::1931	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	142.251.40.130 142.251.40.130	15169 (GOOGLE) (GOOGLE)
1 2	142.250.80.70 142.250.80.70	15169 (GOOGLE) (GOOGLE)
4	2607:f8b0:400... 2607:f8b0:4006:80d::2002	15169 (GOOGLE) (GOOGLE)
1 7	104.77.220.247 104.77.220.247	16625 (AKAMAI-AS) (AKAMAI-AS)
3	2607:f8b0:400... 2607:f8b0:4006:822::2004	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:81e::2003	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:81e::2002	15169 (GOOGLE) (GOOGLE)
1	2a04:4e42:200... 2a04:4e42:200::396	54113 (FASTLY) (FASTLY)
1 4	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2600:141b:13:... 2600:141b:13::17d7:826a	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2606:4700:303... 2606:4700:3033::ac43:c8a1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	151.101.1.140 151.101.1.140	54113 (FASTLY) (FASTLY)
7	52.20.34.81 52.20.34.81	14618 (AMAZON-AES) (AMAZON-AES)
1	142.250.64.102 142.250.64.102	15169 (GOOGLE) (GOOGLE)
4 4	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1	108.174.10.14 108.174.10.14	14413 (LINKEDIN) (LINKEDIN)
1 2	104.18.101.194 104.18.101.194	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:11:... 2606:4700:11::6817:850b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	2607:f8b0:400... 2607:f8b0:4006:80b::2002	15169 (GOOGLE) (GOOGLE)
1	142.250.64.66 142.250.64.66	15169 (GOOGLE) (GOOGLE)
2	20.85.30.134 20.85.30.134	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 2	20.36.253.92 20.36.253.92	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
3 14	34.98.64.218 34.98.64.218	15169 (GOOGLE) (GOOGLE)
2	2602:803:c002... 2602:803:c002:200::52	26667 (RUBICONPR...) (RUBICONPROJECT)
3	3.92.156.8 3.92.156.8	14618 (AMAZON-AES) (AMAZON-AES)
1	96.6.23.240 96.6.23.240	16625 (AKAMAI-AS) (AKAMAI-AS)
2	68.67.161.205 68.67.161.205	29990 (ASN-APPNEX) (ASN-APPNEX)
1 8	209.54.176.128 209.54.176.128	16509 (AMAZON-02) (AMAZON-02)
2	104.105.42.146 104.105.42.146	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	52.45.33.138 52.45.33.138	14618 (AMAZON-AES) (AMAZON-AES)
1	2607:f8b0:400... 2607:f8b0:4006:823::2001	15169 (GOOGLE) (GOOGLE)
1 3	2600:1f18:4e9... 2600:1f18:4e9:5a05:cbbe:ce00:264f:b9b8	14618 (AMAZON-AES) (AMAZON-AES)
4 8	142.250.72.98 142.250.72.98	15169 (GOOGLE) (GOOGLE)
2 2	3.213.3.60 3.213.3.60	14618 (AMAZON-AES) (AMAZON-AES)
2 4	35.190.60.146 35.190.60.146	15169 (GOOGLE) (GOOGLE)
2 2	107.178.254.65 107.178.254.65	15169 (GOOGLE) (GOOGLE)
1 1	34.98.67.3 34.98.67.3	15169 (GOOGLE) (GOOGLE)
1 1	2620:112:f002... 2620:112:f002:bbbb::21	6336 (TURN-US-ASN) (TURN-US-ASN)
6	2607:f8b0:400... 2607:f8b0:4006:817::2001	15169 (GOOGLE) (GOOGLE)
1 5	69.173.151.100 69.173.151.100	26667 (RUBICONPR...) (RUBICONPROJECT)
4 4	8.39.36.142 8.39.36.142	26667 (RUBICONPR...) (RUBICONPROJECT)
1	2001:4998:1c:... 2001:4998:1c:800::1000	14779 (YAHOO) (YAHOO)
275	83

32 99.84.42.91 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-42-91.ewr52.r.cloudfront.net

www.thestar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 99.84.125.59 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-125-59.ewr52.r.cloudfront.net

e377.thestar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:451 (United States)

ASN13335 (CLOUDFLARENET, US)

be54a597-6b6d-4e2d-9d31-642310a8db25.edge.permutive.app	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 23.41.169.149 (Edison, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-41-169-149.deploy.static.akamaitechnologies.com

sejs.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
px.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.214.17 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-214-17.ewr50.r.cloudfront.net

images.thestar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:2800:220:de:468:2285:c1:4a3 (United States) 1 redirects

ASN15133 (EDGECAST, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 199.232.64.157 (Ashburn, United States)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.174.252.231 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-174-252-231.compute-1.amazonaws.com

torstar.blueconic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 129.213.193.172 (Ashburn, United States)

ASN31898 (ORACLE-BMC-31898, US)

torstar.gscontxt.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 13.225.63.104 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-63-104.ewr53.r.cloudfront.net

resources.thestar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2607:f8b0:4006:81f::2008 (United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 34.96.102.137 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 137.102.96.34.bc.googleusercontent.com

dev.visualwebsiteoptimizer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.241.9.51 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 51.9.241.35.bc.googleusercontent.com

be54a597-6b6d-4e2d-9d31-642310a8db25.prmutv.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 68.67.178.15 (Secaucus, United States) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 633.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 34.107.254.252 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 252.254.107.34.bc.googleusercontent.com

api.permutive.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.66.81 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-66-81.ewr53.r.cloudfront.net

d5phz18u4wuww.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.193.47.203 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-193-47-203.compute-1.amazonaws.com

mb.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 20.49.104.19 (Tappahannock, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

adserver.pressboard.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sr.studiostack.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.41.168.244 (Edison, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-41-168-244.deploy.static.akamaitechnologies.com

js-sec.indexww.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
as-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 104.16.190.66 (None, )

ASN13335 (CLOUDFLARENET, US)

hb.districtm.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.districtm.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dmx.districtm.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.244.42.133 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f012:10c:face:b00c:0:3 (Secaucus, United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 13.226.31.20 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-13-226-31-20.ewr53.r.cloudfront.net

sb.scorecardresearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.226.39.10 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-39-10.ewr53.r.cloudfront.net

d1nxn87txdj54y.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.33.81.146 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-33-81-146.ewr52.r.cloudfront.net

d1z2jf7jlzjs58.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.139.128.11 (United States)

ASN20446 (HIGHWINDS3, US)

cdn.petametrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 143.204.137.197 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-137-197.ewr52.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.244.42.195 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.120.155.137 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 137.155.120.34.bc.googleusercontent.com

api.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 3.33.220.150 (United States) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:820::2002 (United States)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4006:81e::200e (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6810:7caf (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

unpkg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.210.248.36 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-210-248-36.us-west-2.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.226.25.39 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-25-39.ewr53.r.cloudfront.net

cdn.parsely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.190.14.224 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 224.14.190.35.bc.googleusercontent.com

query.petametrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.201.118.58 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 58.118.201.35.bc.googleusercontent.com

form.jotform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 142.251.40.226 (United States)

ASN15169 (GOOGLE, US)
PTR: lga34s39-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700:20::ac43:49b8 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn01.jotfor.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn02.jotfor.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2606:4700:20::681a:686 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn03.jotfor.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.jotfor.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:135e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4023:1404::9c (Columbus, United States)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.144.144.142 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-144-144-142.compute-1.amazonaws.com

p1.parsely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 151.101.130.49 (United States) 5 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.73.194.24 (North Charleston, United States)

ASN396982 (GOOGLE-PRIVATE-CLOUD, US)
PTR: 24.194.73.34.bc.googleusercontent.com

dmx.us-east-34.districtm.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:ae80:1450:15::1720 (United States) 2 redirects

ASN25751 (VALUECLICK, US)

districtm-match.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.90.254.78 (Herndon, United States) 1 redirects

ASN13768 (COGECO-PEER1, CA)

ums.acuityplatform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.184.10.30 (Poland) 2 redirects

ASN203690 (RTB-HOUSE-ASH, PL)
PTR: ip-185-184-10-30.rtbhouse.net

us.creativecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.175.198.118 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-175-198-118.compute-1.amazonaws.com

sync.srv.stackadapt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.88.252.250 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-88-252-250.us-west-2.compute.amazonaws.com

torontostarnewspaperslimited.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.40.172.46 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-40-172-46.us-west-2.compute.amazonaws.com

s.thestar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.233.32.212 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-233-32-212.compute-1.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f112:182:face:b00c:0:25de (Secaucus, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:1400:b000:5a7::1931 (New York, United States)

ASN20940 (AKAMAI-ASN1, NL)

s.pinimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.40.130 (United States)

ASN15169 (GOOGLE, US)
PTR: lga25s80-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.80.70 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: lga34s35-in-f6.1e100.net

10230056.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4006:80d::2002 (United States)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 104.77.220.247 (New York, United States) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-77-220-247.deploy.static.akamaitechnologies.com

ct.pinterest.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.pinterest.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.pinterest.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4006:822::2004 (United States)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:81e::2003 (United States)

ASN15169 (GOOGLE, US)

www.google.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:81e::2002 (United States)

ASN15169 (GOOGLE, US)

adservice.google.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:200::396 (United States)

ASN54113 (FASTLY, US)

www.redditstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:c11::200 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:141b:13::17d7:826a (New York, United States)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3033::ac43:c8a1 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.ndg.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.1.140 (United States)

ASN54113 (FASTLY, US)

alb.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 52.20.34.81 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-20-34-81.compute-1.amazonaws.com

d.ndg.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.64.102 (United States)

ASN15169 (GOOGLE, US)
PTR: lga34s31-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:21::14 (United States) 4 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.174.10.14 (United States) 1 redirects

ASN14413 (LINKEDIN, US)
PTR: 108-174-10-14.fwd.linkedin.com

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.101.194 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

p.adsymptotic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:11::6817:850b (United States)

ASN13335 (CLOUDFLARENET, US)

events.jotform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2607:f8b0:4006:80b::2002 (United States)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.64.66 (United States)

ASN15169 (GOOGLE, US)
PTR: lga34s30-in-f2.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 20.85.30.134 (Boydton, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

j.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 20.36.253.92 (Boydton, United States) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 34.98.64.218 (Kansas City, United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: 218.64.98.34.bc.googleusercontent.com

torontostar-d.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2602:803:c002:200::52 (United States)

ASN26667 (RUBICONPROJECT, US)

fastlane.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 3.92.156.8 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-92-156-8.compute-1.amazonaws.com

c2shb.ssp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 96.6.23.240 (Secaucus, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a96-6-23-240.deploy.static.akamaitechnologies.com

htlb.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 68.67.161.205 (New York, United States)

ASN29990 (ASN-APPNEX, US)
PTR: 799.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 209.54.176.128 (Ashburn, United States) 1 redirects

ASN16509 (AMAZON-02, US)

s.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.105.42.146 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a104-105-42-146.deploy.static.akamaitechnologies.com

eus.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.45.33.138 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-45-33-138.compute-1.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:823::2001 (United States)

ASN15169 (GOOGLE, US)

167d3cc6f273bda69ec806982123f22e.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:1f18:4e9:5a05:cbbe:ce00:264f:b9b8 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 142.250.72.98 (United States) 4 redirects

ASN15169 (GOOGLE, US)
PTR: lga34s32-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.213.3.60 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-213-3-60.compute-1.amazonaws.com

pixel.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 35.190.60.146 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 146.60.190.35.bc.googleusercontent.com

id.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 107.178.254.65 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 65.254.178.107.bc.googleusercontent.com

pippio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.98.67.3 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 3.67.98.34.bc.googleusercontent.com

tags.rd.linksynergy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:112:f002:bbbb::21 (United States) 1 redirects

ASN6336 (TURN-US-ASN, US)

ad.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2607:f8b0:4006:817::2001 (United States)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 69.173.151.100 (United States) 1 redirects

ASN26667 (RUBICONPROJECT, US)

pixel-us-east.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 8.39.36.142 (United States) 4 redirects

ASN26667 (RUBICONPROJECT, US)

token.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4998:1c:800::1000 (New York, United States)

ASN14779 (YAHOO, US)

ads.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
53	thestar.com www.thestar.com — Cisco Umbrella Rank: 85549 e377.thestar.com — Cisco Umbrella Rank: 265450 images.thestar.com — Cisco Umbrella Rank: 106805 resources.thestar.com — Cisco Umbrella Rank: 197834 s.thestar.com — Cisco Umbrella Rank: 255639	2 MB
19	doubleclick.net 5 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 184 stats.g.doubleclick.net — Cisco Umbrella Rank: 96 10230056.fls.doubleclick.net — Cisco Umbrella Rank: 326982 googleads.g.doubleclick.net — Cisco Umbrella Rank: 46 ad.doubleclick.net — Cisco Umbrella Rank: 195 googleads4.g.doubleclick.net — Cisco Umbrella Rank: 274 cm.g.doubleclick.net — Cisco Umbrella Rank: 197	173 KB
17	moatads.com sejs.moatads.com — Cisco Umbrella Rank: 4817 mb.moatads.com — Cisco Umbrella Rank: 561 z.moatads.com — Cisco Umbrella Rank: 361 px.moatads.com — Cisco Umbrella Rank: 391	149 KB
14	openx.net 3 redirects torontostar-d.openx.net — Cisco Umbrella Rank: 345936 u.openx.net — Cisco Umbrella Rank: 710 us-u.openx.net — Cisco Umbrella Rank: 359	3 KB
13	rubiconproject.com 5 redirects fastlane.rubiconproject.com — Cisco Umbrella Rank: 467 eus.rubiconproject.com — Cisco Umbrella Rank: 541 pixel-us-east.rubiconproject.com — Cisco Umbrella Rank: 1135 token.rubiconproject.com — Cisco Umbrella Rank: 689 pixel.rubiconproject.com — Cisco Umbrella Rank: 312	19 KB
13	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 100 167d3cc6f273bda69ec806982123f22e.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 124	100 KB
13	jotfor.ms cdn01.jotfor.ms — Cisco Umbrella Rank: 27804 cdn02.jotfor.ms — Cisco Umbrella Rank: 27880 cdn03.jotfor.ms — Cisco Umbrella Rank: 28704 cdn.jotfor.ms — Cisco Umbrella Rank: 23359	556 KB
13	districtm.io hb.districtm.io — Cisco Umbrella Rank: 91020 cdn.districtm.io — Cisco Umbrella Rank: 2067 dmx.districtm.io — Cisco Umbrella Rank: 1407 dmx.us-east-34.districtm.io — Cisco Umbrella Rank: 18286	17 KB
12	amazon-adsystem.com 1 redirects c.amazon-adsystem.com — Cisco Umbrella Rank: 281 s.amazon-adsystem.com — Cisco Umbrella Rank: 284	47 KB
9	yahoo.com 2 redirects c2shb.ssp.yahoo.com — Cisco Umbrella Rank: 693 ups.analytics.yahoo.com — Cisco Umbrella Rank: 283 pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 470 ads.yahoo.com — Cisco Umbrella Rank: 913	5 KB
8	ndg.io cdn.ndg.io — Cisco Umbrella Rank: 359402 d.ndg.io	11 KB
6	everesttech.net 6 redirects sync-tm.everesttech.net — Cisco Umbrella Rank: 560 cm.everesttech.net — Cisco Umbrella Rank: 992	1 KB
6	studiostack.com sr.studiostack.com — Cisco Umbrella Rank: 27212	26 KB
6	adnxs.com 2 redirects ib.adnxs.com — Cisco Umbrella Rank: 241 secure.adnxs.com — Cisco Umbrella Rank: 404	15 KB
6	visualwebsiteoptimizer.com dev.visualwebsiteoptimizer.com — Cisco Umbrella Rank: 5205	109 KB
5	linkedin.com 5 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 546 www.linkedin.com — Cisco Umbrella Rank: 647 px4.ads.linkedin.com — Cisco Umbrella Rank: 5501	4 KB
5	google.com adservice.google.com — Cisco Umbrella Rank: 80 www.google.com — Cisco Umbrella Rank: 13	2 KB
5	rlcdn.com 2 redirects api.rlcdn.com — Cisco Umbrella Rank: 812 id.rlcdn.com — Cisco Umbrella Rank: 738 idsync.rlcdn.com — Cisco Umbrella Rank: 316	1 KB
5	permutive.com api.permutive.com — Cisco Umbrella Rank: 2062	842 B
5	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 78	218 KB
4	clarity.ms 1 redirects j.clarity.ms c.clarity.ms — Cisco Umbrella Rank: 917	24 KB
4	bing.com 1 redirects bat.bing.com — Cisco Umbrella Rank: 385 c.bing.com — Cisco Umbrella Rank: 273	12 KB
4	pinterest.ca www.pinterest.ca — Cisco Umbrella Rank: 24182	15 KB
4	adsrvr.org 3 redirects match.adsrvr.org — Cisco Umbrella Rank: 329	2 KB
4	twitter.com 1 redirects platform.twitter.com — Cisco Umbrella Rank: 592 analytics.twitter.com — Cisco Umbrella Rank: 537	1 KB
3	google.ca www.google.ca — Cisco Umbrella Rank: 7861 adservice.google.ca — Cisco Umbrella Rank: 12419	2 KB
3	pinterest.com 1 redirects ct.pinterest.com — Cisco Umbrella Rank: 823 www.pinterest.com — Cisco Umbrella Rank: 1200	2 KB
3	facebook.com www.facebook.com — Cisco Umbrella Rank: 98	639 B
3	demdex.net dpm.demdex.net — Cisco Umbrella Rank: 205 torontostarnewspaperslimited.demdex.net — Cisco Umbrella Rank: 239845	5 KB
3	unpkg.com 2 redirects unpkg.com — Cisco Umbrella Rank: 881	2 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 42	20 KB
3	petametrics.com cdn.petametrics.com — Cisco Umbrella Rank: 11246 query.petametrics.com — Cisco Umbrella Rank: 12458	46 KB
3	scorecardresearch.com 1 redirects sb.scorecardresearch.com — Cisco Umbrella Rank: 138	2 KB
3	t.co t.co — Cisco Umbrella Rank: 487	509 B
3	cloudfront.net d5phz18u4wuww.cloudfront.net d1nxn87txdj54y.cloudfront.net d1z2jf7jlzjs58.cloudfront.net	58 KB
2	pippio.com 2 redirects pippio.com — Cisco Umbrella Rank: 797	848 B
2	advertising.com 2 redirects pixel.advertising.com — Cisco Umbrella Rank: 327	699 B
2	casalemedia.com htlb.casalemedia.com — Cisco Umbrella Rank: 461 as-sec.casalemedia.com — Cisco Umbrella Rank: 1285	803 B
2	adsymptotic.com 1 redirects p.adsymptotic.com — Cisco Umbrella Rank: 642	539 B
2	pinimg.com s.pinimg.com — Cisco Umbrella Rank: 701	20 KB
2	creativecdn.com 2 redirects us.creativecdn.com — Cisco Umbrella Rank: 3401	697 B
2	dotomi.com 2 redirects districtm-match.dotomi.com — Cisco Umbrella Rank: 7157	685 B
2	parsely.com cdn.parsely.com — Cisco Umbrella Rank: 2931 p1.parsely.com — Cisco Umbrella Rank: 2249	26 KB
2	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 165	64 KB
2	jotform.com form.jotform.com — Cisco Umbrella Rank: 25748 Failed events.jotform.com — Cisco Umbrella Rank: 27134	10 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 146	113 KB
2	blueconic.net torstar.blueconic.net — Cisco Umbrella Rank: 293784	2 KB
2	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 630	11 KB
1	turn.com 1 redirects ad.turn.com — Cisco Umbrella Rank: 770	441 B
1	linksynergy.com 1 redirects tags.rd.linksynergy.com — Cisco Umbrella Rank: 4739	359 B
1	reddit.com alb.reddit.com — Cisco Umbrella Rank: 1532	125 B
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 1098	2 KB
1	redditstatic.com www.redditstatic.com — Cisco Umbrella Rank: 1463	8 KB
1	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 106	15 KB
1	stackadapt.com 1 redirects sync.srv.stackadapt.com — Cisco Umbrella Rank: 973	571 B
1	acuityplatform.com 1 redirects ums.acuityplatform.com — Cisco Umbrella Rank: 1208	606 B
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 227	5 KB
1	indexww.com js-sec.indexww.com — Cisco Umbrella Rank: 636	39 KB
1	pressboard.ca adserver.pressboard.ca — Cisco Umbrella Rank: 85329	789 B
1	prmutv.co be54a597-6b6d-4e2d-9d31-642310a8db25.prmutv.co — Cisco Umbrella Rank: 319523	487 B
1	gscontxt.net torstar.gscontxt.net — Cisco Umbrella Rank: 236434	510 B
1	permutive.app be54a597-6b6d-4e2d-9d31-642310a8db25.edge.permutive.app — Cisco Umbrella Rank: 226407	138 KB
275	62

	Domain	Requested by
32	www.thestar.com	www.thestar.com
12	px.moatads.com	www.thestar.com
11	us-u.openx.net	2 redirects js-sec.indexww.com u.openx.net us-u.openx.net
10	e377.thestar.com	www.thestar.com e377.thestar.com
8	cm.g.doubleclick.net	4 redirects u.openx.net us-u.openx.net eus.rubiconproject.com
8	s.amazon-adsystem.com	1 redirects c.amazon-adsystem.com s.amazon-adsystem.com u.openx.net us-u.openx.net eus.rubiconproject.com
8	dmx.districtm.io	hb.districtm.io cdn.districtm.io www.thestar.com js-sec.indexww.com
8	resources.thestar.com	www.thestar.com resources.thestar.com
7	d.ndg.io	cdn.ndg.io
6	tpc.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com
6	pagead2.googlesyndication.com	ad.doubleclick.net securepubads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com
6	sr.studiostack.com	adserver.pressboard.ca sr.studiostack.com
6	dev.visualwebsiteoptimizer.com	www.thestar.com dev.visualwebsiteoptimizer.com d5phz18u4wuww.cloudfront.net
5	sync-tm.everesttech.net	5 redirects
5	cdn.jotfor.ms	form.jotform.com cdn01.jotfor.ms
5	securepubads.g.doubleclick.net	www.googletagservices.com securepubads.g.doubleclick.net www.thestar.com
5	api.permutive.com	be54a597-6b6d-4e2d-9d31-642310a8db25.edge.permutive.app
5	www.googletagmanager.com	www.thestar.com www.googletagmanager.com
4	pixel.rubiconproject.com	eus.rubiconproject.com
4	token.rubiconproject.com	4 redirects
4	www.pinterest.ca	s.pinimg.com www.thestar.com
4	match.adsrvr.org	3 redirects js-sec.indexww.com
4	c.amazon-adsystem.com	www.thestar.com c.amazon-adsystem.com
4	ib.adnxs.com	2 redirects be54a597-6b6d-4e2d-9d31-642310a8db25.edge.permutive.app js-sec.indexww.com
3	id.rlcdn.com	2 redirects eus.rubiconproject.com
3	pr-bh.ybp.yahoo.com	1 redirects u.openx.net us-u.openx.net
3	c2shb.ssp.yahoo.com	js-sec.indexww.com
3	px.ads.linkedin.com	3 redirects
3	bat.bing.com	www.googletagmanager.com bat.bing.com
3	www.google.com	www.thestar.com tpc.googlesyndication.com securepubads.g.doubleclick.net
3	www.facebook.com	www.thestar.com
3	cdn02.jotfor.ms	form.jotform.com
3	cdn01.jotfor.ms	form.jotform.com
3	unpkg.com	2 redirects www.thestar.com
3	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
3	analytics.twitter.com	platform.twitter.com static.ads-twitter.com
3	sb.scorecardresearch.com	1 redirects www.thestar.com
3	t.co	www.thestar.com
3	z.moatads.com	sejs.moatads.com www.thestar.com securepubads.g.doubleclick.net
2	pippio.com	2 redirects
2	pixel.advertising.com	2 redirects
2	ups.analytics.yahoo.com	1 redirects us-u.openx.net
2	eus.rubiconproject.com	s.amazon-adsystem.com eus.rubiconproject.com
2	secure.adnxs.com	js-sec.indexww.com
2	fastlane.rubiconproject.com	js-sec.indexww.com
2	torontostar-d.openx.net	1 redirects
2	c.clarity.ms	1 redirects
2	j.clarity.ms	bat.bing.com j.clarity.ms
2	p.adsymptotic.com	1 redirects
2	adservice.google.ca	adservice.google.com securepubads.g.doubleclick.net
2	adservice.google.com	10230056.fls.doubleclick.net securepubads.g.doubleclick.net
2	ct.pinterest.com	s.pinimg.com www.thestar.com
2	10230056.fls.doubleclick.net	1 redirects www.googletagmanager.com
2	s.pinimg.com	www.thestar.com s.pinimg.com
2	s.thestar.com	resources.thestar.com
2	us.creativecdn.com	2 redirects
2	districtm-match.dotomi.com	2 redirects
2	dmx.us-east-34.districtm.io	www.thestar.com
2	cdn03.jotfor.ms	form.jotform.com
2	query.petametrics.com	www.thestar.com
2	dpm.demdex.net	resources.thestar.com www.thestar.com
2	cdn.districtm.io	hb.districtm.io cdn.districtm.io
2	www.googletagservices.com	www.thestar.com securepubads.g.doubleclick.net
2	connect.facebook.net	www.thestar.com connect.facebook.net
2	torstar.blueconic.net	e377.thestar.com
2	static.ads-twitter.com	www.thestar.com
1	ads.yahoo.com	eus.rubiconproject.com
1	pixel-us-east.rubiconproject.com	1 redirects
1	ad.turn.com	1 redirects
1	idsync.rlcdn.com	us-u.openx.net
1	tags.rd.linksynergy.com	1 redirects
1	167d3cc6f273bda69ec806982123f22e.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	as-sec.casalemedia.com	js-sec.indexww.com
1	u.openx.net	s.amazon-adsystem.com
1	htlb.casalemedia.com	js-sec.indexww.com
1	c.bing.com	1 redirects
1	googleads4.g.doubleclick.net	ad.doubleclick.net
1	events.jotform.com
1	px4.ads.linkedin.com	1 redirects
1	www.linkedin.com	1 redirects
1	ad.doubleclick.net	www.thestar.com
1	alb.reddit.com
1	cdn.ndg.io	www.googletagmanager.com
1	snap.licdn.com	www.googletagmanager.com
1	www.redditstatic.com	www.googletagmanager.com
1	www.pinterest.com	1 redirects
1	www.google.ca	www.thestar.com
1	googleads.g.doubleclick.net	www.googleadservices.com
1	www.googleadservices.com	www.googletagmanager.com
1	cm.everesttech.net	1 redirects
1	torontostarnewspaperslimited.demdex.net	resources.thestar.com
1	sync.srv.stackadapt.com	1 redirects
1	ums.acuityplatform.com	1 redirects
1	p1.parsely.com	www.thestar.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	cdnjs.cloudflare.com	form.jotform.com
1	cdn.parsely.com	d1z2jf7jlzjs58.cloudfront.net
1	api.rlcdn.com	js-sec.indexww.com
1	form.jotform.com	srcdoc
1	cdn.petametrics.com	www.thestar.com
1	d1z2jf7jlzjs58.cloudfront.net	www.thestar.com
1	d1nxn87txdj54y.cloudfront.net	www.thestar.com
1	hb.districtm.io	www.thestar.com
1	js-sec.indexww.com	www.thestar.com
1	adserver.pressboard.ca	www.thestar.com
1	mb.moatads.com	sejs.moatads.com
1	d5phz18u4wuww.cloudfront.net	www.thestar.com
1	be54a597-6b6d-4e2d-9d31-642310a8db25.prmutv.co	be54a597-6b6d-4e2d-9d31-642310a8db25.edge.permutive.app
1	torstar.gscontxt.net	www.thestar.com
1	platform.twitter.com	1 redirects
1	images.thestar.com	www.thestar.com
1	sejs.moatads.com	www.thestar.com
1	be54a597-6b6d-4e2d-9d31-642310a8db25.edge.permutive.app	www.thestar.com
275	113

This site contains links to these domains. Also see Links.

Domain
diversions.thestar.com
www.torontostarreprints.com
notices.torstar.com
www.homefinder.ca
www.tsoffers.ca
toriservices.newscyclecloud.com
torontostar.pressreader.com
www.thestaradvisers.com
www.classroomconnection.ca
pagesofthepast.ca
www.facebook.com
twitter.com
www.youtube.com
www.instagram.com
apps.apple.com
play.google.com

Subject Issuer	Validity	Valid
*.thestar.com Trustwave Organization Validation SHA256 CA, Level 1	`2021-09-20` - `2022-10-19`	a year	crt.sh
e377.thestar.com Amazon	`2021-09-15` - `2022-10-14`	a year	crt.sh
permutive.app Cloudflare Inc ECC CA-3	`2022-01-16` - `2022-04-16`	3 months	crt.sh
moatads.com DigiCert SHA2 Secure Server CA	`2021-11-27` - `2022-11-29`	a year	crt.sh
*.blueconic.net Amazon	`2021-08-07` - `2022-09-05`	a year	crt.sh
*.gscontxt.net DigiCert TLS RSA SHA256 2020 CA1	`2021-12-08` - `2022-12-08`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-12-27` - `2022-03-21`	3 months	crt.sh
*.visualwebsiteoptimizer.com Starfield Secure Certificate Authority - G2	`2020-06-19` - `2022-07-06`	2 years	crt.sh
*.prmutv.co R3	`2022-01-19` - `2022-04-19`	3 months	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2021-03-05` - `2022-02-19`	a year	crt.sh
api.permutive.com R3	`2021-12-20` - `2022-03-20`	3 months	crt.sh
*.cloudfront.net Amazon	`2021-03-19` - `2022-03-17`	a year	crt.sh
*.moatads.com DigiCert TLS RSA SHA256 2020 CA1	`2021-05-25` - `2022-06-25`	a year	crt.sh
*.pressboard.ca Go Daddy Secure Certificate Authority - G2	`2021-02-15` - `2022-03-17`	a year	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2021-12-12` - `2022-12-13`	a year	crt.sh
districtm.io Cloudflare Inc ECC CA-3	`2021-06-02` - `2022-06-01`	a year	crt.sh
t.co DigiCert TLS RSA SHA256 2020 CA1	`2021-03-24` - `2022-03-23`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-11-04` - `2022-02-02`	3 months	crt.sh
*.scorecardresearch.com Amazon	`2021-02-28` - `2022-03-29`	a year	crt.sh
cdn-stackpath.petametrics.com R3	`2022-01-02` - `2022-04-02`	3 months	crt.sh
c.amazon-adsystem.com Amazon	`2021-07-06` - `2022-06-27`	a year	crt.sh
*.twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2021-03-24` - `2022-03-23`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2021-02-25` - `2022-03-28`	a year	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2021-03-18` - `2022-04-19`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-12-27` - `2022-03-21`	3 months	crt.sh
*.demdex.net DigiCert TLS RSA SHA256 2020 CA1	`2021-10-19` - `2022-11-19`	a year	crt.sh
*.parsely.com Amazon	`2021-07-05` - `2022-08-03`	a year	crt.sh
*.liftigniter.com R3	`2021-11-27` - `2022-02-25`	3 months	crt.sh
*.studiostack.com Go Daddy Secure Certificate Authority - G2	`2021-11-16` - `2022-12-18`	a year	crt.sh
*.jotform.com Sectigo RSA Domain Validation Secure Server CA	`2021-06-28` - `2022-06-28`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-06-17` - `2022-06-16`	a year	crt.sh
s.thestar.com DigiCert TLS RSA SHA256 2020 CA1	`2021-07-20` - `2022-08-20`	a year	crt.sh
ads-twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2021-07-21` - `2022-07-26`	a year	crt.sh
*.pinterest.com DigiCert TLS RSA SHA256 2020 CA1	`2021-07-26` - `2022-08-05`	a year	crt.sh
www.googleadservices.com GTS CA 1C3	`2021-12-27` - `2022-03-21`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2021-12-27` - `2022-03-21`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-12-27` - `2022-03-21`	3 months	crt.sh
www.google.com GTS CA 1C3	`2021-12-27` - `2022-03-21`	3 months	crt.sh
*.google.ca GTS CA 1C3	`2021-12-27` - `2022-03-21`	3 months	crt.sh
www.redditstatic.com DigiCert TLS RSA SHA256 2020 CA1	`2021-10-05` - `2022-04-02`	6 months	crt.sh
www.bing.com Microsoft RSA TLS CA 01	`2021-12-22` - `2022-06-22`	6 months	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2021-07-15` - `2022-07-20`	a year	crt.sh
*.reddit.com DigiCert TLS RSA SHA256 2020 CA1	`2021-10-05` - `2022-04-02`	6 months	crt.sh
*.ndg.io Amazon	`2021-09-14` - `2022-10-13`	a year	crt.sh
a.clarity.ms Microsoft RSA TLS CA 01	`2021-07-27` - `2022-07-27`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2021-03-30` - `2022-04-04`	a year	crt.sh
web.ssp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2021-10-14` - `2022-04-06`	6 months	crt.sh
s.amazon-adsystem.com Amazon	`2021-07-14` - `2022-06-27`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2021-07-08` - `2022-08-08`	a year	crt.sh
*.ybp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2022-01-18` - `2022-07-13`	6 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-12-27` - `2022-03-21`	3 months	crt.sh

This page contains 23 frames:

Primary Page: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Frame ID: 4D24D7557389C438F0136CD17957591D
Requests: 184 HTTP requests in this frame

Frame: https://z.moatads.com/hd09824092/iframe.html
Frame ID: E88E9E0B28D722090CDEA6D3CA970DFA
Requests: 1 HTTP requests in this frame

Frame: https://form.jotform.com/jsform/220106406818247
Frame ID: 2D85B5EAFC18FFFC139828D4A15C4480
Requests: 1 HTTP requests in this frame

Frame: https://cdn.districtm.io/ids/index.html
Frame ID: AA868F6D2E0FB13CB131648C56742D70
Requests: 9 HTTP requests in this frame

Frame: https://form.jotform.com/jsform/220106406818247
Frame ID: 56AE00E411019242EA52437E1C9A5E92
Requests: 1 HTTP requests in this frame

Frame: https://cdn01.jotfor.ms/themes/CSS/5e6b428acc8c4e222d1beb91.css
Frame ID: 5D2C05B9DDAD0FDBDA5E1EEA45650024
Requests: 16 HTTP requests in this frame

Frame: https://torontostarnewspaperslimited.demdex.net/dest5.html?d_nsid=0
Frame ID: 3782E9A3192278EA57826D88F0C169DD
Requests: 1 HTTP requests in this frame

Frame: https://10230056.fls.doubleclick.net/activityi;dc_pre=CICjpr7Kz_UCFUwI0AQdVMwNqw;src=10230056;type=ret01;cat=land01;ord=7530049612684;gtm=2od1o0;auiddc=2126384688.1643205763;~oref=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html
Frame ID: 48D3FF03A9391C5F8571BA18DBDCDA7D
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.com/ddm/fls/i/dc_pre=CICjpr7Kz_UCFUwI0AQdVMwNqw;src=10230056;type=ret01;cat=land01;ord=7530049612684;gtm=2od1o0;auiddc=2126384688.1643205763;~oref=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html
Frame ID: ADE2E999C8AA90E161104C9339951490
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.ca/ddm/fls/i/dc_pre=CICjpr7Kz_UCFUwI0AQdVMwNqw;src=10230056;type=ret01;cat=land01;ord=7530049612684;gtm=2od1o0;auiddc=2126384688.1643205763;~oref=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html
Frame ID: F1AF7936D9CB693AC4C20EECEBE28FE7
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 68B128498E5981D7B9275D65B25E6581
Requests: 1 HTTP requests in this frame

Frame: https://www.pinterest.ca/ct.html
Frame ID: 9894DBA6451519447637F405B3831E9B
Requests: 4 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=rbd_n-vmg_ox-db5_an-db5&dcc=t
Frame ID: 24035153FBA1E75C77F122D52D9FA864
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/v3/pr?exlist=ox-db5_rbd_n-vmg_an-db5&fv=1.0&a=cm&cm3ppd=1
Frame ID: 95642FA5BAB0393DF5E88BA8D18E3D76
Requests: 1 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/cm?id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Frame ID: C01DF8FE45A30D1DD157EF481C6B8B6E
Requests: 7 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Frame ID: FBB4F1B4C84B36F8CB4FCE9D3276461B
Requests: 11 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=vmg.com&id=eS1vbG1aS2dkRTJ1TGg5YzRHTFJsb0g5QTRVNUNja1JyeX5B
Frame ID: F0DFA27E61AC11690A5935A07E67B564
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?id=4244130733842794831&ex=appnexus.com
Frame ID: 35BF56CA54EC1408703E363D3C404C9A
Requests: 1 HTTP requests in this frame

Frame: https://us-u.openx.net/w/1.0/pd?plm=10&ph=b846aece-0593-4d62-982b-779a22b235ef&gdpr=0
Frame ID: 06D7ADB600BC751F0D958BC8E956D23F
Requests: 11 HTTP requests in this frame

Frame: https://167d3cc6f273bda69ec806982123f22e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 9F1ADB5050C715D747A5714FC03444C4
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 99671114E3A66374FE2D2FC87E9EA1CF
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 9369B2CCACD1B45D03B106675175CFD3
Requests: 2 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsud1mTmXpeWBhs6UpPHT8sHfMcPiZoX0tUz8SWfBU7_RWIAAkGnu3CAwHXuKxqDka2KvvaAC7lOiPnqByrx68gJTqJ5TNskVrAQXZWaJOVR8eYJ_HWwaRc-lzxGeNkNDeJtarHVJaU3u8V2o_nqqYuRVT02kwisx0sabCdDPU35rDgl_TggEkP4G0l6MTEE7Kt7ahSE7_0lxzQrm6BLSYME6tyDPS9Akk0z_8fN3QCmRazAhnGwBh-mhKvYduuF-vouZ0SPcpjkS_0P2RXaC6-jjO5bsA0OpwLgU7xr8rYLL_n9RekOfrKeWcdqQgchg_UaIjZPx0sNGncyWg&sig=Cg0ArKJSzLWl_UBy8_hjEAE&uach_m=[UACH]&adurl=
Frame ID: B15CE758D26E662FA3605D276372E1DD
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

NORTON ROSE FULBRIGHT: Enjoy complimentary Saturday Star Home Delivery with digital access or Digital Access only | The Star

Detected technologies

Prototype (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

(?:prototype|protoaculous)(?:-([\d.]*[\d]))?.*\.js

React (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+data-react

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick for Publishers (DFP) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googletagservices\.com/tag/js/gpt(?:_mobile)?\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Moat (Analytics) Expand

Overall confidence: 100%
Detected patterns

moatads\.com

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Prebid (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.com/[^"]*(?:prebid|/pb\.js)

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

VWO (Analytics) Expand

Overall confidence: 100%
Detected patterns

dev\.visualwebsiteoptimizer\.com/?([\d.]+)

comScore (Analytics) Expand

Overall confidence: 100%
Detected patterns

<iframe[^>]* (?:id="comscore"|scr=[^>]+comscore)|\.scorecardresearch\.com/beacon\.js|COMSCORE\.beacon
\.scorecardresearch\.com/beacon\.js|COMSCORE\.beacon

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

275
Requests

87 %
HTTPS

32 %
IPv6

62
Domains

113
Subdomains

83
IPs

3
Countries

3940 kB
Transfer

11839 kB
Size

109
Cookies

18 Outgoing links

These are links going to different origins than the main page.

URL: https://diversions.thestar.com/
Title: fun & games

Search URL Search Domain Scan URL

URL: https://diversions.thestar.com/comics.html
Title: comics

Search URL Search Domain Scan URL

URL: http://www.torontostarreprints.com/
Title: www.TorontoStarReprints.com

Search URL Search Domain Scan URL

URL: http://notices.torstar.com/privacy-policy/index.html
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: http://notices.torstar.com/main_terms_of_use_daily_and_community_brands_EN/
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.homefinder.ca/
Title: Homefinder.ca

Search URL Search Domain Scan URL

URL: https://www.tsoffers.ca/
Title: Subscribe to Home Delivery

Search URL Search Domain Scan URL

URL: https://toriservices.newscyclecloud.com/cgi-bin/cmo_tor-c-cmdb-01.sh/custservice/web/login.html?SiteID=TS
Title: Manage Home Delivery Subscription

Search URL Search Domain Scan URL

URL: http://torontostar.pressreader.com/
Title: Star ePaper Edition

Search URL Search Domain Scan URL

URL: https://www.thestaradvisers.com/Portal/default.aspx
Title: Star Advisers

Search URL Search Domain Scan URL

URL: http://www.classroomconnection.ca/
Title: Classroom Connection

Search URL Search Domain Scan URL

URL: http://pagesofthepast.ca/
Title: Toronto Star Archives

Search URL Search Domain Scan URL

URL: https://www.facebook.com/torontostar

Search URL Search Domain Scan URL

URL: https://twitter.com/torontostar

Search URL Search Domain Scan URL

URL: https://www.youtube.com/TorontoStar

Search URL Search Domain Scan URL

URL: https://www.instagram.com/thetorontostar/

Search URL Search Domain Scan URL

URL: https://apps.apple.com/ca/app/thestar-com-iphone/id379481068

Search URL Search Domain Scan URL

URL: https://play.google.com/store/apps/details?id=com.thestar.www

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 24

https://platform.twitter.com/oct.js HTTP 301
https://static.ads-twitter.com/oct.js

Request Chain 71

https://unpkg.com/web-vitals HTTP 302
https://unpkg.com/web-vitals@2.1.4 HTTP 302
https://unpkg.com/web-vitals@2.1.4/dist/web-vitals.umd.js

Request Chain 72

https://sb.scorecardresearch.com/b?c1=2&c2=3005674&ns__t=1643205761901&ns_c=UTF-8&cv=3.5&c8=NORTON%20ROSE%20FULBRIGHT%3A%20Enjoy%20complimentary%20Saturday%20Star%20Home%20Delivery%20with%20digital%20access%20or%20Digital%20Access%20only%20%7C%20The%20Star&c7=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&c9= HTTP 302
https://sb.scorecardresearch.com/b2?c1=2&c2=3005674&ns__t=1643205761901&ns_c=UTF-8&cv=3.5&c8=NORTON%20ROSE%20FULBRIGHT%3A%20Enjoy%20complimentary%20Saturday%20Star%20Home%20Delivery%20with%20digital%20access%20or%20Digital%20Access%20only%20%7C%20The%20Star&c7=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&c9=

Request Chain 112

https://sync-tm.everesttech.net/upi/pid/1477?redir=https%3A//dmx.us-east-34.districtm.io/s/10016/$%7BTM_USER_ID%7D HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/1477?redir=https%3A//dmx.us-east-34.districtm.io/s/10016/$%7BTM_USER_ID%7D&_test=YfFUggABeNztqABH HTTP 302
https://dmx.us-east-34.districtm.io/s/10016/YfFUggABeNztqABH&_test=YfFUggABeNztqABH

Request Chain 113

https://districtm-match.dotomi.com/match/bounce/current?version=1&networkId=33921&nuid=24EpmyGWp79d3iYyWltzQz4jsk1&rurl=//dmx.us-east-34.districtm.io/s/10007/ HTTP 302
https://districtm-match.dotomi.com/match/bounce/current?DotomiTest=6485acaf3a99120c&is_secure=true&version=1&networkId=33921&nuid=24EpmyGWp79d3iYyWltzQz4jsk1&rurl=%2F%2Fdmx.us-east-34.districtm.io%2Fs%2F10007%2F HTTP 302
https://dmx.us-east-34.districtm.io/s/10007/AAAGaE99fkrCyQNIDVpLAAAAAAA&expiration=1643292162&nuid=24EpmyGWp79d3iYyWltzQz4jsk1&is_secure=true

Request Chain 114

https://ums.acuityplatform.com/tum?umid=137&rurl=https%3A%2F%2Fdmx.districtm.io%2Fs%2F10022%2F___AUID___ HTTP 302
https://dmx.districtm.io/s/10022/642723330272

Request Chain 115

https://us.creativecdn.com/cm-notify?pi=districtm HTTP 302
https://us.creativecdn.com/cm-notify?pi=districtm&tc=1 HTTP 302
https://dmx.districtm.io/s/10027/s0WRDZ573Zm9mQraswGZ?pi=districtm&tc=1

Request Chain 116

https://sync.srv.stackadapt.com/sync?nid=132 HTTP 302
https://dmx.districtm.io/s/10026/23PzkFtNT9tscFmE9RkALZU4mbs

Request Chain 121

https://cm.everesttech.net/cm/dd?d_uuid=29182792948317073581956995184761942639 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YfFUggAAAE3qCwQr

Request Chain 148

https://10230056.fls.doubleclick.net/activityi;src=10230056;type=ret01;cat=land01;ord=7530049612684;gtm=2od1o0;auiddc=2126384688.1643205763;~oref=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html HTTP 302
https://10230056.fls.doubleclick.net/activityi;dc_pre=CICjpr7Kz_UCFUwI0AQdVMwNqw;src=10230056;type=ret01;cat=land01;ord=7530049612684;gtm=2od1o0;auiddc=2126384688.1643205763;~oref=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html

Request Chain 159

https://www.pinterest.com/ct.html HTTP 302
https://www.pinterest.ca/ct.html

Request Chain 175

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1671964&time=1643205763357&url=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1671964&time=1643205763357&url=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1671964%26time%3D1643205763357%26url%3Dhttps%253A%252F%252Fwww.thestar.com%252Fsponsored_sections%252F2022%252F01%252F13%252Fnortonrose.html%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1671964&time=1643205763357&url=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&cookiesTest=true&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1671964&time=1643205763357&url=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&cookiesTest=true&liSync=true&e_ipv6=AQI7yBUFclWSMQAAAX6WsiIrLCUZOhaBL3-Fk8ksEXSRSm7oa6NTVnqhaD9p3ItvHdvmKYtfGg HTTP 302
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=73ec822e-514c-4c2d-b5ea-aa4ff5250b72 HTTP 302
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=73ec822e-514c-4c2d-b5ea-aa4ff5250b72&_expected_cookie=2d5176e89829613b39ae6a7748697224

Request Chain 181

https://c.clarity.ms/c.gif HTTP 302
https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=C9D76670054E423D8AB644B3E9565598&RedC=c.clarity.ms&MXFR=20D7655C83A76F200BF3746487A7613B HTTP 302
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=C9D76670054E423D8AB644B3E9565598&MUID=2B4417828F086C17380906BA8EA26D60

Request Chain 187

https://torontostar-d.openx.net/w/1.0/arj?auid=540273844%2C540273840&aus=728x90%2C970x250%7C728x90&ju=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&jr=&ch=UTF-8&tz=0&bc=hb_ix_2.1.3&be=1&res=1600x1200&tws=1600x1200&ifr=0&callback=window.headertag.OpenXHtb.adResponseCallbacks._OB3u7Bq5&cache=1643205763956&ttduuid=98ec7b18-03f3-4f38-9fd0-bab1d9f133a3 HTTP 302
https://torontostar-d.openx.net/w/1.0/arj?cc=1&auid=540273844%2C540273840&aus=728x90%2C970x250%7C728x90&ju=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&jr=&ch=UTF-8&tz=0&bc=hb_ix_2.1.3&be=1&res=1600x1200&tws=1600x1200&ifr=0&callback=window.headertag.OpenXHtb.adResponseCallbacks._OB3u7Bq5&cache=1643205763956&ttduuid=98ec7b18-03f3-4f38-9fd0-bab1d9f133a3

Request Chain 198

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=rbd_n-vmg_ox-db5_an-db5 HTTP 302
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=rbd_n-vmg_ox-db5_an-db5&dcc=t

Request Chain 202

https://ups.analytics.yahoo.com/ups/58251/sync?redir=true HTTP 302
https://s.amazon-adsystem.com/ecm3?ex=vmg.com&id=eS1vbG1aS2dkRTJ1TGg5YzRHTFJsb0g5QTRVNUNja1JyeX5B

Request Chain 203

https://ib.adnxs.com/getuid?https://s.amazon-adsystem.com/ecm3?id=$UID&ex=appnexus.com HTTP 302
https://s.amazon-adsystem.com/ecm3?id=4244130733842794831&ex=appnexus.com

Request Chain 212

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537148856&val=YfFUggAAAE3qCwQr

Request Chain 214

https://match.adsrvr.org/track/cmf/openx?oxid=0a29796d-9bc2-33e2-700d-2e5758567b88&gdpr=0 HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072971&val=98ec7b18-03f3-4f38-9fd0-bab1d9f133a3&ttd_puid=0a29796d-9bc2-33e2-700d-2e5758567b88

Request Chain 216

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEH_QCtTDjfH3wWmecouqdrI&google_cver=1

Request Chain 217

https://us-u.openx.net/w/1.0/cm?id=9e0a35ea-c8e3-4b1b-9efa-4af6f54a373e&r=https://pixel.advertising.com/ups/58294/sync?_origin=1&uid={OPENX_ID} HTTP 302
https://pixel.advertising.com/ups/58294/sync?_origin=1&uid=24edfae4-43a8-09ab-232a-ef5dcff58fe1 HTTP 302
https://pixel.advertising.com/ups/58294/sync?_origin=1&uid=24edfae4-43a8-09ab-232a-ef5dcff58fe1&verify=true HTTP 302
https://ups.analytics.yahoo.com/ups/58294/sync?_origin=1&uid=24edfae4-43a8-09ab-232a-ef5dcff58fe1&apid=UPa24aaec3-7eb0-11ec-bab7-0e3b021ff725

Request Chain 218

https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fid.rlcdn.com%2F464246.gif%3Fpartner_uid%3D HTTP 302
https://id.rlcdn.com/464246.gif?partner_uid=5fef060b-5685-0582-2f74-aea461cd1a50 HTTP 307
https://id.rlcdn.com/1000.gif?memo=CPaqHBIvCisIARCUaxokNWZlZjA2MGItNTY4NS0wNTgyLTJmNzQtYWVhNDYxY2QxYTUwEAAaDQiEqcWPBhIFCOgHEABCAEoA HTTP 307
https://pippio.com/api/sync?pid=5324&it=1&iv=4fa65bf84239c9840bba77367b0a1b347ffc82f12ba140869a7d2f0debbe61e1791426b5417dce21&_=2 HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlA0ZmE2NWJmODQyMzljOTg0MGJiYTc3MzY3YjBhMWIzNDdmZmM4MmYxMmJhMTQwODY5YTdkMmYwZGViYmU2MWUxNzkxNDI2YjU0MTdkY2UyMRAAGgwIhKnFjwYSBAgCEABCAEoA HTTP 302
https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlA0ZmE2NWJmODQyMzljOTg0MGJiYTc3MzY3YjBhMWIzNDdmZmM4MmYxMmJhMTQwODY5YTdkMmYwZGViYmU2MWUxNzkxNDI2YjU0MTdkY2UyMRAAGgwIhKnFjwYSBAgCEABCAEoA&google_gid=CAESEI19HYES6GN1ufqiBnJ5PZk&google_cver=1 HTTP 307
https://tags.rd.linksynergy.com/rcs?ns=lr&uid3= HTTP 303
https://idsync.rlcdn.com/458249.gif?partner_uid=6fc6f59f-0a70-43b4-8af8-ccf0ea43162a

Request Chain 219

https://ib.adnxs.com/getuid?https://us-u.openx.net/w/1.0/sd?id=537072399&val=$UID HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072399&val=4244130733842794831

Request Chain 221

https://ad.turn.com/r/cs?pid=9&gdpr=0 HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537073061&val=3326741634532946709&gdpr=0&gdpr_consent=&us_privacy=

Request Chain 222

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537148856&val=YfFUggAAAE3qCwQr

Request Chain 224

https://match.adsrvr.org/track/cmf/openx?oxid=0a29796d-9bc2-33e2-700d-2e5758567b88&gdpr=0 HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072971&val=98ec7b18-03f3-4f38-9fd0-bab1d9f133a3&ttd_puid=0a29796d-9bc2-33e2-700d-2e5758567b88

Request Chain 226

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEH_QCtTDjfH3wWmecouqdrI&google_cver=1

Request Chain 229

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=a9us&khaos=KYVMAA4U-Z-LMBI HTTP 302
https://s.amazon-adsystem.com/ecm3?id=KYVMAA4U-Z-LMBI&ex=d-rubiconproject.com&status=ok

Request Chain 233

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1 HTTP 302
https://pr-bh.ybp.yahoo.com/sync/rubicon/ovJK-294_2l_7UmevbvGKg?csrc= HTTP 302
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=4693695464757336785

Request Chain 234

https://match.adsrvr.org/track/cmf/rubicon HTTP 302
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=98ec7b18-03f3-4f38-9fd0-bab1d9f133a3&gdpr=0&gdpr_consent=&expires=30

Request Chain 235

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc HTTP 302
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEKOfV0XkaBCpI7NBV5q5R_E&google_cver=1

Request Chain 236

https://token.rubiconproject.com/token?pid=26594 HTTP 302
https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KYVMAA4U-Z-LMBI&sigv=1&esig=2~b0b665ca333e8d3b2b61849810632926ea7d07cc

Request Chain 237

https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D191940%26nid%3D3778%26put%3D%24%7BUSER_ID%7D HTTP 302
https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=YfFUggAAAE3qCwQr

Request Chain 238

https://token.rubiconproject.com/token?pid=25470 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1lWTUFBNFUtWi1MTUJJ

Request Chain 239

https://token.rubiconproject.com/token?pid=2249&pt=n HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZjVmNjQxN2U5ODc5NjMwMWUwMTk0NjVjNmEyZmE2NWJmN2E5MTdlNw

275 HTTP transactions
-1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request nortonrose.html Show response
www.thestar.com/sponsored_sections/2022/01/13/ 105 KB
26 KB 122ms
50ms Document
text/html 99.84.42.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.42.91 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-42-91.ewr52.r.cloudfront.net

Software

Apache/2.4.52 (Unix) OpenSSL/1.1.1k / Express

Resource Hash

e540888c6295f4ad15bf07006ade70719c76979fbb399b87759dadaf0e3c92f6

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

content-type: text/html; charset=utf-8
server: Apache/2.4.52 (Unix) OpenSSL/1.1.1k
x-frame-options: SAMEORIGIN
access-control-allow-origin: https://amp.thestar.com
x-powered-by: Express
content-encoding: gzip
date: Wed, 26 Jan 2022 14:01:38 GMT
cache-control: max-age=180
etag: W/"1a2ad-y/wQ+1nlZJsCzzC+WwvIZTyPvNw"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 fc07a3272275b95dac262d5ece1fcdf8.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR52-C4
x-amz-cf-id: J7JvaQVU4llTt63ZcKKC2M69blOabKGULmYDIq237iicRLyN99ip6g==
age: 62

GET
H2 200 TorstarTextO3-Roman.ttf
www.thestar.com/assets/fonts/ 24 KB
15 KB 92ms
91ms Font
font/ttf 99.84.42.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thestar.com/assets/fonts/TorstarTextO3-Roman.ttf

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.42.91 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-42-91.ewr52.r.cloudfront.net

Software

Apache/2.4.52 (Unix) OpenSSL/1.1.1k / Express

Resource Hash

502a19bd8010b390245ee5ce7cab84a4250da24d548828b555a53a68cfbd8db9

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Origin: https://www.thestar.com
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 11:29:08 GMT
content-encoding: gzip
age: 9212
x-powered-by: Express
x-cache: Hit from cloudfront
access-control-allow-origin: https://amp.thestar.com
last-modified: Wed, 19 Jan 2022 21:36:32 GMT
server: Apache/2.4.52 (Unix) OpenSSL/1.1.1k
x-frame-options: SAMEORIGIN
etag: W/"6028-17e74451700"
vary: Accept-Encoding
content-type: font/ttf
via: 1.1 fc07a3272275b95dac262d5ece1fcdf8.cloudfront.net (CloudFront)
cache-control: max-age=14400
x-amz-cf-pop: EWR52-C4
x-amz-cf-id: n2swp2jDXwj4IE4-pkC17q_J5rKRVrkA1UBu3TdrF2iVrHa6JU8w3g==

GET
H2 200 TorstarTextO3-Italic.woff2
www.thestar.com/assets/fonts/ 18 KB
18 KB 74ms
72ms Font
font/woff2 99.84.42.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thestar.com/assets/fonts/TorstarTextO3-Italic.woff2

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.42.91 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-42-91.ewr52.r.cloudfront.net

Software

Apache/2.4.52 (Unix) OpenSSL/1.1.1k / Express

Resource Hash

448edd4a71b4ca28931010c1c2166872801702a420ff549a7c757edf863d7530

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Origin: https://www.thestar.com
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 11:29:08 GMT
via: 1.1 fc07a3272275b95dac262d5ece1fcdf8.cloudfront.net (CloudFront)
age: 9212
x-powered-by: Express
x-cache: Hit from cloudfront
content-length: 18316
last-modified: Wed, 19 Jan 2022 21:36:32 GMT
server: Apache/2.4.52 (Unix) OpenSSL/1.1.1k
etag: W/"478c-17e74451700"
x-frame-options: SAMEORIGIN
content-type: font/woff2
access-control-allow-origin: https://amp.thestar.com
cache-control: max-age=14400
x-amz-cf-pop: EWR52-C4
accept-ranges: bytes
x-amz-cf-id: B_5GZ9bCIIpfnzpBSH_z37Mr15oOkwGc7YpJq83Y9uLTdx5mhNtwvg==

GET
H2 200 TorstarTextO3-Bold.woff2
www.thestar.com/assets/fonts/ 18 KB
18 KB 75ms
74ms Font
font/woff2 99.84.42.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thestar.com/assets/fonts/TorstarTextO3-Bold.woff2

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.42.91 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-42-91.ewr52.r.cloudfront.net

Software

Apache/2.4.52 (Unix) OpenSSL/1.1.1k / Express

Resource Hash

38254c821b6bec9ee36bb8116cf81a16b0a9c2a51f97cacdb483b4fdeb6e3821

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Origin: https://www.thestar.com
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 11:29:08 GMT
via: 1.1 fc07a3272275b95dac262d5ece1fcdf8.cloudfront.net (CloudFront)
age: 9212
x-powered-by: Express
x-cache: Hit from cloudfront
content-length: 18276
last-modified: Wed, 19 Jan 2022 21:36:32 GMT
server: Apache/2.4.52 (Unix) OpenSSL/1.1.1k
etag: W/"4764-17e74451700"
x-frame-options: SAMEORIGIN
content-type: font/woff2
access-control-allow-origin: https://amp.thestar.com
cache-control: max-age=14400
x-amz-cf-pop: EWR52-C4
accept-ranges: bytes
x-amz-cf-id: Ffgt2FsLuhZ2Yz4NE0PhsFLgEIlXFul4gT0mvgug8zgth3xRJ9xvhw==

GET
H2 200 TorstarDeckCondensed-Roman.woff2
www.thestar.com/assets/fonts/ 19 KB
19 KB 93ms
91ms Font
font/woff2 99.84.42.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thestar.com/assets/fonts/TorstarDeckCondensed-Roman.woff2

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.42.91 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-42-91.ewr52.r.cloudfront.net

Software

Apache/2.4.52 (Unix) OpenSSL/1.1.1k / Express

Resource Hash

5f8f2739eab8542e8316b8d27f96040f31ae37bba3f5247dc55a7a32d1eac773

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Origin: https://www.thestar.com
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 11:29:08 GMT
via: 1.1 fc07a3272275b95dac262d5ece1fcdf8.cloudfront.net (CloudFront)
age: 9212
x-powered-by: Express
x-cache: Hit from cloudfront
content-length: 19052
last-modified: Wed, 19 Jan 2022 21:36:32 GMT
server: Apache/2.4.52 (Unix) OpenSSL/1.1.1k
etag: W/"4a6c-17e74451700"
x-frame-options: SAMEORIGIN
content-type: font/woff2
access-control-allow-origin: https://amp.thestar.com
cache-control: max-age=14400
x-amz-cf-pop: EWR52-C4
accept-ranges: bytes
x-amz-cf-id: U7VeKf8eAHpncWwHqfrSLXh3msb9gb9m49n4U6yxFh18vt4WVEbNCQ==

GET
H2 200 TorstarDeckCondensed-Semibold.woff2
www.thestar.com/assets/fonts/ 18 KB
19 KB 93ms
91ms Font
font/woff2 99.84.42.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thestar.com/assets/fonts/TorstarDeckCondensed-Semibold.woff2

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.42.91 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-42-91.ewr52.r.cloudfront.net

Software

Apache/2.4.52 (Unix) OpenSSL/1.1.1k / Express

Resource Hash

bc2dee2d7bba673bee2abc6490f270aedec3e93055882daa0cd0a474388265b9

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Origin: https://www.thestar.com
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 11:29:08 GMT
via: 1.1 fc07a3272275b95dac262d5ece1fcdf8.cloudfront.net (CloudFront)
age: 9212
x-powered-by: Express
x-cache: Hit from cloudfront
content-length: 18736
last-modified: Wed, 19 Jan 2022 21:36:32 GMT
server: Apache/2.4.52 (Unix) OpenSSL/1.1.1k
etag: W/"4930-17e74451700"
x-frame-options: SAMEORIGIN
content-type: font/woff2
access-control-allow-origin: https://amp.thestar.com
cache-control: max-age=14400
x-amz-cf-pop: EWR52-C4
accept-ranges: bytes
x-amz-cf-id: _m_HZ9lagBy5ZTJKRncNpjH7W9js9FbO0lpcTUpZdKLG0glJmgLvuA==

GET
H2 200 MerriweatherSans-Regular.woff2
www.thestar.com/assets/fonts/merriweather/ 54 KB
54 KB 65ms
63ms Font
font/woff2 99.84.42.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thestar.com/assets/fonts/merriweather/MerriweatherSans-Regular.woff2

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.42.91 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-42-91.ewr52.r.cloudfront.net

Software

Apache/2.4.52 (Unix) OpenSSL/1.1.1k / Express

Resource Hash

4b123f8e3a4b0db9c32f6add4b53ac3b66afecd0ac6c0b17a90e1451642f7418

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Origin: https://www.thestar.com
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 11:29:08 GMT
via: 1.1 fc07a3272275b95dac262d5ece1fcdf8.cloudfront.net (CloudFront)
age: 9212
x-powered-by: Express
x-cache: Hit from cloudfront
content-length: 55032
last-modified: Wed, 19 Jan 2022 21:36:32 GMT
server: Apache/2.4.52 (Unix) OpenSSL/1.1.1k
etag: W/"d6f8-17e74451700"
x-frame-options: SAMEORIGIN
content-type: font/woff2
access-control-allow-origin: https://amp.thestar.com
cache-control: max-age=14400
x-amz-cf-pop: EWR52-C4
accept-ranges: bytes
x-amz-cf-id: N-yFQ4TPxdOm2nHOsWK08KnsN5pZtOeOiWizzs-00Q4NN2PnoJMmJg==

GET
H2 200 MerriweatherSans-Italic.woff2
www.thestar.com/assets/fonts/merriweather/ 52 KB
53 KB 76ms
75ms Font
font/woff2 99.84.42.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thestar.com/assets/fonts/merriweather/MerriweatherSans-Italic.woff2

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.42.91 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-42-91.ewr52.r.cloudfront.net

Software

Apache/2.4.52 (Unix) OpenSSL/1.1.1k / Express

Resource Hash

6a5d134ce0702f55663b83e6d4a9d300e38f9328f96f1651419111712f9f02cb

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Origin: https://www.thestar.com
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 11:29:08 GMT
via: 1.1 fc07a3272275b95dac262d5ece1fcdf8.cloudfront.net (CloudFront)
age: 9212
x-powered-by: Express
x-cache: Hit from cloudfront
content-length: 53664
last-modified: Wed, 19 Jan 2022 21:36:32 GMT
server: Apache/2.4.52 (Unix) OpenSSL/1.1.1k
etag: W/"d1a0-17e74451700"
x-frame-options: SAMEORIGIN
content-type: font/woff2
access-control-allow-origin: https://amp.thestar.com
cache-control: max-age=14400
x-amz-cf-pop: EWR52-C4
accept-ranges: bytes
x-amz-cf-id: 6BaPJR3dBOAIVgt_ge-X7c6QYkZEBv0zJL-EFjnvfQd_RcvI30iIMg==

GET
H2 200 MerriweatherSans-Bold.woff2
www.thestar.com/assets/fonts/merriweather/ 55 KB
56 KB 54ms
52ms Font
font/woff2 99.84.42.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thestar.com/assets/fonts/merriweather/MerriweatherSans-Bold.woff2

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.42.91 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-42-91.ewr52.r.cloudfront.net

Software

Apache/2.4.52 (Unix) OpenSSL/1.1.1k / Express

Resource Hash

6c6bd4f1d599be4d43843b7dbf5ec5e134cd7aec0c900ac1c030ead10bbe4ea1

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Origin: https://www.thestar.com
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 11:51:58 GMT
via: 1.1 fc07a3272275b95dac262d5ece1fcdf8.cloudfront.net (CloudFront)
age: 9212
x-powered-by: Express
x-cache: Hit from cloudfront
content-length: 56380
last-modified: Wed, 19 Jan 2022 21:36:32 GMT
server: Apache/2.4.52 (Unix) OpenSSL/1.1.1k
etag: W/"dc3c-17e74451700"
x-frame-options: SAMEORIGIN
content-type: font/woff2
access-control-allow-origin: https://amp.thestar.com
cache-control: max-age=14400
x-amz-cf-pop: EWR52-C4
accept-ranges: bytes
x-amz-cf-id: cQjZ-IJrvB4JD5mY2GvWta5iSPm_yzOul91qDvJCRhU6QUI6HpzySg==

GET
H2 200 MerriweatherSans-BoldItalic.woff2
www.thestar.com/assets/fonts/merriweather/ 54 KB
54 KB 86ms
84ms Font
font/woff2 99.84.42.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thestar.com/assets/fonts/merriweather/MerriweatherSans-BoldItalic.woff2

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.42.91 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-42-91.ewr52.r.cloudfront.net

Software

Apache/2.4.52 (Unix) OpenSSL/1.1.1k / Express

Resource Hash

b8dd12b4cc0283b0d20c31c231b8ae14fa61c1b64d594cd8f8c0ed1948acb3b5

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Origin: https://www.thestar.com
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 11:51:04 GMT
via: 1.1 fc07a3272275b95dac262d5ece1fcdf8.cloudfront.net (CloudFront)
age: 9212
x-powered-by: Express
x-cache: Hit from cloudfront
content-length: 54800
last-modified: Wed, 19 Jan 2022 21:36:32 GMT
server: Apache/2.4.52 (Unix) OpenSSL/1.1.1k
etag: W/"d610-17e74451700"
x-frame-options: SAMEORIGIN
content-type: font/woff2
access-control-allow-origin: https://amp.thestar.com
cache-control: max-age=14400
x-amz-cf-pop: EWR52-C4
accept-ranges: bytes
x-amz-cf-id: 9doCfsh_vB5lZZyzEpc1C0OpbNG016ahHs3d7RFdxTun4yOD_23zbA==

GET
H2 200 MerriweatherSans-Black.woff2
www.thestar.com/assets/fonts/merriweather/ 53 KB
54 KB 81ms
79ms Font
font/woff2 99.84.42.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thestar.com/assets/fonts/merriweather/MerriweatherSans-Black.woff2

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.42.91 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-42-91.ewr52.r.cloudfront.net

Software

Apache/2.4.52 (Unix) OpenSSL/1.1.1k / Express

Resource Hash

098ac1fe26b8dcbf76d32aa5db27e6112d093743f9a3e4df1dc529c131df4363

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Origin: https://www.thestar.com
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 11:30:29 GMT
via: 1.1 fc07a3272275b95dac262d5ece1fcdf8.cloudfront.net (CloudFront)
age: 9216
x-powered-by: Express
x-cache: Hit from cloudfront
content-length: 54304
last-modified: Wed, 19 Jan 2022 21:36:32 GMT
server: Apache/2.4.52 (Unix) OpenSSL/1.1.1k
etag: W/"d420-17e74451700"
x-frame-options: SAMEORIGIN
content-type: font/woff2
access-control-allow-origin: https://amp.thestar.com
cache-control: max-age=14400
x-amz-cf-pop: EWR52-C4
accept-ranges: bytes
x-amz-cf-id: MME1JZOe30dQyJSPqO6teRGUOXv_9SzdqWSnAM4wGRjpM4Wl0TqTdQ==

GET
H2 200 script.js Show response
e377.thestar.com/ 136 KB
40 KB 82ms
20ms Script
text/javascript 99.84.125.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://e377.thestar.com/script.js

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.125.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-125-59.ewr52.r.cloudfront.net

Software

- /

Resource Hash

261b19d19129e9475642603543d240ff2a024a5a5d34cf9e95048bb1df789769

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 13:58:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
age: 270
x-cache: Hit from cloudfront
p3p: policyref="", CP="DSP"
content-length: 40827
x-xss-protection: 1; mode=block
last-modified: Wed, 26 Jan 2022 13:17:46 GMT
server: -
etag: cacec2b2932cd6eeb7b7ba3934bbec70
content-type: text/javascript; charset=utf-8
via: 1.1 c1c976b1b60b605adb44f62da9e0bb8a.cloudfront.net (CloudFront)
cache-control: public, no-cache="Set-Cookie", max-age=600
x-amz-cf-pop: EWR52-C3
x-robots-tag: noindex, nofollow
x-amz-cf-id: OaLppLFA0CWa9SZjUpU1a-xk4BD-7ZhK13U6btZ0-KhJhNHJztffWQ==
expires: Wed, 26 Jan 2022 14:08:10 GMT

GET
H2 200 72.css
www.thestar.com/static/ 8 KB
3 KB 34ms
33ms Stylesheet
text/css 99.84.42.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thestar.com/static/72.css?v=74364c882dc7d0ac22e2

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.42.91 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-42-91.ewr52.r.cloudfront.net

Software

Apache/2.4.52 (Unix) OpenSSL/1.1.1k / Express

Resource Hash

4c9a6bfaa9eb3219c33fe9a77d13c5aa2f6eb17a72bb5c09372e56351a57ea0c

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 25 Jan 2022 19:29:10 GMT
content-encoding: gzip
age: 66810
x-powered-by: Express
x-cache: Hit from cloudfront
access-control-allow-origin: https://amp.thestar.com
last-modified: Wed, 19 Jan 2022 21:41:50 GMT
server: Apache/2.4.52 (Unix) OpenSSL/1.1.1k
x-frame-options: SAMEORIGIN
etag: W/"205b-17e7449f130"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
via: 1.1 fc07a3272275b95dac262d5ece1fcdf8.cloudfront.net (CloudFront)
cache-control: max-age=300
x-amz-cf-pop: EWR52-C4
x-amz-cf-id: c0SUqiCBI05DgC5XL6S3k-p8njfFYDXdpca818AloIQ6xzpL39-Ohw==

GET
H2 200 bundle.css
www.thestar.com/static/ 432 KB
55 KB 37ms
36ms Stylesheet
text/css 99.84.42.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thestar.com/static/bundle.css?v=01a5ee26cfa1e575ae31

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.42.91 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-42-91.ewr52.r.cloudfront.net

Software

Apache/2.4.52 (Unix) OpenSSL/1.1.1k / Express

Resource Hash

0659a91e86a2de4047daaefdc9c513c051bd54135347ba21788a345e19114fcd

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 25 Jan 2022 19:29:09 GMT
content-encoding: gzip
age: 66811
x-powered-by: Express
x-cache: Hit from cloudfront
access-control-allow-origin: https://amp.thestar.com
last-modified: Wed, 19 Jan 2022 21:41:50 GMT
server: Apache/2.4.52 (Unix) OpenSSL/1.1.1k
x-frame-options: SAMEORIGIN
etag: W/"6be46-17e7449f130"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
via: 1.1 fc07a3272275b95dac262d5ece1fcdf8.cloudfront.net (CloudFront)
cache-control: max-age=300
x-amz-cf-pop: EWR52-C4
x-amz-cf-id: yZIhxJAf8JxDUkaM4jh1HAJTmJak0THHGhatNlXY_4Ch8DyXkQKJrg==

GET
H2 200 be54a597-6b6d-4e2d-9d31-642310a8db25-web.js Show response
be54a597-6b6d-4e2d-9d31-642310a8db25.edge.permutive.app/ 476 KB
138 KB 113ms
60ms Script
application/javascript 2606:4700::6812:451
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://be54a597-6b6d-4e2d-9d31-642310a8db25.edge.permutive.app/be54a597-6b6d-4e2d-9d31-642310a8db25-web.js
Requested by: Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:451 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 945fa1102d7171aaa3abdb1b5dcef89476989aca1bc640ef30cf3643cd719de4

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:40 GMT
content-encoding: br
cf-cache-status: HIT
x-goog-meta-oid: be54a597-6b6d-4e2d-9d31-642310a8db25
age: 1850
x-guploader-uploadid: ADPycdtq3PdXoRtYcI6hUoJIieJSIM9zzKjnlytfB8909BcNAXRyp_JJyCLiKhqJ3NpXYTYADXgPbFMhA7giuxh7P9c
x-goog-storage-class: REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
content-type: application/javascript
last-modified: Tue, 25 Jan 2022 21:29:29 GMT
server: cloudflare
etag: W/"42bb8d81f0e981b8486f59dd57f42ce8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=eMsPXg==, md5=QruNgfDpgbhIb1ndV/Qs6A==
x-goog-generation: 1643146169027773
cache-control: public, max-age=900
x-goog-stored-content-length: 145980
cf-ray: 6d3a47c4be30ca53-YUL
expires: Wed, 26 Jan 2022 14:17:40 GMT

GET
H/1.1 200
OK yi.js Show response
sejs.moatads.com/torontoprebidheader623296055317/ 246 KB
85 KB 178ms
39ms Script
application/x-javascript 23.41.169.149
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://sejs.moatads.com/torontoprebidheader623296055317/yi.js
Requested by: Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.41.169.149 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-41-169-149.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 2a9985346636b1ba338c34b11e4083dc11cec0b1067d396dc2c44c685ae03a01

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 26 Jan 2022 14:02:41 GMT
Content-Encoding: gzip
Server: AmazonS3
x-amz-request-id: CEAN8NG88R5NVMW5
ETag: "ae67d7334b3e8fccef48c39bb0e8d7f9"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=50240
Transfer-Encoding: chunked
Connection: keep-alive, Transfer-Encoding
x-amz-id-2: +smdrX36HfRBfouYQTqFP5uHOjYj5yXAxXRHlIRNmxYRwsu1eOWk+JVHrHKTMO2smHdorTIj1ps=

GET
H2 200 ads.js Show response
www.thestar.com/assets/js/ 22 B
466 B 51ms
50ms Script
application/javascript 99.84.42.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thestar.com/assets/js/ads.js

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.42.91 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-42-91.ewr52.r.cloudfront.net

Software

Apache/2.4.52 (Unix) OpenSSL/1.1.1k / Express

Resource Hash

be2277c99594557635d0993ac606fdc4994494e43408bc1be5c6ac9bfabc5dac

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 11:30:57 GMT
via: 1.1 fc07a3272275b95dac262d5ece1fcdf8.cloudfront.net (CloudFront)
age: 9103
x-powered-by: Express
x-cache: Hit from cloudfront
content-length: 22
last-modified: Wed, 19 Jan 2022 21:36:33 GMT
server: Apache/2.4.52 (Unix) OpenSSL/1.1.1k
etag: W/"16-17e74451ae8"
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: https://amp.thestar.com
cache-control: max-age=14400
x-amz-cf-pop: EWR52-C4
accept-ranges: bytes
x-amz-cf-id: va_0Da4Q4u5j_nm9i2_ICwIuNPo7EdayVBWUF9X7caG8Xm5XSEz9sg==

GET
H2 200 logo-toronto.svg
www.thestar.com/assets/svg/ 7 KB
3 KB 53ms
53ms Image
image/svg+xml 99.84.42.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.thestar.com/assets/svg/logo-toronto.svg

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.42.91 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-42-91.ewr52.r.cloudfront.net

Software

Apache/2.4.52 (Unix) OpenSSL/1.1.1k / Express

Resource Hash

4466f366b2897f4839ba95e1b5d96fa3c3e11cadb7fe0096afb3a5a97b872ffb

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 11:29:08 GMT
content-encoding: gzip
age: 9213
x-powered-by: Express
x-cache: Hit from cloudfront
access-control-allow-origin: https://amp.thestar.com
last-modified: Wed, 19 Jan 2022 21:36:33 GMT
server: Apache/2.4.52 (Unix) OpenSSL/1.1.1k
x-frame-options: SAMEORIGIN
etag: W/"1df3-17e74451ae8"
vary: Accept-Encoding
content-type: image/svg+xml
via: 1.1 fc07a3272275b95dac262d5ece1fcdf8.cloudfront.net (CloudFront)
cache-control: max-age=14400
x-amz-cf-pop: EWR52-C4
x-amz-cf-id: bdbZEZxptmGyxRdVt9wt64JotrvCY_gGLSXd0dLbEO19TDbzJHiccA==

GET
H2 200 loading-spinner.svg
www.thestar.com/assets/img/ 3 KB
963 B 41ms
41ms Image
image/svg+xml 99.84.42.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.thestar.com/assets/img/loading-spinner.svg

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.42.91 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-42-91.ewr52.r.cloudfront.net

Software

Apache/2.4.52 (Unix) OpenSSL/1.1.1k / Express

Resource Hash

9474557b14923e78c9b0b7b44bccd0d7018187fb0150095946932a071f155933

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 11:29:08 GMT
content-encoding: gzip
age: 9213
x-powered-by: Express
x-cache: Hit from cloudfront
access-control-allow-origin: https://amp.thestar.com
last-modified: Wed, 19 Jan 2022 21:36:33 GMT
server: Apache/2.4.52 (Unix) OpenSSL/1.1.1k
x-frame-options: SAMEORIGIN
etag: W/"d54-17e74451ae8"
vary: Accept-Encoding
content-type: image/svg+xml
via: 1.1 fc07a3272275b95dac262d5ece1fcdf8.cloudfront.net (CloudFront)
cache-control: max-age=14400
x-amz-cf-pop: EWR52-C4
x-amz-cf-id: 4gLfnhibSqAbZlU7OkidWRfpTq0Q969aW3gPV1C5n63c2C7EujKGIw==

GET
H2 200 logo-round-thestar.svg
www.thestar.com/assets/svg/ 589 B
1 KB 41ms
41ms Image
image/svg+xml 99.84.42.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.thestar.com/assets/svg/logo-round-thestar.svg

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.42.91 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-42-91.ewr52.r.cloudfront.net

Software

Apache/2.4.52 (Unix) OpenSSL/1.1.1k / Express

Resource Hash

95f4db14172013eb07b61d3933cdcee02d39e70569f86e2d445e637db2d62547

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 11:29:08 GMT
via: 1.1 fc07a3272275b95dac262d5ece1fcdf8.cloudfront.net (CloudFront)
age: 9213
x-powered-by: Express
x-cache: Hit from cloudfront
content-length: 589
last-modified: Wed, 19 Jan 2022 21:36:33 GMT
server: Apache/2.4.52 (Unix) OpenSSL/1.1.1k
etag: W/"24d-17e74451ae8"
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
access-control-allow-origin: https://amp.thestar.com
cache-control: max-age=14400
x-amz-cf-pop: EWR52-C4
accept-ranges: bytes
x-amz-cf-id: xSuKT_xoX6Q__d15T8wmpl2I_DJsBjlCGsuu9BbXq6NOuvAHedJc4g==

GET
H2 200 logo-thestar.svg
www.thestar.com/assets/svg/ 2 KB
1 KB 67ms
66ms Image
image/svg+xml 99.84.42.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.thestar.com/assets/svg/logo-thestar.svg

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.42.91 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-42-91.ewr52.r.cloudfront.net

Software

Apache/2.4.52 (Unix) OpenSSL/1.1.1k / Express

Resource Hash

ab199625a90b8111a0ae408ef6b43ae28dd55ad6d2fa2524666c169b5b1262bc

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 11:29:08 GMT
content-encoding: gzip
age: 9213
x-powered-by: Express
x-cache: Hit from cloudfront
access-control-allow-origin: https://amp.thestar.com
last-modified: Wed, 19 Jan 2022 21:36:33 GMT
server: Apache/2.4.52 (Unix) OpenSSL/1.1.1k
x-frame-options: SAMEORIGIN
etag: W/"73e-17e74451ae8"
vary: Accept-Encoding
content-type: image/svg+xml
via: 1.1 fc07a3272275b95dac262d5ece1fcdf8.cloudfront.net (CloudFront)
cache-control: max-age=14400
x-amz-cf-pop: EWR52-C4
x-amz-cf-id: 9e0T0M8l14ptuoP_1yJ_-AGUvfH4XzNUZZyv8S3_WnH1wdw8J2unPw==

GET
H2 200 ts-subsoffer-header-v1-0.jpg
images.thestar.com/wbgYxNOxIg4JBFI7tP9eEFp4AJM=/0x0:1086x631/1086x631/smart/filters:cb(1641932490787)/https://www.thestar.com/content/dam/thestar/uploads/2022/01/11/ 136 KB
136 KB 92ms
29ms Image
image/jpeg 13.225.214.17
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.thestar.com/wbgYxNOxIg4JBFI7tP9eEFp4AJM=/0x0:1086x631/1086x631/smart/filters:cb(1641932490787)/https://www.thestar.com/content/dam/thestar/uploads/2022/01/11/ts-subsoffer-header-v1-0.jpg
Requested by: Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.214.17 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-214-17.ewr50.r.cloudfront.net
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 4f42b355fb802a26059b40048576fe9e61ab5a4ee39971b20a812ca10b2da540

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 25 Jan 2022 16:39:59 GMT
via: 1.1 27c608e7692c0c2238fa431356d5d6e2.cloudfront.net (CloudFront)
server: nginx/1.14.0 (Ubuntu)
age: 76962
etag: "14b1d9b9aadf5c1c4009a408281ab90ecc9a4b9e"
x-cache: Hit from cloudfront
content-type: image/jpeg
cache-control: max-age=315360000
x-amz-cf-pop: EWR50-C1
content-length: 139230
x-amz-cf-id: a3tFcGQx93BY0_hmrWJ5bRQ9O0IZzT9UWhT6sR-HARzob1tJr62qfQ==
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 brandmark-thestar.svg
www.thestar.com/assets/svg/ 263 B
703 B 49ms
46ms Image
image/svg+xml 99.84.42.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.thestar.com/assets/svg/brandmark-thestar.svg

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.42.91 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-42-91.ewr52.r.cloudfront.net

Software

Apache/2.4.52 (Unix) OpenSSL/1.1.1k / Express

Resource Hash

9b4fd2bac023c59fa666614872a2a06a413659ca1b03eb71c3ad32298b2366dd

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 11:29:13 GMT
via: 1.1 fc07a3272275b95dac262d5ece1fcdf8.cloudfront.net (CloudFront)
age: 9208
x-powered-by: Express
x-cache: Hit from cloudfront
content-length: 263
last-modified: Wed, 19 Jan 2022 21:36:33 GMT
server: Apache/2.4.52 (Unix) OpenSSL/1.1.1k
etag: W/"107-17e74451ae8"
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
access-control-allow-origin: https://amp.thestar.com
cache-control: max-age=14400
x-amz-cf-pop: EWR52-C4
accept-ranges: bytes
x-amz-cf-id: momztFq0wdjYd4DZEWqEzd6ABbdvRQNUxm3GBmMVhGzJF7ndFqf0OA==

GET
H2 200 app-store.svg
www.thestar.com/assets/svg/ 8 KB
4 KB 49ms
45ms Image
image/svg+xml 99.84.42.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.thestar.com/assets/svg/app-store.svg

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.42.91 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-42-91.ewr52.r.cloudfront.net

Software

Apache/2.4.52 (Unix) OpenSSL/1.1.1k / Express

Resource Hash

133d99ecc7e1f65d2e0bdc9d04fae746f2e9b820213b2a2df7fed60ba073475e

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 11:29:08 GMT
content-encoding: gzip
age: 9213
x-powered-by: Express
x-cache: Hit from cloudfront
access-control-allow-origin: https://amp.thestar.com
last-modified: Wed, 19 Jan 2022 21:36:33 GMT
server: Apache/2.4.52 (Unix) OpenSSL/1.1.1k
x-frame-options: SAMEORIGIN
etag: W/"1e63-17e74451ae8"
vary: Accept-Encoding
content-type: image/svg+xml
via: 1.1 fc07a3272275b95dac262d5ece1fcdf8.cloudfront.net (CloudFront)
cache-control: max-age=14400
x-amz-cf-pop: EWR52-C4
x-amz-cf-id: wvcwpmqpFpdnwQ1SU5bA5LsVtmP-ECO_cjbrwxa_uSpDu54IxUvYoA==

GET
H2 200 google-play.svg
www.thestar.com/assets/svg/ 10 KB
4 KB 48ms
44ms Image
image/svg+xml 99.84.42.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.thestar.com/assets/svg/google-play.svg

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.42.91 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-42-91.ewr52.r.cloudfront.net

Software

Apache/2.4.52 (Unix) OpenSSL/1.1.1k / Express

Resource Hash

b0ab2f21243b940db6c6b986e1cedb149ffcc296b62b326e9214366585d1040d

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 11:30:28 GMT
content-encoding: gzip
age: 9208
x-powered-by: Express
x-cache: Hit from cloudfront
access-control-allow-origin: https://amp.thestar.com
last-modified: Wed, 19 Jan 2022 21:36:33 GMT
server: Apache/2.4.52 (Unix) OpenSSL/1.1.1k
x-frame-options: SAMEORIGIN
etag: W/"2859-17e74451ae8"
vary: Accept-Encoding
content-type: image/svg+xml
via: 1.1 fc07a3272275b95dac262d5ece1fcdf8.cloudfront.net (CloudFront)
cache-control: max-age=14400
x-amz-cf-pop: EWR52-C4
x-amz-cf-id: E4LLkwArHmuqEgCDMHOuMbIIZgm-AnBXTOjwUBJUNtOkiWmlQ0RouA==

GET
H2

200

oct.js Show response
static.ads-twitter.com/
Redirect Chain

https://platform.twitter.com/oct.js
https://static.ads-twitter.com/oct.js

14 KB
6 KB

97ms
26ms

Script
application/javascript

199.232.64.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/oct.js
Requested by: Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Protocol: H2
Server: 199.232.64.157 Ashburn, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4da3e3aa30b5b06390d7e7e3fcfb16d648909eb429d161c2748bd6d79a7ec5fb

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:40 GMT
content-encoding: gzip
last-modified: Thu, 16 Sep 2021 23:12:14 GMT
etag: "8dc11b7ca1d5ed9ec3b1ab1beb621c75+gzip+gzip"
vary: Accept-Encoding,Host
x-tw-cdn: FT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache
x-cache: HIT, HIT
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
content-length: 5410
x-served-by: cache-iad-kiad7000179-IAD, cache-wdc5560-WDC

Redirect headers

x-tw-cdn: VZ
Date: Wed, 26 Jan 2022 14:02:40 GMT
Server: ECS (nyb/1D2F)
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Location: https://static.ads-twitter.com/oct.js
Server-Timing: "x-cache;desc= ,x-tw-cdn;desc=VZ",edge;dur=1
Content-Length: 0

GET
H2 200 vendors~bundle.chunk.js Show response
www.thestar.com/static/ 2 MB
511 KB 22ms
19ms Script
application/javascript 99.84.42.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thestar.com/static/vendors~bundle.chunk.js?v=e27c5c32

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.42.91 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-42-91.ewr52.r.cloudfront.net

Software

Apache/2.4.52 (Unix) OpenSSL/1.1.1k / Express

Resource Hash

88a204ed5ddd9041bfb6b1f4cc99579ac4b8c0dcd0ad3efdf7d590f84229834a

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:00:56 GMT
content-encoding: gzip
age: 105
x-powered-by: Express
x-cache: Hit from cloudfront
access-control-allow-origin: https://amp.thestar.com
last-modified: Wed, 19 Jan 2022 21:41:50 GMT
server: Apache/2.4.52 (Unix) OpenSSL/1.1.1k
x-frame-options: SAMEORIGIN
etag: W/"1cf70f-17e7449f130"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
via: 1.1 fc07a3272275b95dac262d5ece1fcdf8.cloudfront.net (CloudFront)
cache-control: max-age=300
x-amz-cf-pop: EWR52-C4
x-amz-cf-id: dr7zr7vkoBEH2wbM7xmlbVlh4SRNYIhcGIdCaclXQb0TlWuwXkxwPA==

GET
H2 200 bundle.js Show response
www.thestar.com/static/ 1 MB
231 KB 40ms
37ms Script
application/javascript 99.84.42.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thestar.com/static/bundle.js?v=5e46e0cb

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.42.91 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-42-91.ewr52.r.cloudfront.net

Software

Apache/2.4.52 (Unix) OpenSSL/1.1.1k / Express

Resource Hash

5f5466f44e74c501df50e271f39051d8ca297bfcb1dd30e963df88964152c8db

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:00:56 GMT
content-encoding: gzip
age: 105
x-powered-by: Express
x-cache: Hit from cloudfront
access-control-allow-origin: https://amp.thestar.com
last-modified: Wed, 19 Jan 2022 21:41:50 GMT
server: Apache/2.4.52 (Unix) OpenSSL/1.1.1k
x-frame-options: SAMEORIGIN
etag: W/"12ff72-17e7449f130"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
via: 1.1 fc07a3272275b95dac262d5ece1fcdf8.cloudfront.net (CloudFront)
cache-control: max-age=300
x-amz-cf-pop: EWR52-C4
x-amz-cf-id: YqGMGbdvI6kJafjSGiFfxbPGpP9BIkyoCYEJ86bbFZh07z8onOu0WA==

GET
H2 200 cs Show response
torstar.blueconic.net/DG/DEFAULT/ 16 B
698 B 90ms
26ms Script
text/javascript 35.174.252.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://torstar.blueconic.net/DG/DEFAULT/cs?&callback=bc_json160

Requested by

Host: e377.thestar.com
URL: https://e377.thestar.com/script.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.174.252.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-174-252-231.compute-1.amazonaws.com

Software

- /

Resource Hash

7d5f456fd98c1b919d5f1df7e888587605996d471a6bc33ef5da733b002c1373

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: -
x-robots-tag: noindex, nofollow
p3p: policyref="", CP="DSP"
x-permitted-cross-domain-policies: master-only
cache-control: no-cache, no-store, no-transform, must-revalidate, private
content-type: text/javascript; charset=utf-8
content-length: 36
x-xss-protection: 1; mode=block
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK channels.cgi Show response
torstar.gscontxt.net/main/ 432 B
510 B 120ms
23ms Script
application/javascript 129.213.193.172
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL: https://torstar.gscontxt.net/main/channels.cgi?url=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html
Requested by: Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 129.213.193.172 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: /
Resource Hash: 4f72b8caea92dbc2422817753915f814b16ef6def30a2b6c6a109fb0c6cecf00

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Length: 432
Content-Type: application/javascript

GET
H2 200 launch-EN5e55511c260e4c0cb05872ba3729b255.min.js Show response
resources.thestar.com/ 314 KB
69 KB 149ms
20ms Script
text/javascript 13.225.63.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.thestar.com/launch-EN5e55511c260e4c0cb05872ba3729b255.min.js
Requested by: Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.63.104 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-63-104.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: bce8546e091fc6b313d77b803148c20b50e9f31a5ec1abf70ddfed46d5833765

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 13:32:28 GMT
content-encoding: gzip
last-modified: Wed, 26 Jan 2022 13:32:12 GMT
server: AmazonS3
age: 1814
etag: W/"95493883e8cb420dc4a90f25bd686610"
vary: Accept-Encoding
x-cache: Hit from cloudfront
x-amz-version-id: mxAGkLwBBjGND8DgO.kl.blIsVYNNGUD
via: 1.1 e2ddb156cdc225570ee247c2aefc938e.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR53-C1
content-type: text/javascript
x-amz-cf-id: 8vurZ3Iq9GK6ZwdmyXwca2ojxDqqlCx4JQfp38rNE7Fz3jGeiojZmQ==

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 203 KB
71 KB 86ms
34ms Script
application/javascript 2607:f8b0:4006:81f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-P86MZHL&gtm_auth=6lA8dG63UaQ5ed3gQljsjQ&gtm_preview=env-2&gtm_cookies_win=x

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81f::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

86c766a629561f83ab93e2ed07dd397c504811f05e9eb6f97d0c33ace663c607

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:41 GMT
content-encoding: br
vary: *
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 72678
x-xss-protection: 0
pragma: no-cache
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 js_visitor_settings.php Show response
dev.visualwebsiteoptimizer.com/deploy/ 12 KB
3 KB 110ms
86ms Script
application/javascript 34.96.102.137
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/deploy/js_visitor_settings.php?v=1&a=354908&url=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&random=0.8738423212808157
Requested by: Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gnv1 /
Resource Hash: 9dcb057b6332f78f4e69a8393f2666e34b96a7d90f1efa010cbac0db8426195e

Request headers

Referer: https://www.thestar.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 26 Jan 2022 14:02:40 GMT
via: 1.1 google
server: gnv1
content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-type: application/javascript; charset=UTF-8

GET
H2 200 track-3a8c03cc83fd9c554b5af6e1cc1ffa80.js Show response
dev.visualwebsiteoptimizer.com/7.0/ 12 KB
4 KB 259ms
258ms Script
text/javascript 34.96.102.137
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/7.0/track-3a8c03cc83fd9c554b5af6e1cc1ffa80.js
Requested by: Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/deploy/js_visitor_settings.php?v=1&a=354908&url=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&random=0.8738423212808157
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gnv1 /
Resource Hash: 8cbd246e3c6473e7a092ad1c202fa0ed50c2fafac6ee80b8295a3ba2982d6ec6

Request headers

Referer: https://www.thestar.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 26 Jan 2022 14:02:41 GMT
content-encoding: br
last-modified: Wed, 26 Jan 2022 13:27:59 GMT
server: gnv1
etag: "61f14c5f-e87"
vary: Accept-Encoding, User-Agent
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3719
via: 1.1 google

GET
H2 200 opa-608d8314e5c4b9c6caefe04b8ad484ca.js Show response
dev.visualwebsiteoptimizer.com/analysis/4.0/ 103 KB
27 KB 147ms
147ms Script
application/javascript 34.96.102.137
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/analysis/4.0/opa-608d8314e5c4b9c6caefe04b8ad484ca.js
Requested by: Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/deploy/js_visitor_settings.php?v=1&a=354908&url=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&random=0.8738423212808157
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gnv1 /
Resource Hash: fa7f953e8f4f0d1eaca1c0952f8841238c9c191df4051076dc5bb108d468fdfc

Request headers

Referer: https://www.thestar.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 26 Jan 2022 14:02:40 GMT
content-encoding: br
last-modified: Wed, 26 Jan 2022 13:27:55 GMT
server: gnv1
etag: "61f14c5b-6a3e"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27198
via: 1.1 google

GET
H3 200 v.gif
dev.visualwebsiteoptimizer.com/ 35 B
52 B 30ms
28ms Image
image/gif 34.96.102.137
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dev.visualwebsiteoptimizer.com/v.gif?cd=0&a=354908&d=thestar.com&u=D32289A8ADD8292F80FE3620CD2E37C46&h=f5e1c18143697ad9f787ca5374be0cba&r=0.440583088375079

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

QUIC, , AES_128_GCM

Server

34.96.102.137 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

137.102.96.34.bc.googleusercontent.com

Software

gnv1c /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:41 GMT
via: 1.1 google
x-content-type-options: nosniff
server: gnv1c
content-type: image/gif
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 10 Jan 2005 00:00:01 GMT

GET
H2 200 pxid Show response
be54a597-6b6d-4e2d-9d31-642310a8db25.prmutv.co/v2.0/ 46 B
487 B 143ms
95ms XHR
application/json 35.241.9.51
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://be54a597-6b6d-4e2d-9d31-642310a8db25.prmutv.co/v2.0/pxid?k=025ad678-bf0a-4fe2-b383-8487592159bc
Requested by: Host: be54a597-6b6d-4e2d-9d31-642310a8db25.edge.permutive.app
URL: https://be54a597-6b6d-4e2d-9d31-642310a8db25.edge.permutive.app/be54a597-6b6d-4e2d-9d31-642310a8db25-web.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.241.9.51 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 51.9.241.35.bc.googleusercontent.com
Software: Permutive /
Resource Hash: e6144aaf9c84548c0fa1cf4a3a11b186ea92d7818742dd13689ff64ca5637e8e

Request headers

Referer: https://www.thestar.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
content-type: text/plain

Response headers

date: Wed, 26 Jan 2022 14:02:40 GMT
content-encoding: gzip
server: Permutive
vary: Origin,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: https://www.thestar.com
access-control-expose-headers: *
access-control-allow-credentials: true
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66
via: 1.1 google

GET
H/1.1 200
OK getuidj Show response
ib.adnxs.com/ 11 B
691 B 75ms
36ms XHR
application/json 68.67.178.15
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/getuidj

Requested by

Host: be54a597-6b6d-4e2d-9d31-642310a8db25.edge.permutive.app
URL: https://be54a597-6b6d-4e2d-9d31-642310a8db25.edge.permutive.app/be54a597-6b6d-4e2d-9d31-642310a8db25-web.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.178.15 Secaucus, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

633.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.thestar.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
content-type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 26 Jan 2022 14:02:40 GMT
X-Proxy-Origin: 149.56.153.187; 149.56.153.187; 633.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: cf5ed2c3-a106-4bb2-b9c5-0faf5f1257c4
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.thestar.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 11
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 geoip Show response
api.permutive.com/v2.0/ 229 B
454 B 120ms
94ms XHR
application/json 34.107.254.252
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.permutive.com/v2.0/geoip?include=geo&include=isp&include=ip_hash&k=025ad678-bf0a-4fe2-b383-8487592159bc
Requested by: Host: be54a597-6b6d-4e2d-9d31-642310a8db25.edge.permutive.app
URL: https://be54a597-6b6d-4e2d-9d31-642310a8db25.edge.permutive.app/be54a597-6b6d-4e2d-9d31-642310a8db25-web.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.254.252 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 252.254.107.34.bc.googleusercontent.com
Software: Permutive /
Resource Hash: 989d94d8baba214a6dcc1ba6795c35dc9ce9cf94863248b8970cd8e864674347

Request headers

Referer: https://www.thestar.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
content-type: text/plain

Response headers

date: Wed, 26 Jan 2022 14:02:40 GMT
content-encoding: gzip
server: Permutive
vary: Origin,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: https://www.thestar.com
access-control-expose-headers: *
access-control-allow-credentials: true
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 166
via: 1.1 google

GET
BLOB 200
OK 68a33e8e-a1da-4338-a7ed-c70ab13ed7cb
https://www.thestar.com/ 269 KB
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.thestar.com/68a33e8e-a1da-4338-a7ed-c70ab13ed7cb
Requested by: Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 930e145b4ec9b56aa495a4cb5f87269e3c8076d644f6d35ee90b19f948c92105

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Length: 275016

GET
BLOB 200
OK 2c4b2ca4-4440-44fa-bb2e-09ad9a8e31a4
https://www.thestar.com/ 19 KB
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.thestar.com/2c4b2ca4-4440-44fa-bb2e-09ad9a8e31a4
Requested by: Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 982aa9ad2147f7acf4693df772516b751a9c128c41fbec55d057b8e19e42f8de

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Length: 19525

POST
H3 200 identify Show response
api.permutive.com/v2.0/ 50 B
91 B 117ms
104ms XHR
application/json 34.107.254.252
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.permutive.com/v2.0/identify?k=025ad678-bf0a-4fe2-b383-8487592159bc
Requested by: Host: be54a597-6b6d-4e2d-9d31-642310a8db25.edge.permutive.app
URL: https://be54a597-6b6d-4e2d-9d31-642310a8db25.edge.permutive.app/be54a597-6b6d-4e2d-9d31-642310a8db25-web.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.107.254.252 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 252.254.107.34.bc.googleusercontent.com
Software: Permutive /
Resource Hash: 0ae8edb5535f481c43a3f80a93269bba430ba3e6503de152f1dfec02cea97e03

Request headers

Referer: https://www.thestar.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
content-type: text/plain

Response headers

date: Wed, 26 Jan 2022 14:02:41 GMT
content-encoding: gzip
server: Permutive
vary: Origin,Access-Control-Request-Method
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: https://www.thestar.com
access-control-expose-headers: *
access-control-allow-credentials: true
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 70
via: 1.1 google

GET
H/1.1 200
OK vis_opt.js Show response
d5phz18u4wuww.cloudfront.net/ 168 KB
56 KB 83ms
19ms Script
text/javascript 13.225.66.81
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d5phz18u4wuww.cloudfront.net/vis_opt.js
Requested by: Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.66.81 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-66-81.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e96ee4202dd697f4757a0c1502f5b3ae79c0d59d0823d80a80ac3ed97132d861

Request headers

Referer: https://www.thestar.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date: Wed, 26 Jan 2022 13:32:59 GMT
Content-Encoding: gzip
Connection: keep-alive
Last-Modified: Thu, 02 May 2019 08:14:16 GMT
Server: AmazonS3
Age: 1782
ETag: "85932b0cd7c8dce121fa1923529a3189"
X-Cache: Hit from cloudfront
Content-Type: text/javascript
Via: 1.1 5ec6b37107376867228d2ed46a794602.cloudfront.net (CloudFront)
Cache-Control: max-age=3600
X-Amz-Cf-Pop: EWR53-C1
Accept-Ranges: bytes
Content-Length: 57240
X-Amz-Cf-Id: z1vdbwInhJ-MyUs8QVREs5ZFAsMjm225nM_Agk18goQnIo4E0ATexA==

GET
H3 200 vis_opt-3a8c03cc83fd9c554b5af6e1cc1ffa80.js Show response
dev.visualwebsiteoptimizer.com/7.0/ 219 KB
62 KB 27ms
27ms Script
text/javascript 34.96.102.137
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/7.0/vis_opt-3a8c03cc83fd9c554b5af6e1cc1ffa80.js
Requested by: Host: d5phz18u4wuww.cloudfront.net
URL: https://d5phz18u4wuww.cloudfront.net/vis_opt.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gnv1 /
Resource Hash: 69773e0e2625f165da9eac9c1272f990a8c1307e13e2d8b2d078261a8f4210f2

Request headers

Referer: https://www.thestar.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 26 Jan 2022 14:02:40 GMT
content-encoding: br
last-modified: Wed, 26 Jan 2022 13:27:59 GMT
server: gnv1
etag: "61f14c5f-f914"
vary: Accept-Encoding, User-Agent
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 63764
via: 1.1 google

GET
H2 200 v2 Show response
mb.moatads.com/yi/ 366 B
541 B 163ms
37ms Script
text/html 34.193.47.203
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://mb.moatads.com/yi/v2?ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BYbjrG%3DH%3CU%3CO%24cRJ%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C2%2C2%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-vUthrZVsFccVxRDaTGndGCUc8IKBUGMSV3C%2FvEJM65hND7UVt69nIRrqyNQFcZFf7egP&rs=1-2Shgt24580cdYQ%3D%3D&sc=1&os=1-Bg%3D%3D&qp=10000&is=&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&pcode=torontoprebidheader623296055317&rx=538703511803&callback=MoatNadoAllJsonpRequest_59682825
Requested by: Host: sejs.moatads.com
URL: https://sejs.moatads.com/torontoprebidheader623296055317/yi.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.193.47.203 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-193-47-203.compute-1.amazonaws.com
Software: TornadoServer/5.1.1 /
Resource Hash: 81b7b28fdb0ee6ed7f0a1452ca13473a59c9e2c0b1bd560ab5b4bb2371120389

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:41 GMT
cache-control: max-age=900
server: TornadoServer/5.1.1
timing-allow-origin: *
etag: "6716bd3fd811f73846b0187829c56f9405ee0c2e"
content-length: 366
content-type: text/html; charset=UTF-8

GET
H2 200 iframe.html Show response
z.moatads.com/hd09824092/ Frame E88E 1 KB
2 KB 59ms
19ms Document
text/html 23.41.169.149
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/hd09824092/iframe.html
Requested by: Host: sejs.moatads.com
URL: https://sejs.moatads.com/torontoprebidheader623296055317/yi.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.41.169.149 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-41-169-149.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 49d65831c7e98a7d885d223699a41198204329efff9d1904c8af71323f613d68

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/

Response headers

x-amz-id-2: hQ76LONt8Z0+0gvX3A4RyhSAR+G2Z6t19zCkHXVFoPjEF/LsnPK0v5GFk/w7HR+V18HzBhT8pKE=
x-amz-request-id: 7C72C67561922266
last-modified: Tue, 26 Jan 2021 22:41:39 GMT
etag: "4a9cbc2e5bc164313dace42a58bef141"
accept-ranges: bytes
content-type: text/html
content-length: 1374
server: AmazonS3
cache-control: max-age=1001
date: Wed, 26 Jan 2022 14:02:41 GMT

GET
H/1.1 200
OK embedder Show response
adserver.pressboard.ca/v3/ 351 B
789 B 436ms
30ms Script
application/x-javascript 20.49.104.19
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver.pressboard.ca/v3/embedder?media=130507
Requested by: Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.49.104.19 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 4da8f4d2d20833c254b092ab30d0ebaee5e3d93716e320773ff55c27c353796b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 26 Jan 2022 14:02:41 GMT
Access-Control-Allow-Methods: GET, POST, OPTIONS, HEAD, PUT
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Expires: 0
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Content-Length: 351
request-context: appId=cid-v1:c374023b-8354-459d-b51b-039919730c2c

GET
H/1.1 200
OK 181778-254412191205210.js Show response
js-sec.indexww.com/ht/p/ 139 KB
39 KB 87ms
20ms Script
text/javascript 23.41.168.244
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/ht/p/181778-254412191205210.js
Requested by: Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.41.168.244 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-41-168-244.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: acf47ed08e03deb30050e6cc80f2972698f083352e87deda1ef3f3b1bef79e1a

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 26 Jan 2022 14:02:41 GMT
Content-Encoding: gzip
Last-Modified: Wed, 26 Jan 2022 14:00:13 GMT
Server: Apache
ETag: "9034c6-22b48-5d67c9edc114a"
Vary: Accept-Encoding
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=3453
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: text/javascript
Content-Length: 39661
Expires: Wed, 26 Jan 2022 15:00:14 GMT

GET
H2 200 ron.torstar.js Show response
hb.districtm.io/prod/101918/ 36 KB
13 KB 109ms
55ms Script
application/javascript 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.districtm.io/prod/101918/ron.torstar.js
Requested by: Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 27beeba23682336597600e18159da8ff6bb418008f46b6ad7b6a790585105986

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:41 GMT
via: 1.1 995664ee945c06fc706b5cb8e0e650dc.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 6528
x-cache: Miss from cloudfront
cf-bgj: minify
content-encoding: br
last-modified: Thu, 10 Dec 2020 20:41:04 GMT
server: cloudflare
etag: W/"4cc0ea4602b93de3e4b78bd1246a5245"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=43200
x-amz-cf-pop: SEA19-C1
cf-ray: 6d3a47c89d20f97d-YYZ
x-amz-cf-id: MpdTbwhUZTCDSvcXYAmCZ4Hbc7bWSkF1XUDC89hSi5Aopd_lq0T-KA==
expires: Thu, 27 Jan 2022 02:02:41 GMT

GET
H2 200 moatcontent.js Show response
z.moatads.com/torontocontentstarcontent37863992/ 165 KB
54 KB 29ms
21ms Script
application/x-javascript 23.41.169.149
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/torontocontentstarcontent37863992/moatcontent.js
Requested by: Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.41.169.149 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-41-169-149.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: d85850c885fe92574f866d77f638250a2747c691aa7f537b4922e28b368cd51a

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:41 GMT
content-encoding: gzip
last-modified: Mon, 24 Aug 2020 17:22:35 GMT
server: AmazonS3
x-amz-request-id: DB6930A7D4C7ED9E
etag: "491121b0fb1268b17bdb2c53880291f2"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=47261
accept-ranges: bytes
content-length: 54912
x-amz-id-2: nZph3UHwPcajm9C8FqN0XdUMh5siUw0Qy+b/JNip4Kp6vtU22sPdXD9z5Xl61fYDClBOdsFUmic=

GET
H2 200 material-icons-base-400-normal.woff2
www.thestar.com/static/assets/ 101 KB
102 KB 56ms
55ms Font
font/woff2 99.84.42.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thestar.com/static/assets/material-icons-base-400-normal.woff2?v=fe7e45c2

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/static/72.css?v=74364c882dc7d0ac22e2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.42.91 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-42-91.ewr52.r.cloudfront.net

Software

Apache/2.4.52 (Unix) OpenSSL/1.1.1k / Express

Resource Hash

53e47f0803e3983ae0b26db5f39e87c0bfd327981749c02c9e2f955341e34d7b

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.thestar.com/static/72.css?v=74364c882dc7d0ac22e2
Origin: https://www.thestar.com
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:41 GMT
via: 1.1 fc07a3272275b95dac262d5ece1fcdf8.cloudfront.net (CloudFront)
age: 92
x-powered-by: Express
x-cache: Hit from cloudfront
content-length: 103852
last-modified: Wed, 19 Jan 2022 21:41:50 GMT
server: Apache/2.4.52 (Unix) OpenSSL/1.1.1k
etag: W/"195ac-17e7449f130"
x-frame-options: SAMEORIGIN
content-type: font/woff2
access-control-allow-origin: https://amp.thestar.com
cache-control: max-age=300
x-amz-cf-pop: EWR52-C4
accept-ranges: bytes
x-amz-cf-id: E6M0D_HFwQuIK3Qs6dVdaDZcShQFJ3nIetOJ7eQqzq0-PRQMez04Rw==

GET
H2 200 star-icons.ttf
www.thestar.com/static/ 21 KB
11 KB 41ms
41ms Font
font/ttf 99.84.42.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thestar.com/static/star-icons.ttf?203c50bac89a39e0ae4f2cca3d0d56d4

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/static/72.css?v=74364c882dc7d0ac22e2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.42.91 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-42-91.ewr52.r.cloudfront.net

Software

Apache/2.4.52 (Unix) OpenSSL/1.1.1k / Express

Resource Hash

cfe210b9b960e92d867cb501ba3cb9b03c4c66b816dd2427566bed986fb1c00f

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.thestar.com/static/72.css?v=74364c882dc7d0ac22e2
Origin: https://www.thestar.com
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:41 GMT
content-encoding: gzip
age: 94
x-powered-by: Express
x-cache: Hit from cloudfront
access-control-allow-origin: https://amp.thestar.com
last-modified: Wed, 19 Jan 2022 21:41:50 GMT
server: Apache/2.4.52 (Unix) OpenSSL/1.1.1k
x-frame-options: SAMEORIGIN
etag: W/"5254-17e7449f130"
vary: Accept-Encoding
content-type: font/ttf
via: 1.1 fc07a3272275b95dac262d5ece1fcdf8.cloudfront.net (CloudFront)
cache-control: max-age=300
x-amz-cf-pop: EWR52-C4
x-amz-cf-id: HG-9dlW6dW-KICz58ONJgAQaSJruSYY1KrQoNE-AK-vBV6Oa-Xyz4g==

GET
H2 200 adsct
t.co/i/ 43 B
335 B 164ms
62ms Image
image/gif 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=nuz9l&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=f2c88bab-34dc-4ab4-819f-2dd0b05fcc3f&tw_document_href=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-response-time: 7
date: Wed, 26 Jan 2022 14:02:41 GMT
server: tsa_b
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 324e401e889ef817433039c44007b96d3fbcdb1cd3b4bd02761ceeb09eaeff60
content-length: 43

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 99 KB
26 KB 81ms
17ms Script
application/x-javascript 2a03:2880:f012:10c:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

c55508ea7ce1ad08364772fbfadb835d2b1d1b9238d345c45eee1943ada4ff6f

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length: 26237
x-xss-protection: 0
pragma: public
x-fb-debug: OuJ3QO47mySvsQWJKFdlcQZ6a9ExOdP3llZef+yR6COSrNntHDBd3sq2/syA/Ai9vgxQkdYhJpwB8uIHg4IeEQ==
x-fb-trip-id: 2050670934
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Wed, 26 Jan 2022 14:02:41 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 beacon.js Show response
sb.scorecardresearch.com/ 1 KB
1 KB 59ms
19ms Script
application/javascript 13.226.31.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.scorecardresearch.com/beacon.js
Requested by: Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.31.20 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-31-20.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 13:58:56 GMT
content-encoding: gzip
etag: W/"1827f116c73f319409b97f10b8a58ade"
last-modified: Fri, 26 Feb 2021 14:35:05 GMT
server: AmazonS3
age: 15260
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 0a84c1b70b100e694edd23e638bf7fa8.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR53-C2
x-amz-cf-id: kn1UW1xw7HnlQhil1m3LtUWW8RXSS554msefPpppoIZnbb8IJSE7gg==

GET
H/1.1 200
OK /
d1nxn87txdj54y.cloudfront.net/ 43 B
524 B 141ms
84ms Image
image/gif 13.226.39.10
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d1nxn87txdj54y.cloudfront.net/?a=40727dc8cfba4185b5b471b11fed6eb9
Requested by: Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.39.10 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-39-10.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 26 Jan 2022 14:02:42 GMT
Via: 1.1 0f37773e2cce4ff7a5301ebabb04538a.cloudfront.net (CloudFront)
Last-Modified: Mon, 22 Apr 2013 19:31:32 GMT
Server: AmazonS3
X-Amz-Cf-Pop: EWR53-C2
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
X-Cache: RefreshHit from cloudfront
Content-Type: image/gif
Cache-Control: no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
X-Amz-Cf-Id: FYwC3A2_GufbSraBNku6psnyJBIWPRg_mcpzPFc3hBvdMdUtguwZgg==

GET
H/1.1 200
OK p.js Show response
d1z2jf7jlzjs58.cloudfront.net/ 930 B
1 KB 68ms
17ms Script
application/javascript 13.33.81.146
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1z2jf7jlzjs58.cloudfront.net/p.js
Requested by: Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.81.146 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-33-81-146.ewr52.r.cloudfront.net
Software: nginx /
Resource Hash: 62f586be8571b23584eb4a60a45a3157ff7c8388b1b1e3b4e8890e243b3e47de

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 26 Jan 2022 06:45:48 GMT
Via: 1.1 d13d8a0a456d6aa0acf023a1e3acb2be.cloudfront.net (CloudFront)
Age: 26213
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 930
Pragma: public
Last-Modified: Wed, 06 May 2020 20:19:48 GMT
Server: nginx
ETag: "5eb31be4-3a2"
Content-Type: application/javascript
Cache-Control: max-age=86400, public
X-Amz-Cf-Pop: EWR52-C1
Accept-Ranges: bytes
X-Amz-Cf-Id: 8HMVVP-KRhxESiltW97bfUfBdgKQ3dw-yhLQx-Y5JF40tWjMxqzn5A==
Expires: Thu, 27 Jan 2022 06:45:48 GMT

GET
H2 200 q9fqmmutk5a97trs-nbc.js Show response
cdn.petametrics.com/ 157 KB
46 KB 90ms
27ms Script
application/javascript 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.petametrics.com/q9fqmmutk5a97trs-nbc.js?ts=456446
Requested by: Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 87e3314fa5f650d537089a1858ef876765aabbbf6aec26de82fb48f80c35b4ce

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:41 GMT
content-encoding: gzip
last-modified: Tue, 23 Nov 2021 05:03:21 GMT
server: AmazonS3
x-amz-request-id: YCART8FDCMBFJMM2
etag: "84c846f02beac40f327ee7c0dcd7817e"
x-hw: 1643205761.cds053.dc2.hn,1643205761.cds182.dc2.c
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400, s-maxage=31536000
content-length: 46531
accept-ranges: bytes
x-amz-version-id: wH1m93aADVE2Owp75TDLlh1vUqJ5LR5b
x-amz-id-2: QC1BL7nZs8yqrNDB9sH6T3lAYv6I4iqwLQwVsP4yEm3Z2p6UR6PtJdOseYrU1PQ9mJsb2rVKq8E=

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 134 KB
36 KB 76ms
19ms Script
application/javascript 143.204.137.197
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.137.197 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-137-197.ewr52.r.cloudfront.net
Software: Server /
Resource Hash: c7360a9b46fde11845b3090ca0034fb409d92398a71f3ae15fac3a2fa29ae6cc

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-amz-version-id: geSt9cz1lsAtYP61GkP_lJF1zC5l7T_2
content-encoding: gzip
etag: a89a0f9aa62d9c46ee287cd1f0b6423d
age: 60759
x-cache: Hit from cloudfront
server: Server
x-amz-rid: 1SAAGK56FYPE2Y3TXRYJ
date: Tue, 25 Jan 2022 21:10:02 GMT
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 b078462cffa3a81b6e262ef7f6040412.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: EWR52-C2
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: sPpukpj65PMCBhEX7FzzZHno1DfVu7kwjr59uQN6Bw5dMKW8ea5oiQ==

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
457 B 149ms
49ms Script
application/javascript 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=nuz9l&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=f2c88bab-34dc-4ab4-819f-2dd0b05fcc3f&tw_document_href=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&tpx_cb=twttr.conversion.loadPixels

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/oct.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-response-time: 9
date: Wed, 26 Jan 2022 14:02:41 GMT
content-encoding: gzip
server: tsa_b
strict-transport-security: max-age=631138519
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0
x-connection-hash: cdb996ee132922af2a754a34e3101a60a08ddf58cbe2321fbfa4bab1c7759903
content-type: application/javascript;charset=utf-8
content-length: 57

GET
H3 200 worker-70faafffa0475802f5ee03ca5ff74179.js Show response
dev.visualwebsiteoptimizer.com/analysis/ 47 KB
13 KB 80ms
66ms XHR
application/javascript 34.96.102.137
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/analysis/worker-70faafffa0475802f5ee03ca5ff74179.js
Requested by: Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/analysis/4.0/opa-608d8314e5c4b9c6caefe04b8ad484ca.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gnv1 /
Resource Hash: e916478d94814b1a0c2680424c323db0514f4a022d16835cd7bcc754722308f4

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:41 GMT
content-encoding: br
last-modified: Wed, 26 Jan 2022 13:27:55 GMT
server: gnv1
etag: "61f14c5b-351f"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13599
via: 1.1 google

GET 220106406818247
form.jotform.com/jsform/ Frame 2D85 0
0

POST
H2 200 159 Show response
e377.thestar.com/DG/DEFAULT/rest/rpc/ 49 KB
9 KB 32ms
31ms XHR
application/json 99.84.125.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://e377.thestar.com/DG/DEFAULT/rest/rpc/159?referer=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&bcsessionid=&bctempid=&overruleReferrer=&time=2022-01-26T14%3A02%3A41%2B00%3A00&ts=1643205761479

Requested by

Host: e377.thestar.com
URL: https://e377.thestar.com/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.125.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-125-59.ewr52.r.cloudfront.net

Software

- /

Resource Hash

2d4905abac6646552652568b8199976a4fea4098ebf9126d41da554902f1da05

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.thestar.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 26 Jan 2022 14:02:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: EWR52-C3
x-cache: Miss from cloudfront
p3p: policyref="", CP="DSP"
content-length: 8201
x-xss-protection: 1; mode=block
pragma: no-cache
access-control-allow-origin: https://www.thestar.com
server: -
content-type: application/json; charset=utf-8
via: 1.1 c1c976b1b60b605adb44f62da9e0bb8a.cloudfront.net (CloudFront)
cache-control: no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
x-amz-cf-id: yvjlUvWHfw1e2E3QALzlOdXwl_yrRCdbYy95ULn1Gbp3AAOn6o1iBw==
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 451 identity Show response
api.rlcdn.com/api/ 0
253 B 91ms
44ms XHR
text/plain 34.120.155.137
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.rlcdn.com/api/identity?pid=2&rt=envelope
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/181778-254412191205210.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.155.137 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 137.155.120.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.thestar.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Wed, 26 Jan 2022 14:02:41 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: https://www.thestar.com
access-control-allow-credentials: true
access-control-allow-headers: Accept, Authorization, Content-Type, Cookie, Origin, X-Requested-With
content-length: 0

GET
H2 200 rid Show response
match.adsrvr.org/track/ 109 B
544 B 75ms
24ms XHR
application/json 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=casale&fmt=json&p=181778
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/181778-254412191205210.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: c2063881a851c763485fce5ef18fb40175ed4d14367815bb66e8d2d1989b4b3a

Request headers

Referer: https://www.thestar.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Wed, 26 Jan 2022 14:02:41 GMT
x-aspnet-version: 4.0.30319
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.thestar.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 109
expires: Fri, 25 Feb 2022 14:02:41 GMT

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 79 KB
27 KB 86ms
39ms Script
text/javascript 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/static/bundle.js?v=5e46e0cb

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

776083d5db69f039483812ca84197495adbbd0bc69de4e967bf201d3c0e625ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27058
x-xss-protection: 0
server: sffe
etag: "1113 / 398 of 1000 / last-modified: 1643198680"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 26 Jan 2022 14:02:41 GMT

GET
H2 200 breakingnews Show response
www.thestar.com/api/alerts/ 19 B
420 B 18ms
18ms XHR
application/json 99.84.42.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thestar.com/api/alerts/breakingnews

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/static/vendors~bundle.chunk.js?v=e27c5c32

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.42.91 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-42-91.ewr52.r.cloudfront.net

Software

Apache/2.4.52 (Unix) OpenSSL/1.1.1k / Express

Resource Hash

b3abab8c0524b6f876d36f99aedd1fb14317c2e3758d2bdf093362d458f6f199

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:01:27 GMT
via: 1.1 fc07a3272275b95dac262d5ece1fcdf8.cloudfront.net (CloudFront)
server: Apache/2.4.52 (Unix) OpenSSL/1.1.1k
age: 74
x-powered-by: Express
etag: W/"13-Ke/+pN/k0l2LXDxWablmwTVvPYs"
x-frame-options: SAMEORIGIN
x-cache: Hit from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: https://amp.thestar.com
cache-control: max-age=180
x-amz-cf-pop: EWR52-C4
content-length: 19
x-amz-cf-id: 0cg_BoFkM5VtdRjFFTW8X6mME7M-3N5JXIR4paW_9RPl4WHVYBcilA==

GET
H2 200 updates Show response
www.thestar.com/api/alerts/ 19 B
420 B 19ms
18ms XHR
application/json 99.84.42.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thestar.com/api/alerts/updates

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/static/vendors~bundle.chunk.js?v=e27c5c32

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.42.91 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-42-91.ewr52.r.cloudfront.net

Software

Apache/2.4.52 (Unix) OpenSSL/1.1.1k / Express

Resource Hash

b3abab8c0524b6f876d36f99aedd1fb14317c2e3758d2bdf093362d458f6f199

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:01:27 GMT
via: 1.1 fc07a3272275b95dac262d5ece1fcdf8.cloudfront.net (CloudFront)
server: Apache/2.4.52 (Unix) OpenSSL/1.1.1k
age: 74
x-powered-by: Express
etag: W/"13-Ke/+pN/k0l2LXDxWablmwTVvPYs"
x-frame-options: SAMEORIGIN
x-cache: Hit from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: https://amp.thestar.com
cache-control: max-age=180
x-amz-cf-pop: EWR52-C4
content-length: 19
x-amz-cf-id: Hhdi28lCnuUs2uYuw9-cpPVa_7nXAylRnwlCBVvmMjT6L7HfCxzkVA==

GET
H2 200 all-home-0-default-default.json Show response
www.thestar.com/ts/api/trending/ 19 KB
19 KB 19ms
19ms XHR
application/octet-stream 99.84.42.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.thestar.com/ts/api/trending/all-home-0-default-default.json
Requested by: Host: www.thestar.com
URL: https://www.thestar.com/static/vendors~bundle.chunk.js?v=e27c5c32
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.42.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-42-91.ewr52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 69ae5b8ad4472b900290fbd0a5cb90813eedcd0f9f364badd2236eb9ae622b96

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-amz-version-id: oN0FFGcI7ag7tdZVJ7PlXYnzf52seZnB
via: 1.1 fc07a3272275b95dac262d5ece1fcdf8.cloudfront.net (CloudFront)
last-modified: Wed, 26 Jan 2022 13:52:27 GMT
server: AmazonS3
age: 63
etag: "a981c38ab6cf3b59802f83174c8fcde7"
x-cache: Hit from cloudfront
content-type: application/octet-stream
date: Wed, 26 Jan 2022 14:01:39 GMT
x-amz-cf-pop: EWR52-C4
accept-ranges: bytes
content-length: 18949
x-amz-cf-id: -HZtX1RSKk26tLbk9cO2IjgTTUfZSCkkdoBJVdks8nfW9HCnLy98Hw==

GET
H2 200 articles Show response
www.thestar.com/api/ 41 KB
10 KB 20ms
20ms XHR
application/json 99.84.42.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thestar.com/api/articles?type=top

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/static/vendors~bundle.chunk.js?v=e27c5c32

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.42.91 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-42-91.ewr52.r.cloudfront.net

Software

Apache/2.4.52 (Unix) OpenSSL/1.1.1k / Express

Resource Hash

23d33ed5ec9e53a9ee4e4b65c9b53755c6dc806e7faf661c41aec564c7f30fef

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:23 GMT
content-encoding: gzip
etag: W/"a2ec-ubJa7jfakeYtPfiQsaZw56lg0XI"
server: Apache/2.4.52 (Unix) OpenSSL/1.1.1k
age: 18
x-frame-options: SAMEORIGIN
x-powered-by: Express
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: https://amp.thestar.com
cache-control: max-age=180
x-amz-cf-pop: EWR52-C4
x-amz-cf-id: LeCIQPK9X495vvmm6zvCTTbCfhWmmH18mkFkE0r0LE2-6BsKIWO0TQ==
via: 1.1 fc07a3272275b95dac262d5ece1fcdf8.cloudfront.net (CloudFront)

GET
H2 200 cac4d831d2a84342261874732c6d088c Show response
e377.thestar.com/plugin/plugin/ 191 KB
42 KB 22ms
22ms Script
text/javascript 99.84.125.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://e377.thestar.com/plugin/plugin/cac4d831d2a84342261874732c6d088c

Requested by

Host: e377.thestar.com
URL: https://e377.thestar.com/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.125.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-125-59.ewr52.r.cloudfront.net

Software

- /

Resource Hash

9b3f8f4f322b5b7c3fa18a87e5193818dab66fa8f89af5d0b5bd0839a95adcd3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 25 Jan 2022 19:07:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
age: 68084
x-cache: Hit from cloudfront
p3p: policyref="", CP="DSP"
content-length: 42267
x-xss-protection: 1; mode=block
last-modified: Mon, 24 Jan 2022 19:07:57 GMT
server: -
etag: cac4d831d2a84342261874732c6d088c
content-type: text/javascript; charset=utf-8
via: 1.1 c1c976b1b60b605adb44f62da9e0bb8a.cloudfront.net (CloudFront)
cache-control: public, no-cache="Set-Cookie", max-age=31536000
x-amz-cf-pop: EWR52-C3
x-robots-tag: noindex, nofollow
x-amz-cf-id: 5_RpmYFwunVZ3HKla1Yxs6LyuBR_MvlWKBnwZ19VMF9NCc_lgMvjUQ==
expires: Wed, 25 Jan 2023 19:07:57 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 66ms
20ms Script
text/javascript 2607:f8b0:4006:81e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P86MZHL&gtm_auth=6lA8dG63UaQ5ed3gQljsjQ&gtm_preview=env-2&gtm_cookies_win=x

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 4902
date: Wed, 26 Jan 2022 12:40:59 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Wed, 26 Jan 2022 14:40:59 GMT

GET
H2

200

web-vitals.umd.js Show response
unpkg.com/web-vitals@2.1.4/dist/
Redirect Chain

https://unpkg.com/web-vitals
https://unpkg.com/web-vitals@2.1.4
https://unpkg.com/web-vitals@2.1.4/dist/web-vitals.umd.js

5 KB
2 KB

27ms
25ms

Script
application/javascript

2606:4700::6810:7caf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://unpkg.com/web-vitals@2.1.4/dist/web-vitals.umd.js

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Server

2606:4700::6810:7caf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

52cac1193a3683e35353723a38e01a9bcc0c5f9bf2be42d29c96905527c7923d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:42 GMT
via: 1.1 fly.io
x-content-type-options: nosniff
cf-cache-status: HIT
age: 474597
fly-request-id: 01FSX6GNMHG61XC2EVA2S5CEWB
content-encoding: br
vary: Accept-Encoding
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
server: cloudflare
etag: W/"120b-0F8cYs4ysxGP6ebngBlASGivDqM"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6d3a47cd2f4e714b-YUL

Redirect headers

date: Wed, 26 Jan 2022 14:02:42 GMT
via: 1.1 fly.io
x-content-type-options: nosniff
cf-cache-status: HIT
fly-request-id: 01FSX6HZMM34P8FW25PGXYVGD6
server: cloudflare
age: 474554
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: text/plain; charset=utf-8
location: /web-vitals@2.1.4/dist/web-vitals.umd.js
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 6d3a47ccdeee714b-YUL
access-control-allow-origin: *

GET
H2

204

b2
sb.scorecardresearch.com/
Redirect Chain

https://sb.scorecardresearch.com/b?c1=2&c2=3005674&ns__t=1643205761901&ns_c=UTF-8&cv=3.5&c8=NORTON%20ROSE%20FULBRIGHT%3A%20Enjoy%20complimentary%20Saturday%20Star%20Home%20Delivery%20with%20digital...
https://sb.scorecardresearch.com/b2?c1=2&c2=3005674&ns__t=1643205761901&ns_c=UTF-8&cv=3.5&c8=NORTON%20ROSE%20FULBRIGHT%3A%20Enjoy%20complimentary%20Saturday%20Star%20Home%20Delivery%20with%20digita...

0
225 B

25ms
25ms

Image
text/plain

13.226.31.20
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/b2?c1=2&c2=3005674&ns__t=1643205761901&ns_c=UTF-8&cv=3.5&c8=NORTON%20ROSE%20FULBRIGHT%3A%20Enjoy%20complimentary%20Saturday%20Star%20Home%20Delivery%20with%20digital%20access%20or%20Digital%20Access%20only%20%7C%20The%20Star&c7=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&c9=
Requested by: Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Protocol: H2
Server: 13.226.31.20 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-31-20.ewr53.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:42 GMT
via: 1.1 0a84c1b70b100e694edd23e638bf7fa8.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR53-C2
etag: W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"
x-amz-cf-id: 53g7YODVsI4fTVMe2uJlXuOCQqVllW1ECl7nSbXVyXCxzrypYNaY-g==
x-cache: Miss from cloudfront

Redirect headers

date: Wed, 26 Jan 2022 14:02:41 GMT
via: 1.1 0a84c1b70b100e694edd23e638bf7fa8.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR53-C2
vary: Accept
x-cache: Miss from cloudfront
content-type: text/plain; charset=utf-8
location: https://sb.scorecardresearch.com/b2?c1=2&c2=3005674&ns__t=1643205761901&ns_c=UTF-8&cv=3.5&c8=NORTON%20ROSE%20FULBRIGHT%3A%20Enjoy%20complimentary%20Saturday%20Star%20Home%20Delivery%20with%20digital%20access%20or%20Digital%20Access%20only%20%7C%20The%20Star&c7=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&c9=
content-length: 372
x-amz-cf-id: WajZv7SGT3MeXLG2RHmrj_7-Aji6dlCx9Usdisylhbn8G5e7RLMcvg==

GET
H2 200 index.html Show response
cdn.districtm.io/ids/ Frame AA86 116 B
313 B 52ms
40ms Document
text/html 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.districtm.io/ids/index.html
Requested by: Host: hb.districtm.io
URL: https://hb.districtm.io/prod/101918/ron.torstar.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f752ad8cf812a358129aac3fd9784b0baf6f19899eb49116f08a1afab1fa133e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/

Response headers

date: Wed, 26 Jan 2022 14:02:41 GMT
content-type: text/html
cf-ray: 6d3a47cc1b35f97d-YYZ
age: 22468
last-modified: Thu, 20 May 2021 02:18:27 GMT
via: 1.1 81f44da9c25150028cb0a201880d21ae.cloudfront.net (CloudFront)
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-amz-cf-id: obSL5Kd8GNz_hkJBnAaK3Tobep_noEaObF8KaAcm5kltOgln6rWKog==
x-amz-cf-pop: YTO50-C3
x-cache: Hit from cloudfront
vary: Accept-Encoding
server: cloudflare
content-encoding: br

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
205 B 86ms
73ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/b/v1

Requested by

Host: hb.districtm.io
URL: https://hb.districtm.io/prod/101918/ron.torstar.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.thestar.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 26 Jan 2022 14:02:41 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: origin, Accept-Encoding
access-control-allow-methods: OPTIONS, POST
access-control-allow-origin: https://www.thestar.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 6d3a47cc1b3af97d-YYZ
access-control-allow-headers: origin, content-type

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 387 B
1 KB 338ms
78ms XHR
application/json 34.210.248.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=5.3.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=19A568F454F72DAF0A4C98A6%40AdobeOrg&d_nsid=0&ts=1643205762007

Requested by

Host: resources.thestar.com
URL: https://resources.thestar.com/launch-EN5e55511c260e4c0cb05872ba3729b255.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.210.248.36 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-210-248-36.us-west-2.compute.amazonaws.com

Software

Resource Hash

71824f15db54e51d373424315230faff0acab475cd1a062a1830ef7366942052

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.thestar.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-usw2-2-v024-0879ff322.edge-usw2.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: bBbfysTpScI=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.thestar.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 326
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 AppMeasurement.min.js Show response
resources.thestar.com/cf7f3d5747a0/cb6b77270cd8/605968dbcb7f/hostedLibFiles/EPb56e12d7054b4acea984e91c910051cc/ 33 KB
12 KB 19ms
18ms Script
text/javascript 13.225.63.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.thestar.com/cf7f3d5747a0/cb6b77270cd8/605968dbcb7f/hostedLibFiles/EPb56e12d7054b4acea984e91c910051cc/AppMeasurement.min.js
Requested by: Host: resources.thestar.com
URL: https://resources.thestar.com/launch-EN5e55511c260e4c0cb05872ba3729b255.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.63.104 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-63-104.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 04d439e000eb278a036c741b3a0b3ddb4b22087ff0bbb9342a6be5dc7d1ab60a

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 13:32:27 GMT
content-encoding: gzip
last-modified: Wed, 26 Jan 2022 13:31:43 GMT
server: AmazonS3
age: 1816
etag: W/"820eb42f3120ddf65e303b24a8285815"
vary: Accept-Encoding
x-cache: Hit from cloudfront
x-amz-version-id: h3NnFdeA1f9ZFVdQA4JLNkpuabA3iFZV
via: 1.1 e2ddb156cdc225570ee247c2aefc938e.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR53-C1
content-type: text/javascript
x-amz-cf-id: Dgk-7EWwsmlBOg1Io1nV6hxjAJYNPbwRsaELVXpZpabuhVcyoE-I8w==

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
resources.thestar.com/cf7f3d5747a0/cb6b77270cd8/605968dbcb7f/hostedLibFiles/EPb56e12d7054b4acea984e91c910051cc/ 3 KB
2 KB 20ms
20ms Script
text/javascript 13.225.63.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.thestar.com/cf7f3d5747a0/cb6b77270cd8/605968dbcb7f/hostedLibFiles/EPb56e12d7054b4acea984e91c910051cc/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: resources.thestar.com
URL: https://resources.thestar.com/launch-EN5e55511c260e4c0cb05872ba3729b255.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.63.104 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-63-104.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 99affd7a1c868ecf15a0789fc85e87ca23ae783e7916aee316e6282d9777369c

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 13:32:27 GMT
content-encoding: gzip
last-modified: Wed, 26 Jan 2022 13:31:43 GMT
server: AmazonS3
age: 1816
etag: W/"abbe69e5c8f385f00652c3d0c2bba347"
vary: Accept-Encoding
x-cache: Hit from cloudfront
x-amz-version-id: 2CgiCoLwyWbSUlCjb.YD32d.x14pqd8K
via: 1.1 e2ddb156cdc225570ee247c2aefc938e.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR53-C1
content-type: text/javascript
x-amz-cf-id: 9fK48c11t96rNgmALJiScspa-KGO1rk7p8fVR0kaxhWWDPyeEu7qUA==

GET
H2 200 p.js Show response
cdn.parsely.com/keys/thestar.com/ 73 KB
26 KB 59ms
20ms Script
application/javascript 13.226.25.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.parsely.com/keys/thestar.com/p.js
Requested by: Host: d1z2jf7jlzjs58.cloudfront.net
URL: https://d1z2jf7jlzjs58.cloudfront.net/p.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.25.39 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-25-39.ewr53.r.cloudfront.net
Software: nginx /
Resource Hash: 54ecac46ec4e41cab653a43dc1b9b094a1195bbfe300fd2b5ca791168c3dcae3

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: public
date: Tue, 25 Jan 2022 20:00:28 GMT
content-encoding: gzip
last-modified: Wed, 19 Jan 2022 19:03:50 GMT
server: nginx
age: 64934
etag: W/"61e86096-12236"
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 45a2ed7d71b913b3658a34b14cb3cc86.cloudfront.net (CloudFront)
cache-control: max-age=86400, public
x-amz-cf-pop: EWR53-C2
x-amz-cf-id: tYiNL7i7u3njby1b67lI2rHxZgTN02-wlasXAIXUWXpLd2Xm3D-b5A==
expires: Wed, 26 Jan 2022 20:00:28 GMT

GET
H2 204 config Show response
c.amazon-adsystem.com/cdn/prod/ 0
311 B 17ms
17ms XHR
text/plain 143.204.137.197
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=5028&u=https%3A%2F%2Fwww.thestar.com
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.137.197 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-137-197.ewr52.r.cloudfront.net
Software: Server /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 12:58:03 GMT
via: 1.1 b078462cffa3a81b6e262ef7f6040412.cloudfront.net (CloudFront)
server: Server
age: 3878
x-cache: Hit from cloudfront
access-control-allow-origin: https://www.thestar.com
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
x-amz-cf-pop: EWR52-C2
x-amz-cf-id: 8GRofgVMXHjT4RORhQt1sipjEA6vLFqy3ocIVSMpVQNHLgjlvzRt8g==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 54ms
17ms XHR
application/javascript 143.204.137.197
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.137.197 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-137-197.ewr52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 02:57:20 GMT
content-encoding: gzip
vary: Accept-Encoding,Origin
age: 39923
x-cache: Hit from cloudfront
access-control-allow-origin: *
last-modified: Fri, 21 Jan 2022 02:54:57 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: eaU6ir6qmGswM2SGRmLi7PKhBcBrRdvn
via: 1.1 81834769243dfd27a095a32cf5b86722.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: EWR52-C2
content-type: application/javascript
x-amz-cf-id: 7uNRZUSTTA0b51Oc6WAbL0E9lIa36AGaqmw5JZLWQZCHko5OprFj7g==

GET
H2 200 __activity.gif
query.petametrics.com/v3/q9fqmmutk5a97trs/bc8d10ba-d37a-4195-968e-892d5ffe5c12/ 35 B
175 B 83ms
56ms Image
image/gif 35.190.14.224
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://query.petametrics.com/v3/q9fqmmutk5a97trs/bc8d10ba-d37a-4195-968e-892d5ffe5c12/__activity.gif?e=pageview&ct=Sponsored+%7C+NORTON+ROSE+FULBRIGHT%3A+Enjoy+complimentary+Saturday+Star+Home+Delivery+with+digital+access+or+Digital+Access+only&ccu=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&tspl=1642&blst=897&ist=1632&iet=1640&bdst=898&bdet=1095&bcttt=14&jsfv=nbc&ts=1643205762093&jsk=q9fqmmutk5a97trs&jsv=20211122&cu=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&uid=bc8d10ba-d37a-4195-968e-892d5ffe5c12&sid=58c11ba5-8125-4232-ccc6-ee35c98f349a&pvid=7ee61243-50c9-4cf4-f627-e09d040e4a48&ua=Mozilla%2F5.0+(Windows+NT+10.0%3B+Win64%3B+x64)+AppleWebKit%2F537.36+(KHTML%2C+like+Gecko)+Chrome%2F97.0.4692.71+Safari%2F537.36&l=en-US&os=Linux+x86_64&cet=4g&crtt=-1&cdl=10&saveData=false&ctyp=unknown&tzo=0&sdk=bc-pixel
Requested by: Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.14.224 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 224.14.190.35.bc.googleusercontent.com
Software: openresty/1.13.6.2 /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 26 Jan 2022 14:02:42 GMT
via: 1.1 google
server: openresty/1.13.6.2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
content-type: image/gif

GET
H/1.1 200
OK services Show response
sr.studiostack.com/v3/ 24 KB
24 KB 345ms
41ms Script
application/x-javascript 20.49.104.19
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.studiostack.com/v3/services
Requested by: Host: adserver.pressboard.ca
URL: https://adserver.pressboard.ca/v3/embedder?media=130507
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.49.104.19 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 2c920092a8bfebe9b51a94ca573807f4e38de67289b06013c954f4743dff5cc7

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 26 Jan 2022 14:02:41 GMT
Access-Control-Allow-Methods: GET, POST, OPTIONS, HEAD, PUT
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Expires: 0
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Content-Length: 24454
request-context: appId=cid-v1:c374023b-8354-459d-b51b-039919730c2c

GET
H2 200 220106406818247 Show response
form.jotform.com/jsform/ Frame 56AE 36 KB
9 KB 42ms
41ms Script
text/javascript 35.201.118.58
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://form.jotform.com/jsform/220106406818247
Requested by: Host: srcdoc
URL: about:srcdoc
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.118.58 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 58.118.201.35.bc.googleusercontent.com
Software: CacheX v2.1 /
Resource Hash: 1433f4f745ede48da1ce2bacdd82721a8b2ca9ed3edad5efa507e59edf5289ce

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:42 GMT
content-encoding: gzip
cache-hit: 1
server: CacheX v2.1
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-cache
alt-svc: clear
via: 1.1 google
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 mdc.textfield.min.js Show response
e377.thestar.com/plugins/toolbar_whatcounts/ts_d3dd9500cca2bd121600d736b16f4f6c/frontend/src/scripts/ 66 KB
12 KB 21ms
21ms Script
text/javascript 99.84.125.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://e377.thestar.com/plugins/toolbar_whatcounts/ts_d3dd9500cca2bd121600d736b16f4f6c/frontend/src/scripts/mdc.textfield.min.js

Requested by

Host: e377.thestar.com
URL: https://e377.thestar.com/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.125.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-125-59.ewr52.r.cloudfront.net

Software

- /

Resource Hash

2d767fe00284ba315844a0f61f8f69721df84ca58781e8b960455fee618c9778

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 10 Sep 2021 03:12:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
age: 11962229
x-cache: Hit from cloudfront
p3p: policyref="", CP="DSP"
content-length: 11561
x-xss-protection: 1; mode=block
last-modified: Thu, 09 Sep 2021 03:12:13 GMT
server: -
etag: 6255d33f94b82e67e60ed3d71ba26fe3
content-type: text/javascript; charset=utf-8
via: 1.1 c1c976b1b60b605adb44f62da9e0bb8a.cloudfront.net (CloudFront)
cache-control: public, no-cache="Set-Cookie", max-age=31536000
x-amz-cf-pop: EWR52-C3
x-robots-tag: noindex, nofollow
x-amz-cf-id: 2JS4AY2OIV3V51Xbreyi44Tv4WA_3jlketFIv6YC7LP4SQvwnK_TEg==
expires: Sat, 10 Sep 2022 03:12:13 GMT

GET
H2 200 51f58fc90ed7e88ea89eb825e5b785fc Show response
e377.thestar.com/plugin/library/ 463 KB
148 KB 19ms
19ms Script
text/javascript 99.84.125.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://e377.thestar.com/plugin/library/51f58fc90ed7e88ea89eb825e5b785fc

Requested by

Host: e377.thestar.com
URL: https://e377.thestar.com/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.125.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-125-59.ewr52.r.cloudfront.net

Software

- /

Resource Hash

a32864919f884a41f1c9ddca9e8b12da54017b7d4a80e888db92bdd453a0d963

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 19:21:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
age: 1795250
x-cache: Hit from cloudfront
p3p: policyref="", CP="DSP"
content-length: 150391
x-xss-protection: 1; mode=block
last-modified: Tue, 04 Jan 2022 19:21:52 GMT
server: -
etag: 51f58fc90ed7e88ea89eb825e5b785fc
content-type: text/javascript; charset=utf-8
via: 1.1 c1c976b1b60b605adb44f62da9e0bb8a.cloudfront.net (CloudFront)
cache-control: public, no-cache="Set-Cookie", max-age=31536000
x-amz-cf-pop: EWR52-C3
x-robots-tag: noindex, nofollow
x-amz-cf-id: iAoYxESit4Z2WxmeFZKffztFImBLUHDowuQwanMe6U8AeXtMKNhkwQ==
expires: Thu, 05 Jan 2023 19:21:52 GMT

POST
H2 200 LB-Zone-1 Show response
e377.thestar.com/DG/DEFAULT/rest/rpc/159/ 2 KB
2 KB 69ms
68ms XHR
application/json 99.84.125.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://e377.thestar.com/DG/DEFAULT/rest/rpc/159/LB-Zone-1?referer=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&bcsessionid=&bctempid=577e82e5-7a36-4085-9532-1930d371ab2b&overruleReferrer=&time=2022-01-26T14%3A02%3A42%2B00%3A00&ts=1643205762111

Requested by

Host: e377.thestar.com
URL: https://e377.thestar.com/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.125.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-125-59.ewr52.r.cloudfront.net

Software

- /

Resource Hash

046ff6f854bf54aea753da921e703c5a8eb91e52ddda852f7ac18f8cec09ebf8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.thestar.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 26 Jan 2022 14:02:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: EWR52-C3
x-cache: Miss from cloudfront
p3p: policyref="", CP="DSP"
content-length: 888
x-xss-protection: 1; mode=block
pragma: no-cache
access-control-allow-origin: https://www.thestar.com
server: -
content-type: application/json; charset=utf-8
via: 1.1 c1c976b1b60b605adb44f62da9e0bb8a.cloudfront.net (CloudFront)
cache-control: no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
x-amz-cf-id: qAPegjKiczB9YVCI63kEBcp2LgXVFcSffRcEEHvT23w9kXGYJGWJIA==
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 idsync.d5cb6b96.js Show response
cdn.districtm.io/ids/ Frame AA86 3 KB
2 KB 35ms
35ms Script
application/javascript 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.districtm.io/ids/idsync.d5cb6b96.js
Requested by: Host: cdn.districtm.io
URL: https://cdn.districtm.io/ids/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aebd50af0cd8da2f314a52e2088788775d1a441bd674ef9379578e7bc1b5ad50

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/ids/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:42 GMT
via: 1.1 a20436c6d109fe9002d093f519ad4399.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 127618
cf-polished: origSize=3302
x-cache: Hit from cloudfront
cf-bgj: minify
content-encoding: br
last-modified: Thu, 20 May 2021 02:18:27 GMT
server: cloudflare
etag: W/"74ede07ef946dc2316f86b2661cf2dd3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=172800
x-amz-cf-pop: IAD89-C2
cf-ray: 6d3a47cd4d37f97d-YYZ
x-amz-cf-id: 1eRSpWhdVAkBadFJp4F5rFN7MnzWD6LrYuBkp7TuCOeRux1TRVDlcg==
expires: Fri, 28 Jan 2022 14:02:42 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 63ms
34ms XHR
text/plain 2607:f8b0:4006:81e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=385159083&t=pageview&_s=1&dl=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&ul=en-us&de=UTF-8&dt=NORTON%20ROSE%20FULBRIGHT%3A%20Enjoy%20complimentary%20Saturday%20Star%20Home%20Delivery%20with%20digital%20access%20or%20Digital%20Access%20only%20%7C%20The%20Star&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAAABAAAAAC~&jid=2117780674&gjid=1505338978&cid=1142013295.1643205762&tid=UA-70431129-1&_gid=125428799.1643205762&_r=1&gtm=2wg1o0P86MZHL&cd9=web&cd14=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F97.0.4692.71%20Safari%2F537.36&z=1890672938

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.thestar.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:42 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.thestar.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 53ms
33ms XHR
text/plain 2607:f8b0:4006:81e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=385159083&t=pageview&_s=1&dl=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&ul=en-us&de=UTF-8&dt=NORTON%20ROSE%20FULBRIGHT%3A%20Enjoy%20complimentary%20Saturday%20Star%20Home%20Delivery%20with%20digital%20access%20or%20Digital%20Access%20only%20%7C%20The%20Star&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEDAAAABAAAAAC~&jid=1423872519&gjid=1071087301&cid=1142013295.1643205762&tid=UA-73335503-3&_gid=125428799.1643205762&_r=1&gtm=2wg1o0P86MZHL&z=759256050

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81e::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.thestar.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:42 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.thestar.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubads_impl_2022011002.js Show response
securepubads.g.doubleclick.net/gpt/ 352 KB
119 KB 71ms
19ms Script
text/javascript 142.251.40.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011002.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s39-in-f2.1e100.net

Software

sffe /

Resource Hash

e87e542e34fc3af7847f53ae5c258f82ff2d8739646ed8d249c9a54ede9f7128

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 06:54:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 25681
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 121009
x-xss-protection: 0
last-modified: Mon, 10 Jan 2022 21:10:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 26 Jan 2023 06:54:41 GMT

GET
H2 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 203 B
766 B 89ms
38ms XHR
application/json 142.251.40.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.thestar.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s39-in-f2.1e100.net

Software

cafe /

Resource Hash

5cb58980d85cf281723d540bba89bab8667e9929132da9cf516b39cbf6afb4c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 26 Jan 2022 14:02:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 130
x-xss-protection: 0
expires: Wed, 26 Jan 2022 14:02:42 GMT

GET
H2 200 5e6b428acc8c4e222d1beb91.css
cdn01.jotfor.ms/themes/CSS/ Frame 5D2C 202 KB
36 KB 124ms
71ms Stylesheet
text/css 2606:4700:20::ac43:49b8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn01.jotfor.ms/themes/CSS/5e6b428acc8c4e222d1beb91.css?
Requested by: Host: form.jotform.com
URL: https://form.jotform.com/jsform/220106406818247
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:49b8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bb029bb9408d25cd51359856c56d0ab8a14121f654757aabb313b366764a6686

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:42 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-security-policy-report-only: default-src https: data: blob: wss: 'unsafe-inline' 'unsafe-eval'; report-uri /opt/csp-violation-report.php
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
content-encoding: br
pragma: no-cache
last-modified: Wed, 26 Jan 2022 14:02:42 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Kd0pZjH2BErs05kZpQNB2%2Be0IqjkKhQkLxzmMDl0kJw8xs4mNmiNzh3%2F9pC9mdunwbfAA6A3Pws6%2Fxl9R%2FYqHILfHBl%2BoaDoiTgGSGblI1qZOkosJJQ88yEKJO009XuDqND0UMgjGqfA6fii3A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css;charset=UTF-8
cache-control: no-cache
x-form-cache: MISS-APP
cf-ray: 6d3a47ce0af67136-YUL
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 payment_styles.css
cdn02.jotfor.ms/css/styles/payment/ Frame 5D2C 75 KB
12 KB 117ms
64ms Stylesheet
text/css 2606:4700:20::ac43:49b8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn02.jotfor.ms/css/styles/payment/payment_styles.css?3.3.30290
Requested by: Host: form.jotform.com
URL: https://form.jotform.com/jsform/220106406818247
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:49b8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7c83d8a33e5c560ed77f4c04f0238ec3ecad5b838104c844b7f42b10342c95d3

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

cf-ray: 6d3a47ce083f4bbe-YUL
date: Wed, 26 Jan 2022 14:02:42 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
last-modified: Thu, 20 Jan 2022 07:18:13 GMT
server: cloudflare
etag: W/"61e90cb5-12deb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8Tr6v%2F0ulNpX8RS5Okzl9VMRZFmHYQkoQi9YDu15NzW12XTOY6CKWaN6Ibur4GXiXYj5SAE90chOsK%2Bgjq1HZI1tNYw0hwhKtyaMlzBANrN9q7KG%2Be8Y8hWLHjjS67RvLMR7k5zfjIDhdaieow%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=315360000, public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 payment_feature.css
cdn03.jotfor.ms/css/styles/payment/ Frame 5D2C 43 KB
8 KB 113ms
60ms Stylesheet
text/css 2606:4700:20::681a:686
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn03.jotfor.ms/css/styles/payment/payment_feature.css?3.3.30290
Requested by: Host: form.jotform.com
URL: https://form.jotform.com/jsform/220106406818247
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:686 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4d23d35ef196077142ffcc5a4557a98e5a0b3dc1ba7432d103efcd5aa5bb138d

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

cf-ray: 6d3a47ce0da1ca67-YUL
date: Wed, 26 Jan 2022 14:02:42 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
last-modified: Tue, 07 Dec 2021 08:02:30 GMT
server: cloudflare
etag: W/"61af1516-aba9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fqi%2F5NxLNrZOEh7hdX55pXgxHDe5R%2BCcPte4WQVEeanQpf0wgDZw3%2BsgNB%2BC%2FyOVNugRLho1ynDQG0EWlLeLbbmLI9uwd4fvM%2BaCIot2I0qFPbiYXQh7Z7uGYpny5u9D3sTao62DC5d0qhJIQw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=315360000, public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 prototype.forms.js Show response
cdn01.jotfor.ms/static/ Frame 5D2C 126 KB
35 KB 119ms
66ms Script
application/x-javascript 2606:4700:20::ac43:49b8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn01.jotfor.ms/static/prototype.forms.js
Requested by: Host: form.jotform.com
URL: https://form.jotform.com/jsform/220106406818247
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:49b8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2a767bbec1a4ac999a027520af58a654b74e2e54f6af0960b46384f00b550481

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

cf-ray: 6d3a47ce0af97136-YUL
date: Wed, 26 Jan 2022 14:02:42 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
last-modified: Wed, 26 Jan 2022 13:50:10 GMT
server: cloudflare
etag: W/"61f15192-1f947"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UOm6ctzRz3Sty5JpBQj%2FNmc9ePbE%2BaXYzKZghCiy8Cv%2BQtbiADfzGZABwWdWcVWB7L1sg3wnIcoLJRwmognzQAWWtdLXqqW8HKuy9RcisirOx92PRMbxJ%2FUfldrZYoaTVftZopOIyIMJ6lIIsA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
cache-control: no-cache, public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 jotform.forms.js Show response
cdn02.jotfor.ms/static/ Frame 5D2C 527 KB
140 KB 137ms
85ms Script
application/x-javascript 2606:4700:20::ac43:49b8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn02.jotfor.ms/static/jotform.forms.js?3.3.30290
Requested by: Host: form.jotform.com
URL: https://form.jotform.com/jsform/220106406818247
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:49b8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9043405e2f76688f3c01c480555dfd1c453fdcd6508319991c926e65b9d124d9

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

cf-ray: 6d3a47ce08414bbe-YUL
date: Wed, 26 Jan 2022 14:02:42 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
last-modified: Wed, 26 Jan 2022 13:50:10 GMT
server: cloudflare
etag: W/"61f15192-83b82"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3dtnifbCg%2FfZfonBCljFXlFMRU8TOR7oglS2lyqnnnn3tBBz3sgWcbjlG1%2B78jHmHdxDv4irfV3MivpEA4TfKzFujNVu1j3e7quuxPQno8gKRbZ1iBmr60diC6bfx6PPgMkSYin0yMQvcWWwMA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
cache-control: no-cache, public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 punycode.js Show response
cdnjs.cloudflare.com/ajax/libs/punycode/1.4.1/ Frame 5D2C 14 KB
5 KB 65ms
23ms Script
application/javascript 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/punycode/1.4.1/punycode.js

Requested by

Host: form.jotform.com
URL: https://form.jotform.com/jsform/220106406818247

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

48e6d618b95c55074ab9b47a6e7bd966c9fd434b874e2c2e2606c5ec0f992982

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 6031620
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4177
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:15:40 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03fac-394e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cPcG%2BoznbLk5%2FxOJflPI71XZAlj3DEBqvgp4c3mTQur%2Bkk31u2prQbIUiHOZe1etO%2BK8p5h1vMUoN5xbAx3QWB4c9J82eOrIx1Tu7FefDkg7WT7cDfR7ST3BP9ef%2Bom3VgzPXavGjygpIxFrRdBOvTMJ"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6d3a47cdfa1a7154-YUL
expires: Mon, 16 Jan 2023 14:02:42 GMT

GET
H2 200 jquery-1.8.0.min.js Show response
cdn03.jotfor.ms/js/vendor/ Frame 5D2C 91 KB
34 KB 116ms
65ms Script
application/x-javascript 2606:4700:20::681a:686
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn03.jotfor.ms/js/vendor/jquery-1.8.0.min.js?v=3.3.30290
Requested by: Host: form.jotform.com
URL: https://form.jotform.com/jsform/220106406818247
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:686 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 163afcf9152c411190e29bb5595f6873816972adbe66e178f9fb6f43e07ad91e

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:42 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
x-static: 2
last-modified: Tue, 07 Dec 2021 08:02:30 GMT
server: cloudflare
etag: W/"61af1516-16dd9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TSl%2B0xXoJ8cglFO9MOvdpkmx5WTfo4cZLnnxFl%2B7vQrQbqIxLNW8okMpWIYksy%2BL7rkdkUQQiPcwKN1MSUANody8XZFtkHZMmi3vh3ml8S%2Fz9ur7%2FoJjrzy9WpnKdWgWweR8VWuOcv6KEfMzfw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
cache-control: no-cache
cf-ray: 6d3a47ce0da2ca67-YUL
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 maskedinput.min.js Show response
cdn01.jotfor.ms/js/vendor/ Frame 5D2C 92 KB
28 KB 118ms
67ms Script
application/x-javascript 2606:4700:20::ac43:49b8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn01.jotfor.ms/js/vendor/maskedinput.min.js?v=3.3.30290
Requested by: Host: form.jotform.com
URL: https://form.jotform.com/jsform/220106406818247
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:49b8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8cf597f90b8dea903f8bd2caa32e7a8ca9b220c2a2d28a1a70d14a46e2dce11a

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:42 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
x-static: 2
last-modified: Thu, 30 Dec 2021 12:59:49 GMT
server: cloudflare
etag: W/"61cdad45-16e87"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IDhYsVA0sNXCyBmbqwnkaW006t7ZBuCNiNkRcEadoV9dwOXVHz70mz%2BSMmG7HYhuuh2Z0dcjjnyJX7S9%2BZKWaERwM36qgs2dkw0KpsfBEld0s6lNBRlr9muSt2PyDovMh%2FfTMrIaXImdd7u39w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
cache-control: no-cache
cf-ray: 6d3a47ce0afa7136-YUL
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 jquery.maskedinput.min.js Show response
cdn02.jotfor.ms/js/vendor/ Frame 5D2C 4 KB
2 KB 119ms
68ms Script
application/x-javascript 2606:4700:20::ac43:49b8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn02.jotfor.ms/js/vendor/jquery.maskedinput.min.js?v=3.3.30290
Requested by: Host: form.jotform.com
URL: https://form.jotform.com/jsform/220106406818247
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:49b8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f3e4a06f8518d0b05c817c35ab157d8f171674c4c96144db765d15fd2870900a

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:42 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
x-static: 2
last-modified: Tue, 07 Dec 2021 08:02:30 GMT
server: cloudflare
etag: W/"61af1516-1124"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=G3YacPeEYuW3W95V%2BpNi8vuS1LIt6DB6iWxj3oEjOFp01GaFxhH8YKV7Npj79SP3s6qAwAZADs4PeCN9OWqyl4dfzi9CXOdf1IN%2FCWe37zpqm2V7JRimv0x8CzpKNxWLGu6u8C0I1jNs71%2FiSg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
cache-control: no-cache
cf-ray: 6d3a47ce08424bbe-YUL
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 smoothscroll.min.js Show response
cdn.jotfor.ms//js/vendor/ Frame 5D2C 5 KB
3 KB 124ms
63ms Script
application/x-javascript 2606:4700:20::681a:686
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.jotfor.ms//js/vendor/smoothscroll.min.js?v=3.3.30290
Requested by: Host: form.jotform.com
URL: https://form.jotform.com/jsform/220106406818247
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:686 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 49176b244de4b07d2a8a79cd8663a2fced053acc22b1807929521665d09f3e3a

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:42 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
x-static: 2
last-modified: Tue, 07 Dec 2021 08:02:30 GMT
server: cloudflare
etag: W/"61af1516-13c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NLgdgLB7o2Dzs52X%2FAeRCLcehnai%2BL27oxPEQO7ZE0niTXuvT7aDCyCb198F8fpTY0vjqoCVV1ajLYj9FjJIE5GZYWlIrhtPCu5ka1O5ZXepvhCfZarq08QdJ4Nf%2F9PS4pQlPjuQ3%2Fsm5iM%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
cache-control: no-cache
cf-ray: 6d3a47ce1ac67139-YUL
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 errorNavigation.js Show response
cdn.jotfor.ms//js/ Frame 5D2C 6 KB
2 KB 125ms
64ms Script
application/x-javascript 2606:4700:20::681a:686
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.jotfor.ms//js/errorNavigation.js?v=3.3.30290
Requested by: Host: form.jotform.com
URL: https://form.jotform.com/jsform/220106406818247
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:686 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6386a77fe21e1406592d82339e40a525295b5a3f389ee8832376b13773112400

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:42 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
x-static: 2
last-modified: Mon, 10 Jan 2022 07:06:00 GMT
server: cloudflare
etag: W/"61dbdad8-1693"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jCb5STY6kzFivgA3%2FlVXBZJjpl%2FWkRijmU%2B%2Bt39UiaYv1%2BlrD7%2BS67MaQs7QVEuMHxs3BijR0v9Eq7ceu%2Fl1IV3wiTGDXid%2BB8wmVM%2F1Ka2rQxoFOkPmUd9GxWO7RvWijkqT9qvcCnIDaoE%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
cache-control: no-cache
cf-ray: 6d3a47ce1ac87139-YUL
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 buyers Show response
dmx.districtm.io/s/v1/ Frame AA86 635 B
798 B 79ms
78ms XHR
application/json 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/s/v1/buyers

Requested by

Host: cdn.districtm.io
URL: https://cdn.districtm.io/ids/idsync.d5cb6b96.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bb2a058ef665ad543aa4f39aaa339534d6bede84617e637e85298e845a2f6bce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:42 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: DELETE, GET, OPTIONS, POST
content-type: application/json
access-control-allow-origin: https://cdn.districtm.io
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 6d3a47cdcdf5f97d-YYZ
access-control-allow-headers: Origin, Content-Type

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
439 B 124ms
51ms XHR
text/plain 2607:f8b0:4023:1404::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-70431129-1&cid=1142013295.1643205762&jid=2117780674&gjid=1505338978&_gid=125428799.1643205762&_u=YEBAAAAAAAAAAC~&z=1587762162

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4023:1404::9c Columbus, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.thestar.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Wed, 26 Jan 2022 14:02:42 GMT
content-type: text/plain
access-control-allow-origin: https://www.thestar.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 159 Show response
e377.thestar.com/DG/DEFAULT/rest/rpc/ 3 KB
3 KB 103ms
101ms XHR
application/json 99.84.125.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://e377.thestar.com/DG/DEFAULT/rest/rpc/159?referer=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&bcsessionid=577e82e5-7a36-4085-9532-1930d371ab2b&bctempid=&overruleReferrer=&time=2022-01-26T14%3A02%3A42%2B00%3A00&ts=1643205762234

Requested by

Host: e377.thestar.com
URL: https://e377.thestar.com/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.125.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-125-59.ewr52.r.cloudfront.net

Software

- /

Resource Hash

aaa9be8950626f7ddaab3a34bf3ce7a213ab3d592490879345177bf635089bf0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.thestar.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 26 Jan 2022 14:02:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: EWR52-C3
x-cache: Miss from cloudfront
p3p: policyref="", CP="DSP"
content-length: 1610
x-xss-protection: 1; mode=block
pragma: no-cache
access-control-allow-origin: https://www.thestar.com
server: -
content-type: application/json; charset=utf-8
via: 1.1 c1c976b1b60b605adb44f62da9e0bb8a.cloudfront.net (CloudFront)
cache-control: no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
x-amz-cf-id: xQvCeEJfbz8pzCWfrgBgxdh3Po4UwF1HQbpdA7ocA71PN-lo9dEWXQ==
expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H2 200 159 Show response
e377.thestar.com/DG/DEFAULT/rest/rpc/ 369 B
1 KB 76ms
75ms XHR
application/json 99.84.125.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://e377.thestar.com/DG/DEFAULT/rest/rpc/159?referer=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&bcsessionid=577e82e5-7a36-4085-9532-1930d371ab2b&bctempid=&overruleReferrer=&time=2022-01-26T14%3A02%3A42%2B00%3A00&ts=1643205762253

Requested by

Host: e377.thestar.com
URL: https://e377.thestar.com/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.125.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-125-59.ewr52.r.cloudfront.net

Software

- /

Resource Hash

78ebbfd435720d8bf86585473506389f98cb639207589f6280d1a9a141df866d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.thestar.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 26 Jan 2022 14:02:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: EWR52-C3
x-cache: Miss from cloudfront
p3p: policyref="", CP="DSP"
content-length: 175
x-xss-protection: 1; mode=block
pragma: no-cache
access-control-allow-origin: https://www.thestar.com
server: -
content-type: application/json; charset=utf-8
via: 1.1 c1c976b1b60b605adb44f62da9e0bb8a.cloudfront.net (CloudFront)
cache-control: no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
x-amz-cf-id: gA2WGRqy_NKZTT8SG9JZsRw69l4iBxMG9pZcXMKxp6sa8S7vppm1PA==
expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H2 200 159 Show response
e377.thestar.com/DG/DEFAULT/rest/rpc/ 185 B
1 KB 92ms
91ms XHR
application/json 99.84.125.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://e377.thestar.com/DG/DEFAULT/rest/rpc/159?referer=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&bcsessionid=577e82e5-7a36-4085-9532-1930d371ab2b&bctempid=&overruleReferrer=&time=2022-01-26T14%3A02%3A42%2B00%3A00&ts=1643205762254

Requested by

Host: e377.thestar.com
URL: https://e377.thestar.com/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.125.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-125-59.ewr52.r.cloudfront.net

Software

- /

Resource Hash

1e74a5d864922eeebc4a67c92658e7b78a7bafc674fc7c4425d5b97ffc76dc5a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.thestar.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 26 Jan 2022 14:02:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: EWR52-C3
x-cache: Miss from cloudfront
p3p: policyref="", CP="DSP"
content-length: 166
x-xss-protection: 1; mode=block
pragma: no-cache
access-control-allow-origin: https://www.thestar.com
server: -
content-type: application/json; charset=utf-8
via: 1.1 c1c976b1b60b605adb44f62da9e0bb8a.cloudfront.net (CloudFront)
cache-control: no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
x-amz-cf-id: msNTeDJificD5_06z1-f3N05qfSlxRE2m3_yiFFVlf80QYcHMXta9w==
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 cs Show response
torstar.blueconic.net/DG/DEFAULT/ 66 B
860 B 25ms
24ms Script
text/javascript 35.174.252.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://torstar.blueconic.net/DG/DEFAULT/cs?bcsessionid=577e82e5-7a36-4085-9532-1930d371ab2b&&callback=bc_json161

Requested by

Host: e377.thestar.com
URL: https://e377.thestar.com/script.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.174.252.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-174-252-231.compute-1.amazonaws.com

Software

- /

Resource Hash

b1246a60434515e315bdbfe6b797b7cf1af383f58046a9799ea024e89fe5fc2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: -
x-robots-tag: noindex, nofollow
p3p: policyref="", CP="DSP"
x-permitted-cross-domain-policies: master-only
cache-control: no-cache, no-store, no-transform, must-revalidate, private
content-type: text/javascript; charset=utf-8
content-length: 86
x-xss-protection: 1; mode=block
expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H2 200 159 Show response
e377.thestar.com/DG/DEFAULT/rest/rpc/ 185 B
1 KB 83ms
83ms XHR
application/json 99.84.125.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://e377.thestar.com/DG/DEFAULT/rest/rpc/159?referer=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&bcsessionid=577e82e5-7a36-4085-9532-1930d371ab2b&bctempid=&overruleReferrer=&time=2022-01-26T14%3A02%3A42%2B00%3A00&ts=1643205762262

Requested by

Host: e377.thestar.com
URL: https://e377.thestar.com/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.125.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-125-59.ewr52.r.cloudfront.net

Software

- /

Resource Hash

40549bcca36cf054154743c855e0e25f7c34a77bd58809b62e1d037b17cfe661

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.thestar.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 26 Jan 2022 14:02:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-permitted-cross-domain-policies: master-only
x-amz-cf-pop: EWR52-C3
x-cache: Miss from cloudfront
p3p: policyref="", CP="DSP"
content-length: 166
x-xss-protection: 1; mode=block
pragma: no-cache
access-control-allow-origin: https://www.thestar.com
server: -
content-type: application/json; charset=utf-8
via: 1.1 c1c976b1b60b605adb44f62da9e0bb8a.cloudfront.net (CloudFront)
cache-control: no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
x-amz-cf-id: Gr_GfkyHu2-ZMB2tTR7UVcqcP4y4FOn0XJ3Yr9NtYIB1UskVaONrow==
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK /
p1.parsely.com/plogger/ 43 B
260 B 104ms
25ms Image
image/gif 54.144.144.142
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p1.parsely.com/plogger/?rand=1643205762287&plid=96461544&idsite=thestar.com&url=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&urlref=&screen=1600x1200%7C1600x1200%7C24&data=%7B%22_scrollIncrement%22%3A0%2C%22_scrollMethod%22%3A%22pageview%22%2C%22_y%22%3A0%2C%22_bodyHeight%22%3A4512%2C%22_trustBar%22%3A2123%7D&sid=1&surl=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&sref=&sts=1643205762170&slts=0&title=NORTON+ROSE+FULBRIGHT%3A+Enjoy+complimentary+Saturday+Star+Home+Delivery+with+digital+access+or+Digital+Access+only+%7C+The+Star&date=Wed+Jan+26+2022+14%3A02%3A42+GMT%2B0000+(GMT)&action=pageview&js=1&pvid=16499339&u=pid%3Dfbe81301c2fea280f1d4fad0829c1671
Requested by: Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.144.144.142 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-144-144-142.compute-1.amazonaws.com
Software: nginx /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 26 Jan 2022 14:02:42 GMT
Cache-Control: no-cache
Last-Modified: Wednesday, 26-Jan-2022 14:02:42 GMT
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2 200 ruleenginedata Show response
www.thestar.com/api/ 11 KB
3 KB 19ms
19ms XHR
application/json 99.84.42.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thestar.com/api/ruleenginedata

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/static/vendors~bundle.chunk.js?v=e27c5c32

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.42.91 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-42-91.ewr52.r.cloudfront.net

Software

Apache/2.4.52 (Unix) OpenSSL/1.1.1k / Express

Resource Hash

0aade1454de72aaab14b0ce231e3be92dffd5fe6ff7c1d97498612a0c377edd8

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 13:57:57 GMT
content-encoding: gzip
vary: Accept-Encoding
server: Apache/2.4.52 (Unix) OpenSSL/1.1.1k
age: 285
x-powered-by: Express
etag: W/"2c83-jMZzegW8UD3v7UAs7NiD0ygTxNQ"
x-frame-options: SAMEORIGIN
x-cache: Hit from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: https://amp.thestar.com
cache-control: max-age=180
x-amz-cf-pop: EWR52-C4
x-amz-cf-id: W4cqxDBWMIpkCN3v_QF6qlJGBo0jwu4OFtzFjpdEhVlLxkqutLtGjw==
via: 1.1 fc07a3272275b95dac262d5ece1fcdf8.cloudfront.net (CloudFront)

GET
H2

200

YfFUggABeNztqABH&_test=YfFUggABeNztqABH Show response
dmx.us-east-34.districtm.io/s/10016/ Frame AA86
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/1477?redir=https%3A//dmx.us-east-34.districtm.io/s/10016/$%7BTM_USER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/1477?redir=https%3A//dmx.us-east-34.districtm.io/s/10016/$%7BTM_USER_ID%7D&_test=YfFUggABeNztqABH
https://dmx.us-east-34.districtm.io/s/10016/YfFUggABeNztqABH&_test=YfFUggABeNztqABH

95 B
232 B

112ms
35ms

Script
application/javascript

34.73.194.24
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.us-east-34.districtm.io/s/10016/YfFUggABeNztqABH&_test=YfFUggABeNztqABH

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Server

34.73.194.24 North Charleston, United States, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

24.194.73.34.bc.googleusercontent.com

Software

Resource Hash

d155b999575e8cd4779daab89ad9bba91c3d0ab95ea3b6bab430f05b93c1f8a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:42 GMT
content-length: 95
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8

Redirect headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:42 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1643205762.410221,VS0,VE0
x-served-by: cache-yul12823-YUL
x-cache: HIT
location: https://dmx.us-east-34.districtm.io/s/10016/YfFUggABeNztqABH&_test=YfFUggABeNztqABH
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2

200

AAAGaE99fkrCyQNIDVpLAAAAAAA&expiration=1643292162&nuid=24EpmyGWp79d3iYyWltzQz4jsk1&is_secure=true Show response
dmx.us-east-34.districtm.io/s/10007/ Frame AA86
Redirect Chain

https://districtm-match.dotomi.com/match/bounce/current?version=1&networkId=33921&nuid=24EpmyGWp79d3iYyWltzQz4jsk1&rurl=//dmx.us-east-34.districtm.io/s/10007/
https://districtm-match.dotomi.com/match/bounce/current?DotomiTest=6485acaf3a99120c&is_secure=true&version=1&networkId=33921&nuid=24EpmyGWp79d3iYyWltzQz4jsk1&rurl=%2F%2Fdmx.us-east-34.districtm.io%...
https://dmx.us-east-34.districtm.io/s/10007/AAAGaE99fkrCyQNIDVpLAAAAAAA&expiration=1643292162&nuid=24EpmyGWp79d3iYyWltzQz4jsk1&is_secure=true

153 B
290 B

76ms
36ms

Script
application/javascript

34.73.194.24
GOOGLE-PRIVATE-CLOUD

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.us-east-34.districtm.io/s/10007/AAAGaE99fkrCyQNIDVpLAAAAAAA&expiration=1643292162&nuid=24EpmyGWp79d3iYyWltzQz4jsk1&is_secure=true

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Server

34.73.194.24 North Charleston, United States, ASN396982 (GOOGLE-PRIVATE-CLOUD, US),

Reverse DNS

24.194.73.34.bc.googleusercontent.com

Software

Resource Hash

2c39fecd7b1515602418dcb155b2f45bcd23b3b71c95c0d5b21c9f06c937cbac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:42 GMT
content-length: 153
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8

Redirect headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:42 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: //dmx.us-east-34.districtm.io/s/10007/AAAGaE99fkrCyQNIDVpLAAAAAAA&expiration=1643292162&nuid=24EpmyGWp79d3iYyWltzQz4jsk1&is_secure=true
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H2

200

642723330272 Show response
dmx.districtm.io/s/10022/ Frame AA86
Redirect Chain

https://ums.acuityplatform.com/tum?umid=137&rurl=https%3A%2F%2Fdmx.districtm.io%2Fs%2F10022%2F___AUID___
https://dmx.districtm.io/s/10022/642723330272

68 B
150 B

74ms
73ms

Script
application/javascript

104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/s/10022/642723330272

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Server

104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

473b0dcf052a646dc08b2f0d32f96ac6cb8ed5dfbdb215212c7cc8f97ff7dc46

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
date: Wed, 26 Jan 2022 14:02:42 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cf-ray: 6d3a47cf88caf97d-YYZ

Redirect headers

Access-Control-Allow-Origin: *
Content-Length: 0
Location: https://dmx.districtm.io/s/10022/642723330272

GET
H2

200

s0WRDZ573Zm9mQraswGZ Show response
dmx.districtm.io/s/10027/ Frame AA86
Redirect Chain

https://us.creativecdn.com/cm-notify?pi=districtm
https://us.creativecdn.com/cm-notify?pi=districtm&tc=1
https://dmx.districtm.io/s/10027/s0WRDZ573Zm9mQraswGZ?pi=districtm&tc=1

76 B
135 B

77ms
77ms

Script
application/javascript

104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/s/10027/s0WRDZ573Zm9mQraswGZ?pi=districtm&tc=1

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Server

104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

60338a45007e4d21670374bab19b7df2bde9acd957067c181a065263eeac77a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
date: Wed, 26 Jan 2022 14:02:42 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cf-ray: 6d3a47cfb90cf97d-YYZ

Redirect headers

location: https://dmx.districtm.io/s/10027/s0WRDZ573Zm9mQraswGZ?pi=districtm&tc=1
pragma: no-cache
date: Wed, 26 Jan 2022 14:02:42 GMT, Wed, 26 Jan 2022 14:02:42 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

23PzkFtNT9tscFmE9RkALZU4mbs Show response
dmx.districtm.io/s/10026/ Frame AA86
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=132
https://dmx.districtm.io/s/10026/23PzkFtNT9tscFmE9RkALZU4mbs

83 B
141 B

77ms
77ms

Script
application/javascript

104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/s/10026/23PzkFtNT9tscFmE9RkALZU4mbs

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Server

104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

503cb1783296b0f0af11e1761b11d57f89cab27954558c0dae6940943ca6eed7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://cdn.districtm.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
date: Wed, 26 Jan 2022 14:02:42 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cf-ray: 6d3a47cf88d3f97d-YYZ

Redirect headers

Location: https://dmx.districtm.io/s/10026/23PzkFtNT9tscFmE9RkALZU4mbs
Date: Wed, 26 Jan 2022 14:02:42 GMT
Connection: keep-alive
Content-Length: 83
Content-Type: text/html; charset=utf-8

GET
H2 404 2021-q1-shop-low Show response
www.thestar.com/api/overlaydatarule/ 178 B
582 B 19ms
19ms XHR
application/json 99.84.42.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thestar.com/api/overlaydatarule/2021-q1-shop-low

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/static/vendors~bundle.chunk.js?v=e27c5c32

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.42.91 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-42-91.ewr52.r.cloudfront.net

Software

Apache/2.4.52 (Unix) OpenSSL/1.1.1k / Express

Resource Hash

b8e8734d09cbff47f0afe26e91200cd19071e79647f718cd7b5c2ba16a13ebf7

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 13:59:51 GMT
via: 1.1 fc07a3272275b95dac262d5ece1fcdf8.cloudfront.net (CloudFront)
etag: W/"b2-DayMIL+sW45ETiP4eQTH7WZtEKg"
server: Apache/2.4.52 (Unix) OpenSSL/1.1.1k
age: 171
x-powered-by: Express
x-frame-options: SAMEORIGIN
x-cache: Error from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: https://amp.thestar.com
cache-control: max-age=180
x-amz-cf-pop: EWR52-C4
content-length: 178
x-amz-cf-id: knZFltsG3fU1jaITqJ5wxiRb4yeYzyBatAEpxcIZlwEqBrOvcLHP5w==

POST
H3 200 events Show response
api.permutive.com/v2.0/batch/ 101 B
132 B 110ms
97ms XHR
application/json 34.107.254.252
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.permutive.com/v2.0/batch/events?enrich=false&sdkp=true&k=025ad678-bf0a-4fe2-b383-8487592159bc
Requested by: Host: be54a597-6b6d-4e2d-9d31-642310a8db25.edge.permutive.app
URL: https://be54a597-6b6d-4e2d-9d31-642310a8db25.edge.permutive.app/be54a597-6b6d-4e2d-9d31-642310a8db25-web.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.107.254.252 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 252.254.107.34.bc.googleusercontent.com
Software: Permutive /
Resource Hash: e81ebf18c5f2590cb50e192f40aca6daf2d9d19ba826d6f016c9c00c3b63ef77

Request headers

Referer: https://www.thestar.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
content-type: text/plain

Response headers

date: Wed, 26 Jan 2022 14:02:42 GMT
content-encoding: gzip
server: Permutive
vary: Origin,Access-Control-Request-Method
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: https://www.thestar.com
access-control-expose-headers: *
access-control-allow-credentials: true
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 111
via: 1.1 google

GET
H/1.1 200
OK dest5.html Show response
torontostarnewspaperslimited.demdex.net/ Frame 3782 7 KB
3 KB 319ms
76ms Document
text/html 52.88.252.250
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://torontostarnewspaperslimited.demdex.net/dest5.html?d_nsid=0

Requested by

Host: resources.thestar.com
URL: https://resources.thestar.com/launch-EN5e55511c260e4c0cb05872ba3729b255.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.88.252.250 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-88-252-250.us-west-2.compute.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/

Response headers

Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
Content-Type: text/html;charset=UTF-8
date: Wed, 26 Jan 2022 14:02:42 GMT
DCS: dcs-prod-usw2-1-v024-003159ae9.edge-usw2.demdex.com UNKNOWN
Expires: Thu, 01 Jan 1970 00:00:00 UTC
last-modified: Thu, 20 Jan 2022 08:41:49 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
vary: accept-encoding
X-TID: PmR/r0RsQu4=
transfer-encoding: chunked
Connection: keep-alive

GET
H2 200 id Show response
s.thestar.com/ 48 B
508 B 277ms
80ms XHR
application/x-javascript 52.40.172.46
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.thestar.com/id?d_visid_ver=5.3.0&d_fieldgroup=A&mcorgid=19A568F454F72DAF0A4C98A6%40AdobeOrg&mid=29146150011500704841956147357525731429&ts=1643205762378

Requested by

Host: resources.thestar.com
URL: https://resources.thestar.com/launch-EN5e55511c260e4c0cb05872ba3729b255.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.40.172.46 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-40-172-46.us-west-2.compute.amazonaws.com

Software

jag /

Resource Hash

ace17341101ef0613bf776951455c946cf1bd7a9916e67deb171d360343a687c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.thestar.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Wed, 26 Jan 2022 14:02:42 GMT
x-content-type-options: nosniff
server: jag
xserver: anedge-74fcddc49f-2ldl9
vary: Origin
x-c: main-1585.I7afc85.M0-540
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://www.thestar.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript;charset=utf-8
content-length: 48
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=YfFUggAAAE3qCwQr
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=29182792948317073581956995184761942639
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YfFUggAAAE3qCwQr

42 B
945 B

84ms
84ms

Image
image/gif

34.210.248.36
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=YfFUggAAAE3qCwQr

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

HTTP/1.1

Server

34.210.248.36 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-210-248-36.us-west-2.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

DCS: dcs-prod-usw2-2-v024-0348b9809.edge-usw2.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: dCA4NdQGTlk=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=YfFUggAAAE3qCwQr
Date: Wed, 26 Jan 2022 14:02:42 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H2 200 overlaydata Show response
www.thestar.com/api/ 64 KB
12 KB 20ms
19ms XHR
application/json 99.84.42.91
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thestar.com/api/overlaydata

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/static/vendors~bundle.chunk.js?v=e27c5c32

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.42.91 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-42-91.ewr52.r.cloudfront.net

Software

Apache/2.4.52 (Unix) OpenSSL/1.1.1k / Express

Resource Hash

e3c7b3ec49bc0c4ce6840a3eaa580e5dbeb5a69ae074f9e88ceb572b8a2567f6

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Accept: application/json, text/plain, */*
Referer: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 13:59:48 GMT
content-encoding: gzip
vary: Accept-Encoding
server: Apache/2.4.52 (Unix) OpenSSL/1.1.1k
age: 174
x-powered-by: Express
etag: W/"fefe-bM9PQTVv+pM/pUilKAIOsrPtXuM"
x-frame-options: SAMEORIGIN
x-cache: Hit from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: https://amp.thestar.com
cache-control: max-age=180
x-amz-cf-pop: EWR52-C4
x-amz-cf-id: SJ7MiQm1487vD-QHV1QShxHoXxXCkKIcMpSO5RdCZALhk5_GNqjTsg==
via: 1.1 fc07a3272275b95dac262d5ece1fcdf8.cloudfront.net (CloudFront)

GET
DATA 200
OK truncated
/ Frame 5D2C 185 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 30abb3e0f8dc461f6e1a3e5d8ed0116d97a75e31343af1714188ca19c7fd7644

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
H2 200 Inter-Regular.woff2
cdn.jotfor.ms/fonts/inter/fonts/ Frame 5D2C 81 KB
81 KB 101ms
61ms Font
text/html 2606:4700:20::681a:686
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.jotfor.ms/fonts/inter/fonts/Inter-Regular.woff2
Requested by: Host: cdn01.jotfor.ms
URL: https://cdn01.jotfor.ms/themes/CSS/5e6b428acc8c4e222d1beb91.css?
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:686 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 257897a5abe39df95df7900e51d84f4de85877513337efdf2e97e0ef36622ae2

Request headers

Referer: https://cdn01.jotfor.ms/
Origin: https://www.thestar.com
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

cf-ray: 6d3a47cf8bc37145-YUL
date: Wed, 26 Jan 2022 14:02:42 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
last-modified: Tue, 07 Dec 2021 12:05:09 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CK7wGOJTQK3fFXXtafnaNccd888G0OgWkhY9b9a0PwBgX4bB%2FOSSaKl5MLHyTqc5wNjy4ZPTC%2FgtbLAgXTd6%2FPk%2Fk1%2FfrcJBmDUizqUEITQK7NTIOCE93Cj0odju67shSQ%2B84O9Lq2JlWOU%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
access-control-allow-origin: *
cache-control: no-cache, public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 Inter-SemiBold.woff2
cdn.jotfor.ms/fonts/inter/fonts/ Frame 5D2C 88 KB
87 KB 125ms
86ms Font
text/html 2606:4700:20::681a:686
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.jotfor.ms/fonts/inter/fonts/Inter-SemiBold.woff2
Requested by: Host: cdn01.jotfor.ms
URL: https://cdn01.jotfor.ms/themes/CSS/5e6b428acc8c4e222d1beb91.css?
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:686 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c5115d063f4f808fc2970e842ee45561e768b711d50d61cb59430b5a96247b28

Request headers

Referer: https://cdn01.jotfor.ms/
Origin: https://www.thestar.com
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

cf-ray: 6d3a47cf8bc67145-YUL
date: Wed, 26 Jan 2022 14:02:42 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
last-modified: Tue, 07 Dec 2021 12:05:09 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ExirkW4zZFzLwgyVgYjUHhPyTQQL3LhmKeKTQCwThNuhtsKV0NE%2FFLJqOhQ1j5p50zqAsR9%2B3lPSLvH7eU92quam7Vszb%2BloEe1OzM2l0sYw6D7HIfcTmp6Vw3KGKlVLkc6hFmbpdVLHRts%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
access-control-allow-origin: *
cache-control: no-cache, public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 Inter-Medium.woff2
cdn.jotfor.ms/fonts/inter/fonts/ Frame 5D2C 87 KB
87 KB 125ms
86ms Font
text/html 2606:4700:20::681a:686
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.jotfor.ms/fonts/inter/fonts/Inter-Medium.woff2
Requested by: Host: cdn01.jotfor.ms
URL: https://cdn01.jotfor.ms/themes/CSS/5e6b428acc8c4e222d1beb91.css?
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:686 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d541e3936c89d10117581b2153619b370ec875729e5bae24000c547d06090e15

Request headers

Referer: https://cdn01.jotfor.ms/
Origin: https://www.thestar.com
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

cf-ray: 6d3a47cf8bc87145-YUL
date: Wed, 26 Jan 2022 14:02:42 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
last-modified: Tue, 07 Dec 2021 12:05:09 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=i9XQz2m6VsNn34tGjoiMj5oXMEwbi6IFiwsfUipjhv8PsT2cBb8N7OSmDiXX4Mtmd4nrX0VOxo6pz%2F7R9vhM41d0gHkVNEW79xbUD6Cc320x0GlH0JLG9on3bwcVZta2ZpupGww2mWrl7Fc%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
access-control-allow-origin: *
cache-control: no-cache, public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 RC92631a6dea374f7f8c4e27bdaaf0a413-source.min.js Show response
resources.thestar.com/cf7f3d5747a0/cb6b77270cd8/605968dbcb7f/ 12 KB
5 KB 19ms
19ms Script
text/javascript 13.225.63.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.thestar.com/cf7f3d5747a0/cb6b77270cd8/605968dbcb7f/RC92631a6dea374f7f8c4e27bdaaf0a413-source.min.js
Requested by: Host: resources.thestar.com
URL: https://resources.thestar.com/launch-EN5e55511c260e4c0cb05872ba3729b255.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.63.104 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-63-104.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3b398752b22b0bc3f5bd5d8deec5f57f87d29d476d0e98c8aaebab7513e4cd4f

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 13:32:27 GMT
content-encoding: gzip
last-modified: Wed, 26 Jan 2022 13:31:43 GMT
server: AmazonS3
age: 1816
etag: W/"d75786e67143ae57609431bed070b13d"
vary: Accept-Encoding
x-cache: Hit from cloudfront
x-amz-version-id: Hh8eAp9SDddgrywkSrArslF6.EeYZf7p
via: 1.1 e2ddb156cdc225570ee247c2aefc938e.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR53-C1
content-type: text/javascript
x-amz-cf-id: Mn8Oz8xb127Kk1V83yvCJB7AiAlbAMPAiwE8fjrLLreUC5bPCE_O7g==

POST
H/1.1 200
OK attention-event Show response
sr.studiostack.com/track/ 0
396 B 33ms
31ms XHR
text/plain 20.49.104.19
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.studiostack.com/track/attention-event
Requested by: Host: sr.studiostack.com
URL: https://sr.studiostack.com/v3/services
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.49.104.19 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.thestar.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/json;charset=UTF-8

Response headers

Pragma: no-cache
Date: Wed, 26 Jan 2022 14:02:42 GMT
Access-Control-Allow-Methods: GET, POST, OPTIONS, HEAD, PUT
Access-Control-Allow-Origin: *
Expires: 0
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Content-Length: 0
request-context: appId=cid-v1:c374023b-8354-459d-b51b-039919730c2c

OPTIONS
H/1.1 200
OK attention-event
sr.studiostack.com/track/ Frame 0
0 118ms
29ms Preflight
text/html 20.49.104.19
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.studiostack.com/track/attention-event
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.49.104.19 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://www.thestar.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Allow: POST
Content-Length: 4
Content-Type: text/html; charset=utf-8
Expires: 0
ETag: W/"4-Yf+Bwwqjx254r+pisuO9HfpJ6FQ"
request-context: appId=cid-v1:c374023b-8354-459d-b51b-039919730c2c
Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Access-Control-Allow-Methods: GET, POST, OPTIONS, HEAD, PUT
Date: Wed, 26 Jan 2022 14:02:42 GMT

GET
H2 200 RC2c755b7ef3ef4f3882b1ae8279370b69-source.min.js Show response
resources.thestar.com/cf7f3d5747a0/cb6b77270cd8/605968dbcb7f/ 1 KB
1 KB 17ms
17ms Script
text/javascript 13.225.63.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.thestar.com/cf7f3d5747a0/cb6b77270cd8/605968dbcb7f/RC2c755b7ef3ef4f3882b1ae8279370b69-source.min.js
Requested by: Host: resources.thestar.com
URL: https://resources.thestar.com/launch-EN5e55511c260e4c0cb05872ba3729b255.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.63.104 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-63-104.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e6b51a277a3aef17a2d98430577d8d969f53370803a59592e44c46a14f91fef4

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 13:32:28 GMT
content-encoding: gzip
last-modified: Wed, 26 Jan 2022 13:31:43 GMT
server: AmazonS3
age: 1815
etag: W/"ff2cd09a3300937a3fe4606e5d1705e8"
vary: Accept-Encoding
x-cache: Hit from cloudfront
x-amz-version-id: eUElak_tbVmxe17xERiRhAevHHYCX4SJ
via: 1.1 e2ddb156cdc225570ee247c2aefc938e.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR53-C1
content-type: text/javascript
x-amz-cf-id: ytcorLg9HwoL9kM6IBSOTUM7SpGGSwImADsWNhFvoVkkL6zFEgV2XA==

GET
H/1.1 200
OK attention-data Show response
sr.studiostack.com/track/ 153 B
640 B 170ms
81ms XHR
application/json 20.49.104.19
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.studiostack.com/track/attention-data?media=130507&ref=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html
Requested by: Host: sr.studiostack.com
URL: https://sr.studiostack.com/v3/services
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.49.104.19 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 0b60c250ebdecf0f6c1098a8304ca46a7b20deccf0e6865e169a49dcdb590f6f

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 26 Jan 2022 14:02:42 GMT
ETag: W/"99-STVXWf+Ko67CmB24OLO/S5Rv0hY"
Access-Control-Allow-Methods: GET, POST, OPTIONS, HEAD, PUT
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Expires: 0
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Content-Length: 153
request-context: appId=cid-v1:c374023b-8354-459d-b51b-039919730c2c

GET
H3 200 549886031832745 Show response
connect.facebook.net/signals/config/ 305 KB
87 KB 40ms
19ms Script
application/x-javascript 2a03:2880:f012:10c:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/549886031832745?v=2.9.51&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

1e14a0ec1e855669dc3808b149b8cf9c63c115ba3f601c051a26d8b6b05d92ba

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length: 89031
x-xss-protection: 0
pragma: public
x-fb-debug: bY/6VQi+CV7CotoMt7WibIbb/KwOb3AkuCJeBi2z6aXTI6dKyWh0b7KCxAaGDfx0X67aKvOod2iej6ffKNdVzg==
x-frame-options: DENY
date: Wed, 26 Jan 2022 14:02:42 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 RC304342cd3a9f487980371091639a8dc3-source.min.js Show response
resources.thestar.com/cf7f3d5747a0/cb6b77270cd8/605968dbcb7f/ 813 B
1 KB 18ms
17ms Script
text/javascript 13.225.63.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.thestar.com/cf7f3d5747a0/cb6b77270cd8/605968dbcb7f/RC304342cd3a9f487980371091639a8dc3-source.min.js
Requested by: Host: resources.thestar.com
URL: https://resources.thestar.com/launch-EN5e55511c260e4c0cb05872ba3729b255.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.63.104 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-63-104.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b8927d9b7dcdd432392b97412a737a4589c5ec7485c5009a9720941647c2eb7e

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 13:32:28 GMT
via: 1.1 e2ddb156cdc225570ee247c2aefc938e.cloudfront.net (CloudFront)
last-modified: Wed, 26 Jan 2022 13:31:43 GMT
server: AmazonS3
age: 1815
etag: "8d05bf12f0b12b0fbf56ab2f9bb1a9d1"
x-cache: Hit from cloudfront
x-amz-version-id: DV5NHQGE2NwdiJJ8n3SgBHBesNr3_I82
x-amz-cf-pop: EWR53-C1
accept-ranges: bytes
content-type: text/javascript
content-length: 813
x-amz-cf-id: RkKAISYNEpkTZqZbcDztBzH4dqGsNcELHNbgHFfD7c2nAxbGVKnnvQ==

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 14 KB
5 KB 26ms
26ms Script
application/javascript 199.232.64.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.232.64.157 Ashburn, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4da3e3aa30b5b06390d7e7e3fcfb16d648909eb429d161c2748bd6d79a7ec5fb

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:42 GMT
content-encoding: gzip
last-modified: Thu, 16 Sep 2021 23:12:14 GMT
etag: "8dc11b7ca1d5ed9ec3b1ab1beb621c75+gzip+gzip"
vary: Accept-Encoding,Host
x-tw-cdn: FT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache
x-cache: HIT, HIT
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
content-length: 5410
x-served-by: cache-iad-kcgs7200107-IAD, cache-wdc5560-WDC

GET
H2 200 RC518669eb80134c629229b164ea843f63-source.min.js Show response
resources.thestar.com/cf7f3d5747a0/cb6b77270cd8/605968dbcb7f/ 2 KB
1 KB 18ms
18ms Script
text/javascript 13.225.63.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.thestar.com/cf7f3d5747a0/cb6b77270cd8/605968dbcb7f/RC518669eb80134c629229b164ea843f63-source.min.js
Requested by: Host: resources.thestar.com
URL: https://resources.thestar.com/launch-EN5e55511c260e4c0cb05872ba3729b255.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.63.104 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-63-104.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 65464aa39ed3fa1bc0c92afd3b67a1c45297705189b59a7db860137278c1de7e

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 13:32:29 GMT
content-encoding: gzip
last-modified: Wed, 26 Jan 2022 13:31:43 GMT
server: AmazonS3
age: 1814
etag: W/"05fdef5e4e82c3153e20d03c7c7e74a1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
x-amz-version-id: CAsm14IidmoYHhxaWzyyf8x2N.IAz4O2
via: 1.1 e2ddb156cdc225570ee247c2aefc938e.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR53-C1
content-type: text/javascript
x-amz-cf-id: aLCrKq5H7L4OASMt1rNoMe-GUyquyR8-9pSFlvbdmL4OSDeCK0bIAw==

POST
H2 204 users Show response
dmx.districtm.io/s/v1/ Frame AA86 0
556 B 73ms
72ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/s/v1/users

Requested by

Host: cdn.districtm.io
URL: https://cdn.districtm.io/ids/idsync.d5cb6b96.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://cdn.districtm.io/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 26 Jan 2022 14:02:42 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: DELETE, GET, OPTIONS, POST
access-control-allow-origin: https://cdn.districtm.io
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 6d3a47d13b32f97d-YYZ
access-control-allow-headers: Origin, Content-Type

OPTIONS
H2 204 users
dmx.districtm.io/s/v1/ Frame 0
0 117ms
70ms Preflight 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/s/v1/users

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://cdn.districtm.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Wed, 26 Jan 2022 14:02:42 GMT
cf-ray: 6d3a47d0cc394009-YYZ
access-control-allow-origin: https://cdn.districtm.io
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
access-control-allow-headers: Origin, Content-Type
access-control-allow-methods: DELETE, GET, OPTIONS, POST
access-control-max-age: 14400
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 97 KB
39 KB 78ms
50ms Script
application/javascript 2607:f8b0:4006:81f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-698108511

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f233da668d7c3ccfa794e982c4d12665f67c1e572c6396a8672fc0c8430a037d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:42 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39462
x-xss-protection: 0
last-modified: Wed, 26 Jan 2022 12:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 26 Jan 2022 14:02:42 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 87 KB
35 KB 61ms
34ms Script
application/javascript 2607:f8b0:4006:81f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-10230056

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b599a8df8f60d928de0574b54137aebe0638c4ef7f4930f3cd10cadd61014ea5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:42 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35782
x-xss-protection: 0
last-modified: Wed, 26 Jan 2022 12:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 26 Jan 2022 14:02:42 GMT

GET
H2 200 RC2f54281ab7324fd39f76106466b9b969-source.min.js Show response
resources.thestar.com/cf7f3d5747a0/cb6b77270cd8/605968dbcb7f/ 1 KB
1013 B 20ms
20ms Script
text/javascript 13.225.63.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.thestar.com/cf7f3d5747a0/cb6b77270cd8/605968dbcb7f/RC2f54281ab7324fd39f76106466b9b969-source.min.js
Requested by: Host: resources.thestar.com
URL: https://resources.thestar.com/launch-EN5e55511c260e4c0cb05872ba3729b255.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.63.104 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-63-104.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1e56b1a64dbd16a02a66360643e5b260c0cfeacc5cb7c0422b99064f3edb2951

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 13:32:29 GMT
content-encoding: gzip
last-modified: Wed, 26 Jan 2022 13:31:43 GMT
server: AmazonS3
age: 1814
etag: W/"9a55114b6a8a2d58b4b5d013234ce7c2"
vary: Accept-Encoding
x-cache: Hit from cloudfront
x-amz-version-id: RydCH4cLNpiCADOuJ3qNzwtXFMY7TTk2
via: 1.1 e2ddb156cdc225570ee247c2aefc938e.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR53-C1
content-type: text/javascript
x-amz-cf-id: m9yc78bp1oC5k2To22hXtEe-9ydC98Me4EIWYCRCSRyqhaFjY5R8nw==

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
93 B 48ms
47ms Script
application/javascript 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=nuz9l&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=be576fb7-e47b-448d-a425-b86167ea03ba&tw_document_href=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&tpx_cb=twttr.conversion.loadPixels

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-response-time: 6
date: Wed, 26 Jan 2022 14:02:41 GMT
content-encoding: gzip
server: tsa_b
strict-transport-security: max-age=631138519
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0
x-connection-hash: cdb996ee132922af2a754a34e3101a60a08ddf58cbe2321fbfa4bab1c7759903
content-type: application/javascript;charset=utf-8
content-length: 57

GET
H2 200 adsct
t.co/i/ 43 B
100 B 53ms
53ms Image
image/gif 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=nuz9l&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=be576fb7-e47b-448d-a425-b86167ea03ba&tw_document_href=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-response-time: 5
date: Wed, 26 Jan 2022 14:02:42 GMT
server: tsa_b
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 324e401e889ef817433039c44007b96d3fbcdb1cd3b4bd02761ceeb09eaeff60
content-length: 43

GET
H2 200 /
www.facebook.com/tr/ 44 B
407 B 66ms
18ms Image
image/gif 2a03:2880:f112:182:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=549886031832745&ev=PageView&dl=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&rl=&if=false&ts=1643205762670&sw=1600&sh=1200&v=2.9.51&r=stable&ec=0&o=30&fbp=fb.1.1643205762667.2117303762&it=1643205762560&coo=false&rqm=GET

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:42 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600
content-length: 44
expires: Wed, 26 Jan 2022 14:02:42 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
214 B 66ms
19ms Image
image/gif 2a03:2880:f112:182:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=549886031832745&ev=ViewContent&dl=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&rl=&if=false&ts=1643205762671&sw=1600&sh=1200&v=2.9.51&r=stable&ec=1&o=30&fbp=fb.1.1643205762667.2117303762&it=1643205762560&coo=false&rqm=GET

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:42 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600
content-length: 44
expires: Wed, 26 Jan 2022 14:02:42 GMT

GET
H2 200 core.js Show response
s.pinimg.com/ct/ 1 KB
1 KB 163ms
40ms Script
application/javascript 2600:1400:b000:5a7::1931
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s.pinimg.com/ct/core.js
Requested by: Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1400:b000:5a7::1931 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: a85ea540e774d24b3472a92b0e69b48634c76af3a0dfce7d10ed473163285984

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

akamai-x-true-ttl: 7200
x-cdn: akamai
etag: "b994f61922eded883a63a8a3d9ec54c1"
vary: Accept-Encoding, Origin
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: max-age=7200
accept-ranges: bytes
content-length: 1142
access-control-expose-headers: X-CDN

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 97 KB
39 KB 35ms
35ms Script
application/javascript 2607:f8b0:4006:81f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-698108511&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-10230056

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

943c463a554b176fa14b6855041dedbf3432b7549faa14edd2e7f6b0d92fb5d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:42 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39473
x-xss-protection: 0
last-modified: Wed, 26 Jan 2022 12:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 26 Jan 2022 14:02:42 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 39 KB
15 KB 114ms
65ms Script
text/javascript 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-698108511

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s80-in-f2.1e100.net

Software

cafe /

Resource Hash

73b783357e1ed270e36ebc7846a8477f3d0d44e457405f46926ee2dc2a7db692

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14860
x-xss-protection: 0
server: cafe
etag: 9607039154328110559
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 26 Jan 2022 14:02:42 GMT

GET
H3

200

activityi;dc_pre=CICjpr7Kz_UCFUwI0AQdVMwNqw;src=10230056;type=ret01;cat=land01;ord=7530049612684;gtm=2od1o0;auiddc=2126384688.1643205763;~oref=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2... Show response
10230056.fls.doubleclick.net/ Frame 48D3
Redirect Chain

https://10230056.fls.doubleclick.net/activityi;src=10230056;type=ret01;cat=land01;ord=7530049612684;gtm=2od1o0;auiddc=2126384688.1643205763;~oref=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%...
https://10230056.fls.doubleclick.net/activityi;dc_pre=CICjpr7Kz_UCFUwI0AQdVMwNqw;src=10230056;type=ret01;cat=land01;ord=7530049612684;gtm=2od1o0;auiddc=2126384688.1643205763;~oref=https%3A%2F%2Fwww...

533 B
439 B

70ms
42ms

Document
text/html

142.250.80.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://10230056.fls.doubleclick.net/activityi;dc_pre=CICjpr7Kz_UCFUwI0AQdVMwNqw;src=10230056;type=ret01;cat=land01;ord=7530049612684;gtm=2od1o0;auiddc=2126384688.1643205763;~oref=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-10230056

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s35-in-f6.1e100.net

Software

cafe /

Resource Hash

9e8686ffee1ae1ccecf16477cfcec31813e6d86c10116afefe315a74ccdc7686

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: about:blank

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 26 Jan 2022 14:02:42 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
pragma: no-cache
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 413
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 26 Jan 2022 14:02:42 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://10230056.fls.doubleclick.net/activityi;dc_pre=CICjpr7Kz_UCFUwI0AQdVMwNqw;src=10230056;type=ret01;cat=land01;ord=7530049612684;gtm=2od1o0;auiddc=2126384688.1643205763;~oref=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 main.4fd9fcbb.js Show response
s.pinimg.com/ct/lib/ 55 KB
19 KB 48ms
48ms Script
application/javascript 2600:1400:b000:5a7::1931
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s.pinimg.com/ct/lib/main.4fd9fcbb.js
Requested by: Host: s.pinimg.com
URL: https://s.pinimg.com/ct/core.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1400:b000:5a7::1931 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 5955908348c9dc49badb9b08e2448d49db335f16720edaf1bf6cbe67692129ae

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

akamai-x-true-ttl: 1209600
content-encoding: gzip
x-cdn: akamai
etag: "ee862b07a016793ba80ef67b90f043d5"
vary: Accept-Encoding, Origin
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: max-age=1209600
accept-ranges: bytes
content-length: 19222
access-control-expose-headers: X-CDN

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/698108511/ 3 KB
2 KB 96ms
40ms Script
text/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/698108511/?random=1643205762858&cv=9&fst=1643205762858&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1o0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&tiba=NORTON%20ROSE%20FULBRIGHT%3A%20Enjoy%20complimentary%20Saturday%20Star%20Home%20Delivery%20with%20digital%20access%20or%20Digital%20Access%20only%20%7C%20The%20Star&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

66304453632b6c45dc2ade3790861f135aac13f668c74fd64eca4f5fb6bf5707

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1144
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
ct.pinterest.com/user/ 487 B
833 B 174ms
72ms XHR
application/json 104.77.220.247
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://ct.pinterest.com/user/?tid=2612846434758&cb=1643205762903

Requested by

Host: s.pinimg.com
URL: https://s.pinimg.com/ct/lib/main.4fd9fcbb.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.77.220.247 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-77-220-247.deploy.static.akamaitechnologies.com

Software

Resource Hash

5c3dbfb84c509437cbbb9209c8717e0df34927af36cdfd8456e3debd02f3ac4e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:43 GMT
content-encoding: gzip
vary: Accept-Encoding
x-cdn: akamai
akamai-grn: 0.cc794668.1643205763.1c1cf504
x-envoy-upstream-service-time: 1
x-pinterest-rid: 1220490419347295
pin-unauth: dWlkPVpURXpNVGs0TlRVdE5HUm1OaTAwT0dFM0xUZzVaVGN0WXpSaE16VTBNMkpsTkRVdw
access-control-allow-origin: https://www.thestar.com
referrer-policy: origin
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
content-type: application/json; charset=utf-8
pragma: no-cache
access-control-expose-headers: Epik,Pin-Unauth
cache-control: no-cache,no-store,must-revalidate,max-age=0
access-control-allow-credentials: true
content-length: 350
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
ct.pinterest.com/v3/ 35 B
333 B 180ms
79ms Image
image/gif 104.77.220.247
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ct.pinterest.com/v3/?tid=2612846434758&event=init&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1200%2C%22sw%22%3A1600%2C%22mh%22%3A%224fd9fcbb%22%2C%22ecm_enabled%22%3Afalse%7D&cb=1643205762905

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.77.220.247 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-77-220-247.deploy.static.akamaitechnologies.com

Software

Resource Hash

37b17c5135a176a9474521af147d96dfa1fb4ca0f43f00d1400bd1885be3ab9b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:43 GMT
referrer-policy: origin
x-cdn: akamai
akamai-grn: 0.cc794668.1643205763.1c1cf51e
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache,no-store,must-revalidate,max-age=0
x-envoy-upstream-service-time: 2
content-length: 35
x-pinterest-rid: 8797288172010864
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H3 200 state Show response
api.permutive.com/v1.0/ 0
34 B 113ms
113ms XHR
text/plain 34.107.254.252
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.permutive.com/v1.0/state?fetch_unseen=true&k=025ad678-bf0a-4fe2-b383-8487592159bc
Requested by: Host: be54a597-6b6d-4e2d-9d31-642310a8db25.edge.permutive.app
URL: https://be54a597-6b6d-4e2d-9d31-642310a8db25.edge.permutive.app/be54a597-6b6d-4e2d-9d31-642310a8db25-web.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.107.254.252 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 252.254.107.34.bc.googleusercontent.com
Software: Permutive /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.thestar.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: *
date: Wed, 26 Jan 2022 14:02:42 GMT
content-encoding: gzip
server: Permutive
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20
via: 1.1 google

GET
H2 200 dc_pre=CICjpr7Kz_UCFUwI0AQdVMwNqw;src=10230056;type=ret01;cat=land01;ord=7530049612684;gtm=2od1o0;auiddc=2126384688.1643205763;~oref=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2... Show response
adservice.google.com/ddm/fls/i/ Frame ADE2 532 B
929 B 91ms
41ms Document
text/html 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/ddm/fls/i/dc_pre=CICjpr7Kz_UCFUwI0AQdVMwNqw;src=10230056;type=ret01;cat=land01;ord=7530049612684;gtm=2od1o0;auiddc=2126384688.1643205763;~oref=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html

Requested by

Host: 10230056.fls.doubleclick.net
URL: https://10230056.fls.doubleclick.net/activityi;dc_pre=CICjpr7Kz_UCFUwI0AQdVMwNqw;src=10230056;type=ret01;cat=land01;ord=7530049612684;gtm=2od1o0;auiddc=2126384688.1643205763;~oref=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1847a20221574e502fe81b1b8fd77734dc3ae378bc7b2745cd2144980ed9e365

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://10230056.fls.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 26 Jan 2022 14:02:43 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
content-type: text/html; charset=UTF-8
pragma: no-cache
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 413
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 /
www.google.com/pagead/1p-user-list/698108511/ 42 B
548 B 87ms
39ms Image
image/gif 2607:f8b0:4006:822::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/698108511/?random=1643205762858&cv=9&fst=1643205600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1o0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&tiba=NORTON%20ROSE%20FULBRIGHT%3A%20Enjoy%20complimentary%20Saturday%20Star%20Home%20Delivery%20with%20digital%20access%20or%20Digital%20Access%20only%20%7C%20The%20Star&async=1&fmt=3&is_vtc=1&random=2061463192&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:822::2004 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.ca/pagead/1p-user-list/698108511/ 42 B
548 B 87ms
40ms Image
image/gif 2607:f8b0:4006:81e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-user-list/698108511/?random=1643205762858&cv=9&fst=1643205600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1o0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&tiba=NORTON%20ROSE%20FULBRIGHT%3A%20Enjoy%20complimentary%20Saturday%20Star%20Home%20Delivery%20with%20digital%20access%20or%20Digital%20Access%20only%20%7C%20The%20Star&async=1&fmt=3&is_vtc=1&random=2061463192&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_pre=CICjpr7Kz_UCFUwI0AQdVMwNqw;src=10230056;type=ret01;cat=land01;ord=7530049612684;gtm=2od1o0;auiddc=2126384688.1643205763;~oref=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2... Show response
adservice.google.ca/ddm/fls/i/ Frame F1AF 194 B
870 B 144ms
86ms Document
text/html 2607:f8b0:4006:81e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/ddm/fls/i/dc_pre=CICjpr7Kz_UCFUwI0AQdVMwNqw;src=10230056;type=ret01;cat=land01;ord=7530049612684;gtm=2od1o0;auiddc=2126384688.1643205763;~oref=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html

Requested by

Host: adservice.google.com
URL: https://adservice.google.com/ddm/fls/i/dc_pre=CICjpr7Kz_UCFUwI0AQdVMwNqw;src=10230056;type=ret01;cat=land01;ord=7530049612684;gtm=2od1o0;auiddc=2126384688.1643205763;~oref=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://adservice.google.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Wed, 26 Jan 2022 14:02:43 GMT
expires: Wed, 26 Jan 2022 14:02:43 GMT
cache-control: private, max-age=0
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 177
x-xss-protection: 0
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"

POST
H3 200 / Show response
www.facebook.com/tr/ Frame 68B1 0
18 B 38ms
18ms Document
text/plain 2a03:2880:f112:182:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
Origin: https://www.thestar.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/

Response headers

content-type: text/plain
access-control-allow-origin: https://www.thestar.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600
priority: u=3,i
date: Wed, 26 Jan 2022 14:02:43 GMT

GET
H2

200

ct.html Show response
www.pinterest.ca/ Frame 9894
Redirect Chain

https://www.pinterest.com/ct.html
https://www.pinterest.ca/ct.html

413 B
4 KB

127ms
126ms

Document
text/html

104.77.220.247
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.pinterest.ca/ct.html

Requested by

Host: s.pinimg.com
URL: https://s.pinimg.com/ct/lib/main.4fd9fcbb.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.77.220.247 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-77-220-247.deploy.static.akamaitechnologies.com

Software

Resource Hash

c877f8c89d3bafae866c9a60e67251614f74f266c70334ae05c8ac21b07c11e2

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' blob: data: .pinimg.com .pinterest.com accounts.google.com fonts.gstatic.com fonts.googleapis.com use.typekit.net .adyen.com .adyenpayments.com; img-src * data: blob:; script-src 'nonce-c1ce432cc49b7d7374f3af83a5df075c' 'strict-dynamic' 'report-sample' 'self' .pinterest.com .pinimg.com .google.com connect.facebook.net .google-analytics.com .facebook.com .googleadservices.com .doubleclick.net .googletagmanager.com .adyen.com .adyenpayments.com cdn.ampproject.org .cdn.ampproject.org radar.cedexis.com .cedexis-test.com www.gstatic.com/recaptcha/ www.recaptcha.net 'unsafe-inline' blob:; connect-src 'self' .pinimg.com .pinterest.com accounts.google.com .facebook.com .dropboxapi.com .adyen.com .adyenpayments.com cdn.ampproject.org .cdn.ampproject.org pinterest-aberdeen.s3.amazonaws.com pinterest-aberdeen.s3.us-east-1.amazonaws.com pinterest-anaheim.s3.amazonaws.com pinterest-anaheim.s3.us-east-1.amazonaws.com pinterest-media-upload.s3.amazonaws.com pinterest-media-upload.s3.us-east-1.amazonaws.com pinterest-media-upload.s3-accelerate.amazonaws.com pinterest-media-upload.s3-accelerate.us-east-1.amazonaws.com pinterest-milwaukee.s3.amazonaws.com pinterest-milwaukee.s3.us-east-1.amazonaws.com pinterest-poughkeepsie.s3.amazonaws.com pinterest-poughkeepsie.s3.us-east-1.amazonaws.com pinterest-waterloo.s3.amazonaws.com pinterest-waterloo.s3.us-east-1.amazonaws.com pinterest-plymouth.s3.amazonaws.com pinterest-plymouth.s3.us-east-1.amazonaws.com pinterest-salvador.s3.us-east-1.amazonaws.com .cedexis.com .cedexis-radar.net blob: .tvpixel.com api.pinadmin.com .live-video.net; media-src 'self' .pinimg.com blob: data: .live-video.net; object-src 'self'; form-action 'self'; frame-src 'self' .google.com .pinimg.com .pinterest.com .pinterdev.com .facebook.com content.googleapis.com .adyen.com .youtube.com .ytimg.com player.vimeo.com calendly.com vine.co bid.g.doubleclick.net .fls.doubleclick.net pinterest-milwaukee.s3.amazonaws.com pinterest-milwaukee.s3.us-east-1.amazonaws.com pinterest-waterloo.s3.amazonaws.com pinterest-waterloo.s3.us-east-1.amazonaws.com pinlogs.s3.amazonaws.com pinlogs.s3.us-east-1.amazonaws.com pinterest-hilo.s3.us-east-1.amazonaws.com pinterest-hilo.s3.amazonaws.com advertising-delivery-metric-reports.s3.amazonaws.com advertising-delivery-metric-reports.s3.us-east-1.amazonaws.com servedby.flashtalking.com pinterest-uk.admo.tv pinterest-uk-web.admo.tv fbrpc://call www.recaptcha.net px.ads.linkedin.com www-pinterest-ca.cdn.ampproject.org; worker-src 'self' blob: https://www-pinterest-com.cdn.ampproject.org 'unsafe-inline'; base-uri 'none'; report-uri /_/_/csp_report/?rid=1156987497742569; frame-ancestors *
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/

Response headers

x-xss-protection: 1; mode=block
x-content-type-options: nosniff
vary: User-Agent, Accept-Encoding
x-ua-compatible: IE=edge
expect-ct: max-age=86400, report-uri="https://www.pinterest.com/_/_/expect_ct_report/"
p3p: CP="This is not a P3P policy. See https://www.pinterest.com/_/_/help/articles/pinterest-and-p3p for more info."
content-security-policy: default-src 'self' 'unsafe-inline' blob: data: *.pinimg.com *.pinterest.com accounts.google.com fonts.gstatic.com fonts.googleapis.com use.typekit.net *.adyen.com *.adyenpayments.com; img-src * data: blob:; script-src 'nonce-c1ce432cc49b7d7374f3af83a5df075c' 'strict-dynamic' 'report-sample' 'self' *.pinterest.com *.pinimg.com *.google.com connect.facebook.net *.google-analytics.com *.facebook.com *.googleadservices.com *.doubleclick.net *.googletagmanager.com *.adyen.com *.adyenpayments.com cdn.ampproject.org *.cdn.ampproject.org radar.cedexis.com *.cedexis-test.com www.gstatic.com/recaptcha/ www.recaptcha.net 'unsafe-inline' blob:; connect-src 'self' *.pinimg.com *.pinterest.com accounts.google.com *.facebook.com *.dropboxapi.com *.adyen.com *.adyenpayments.com cdn.ampproject.org *.cdn.ampproject.org pinterest-aberdeen.s3.amazonaws.com pinterest-aberdeen.s3.us-east-1.amazonaws.com pinterest-anaheim.s3.amazonaws.com pinterest-anaheim.s3.us-east-1.amazonaws.com pinterest-media-upload.s3.amazonaws.com pinterest-media-upload.s3.us-east-1.amazonaws.com pinterest-media-upload.s3-accelerate.amazonaws.com pinterest-media-upload.s3-accelerate.us-east-1.amazonaws.com pinterest-milwaukee.s3.amazonaws.com pinterest-milwaukee.s3.us-east-1.amazonaws.com pinterest-poughkeepsie.s3.amazonaws.com pinterest-poughkeepsie.s3.us-east-1.amazonaws.com pinterest-waterloo.s3.amazonaws.com pinterest-waterloo.s3.us-east-1.amazonaws.com pinterest-plymouth.s3.amazonaws.com pinterest-plymouth.s3.us-east-1.amazonaws.com pinterest-salvador.s3.us-east-1.amazonaws.com *.cedexis.com *.cedexis-radar.net blob: *.tvpixel.com api.pinadmin.com *.live-video.net; media-src 'self' *.pinimg.com blob: data: *.live-video.net; object-src 'self'; form-action 'self'; frame-src 'self' *.google.com *.pinimg.com *.pinterest.com *.pinterdev.com *.facebook.com content.googleapis.com *.adyen.com *.youtube.com *.ytimg.com player.vimeo.com calendly.com vine.co bid.g.doubleclick.net *.fls.doubleclick.net pinterest-milwaukee.s3.amazonaws.com pinterest-milwaukee.s3.us-east-1.amazonaws.com pinterest-waterloo.s3.amazonaws.com pinterest-waterloo.s3.us-east-1.amazonaws.com pinlogs.s3.amazonaws.com pinlogs.s3.us-east-1.amazonaws.com pinterest-hilo.s3.us-east-1.amazonaws.com pinterest-hilo.s3.amazonaws.com advertising-delivery-metric-reports.s3.amazonaws.com advertising-delivery-metric-reports.s3.us-east-1.amazonaws.com servedby.flashtalking.com pinterest-uk.admo.tv pinterest-uk-web.admo.tv fbrpc://call www.recaptcha.net px.ads.linkedin.com www-pinterest-ca.cdn.ampproject.org; worker-src 'self' blob: https://www-pinterest-com.cdn.ampproject.org 'unsafe-inline'; base-uri 'none'; report-uri /_/_/csp_report/?rid=1156987497742569; frame-ancestors *
content-security-policy-report-only: script-src 'nonce-c1ce432cc49b7d7374f3af83a5df075c' 'strict-dynamic' 'report-sample' 'self' *.pinterest.com *.pinimg.com *.google.com connect.facebook.net *.online.tableau.com *.google-analytics.com *.facebook.com *.googleadservices.com *.doubleclick.net *.googletagmanager.com *.adyen.com *.adyenpayments.com cdn.ampproject.org *.cdn.ampproject.org radar.cedexis.com *.cedexis-test.com www.gstatic.com/recaptcha/ www.recaptcha.net 'unsafe-inline'; report-uri /_/_/csp_report/?reportonly , script-src 'report-sample' 'self' *.pinterest.com *.pinimg.com *.google.com connect.facebook.net *.online.tableau.com *.google-analytics.com *.facebook.com *.googleadservices.com *.doubleclick.net *.googletagmanager.com *.adyen.com *.adyenpayments.com cdn.ampproject.org *.cdn.ampproject.org radar.cedexis.com *.cedexis-test.com www.gstatic.com/recaptcha/ www.recaptcha.net 'unsafe-inline'; default-src 'self' 'unsafe-inline' blob: data: *.pinimg.com *.pinterest.com accounts.google.com fonts.gstatic.com fonts.googleapis.com use.typekit.net; frame-src *; img-src * data: blob:; connect-src *; worker-src * blob:; report-uri /_/_/csp_report/?reportonly
x-frame-options: SAMEORIGIN
content-type: text/html; charset=utf-8
link: <https://i.pinimg.com>; rel=preconnect; crossorigin=anonymous, <https://s.pinimg.com>; rel=preconnect; crossorigin=anonymous, <https://v.pinimg.com>; rel=preconnect; crossorigin=anonymous
trailer: x-pinterest-sli-streamed-response-type
x-envoy-upstream-service-time: 81
pinterest-generated-by: coreapp-webapp-prod-0a03f2f3
content-encoding: gzip
pinterest-version: 53d8ce3
referrer-policy: origin
x-pinterest-rid: 1156987497742569
date: Wed, 26 Jan 2022 14:02:43 GMT
content-length: 279
akamai-grn: 0.cc794668.1643205763.1c1cf73d
x-cdn: akamai
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload

Redirect headers

x-xss-protection: 1; mode=block
x-content-type-options: nosniff
vary: User-Agent, Accept-Encoding
x-ua-compatible: IE=edge
expect-ct: max-age=86400, report-uri="https://www.pinterest.com/_/_/expect_ct_report/"
location: https://www.pinterest.ca/ct.html
trailer: x-pinterest-sli-streamed-response-type
x-envoy-upstream-service-time: 157
pinterest-generated-by: coreapp-webapp-prod-0a03db12
content-encoding: gzip
pinterest-version: 53d8ce3
referrer-policy: origin
x-pinterest-rid: 1608411378766910
date: Wed, 26 Jan 2022 14:02:43 GMT
akamai-grn: 0.cc794668.1643205763.1c1cf631
x-cdn: akamai
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 96ms
20ms Image
image/gif 23.41.169.149
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=TORONTO_PREBID_HEADER1&hp=1&wf=1&ra=5&pxm=4&sgs=6&vb=8&cm=1&zMoatIS=0&pl=1&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=11&f=0&t=1643205761238&de=619880097062&rx=538703511803&m=0&ar=3902fe7180d-clean&iw=1fea951&q=1&cb=0&cu=1643205761238&ll=2&lm=0&ln=0&em=0&en=0&d=thestar.com%3ASponsored%20%7C%20NORTON%20ROSE%20FULBRIGHT%20Enjoy%20complimentary%20Saturday%20Star%20Home%20Delivery%20with%20digital%20access%20or%20Digital%20Access%20only%3A__page__%3A-&zGSRC=1&gu=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&id=1&ii=4&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&gw=torontoprebidheader623296055317&fd=1&ac=1&it=500&pe=1%3A881%3A1656%3A0%3A899&fs=196551&na=774000179&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.41.169.149 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-41-169-149.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:43 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 26 Jan 2022 14:02:43 GMT

GET
H2 200 pixel.js Show response
www.redditstatic.com/ads/ 23 KB
8 KB 60ms
11ms Script
application/javascript 2a04:4e42:200::396
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/pixel.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P86MZHL&gtm_auth=6lA8dG63UaQ5ed3gQljsjQ&gtm_preview=env-2&gtm_cookies_win=x
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: 04686da390f8eec3ccd75869fa71e22cad452cfcff6ffa31c979f599d64831d8

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:43 GMT
via: 1.1 varnish, 1.1 varnish
last-modified: Wed, 03 Nov 2021 15:08:58 GMT
server: snooserv
etag: "3fbf36d562f1d2a543a89683060265ed"
vary: Accept-Encoding,Origin
content-type: application/javascript
cache-control: public, max-age=60
accept-ranges: bytes
content-encoding: gzip
content-length: 7632

GET
H2 200 bat.js Show response
bat.bing.com/ 36 KB
11 KB 83ms
36ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P86MZHL&gtm_auth=6lA8dG63UaQ5ed3gQljsjQ&gtm_preview=env-2&gtm_cookies_win=x
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: dfed159907574337d5a3198b898e17e6f0d6c5c325d8ee2fd2343b7cddb34994

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:42 GMT
content-encoding: gzip
last-modified: Fri, 03 Dec 2021 01:53:50 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 474409D494114BF48FEFDE45DE9D1E9A Ref B: YTO01EDGE0707 Ref C: 2022-01-26T14:02:43Z
etag: "0cb09ee8e7d71:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 10468

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 5 KB
2 KB 97ms
27ms Script
application/x-javascript 2600:141b:13::17d7:826a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P86MZHL&gtm_auth=6lA8dG63UaQ5ed3gQljsjQ&gtm_preview=env-2&gtm_cookies_win=x
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:13::17d7:826a New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: fed785a6a8ca96fb67230fec5d85f9c508db49f4075aa0ef284af56cd89813e3

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 26 Jan 2022 14:02:43 GMT
Content-Encoding: gzip
Last-Modified: Wed, 29 Sep 2021 19:17:49 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=78116
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2036

GET
H2 200 ndg-8561576614.js Show response
cdn.ndg.io/ 31 KB
9 KB 90ms
28ms Script
application/javascript 2606:4700:3033::ac43:c8a1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.ndg.io/ndg-8561576614.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P86MZHL&gtm_auth=6lA8dG63UaQ5ed3gQljsjQ&gtm_preview=env-2&gtm_cookies_win=x
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::ac43:c8a1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b86e803713989a0638834bc4a95c891ba13a9ab7ff572eff1e8a914dd9c86c3e

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1830
content-type: application/javascript
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: S0C6G80TXMQBS38Y
x-amz-id-2: 11R6531FDs121x8umFNXcpwxBDbCBXp3XKf79corcnZhVHEVQrPt0JNHUSdUDyzP3EHo62TDPts=
last-modified: Thu, 10 Oct 2019 13:07:15 GMT
server: cloudflare
etag: W/"cb267096c29ddd58cc060dbc0a99e462"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IhAIDS9H%2BL6hQFq7xc15KHpOqk2W%2Bz5SOcEg0TAWh1hC6GgCOPZFxHNArg%2BTc3H7jfVtu8vHIEUoJPCAIWTUgFqKBoDkj9bLuLX53MvGc5wvAUGYUSFk%2FRb5u0aDaXn2gwEpcNfMlaPh"}],"group":"cf-nel","max_age":604800}
x-amz-version-id: null
cache-control: max-age=14400
cf-ray: 6d3a47d4bab2714b-YUL
cf-bgj: minify

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ 87 KB
34 KB 34ms
34ms Script
application/javascript 2607:f8b0:4006:81f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-57Q9DV2

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

31231837ec68070c16a8cdedebef3c1d353b9d320e3d84a0f79bb08e01604e58

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:43 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35023
x-xss-protection: 0
last-modified: Wed, 26 Jan 2022 12:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 26 Jan 2022 14:02:43 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
116 B 48ms
48ms Script
application/javascript 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=o2rz8&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=4b5156e7-4458-42b0-a65b-50d5713f01b4&tw_document_href=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&tpx_cb=twttr.conversion.loadPixels

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-response-time: 7
date: Wed, 26 Jan 2022 14:02:42 GMT
content-encoding: gzip
server: tsa_b
strict-transport-security: max-age=631138519
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0
x-connection-hash: cdb996ee132922af2a754a34e3101a60a08ddf58cbe2321fbfa4bab1c7759903
content-type: application/javascript;charset=utf-8
content-length: 57

GET
H2 200 adsct
t.co/i/ 43 B
74 B 55ms
55ms Image
image/gif 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=o2rz8&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=4b5156e7-4458-42b0-a65b-50d5713f01b4&tw_document_href=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-response-time: 7
date: Wed, 26 Jan 2022 14:02:42 GMT
server: tsa_b
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 324e401e889ef817433039c44007b96d3fbcdb1cd3b4bd02761ceeb09eaeff60
content-length: 43

GET
H3 200 __inventory.gif
query.petametrics.com/v1/ 35 B
48 B 71ms
58ms Image
image/gif 35.190.14.224
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://query.petametrics.com/v1/__inventory.gif?ts=1643205763288&jsk=q9fqmmutk5a97trs&jsv=20211122&cu=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&item=%7B%22content_tier%22%3A%5B%22free%22%5D%2C%22publisher%22%3A%5B%22https%3A%2F%2Fwww.facebook.com%2Ftorontostar%22%5D%2C%22published_time%22%3A%5B%222022-01-25T05%3A00%3A00Z%22%5D%2C%22modified_time%22%3A%5B%22%22%5D%2C%22section%22%3A%5B%22Sponsored%22%5D%2C%22title%22%3A%5B%22NORTON%20ROSE%20FULBRIGHT%3A%20Enjoy%20complimentary%20Saturday%20Star%20Home%20Delivery%20with%20digital%20access%20or%20Digital%20Access%20only%22%5D%2C%22type%22%3A%5B%22article%22%5D%2C%22url%22%3A%5B%22https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html%22%5D%2C%22description%22%3A%5B%22Brought%20To%20You%20By%20Norton%20Rose%20Fulbright%22%5D%2C%22site_name%22%3A%5B%22thestar.com%22%5D%2C%22image%22%3A%5B%22https%3A%2F%2Fimages.thestar.com%2Fx70oRdnP0pI3nJgUrMZGA5EyEGU%3D%2F0x0%3A1086x631%2F1280x1024%2Fsmart%2Ffilters%3Acb(1642009448428)%2Fhttps%3A%2F%2Fwww.thestar.com%2Fcontent%2Fdam%2Fthestar%2Fuploads%2F2022%2F01%2F11%2Fts-subsoffer-header-v1-0.jpg%22%5D%2C%22truncatedDescription%22%3A%5B%22Brought%20To%20You%20By%20Norton%20Rose%20Fulbright%22%5D%2C%22inHouseArticle%22%3A%5B%22false%22%5D%2C%22enableLivechat%22%3A%5B%22false%22%5D%2C%22images%22%3A%5B%22https%3A%2F%2Fwww.thestar.com%2Fassets%2Fimg%2Fthestar-ribbon.png%22%5D%2C%22noShow%22%3A%5B%22false%22%5D%2C%22enableConversations%22%3A%5B%22false%22%5D%2C%22hasImage%22%3A%5B%22true%22%5D%2C%22asset_id%22%3A%5B%2221079e41-c286-489d-bc2d-08df311ab891%22%5D%2C%22enableLivechatadmin%22%3A%5B%22false%22%5D%2C%22thumbor_image%22%3A%5B%22%7B%5C%22imageid%5C%22%3A%5C%22%5C%22%2C%5C%22origImageSize%5C%22%3A%5C%221086x631%5C%22%2C%5C%22lastmodified%5C%22%3A1641932490787%2C%5C%22fullWindowMainart%5C%22%3Afalse%2C%5C%22forceoriginal%5C%22%3Afalse%2C%5C%22caption%5C%22%3A%5C%22%20%5C%22%2C%5C%22source%5C%22%3A%5C%22%20%5C%22%2C%5C%22type%5C%22%3A%5C%22image%5C%22%2C%5C%22credit%5C%22%3A%5C%22%20%5C%22%2C%5C%22mainartSize%5C%22%3A%5C%22medium%5C%22%2C%5C%22url%5C%22%3A%5C%22%2Fcontent%2Fdam%2Fthestar%2Fuploads%2F2022%2F01%2F11%2Fts-subsoffer-header-v1-0.jpg%5C%22%2C%5C%22crop%5C%22%3A%5C%220%2C0%2C1086%2C631%5C%22%7D%22%5D%2C%22trust_label%22%3A%5B%22SPONSORED%22%5D%2C%22last_modified%22%3A%5B%222022-01-21T15%3A43%3A08.027Z%22%5D%7D&ttl=0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.190.14.224 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 224.14.190.35.bc.googleusercontent.com
Software: openresty/1.13.6.2 /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:43 GMT
via: 1.1 google
server: openresty/1.13.6.2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
content-type: image/gif

GET
H2 200 rp.gif
alb.reddit.com/ 42 B
125 B 97ms
56ms Image
image/gif 151.101.1.140
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://alb.reddit.com/rp.gif?ts=1643205763315&id=t2_kcsr8bo&event=PageVisit&m.itemCount=&m.value=&m.currency=&m.transactionId=&m.customEventName=&uuid=b42580f3-d5ff-44f7-94bb-f0b64ca49a72&aaid=&em=&external_id=&idfa=&integration=reddit&opt_out=0&sh=1600&sw=1200&v=rdt_5b7866e3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:43 GMT
via: 1.1 varnish
server: Varnish
accept-ranges: bytes
content-length: 42
retry-after: 0
content-type: image/gif

GET
H2 200 13008914.js Show response
bat.bing.com/p/action/ 684 B
758 B 140ms
138ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/p/action/13008914.js
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 77c78b15436725243d182c25b4887bf8c7377ee3658b27de524ff767493daa7b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:43 GMT
content-encoding: gzip
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: CFF258727B4645ADA0DE26AC14AF2137 Ref B: YTO01EDGE0707 Ref C: 2022-01-26T14:02:43Z
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-store,no-cache
content-length: 583

GET
H2 204 0
bat.bing.com/action/ 0
151 B 34ms
33ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=13008914&tm=gtm002&Ver=2&mid=9eef2a2e-3b3e-49f9-bee1-e61ade775b47&sid=a1ac28107eb011eca6a46d9669f272e3&vid=a1aca6e07eb011ecb27795ca4526572b&vids=1&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=NORTON%20ROSE%20FULBRIGHT%3A%20Enjoy%20complimentary%20Saturday%20Star%20Home%20Delivery%20with%20digital%20access%20or%20Digital%20Access%20only%20%7C%20The%20Star&p=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&r=&lt=2791&evt=pageLoad&msclkid=N&sv=1&rn=659477
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:42 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: CE9419B325B144D4B4174995F4C73E01 Ref B: YTO01EDGE0707 Ref C: 2022-01-26T14:02:43Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 19ms
18ms Image
image/gif 23.41.169.149
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&ra=5&pxm=4&sgs=6&vb=8&kq=1&lo=0&uk=null&pk=0&wk=0&rk=1&tk=0&ak=https%3A%2F%2Fwww.thestar.com%2F%2Fsponsored_sections%2F2022%2F01%2F13%2F-&i=TORONTO_PREBID_HEADER1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BYbjrG%3DH%3CU%3CO%24cRJ%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C2%2C2%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-vUthrZVsFccVxRDaTGndGCUc8IKBUGMSV3C%2FvEJM65hND7UVt69nIRrqyNQFcZFf7egP&rs=1-2Shgt24580cdYQ%3D%3D&sc=1&os=1-Bg%3D%3D&qp=10000&is=&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=11&g=0&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&h=4&w=4&rm=1&zGSRC=1&gu=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&id=1&ii=4&cm=1&zMoatIS=0&pl=1&f=0&t=1643205761238&de=619880097062&rx=538703511803&cu=1643205761238&m=2001&ar=3902fe7180d-clean&iw=1fea951&cb=0&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=5594&le=1&ch=0&vv=0&vw=0%3A0%3A0&vp=undefined&vx=-%3A-%3A-&pe=1%3A881%3A1656%3A0%3A899&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=0&cd=0&ah=0&am=0&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=thestar.com%3ASponsored%20%7C%20NORTON%20ROSE%20FULBRIGHT%20Enjoy%20complimentary%20Saturday%20Star%20Home%20Delivery%20with%20digital%20access%20or%20Digital%20Access%20only%3A__page__%3A-&gw=torontoprebidheader623296055317&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&ab=3&ac=1&fd=1&kt=null&it=500&oq=0&ot=0&zMoatJS=3%3A-&tc=0&fs=196551&na=240352801&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.41.169.149 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-41-169-149.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:43 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 26 Jan 2022 14:02:43 GMT

GET
H2 200 conf Show response
d.ndg.io/ 70 B
140 B 100ms
24ms Script
text/javascript 52.20.34.81
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://d.ndg.io/conf
Requested by: Host: cdn.ndg.io
URL: https://cdn.ndg.io/ndg-8561576614.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.20.34.81 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-20-34-81.compute-1.amazonaws.com
Software: /
Resource Hash: 4317eb61f84a1debbcbc4de453ed70ddf585e25d3a519edd5cf086829127cbb3

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:43 GMT
content-length: 70
content-type: text/javascript

GET
H2 200 B24540798.279406836;sz=1x2;ord=193952878358 Show response
ad.doubleclick.net/ddm/adj/N7050.197812.NSO.CODESRV/ 30 KB
12 KB 110ms
56ms Script
text/javascript 142.250.64.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adj/N7050.197812.NSO.CODESRV/B24540798.279406836;sz=1x2;ord=193952878358?

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.64.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s31-in-f6.1e100.net

Software

cafe /

Resource Hash

c15a91ba12b87eb2962f296bddc411b12646183318a05ce6577ed88301eca6dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:43 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11294
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
p.adsymptotic.com/d/px/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1671964&time=1643205763357&url=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1671964&time=1643205763357&url=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&cookiesTest=true
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1671964%26time%3D1643205763357%26url%3Dhttps%253A%252F%252Fwww.thestar.com%252Fsp...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1671964&time=1643205763357&url=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&cookiesTest=true&liSync=true
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1671964&time=1643205763357&url=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&cookiesTest=true&liSync=true...
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=73ec822e-514c-4c2d-b5ea-aa4ff5250b72
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=73ec822e-514c-4c2d-b5ea-aa4ff5250b72&_expected_cookie=2d5176e89829613b39ae6a77...

43 B
142 B

46ms
46ms

Image
image/gif

104.18.101.194
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=73ec822e-514c-4c2d-b5ea-aa4ff5250b72&_expected_cookie=2d5176e89829613b39ae6a7748697224
Protocol: H2
Server: 104.18.101.194 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:43 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 6d3a47d82e805401-YYZ
p3p: CP='NON DSP COR CONi OUR BUS CNT'
content-type: image/gif
content-length: 43

Redirect headers

location: https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=73ec822e-514c-4c2d-b5ea-aa4ff5250b72&_expected_cookie=2d5176e89829613b39ae6a7748697224
date: Wed, 26 Jan 2022 14:02:43 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 6d3a47d7ddc45401-YYZ
content-length: 0
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"

GET
H2 204 /
events.jotform.com/jsform/220106406818247/ Frame 5D2C 0
367 B 120ms
65ms Image
text/plain 2606:4700:11::6817:850b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events.jotform.com/jsform/220106406818247/?ref=&res=1600x1200&eventID=1643205763449_220106406818247_4V9Uit9&loc=https%253A%252F%252Fwww.thestar.com%252Fsponsored_sections%252F2022%252F01%252F13%252Fnortonrose.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:11::6817:850b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:43 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
last-modified: Wed, 26 Jan 2022 09:02:43 GMT
server: cloudflare
access-control-allow-headers: origin, content-type, accept
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cf-ray: 6d3a47d5fc097145-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 1 Jan 1970 00:00:00 GMT

POST
H2 200 s88010379458609 Show response
s.thestar.com/b/ss/torontodnnlocal/1/JS-2.22.3-LBWB/ 43 B
349 B 82ms
82ms XHR
image/gif 52.40.172.46
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.thestar.com/b/ss/torontodnnlocal/1/JS-2.22.3-LBWB/s88010379458609

Requested by

Host: resources.thestar.com
URL: https://resources.thestar.com/cf7f3d5747a0/cb6b77270cd8/605968dbcb7f/hostedLibFiles/EPb56e12d7054b4acea984e91c910051cc/AppMeasurement.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.40.172.46 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-40-172-46.us-west-2.compute.amazonaws.com

Software

jag /

Resource Hash

55c9d2f019f9d7ddfd69b2ad0351c5617338a222362aebb02b3b98a4dbc18486

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.thestar.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 26 Jan 2022 14:02:43 GMT
x-content-type-options: nosniff
x-c: main-1585.I7afc85.M0-540
p3p: CP="This is not a P3P policy"
vary: *
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Thu, 27 Jan 2022 14:02:43 GMT
server: jag
xserver: anedge-74fcddc49f-t9ft7
etag: 3528757507414917120-4619751286021003197
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif;charset=utf-8
access-control-allow-origin: https://www.thestar.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
expires: Tue, 25 Jan 2022 14:02:43 GMT

GET
H2 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220120/r20110914/elements/html/ 8 KB
4 KB 65ms
19ms Script
text/javascript 2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220120/r20110914/elements/html/omrhp.js

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N7050.197812.NSO.CODESRV/B24540798.279406836;sz=1x2;ord=193952878358?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:00:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 126
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Feb 2022 14:00:37 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ 0
524 B 137ms
82ms Ping
image/gif 142.250.64.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuJXfcIdQv4D5fO2ZRvPOF1Ub9hRDMi-CqCGgSP7SX5bN_gs-T3Vou588sYWQ6ARj5T0OiWmnVBAQ1l550dOmn6eur8-tRs6uxJ3mzdDf00Uv6xgVQkccMBZw_AuLzbwUEb8jN0nok6H9oFdurg&sig=Cg0ArKJSzBpGLUSHeDDEEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=0&cbvp=1&cisv=r20220120.33641&adurl=

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N7050.197812.NSO.CODESRV/B24540798.279406836;sz=1x2;ord=193952878358?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.64.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s30-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.thestar.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Wed, 26 Jan 2022 14:02:43 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 clarity.js Show response
j.clarity.ms/s/0.6.31/ 52 KB
23 KB 98ms
31ms Script
application/javascript 20.85.30.134
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://j.clarity.ms/s/0.6.31/clarity.js
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/p/action/13008914.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.85.30.134 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b2d2f11eb78159e31bce4355ffd5e696717de4270a77ba1d2038e066462008ad

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:43 GMT
content-encoding: br
etag: "1d8120472a41700"
last-modified: Tue, 25 Jan 2022 15:58:52 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: public,max-age=86400
accept-ranges: bytes
request-context: appId=cid-v1:3f60b293-70d6-4805-b0bb-3484f0a73bf0

GET
H2

200

c.gif
c.clarity.ms/
Redirect Chain

https://c.clarity.ms/c.gif
https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=C9D76670054E423D8AB644B3E9565598&RedC=c.clarity.ms&MXFR=20D7655C83A76F200BF3746487A7613B
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=C9D76670054E423D8AB644B3E9565598&MUID=2B4417828F086C17380906BA8EA26D60

42 B
439 B

31ms
31ms

Image
image/gif

20.36.253.92
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=C9D76670054E423D8AB644B3E9565598&MUID=2B4417828F086C17380906BA8EA26D60
Protocol: H2
Server: 20.36.253.92 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:42 GMT
last-modified: Wed, 12 Jan 2022 02:05:35 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
etag: "9ea1ae3587d81:0"
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-type: image/gif
content-length: 42

Redirect headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:43 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 2C627594DADD422089A788F1B1FAC760 Ref B: YTO01EDGE0707 Ref C: 2022-01-26T14:02:43Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location: https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=C9D76670054E423D8AB644B3E9565598&MUID=2B4417828F086C17380906BA8EA26D60
cache-control: private, no-cache, proxy-revalidate, no-store
content-length: 0

POST
H2 204 /
www.pinterest.ca/_/_/csp_report/ Frame 9894 0
4 KB 115ms
115ms Other
text/plain 104.77.220.247
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.pinterest.ca/_/_/csp_report/?rid=1156987497742569

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.77.220.247 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-77-220-247.deploy.static.akamaitechnologies.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' blob: data: .pinimg.com .pinterest.com accounts.google.com fonts.gstatic.com fonts.googleapis.com use.typekit.net .adyen.com .adyenpayments.com; img-src * data: blob:; script-src 'nonce-14d147dfd0f63433e54e9adbb0bb54b7' 'strict-dynamic' 'report-sample' 'self' .pinterest.com .pinimg.com .google.com connect.facebook.net .google-analytics.com .facebook.com .googleadservices.com .doubleclick.net .googletagmanager.com .adyen.com .adyenpayments.com cdn.ampproject.org .cdn.ampproject.org radar.cedexis.com .cedexis-test.com www.gstatic.com/recaptcha/ www.recaptcha.net 'unsafe-inline' blob:; connect-src 'self' .pinimg.com .pinterest.com accounts.google.com .facebook.com .dropboxapi.com .adyen.com .adyenpayments.com cdn.ampproject.org .cdn.ampproject.org pinterest-aberdeen.s3.amazonaws.com pinterest-aberdeen.s3.us-east-1.amazonaws.com pinterest-anaheim.s3.amazonaws.com pinterest-anaheim.s3.us-east-1.amazonaws.com pinterest-media-upload.s3.amazonaws.com pinterest-media-upload.s3.us-east-1.amazonaws.com pinterest-media-upload.s3-accelerate.amazonaws.com pinterest-media-upload.s3-accelerate.us-east-1.amazonaws.com pinterest-milwaukee.s3.amazonaws.com pinterest-milwaukee.s3.us-east-1.amazonaws.com pinterest-poughkeepsie.s3.amazonaws.com pinterest-poughkeepsie.s3.us-east-1.amazonaws.com pinterest-waterloo.s3.amazonaws.com pinterest-waterloo.s3.us-east-1.amazonaws.com pinterest-plymouth.s3.amazonaws.com pinterest-plymouth.s3.us-east-1.amazonaws.com pinterest-salvador.s3.us-east-1.amazonaws.com .cedexis.com .cedexis-radar.net blob: .tvpixel.com api.pinadmin.com .live-video.net; media-src 'self' .pinimg.com blob: data: .live-video.net; object-src 'self'; form-action 'self'; frame-src 'self' .google.com .pinimg.com .pinterest.com .pinterdev.com .facebook.com content.googleapis.com .adyen.com .youtube.com .ytimg.com player.vimeo.com calendly.com vine.co bid.g.doubleclick.net .fls.doubleclick.net pinterest-milwaukee.s3.amazonaws.com pinterest-milwaukee.s3.us-east-1.amazonaws.com pinterest-waterloo.s3.amazonaws.com pinterest-waterloo.s3.us-east-1.amazonaws.com pinlogs.s3.amazonaws.com pinlogs.s3.us-east-1.amazonaws.com pinterest-hilo.s3.us-east-1.amazonaws.com pinterest-hilo.s3.amazonaws.com advertising-delivery-metric-reports.s3.amazonaws.com advertising-delivery-metric-reports.s3.us-east-1.amazonaws.com servedby.flashtalking.com pinterest-uk.admo.tv pinterest-uk-web.admo.tv fbrpc://call www.recaptcha.net px.ads.linkedin.com www-pinterest-ca.cdn.ampproject.org; worker-src 'self' blob: https://www-pinterest-com.cdn.ampproject.org 'unsafe-inline'; base-uri 'none'; report-uri /_/_/csp_report/?rid=8909293976488595; frame-ancestors 'self' , script-src 'nonce-14d147dfd0f63433e54e9adbb0bb54b7' 'report-sample' 'self' .pinterest.com .pinimg.com .google.com connect.facebook.net .google-analytics.com .facebook.com .googleadservices.com .doubleclick.net .googletagmanager.com .adyen.com .adyenpayments.com cdn.ampproject.org .cdn.ampproject.org radar.cedexis.com .cedexis-test.com www.gstatic.com/recaptcha/ www.recaptcha.net 'unsafe-inline' blob:; report-uri /_/_/csp_report/?rid=8909293976488595
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.pinterest.ca/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/csp-report

Response headers

content-security-policy: default-src 'self' 'unsafe-inline' blob: data: *.pinimg.com *.pinterest.com accounts.google.com fonts.gstatic.com fonts.googleapis.com use.typekit.net *.adyen.com *.adyenpayments.com; img-src * data: blob:; script-src 'nonce-14d147dfd0f63433e54e9adbb0bb54b7' 'strict-dynamic' 'report-sample' 'self' *.pinterest.com *.pinimg.com *.google.com connect.facebook.net *.google-analytics.com *.facebook.com *.googleadservices.com *.doubleclick.net *.googletagmanager.com *.adyen.com *.adyenpayments.com cdn.ampproject.org *.cdn.ampproject.org radar.cedexis.com *.cedexis-test.com www.gstatic.com/recaptcha/ www.recaptcha.net 'unsafe-inline' blob:; connect-src 'self' *.pinimg.com *.pinterest.com accounts.google.com *.facebook.com *.dropboxapi.com *.adyen.com *.adyenpayments.com cdn.ampproject.org *.cdn.ampproject.org pinterest-aberdeen.s3.amazonaws.com pinterest-aberdeen.s3.us-east-1.amazonaws.com pinterest-anaheim.s3.amazonaws.com pinterest-anaheim.s3.us-east-1.amazonaws.com pinterest-media-upload.s3.amazonaws.com pinterest-media-upload.s3.us-east-1.amazonaws.com pinterest-media-upload.s3-accelerate.amazonaws.com pinterest-media-upload.s3-accelerate.us-east-1.amazonaws.com pinterest-milwaukee.s3.amazonaws.com pinterest-milwaukee.s3.us-east-1.amazonaws.com pinterest-poughkeepsie.s3.amazonaws.com pinterest-poughkeepsie.s3.us-east-1.amazonaws.com pinterest-waterloo.s3.amazonaws.com pinterest-waterloo.s3.us-east-1.amazonaws.com pinterest-plymouth.s3.amazonaws.com pinterest-plymouth.s3.us-east-1.amazonaws.com pinterest-salvador.s3.us-east-1.amazonaws.com *.cedexis.com *.cedexis-radar.net blob: *.tvpixel.com api.pinadmin.com *.live-video.net; media-src 'self' *.pinimg.com blob: data: *.live-video.net; object-src 'self'; form-action 'self'; frame-src 'self' *.google.com *.pinimg.com *.pinterest.com *.pinterdev.com *.facebook.com content.googleapis.com *.adyen.com *.youtube.com *.ytimg.com player.vimeo.com calendly.com vine.co bid.g.doubleclick.net *.fls.doubleclick.net pinterest-milwaukee.s3.amazonaws.com pinterest-milwaukee.s3.us-east-1.amazonaws.com pinterest-waterloo.s3.amazonaws.com pinterest-waterloo.s3.us-east-1.amazonaws.com pinlogs.s3.amazonaws.com pinlogs.s3.us-east-1.amazonaws.com pinterest-hilo.s3.us-east-1.amazonaws.com pinterest-hilo.s3.amazonaws.com advertising-delivery-metric-reports.s3.amazonaws.com advertising-delivery-metric-reports.s3.us-east-1.amazonaws.com servedby.flashtalking.com pinterest-uk.admo.tv pinterest-uk-web.admo.tv fbrpc://call www.recaptcha.net px.ads.linkedin.com www-pinterest-ca.cdn.ampproject.org; worker-src 'self' blob: https://www-pinterest-com.cdn.ampproject.org 'unsafe-inline'; base-uri 'none'; report-uri /_/_/csp_report/?rid=8909293976488595; frame-ancestors 'self' , script-src 'nonce-14d147dfd0f63433e54e9adbb0bb54b7' 'report-sample' 'self' *.pinterest.com *.pinimg.com *.google.com connect.facebook.net *.google-analytics.com *.facebook.com *.googleadservices.com *.doubleclick.net *.googletagmanager.com *.adyen.com *.adyenpayments.com cdn.ampproject.org *.cdn.ampproject.org radar.cedexis.com *.cedexis-test.com www.gstatic.com/recaptcha/ www.recaptcha.net 'unsafe-inline' blob:; report-uri /_/_/csp_report/?rid=8909293976488595
x-content-type-options: nosniff
x-cdn: akamai
akamai-grn: 0.cc794668.1643205763.1c1cf81d
content-security-policy-report-only: script-src 'nonce-14d147dfd0f63433e54e9adbb0bb54b7' 'strict-dynamic' 'report-sample' 'self' *.pinterest.com *.pinimg.com *.google.com connect.facebook.net *.online.tableau.com *.google-analytics.com *.facebook.com *.googleadservices.com *.doubleclick.net *.googletagmanager.com *.adyen.com *.adyenpayments.com cdn.ampproject.org *.cdn.ampproject.org radar.cedexis.com *.cedexis-test.com www.gstatic.com/recaptcha/ www.recaptcha.net 'unsafe-inline'; report-uri /_/_/csp_report/?reportonly , script-src 'report-sample' 'self' *.pinterest.com *.pinimg.com *.google.com connect.facebook.net *.online.tableau.com *.google-analytics.com *.facebook.com *.googleadservices.com *.doubleclick.net *.googletagmanager.com *.adyen.com *.adyenpayments.com cdn.ampproject.org *.cdn.ampproject.org radar.cedexis.com *.cedexis-test.com www.gstatic.com/recaptcha/ www.recaptcha.net 'unsafe-inline'; default-src 'self' 'unsafe-inline' blob: data: *.pinimg.com *.pinterest.com accounts.google.com fonts.gstatic.com fonts.googleapis.com use.typekit.net; frame-src *; img-src * data: blob:; connect-src *; worker-src * blob:; report-uri /_/_/csp_report/?reportonly
x-envoy-upstream-service-time: 47
vary: User-Agent, Accept-Encoding
x-pinterest-rid: 8909293976488595
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge
pinterest-version: 53d8ce3
referrer-policy: origin
x-frame-options: SAMEORIGIN
date: Wed, 26 Jan 2022 14:02:43 GMT
expect-ct: max-age=86400, report-uri="https://www.pinterest.com/_/_/expect_ct_report/"
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
pinterest-generated-by: coreapp-webapp-prod-0a03f8d1

POST
H2 204 /
www.pinterest.ca/_/_/csp_report/ Frame 9894 0
4 KB 93ms
93ms Other
text/plain 104.77.220.247
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.pinterest.ca/_/_/csp_report/?reportonly

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.77.220.247 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-77-220-247.deploy.static.akamaitechnologies.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' blob: data: .pinimg.com .pinterest.com accounts.google.com fonts.gstatic.com fonts.googleapis.com use.typekit.net .adyen.com .adyenpayments.com; img-src * data: blob:; script-src 'nonce-4860d10f5f0dd1e1c343baf07e180794' 'strict-dynamic' 'report-sample' 'self' .pinterest.com .pinimg.com .google.com connect.facebook.net .google-analytics.com .facebook.com .googleadservices.com .doubleclick.net .googletagmanager.com .adyen.com .adyenpayments.com cdn.ampproject.org .cdn.ampproject.org radar.cedexis.com .cedexis-test.com www.gstatic.com/recaptcha/ www.recaptcha.net 'unsafe-inline' blob:; connect-src 'self' .pinimg.com .pinterest.com accounts.google.com .facebook.com .dropboxapi.com .adyen.com .adyenpayments.com cdn.ampproject.org .cdn.ampproject.org pinterest-aberdeen.s3.amazonaws.com pinterest-aberdeen.s3.us-east-1.amazonaws.com pinterest-anaheim.s3.amazonaws.com pinterest-anaheim.s3.us-east-1.amazonaws.com pinterest-media-upload.s3.amazonaws.com pinterest-media-upload.s3.us-east-1.amazonaws.com pinterest-media-upload.s3-accelerate.amazonaws.com pinterest-media-upload.s3-accelerate.us-east-1.amazonaws.com pinterest-milwaukee.s3.amazonaws.com pinterest-milwaukee.s3.us-east-1.amazonaws.com pinterest-poughkeepsie.s3.amazonaws.com pinterest-poughkeepsie.s3.us-east-1.amazonaws.com pinterest-waterloo.s3.amazonaws.com pinterest-waterloo.s3.us-east-1.amazonaws.com pinterest-plymouth.s3.amazonaws.com pinterest-plymouth.s3.us-east-1.amazonaws.com pinterest-salvador.s3.us-east-1.amazonaws.com .cedexis.com .cedexis-radar.net blob: .tvpixel.com api.pinadmin.com .live-video.net; media-src 'self' .pinimg.com blob: data: .live-video.net; object-src 'self'; form-action 'self'; frame-src 'self' .google.com .pinimg.com .pinterest.com .pinterdev.com .facebook.com content.googleapis.com .adyen.com .youtube.com .ytimg.com player.vimeo.com calendly.com vine.co bid.g.doubleclick.net .fls.doubleclick.net pinterest-milwaukee.s3.amazonaws.com pinterest-milwaukee.s3.us-east-1.amazonaws.com pinterest-waterloo.s3.amazonaws.com pinterest-waterloo.s3.us-east-1.amazonaws.com pinlogs.s3.amazonaws.com pinlogs.s3.us-east-1.amazonaws.com pinterest-hilo.s3.us-east-1.amazonaws.com pinterest-hilo.s3.amazonaws.com advertising-delivery-metric-reports.s3.amazonaws.com advertising-delivery-metric-reports.s3.us-east-1.amazonaws.com servedby.flashtalking.com pinterest-uk.admo.tv pinterest-uk-web.admo.tv fbrpc://call www.recaptcha.net px.ads.linkedin.com www-pinterest-ca.cdn.ampproject.org; worker-src 'self' blob: https://www-pinterest-com.cdn.ampproject.org 'unsafe-inline'; base-uri 'none'; report-uri /_/_/csp_report/?rid=1034365112113228; frame-ancestors 'self' , script-src 'nonce-4860d10f5f0dd1e1c343baf07e180794' 'report-sample' 'self' .pinterest.com .pinimg.com .google.com connect.facebook.net .google-analytics.com .facebook.com .googleadservices.com .doubleclick.net .googletagmanager.com .adyen.com .adyenpayments.com cdn.ampproject.org .cdn.ampproject.org radar.cedexis.com .cedexis-test.com www.gstatic.com/recaptcha/ www.recaptcha.net 'unsafe-inline' blob:; report-uri /_/_/csp_report/?rid=1034365112113228
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.pinterest.ca/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/csp-report

Response headers

content-security-policy: default-src 'self' 'unsafe-inline' blob: data: *.pinimg.com *.pinterest.com accounts.google.com fonts.gstatic.com fonts.googleapis.com use.typekit.net *.adyen.com *.adyenpayments.com; img-src * data: blob:; script-src 'nonce-4860d10f5f0dd1e1c343baf07e180794' 'strict-dynamic' 'report-sample' 'self' *.pinterest.com *.pinimg.com *.google.com connect.facebook.net *.google-analytics.com *.facebook.com *.googleadservices.com *.doubleclick.net *.googletagmanager.com *.adyen.com *.adyenpayments.com cdn.ampproject.org *.cdn.ampproject.org radar.cedexis.com *.cedexis-test.com www.gstatic.com/recaptcha/ www.recaptcha.net 'unsafe-inline' blob:; connect-src 'self' *.pinimg.com *.pinterest.com accounts.google.com *.facebook.com *.dropboxapi.com *.adyen.com *.adyenpayments.com cdn.ampproject.org *.cdn.ampproject.org pinterest-aberdeen.s3.amazonaws.com pinterest-aberdeen.s3.us-east-1.amazonaws.com pinterest-anaheim.s3.amazonaws.com pinterest-anaheim.s3.us-east-1.amazonaws.com pinterest-media-upload.s3.amazonaws.com pinterest-media-upload.s3.us-east-1.amazonaws.com pinterest-media-upload.s3-accelerate.amazonaws.com pinterest-media-upload.s3-accelerate.us-east-1.amazonaws.com pinterest-milwaukee.s3.amazonaws.com pinterest-milwaukee.s3.us-east-1.amazonaws.com pinterest-poughkeepsie.s3.amazonaws.com pinterest-poughkeepsie.s3.us-east-1.amazonaws.com pinterest-waterloo.s3.amazonaws.com pinterest-waterloo.s3.us-east-1.amazonaws.com pinterest-plymouth.s3.amazonaws.com pinterest-plymouth.s3.us-east-1.amazonaws.com pinterest-salvador.s3.us-east-1.amazonaws.com *.cedexis.com *.cedexis-radar.net blob: *.tvpixel.com api.pinadmin.com *.live-video.net; media-src 'self' *.pinimg.com blob: data: *.live-video.net; object-src 'self'; form-action 'self'; frame-src 'self' *.google.com *.pinimg.com *.pinterest.com *.pinterdev.com *.facebook.com content.googleapis.com *.adyen.com *.youtube.com *.ytimg.com player.vimeo.com calendly.com vine.co bid.g.doubleclick.net *.fls.doubleclick.net pinterest-milwaukee.s3.amazonaws.com pinterest-milwaukee.s3.us-east-1.amazonaws.com pinterest-waterloo.s3.amazonaws.com pinterest-waterloo.s3.us-east-1.amazonaws.com pinlogs.s3.amazonaws.com pinlogs.s3.us-east-1.amazonaws.com pinterest-hilo.s3.us-east-1.amazonaws.com pinterest-hilo.s3.amazonaws.com advertising-delivery-metric-reports.s3.amazonaws.com advertising-delivery-metric-reports.s3.us-east-1.amazonaws.com servedby.flashtalking.com pinterest-uk.admo.tv pinterest-uk-web.admo.tv fbrpc://call www.recaptcha.net px.ads.linkedin.com www-pinterest-ca.cdn.ampproject.org; worker-src 'self' blob: https://www-pinterest-com.cdn.ampproject.org 'unsafe-inline'; base-uri 'none'; report-uri /_/_/csp_report/?rid=1034365112113228; frame-ancestors 'self' , script-src 'nonce-4860d10f5f0dd1e1c343baf07e180794' 'report-sample' 'self' *.pinterest.com *.pinimg.com *.google.com connect.facebook.net *.google-analytics.com *.facebook.com *.googleadservices.com *.doubleclick.net *.googletagmanager.com *.adyen.com *.adyenpayments.com cdn.ampproject.org *.cdn.ampproject.org radar.cedexis.com *.cedexis-test.com www.gstatic.com/recaptcha/ www.recaptcha.net 'unsafe-inline' blob:; report-uri /_/_/csp_report/?rid=1034365112113228
x-content-type-options: nosniff
x-cdn: akamai
akamai-grn: 0.cc794668.1643205763.1c1cf81f
content-security-policy-report-only: script-src 'nonce-4860d10f5f0dd1e1c343baf07e180794' 'strict-dynamic' 'report-sample' 'self' *.pinterest.com *.pinimg.com *.google.com connect.facebook.net *.online.tableau.com *.google-analytics.com *.facebook.com *.googleadservices.com *.doubleclick.net *.googletagmanager.com *.adyen.com *.adyenpayments.com cdn.ampproject.org *.cdn.ampproject.org radar.cedexis.com *.cedexis-test.com www.gstatic.com/recaptcha/ www.recaptcha.net 'unsafe-inline'; report-uri /_/_/csp_report/?reportonly , script-src 'report-sample' 'self' *.pinterest.com *.pinimg.com *.google.com connect.facebook.net *.online.tableau.com *.google-analytics.com *.facebook.com *.googleadservices.com *.doubleclick.net *.googletagmanager.com *.adyen.com *.adyenpayments.com cdn.ampproject.org *.cdn.ampproject.org radar.cedexis.com *.cedexis-test.com www.gstatic.com/recaptcha/ www.recaptcha.net 'unsafe-inline'; default-src 'self' 'unsafe-inline' blob: data: *.pinimg.com *.pinterest.com accounts.google.com fonts.gstatic.com fonts.googleapis.com use.typekit.net; frame-src *; img-src * data: blob:; connect-src *; worker-src * blob:; report-uri /_/_/csp_report/?reportonly
x-envoy-upstream-service-time: 35
vary: User-Agent, Accept-Encoding
x-pinterest-rid: 1034365112113228
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge
pinterest-version: 53d8ce3
referrer-policy: origin
x-frame-options: SAMEORIGIN
date: Wed, 26 Jan 2022 14:02:43 GMT
expect-ct: max-age=86400, report-uri="https://www.pinterest.com/_/_/expect_ct_report/"
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
pinterest-generated-by: coreapp-webapp-prod-0a03dabb

POST
H2 204 /
www.pinterest.ca/_/_/csp_report/ Frame 9894 0
4 KB 88ms
88ms Other
text/plain 104.77.220.247
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.pinterest.ca/_/_/csp_report/?reportonly

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.77.220.247 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-77-220-247.deploy.static.akamaitechnologies.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' blob: data: .pinimg.com .pinterest.com accounts.google.com fonts.gstatic.com fonts.googleapis.com use.typekit.net .adyen.com .adyenpayments.com; img-src * data: blob:; script-src 'nonce-315f7b0a22a19a59686fde8c811cafb0' 'strict-dynamic' 'report-sample' 'self' .pinterest.com .pinimg.com .google.com connect.facebook.net .google-analytics.com .facebook.com .googleadservices.com .doubleclick.net .googletagmanager.com .adyen.com .adyenpayments.com cdn.ampproject.org .cdn.ampproject.org radar.cedexis.com .cedexis-test.com www.gstatic.com/recaptcha/ www.recaptcha.net 'unsafe-inline' blob:; connect-src 'self' .pinimg.com .pinterest.com accounts.google.com .facebook.com .dropboxapi.com .adyen.com .adyenpayments.com cdn.ampproject.org .cdn.ampproject.org pinterest-aberdeen.s3.amazonaws.com pinterest-aberdeen.s3.us-east-1.amazonaws.com pinterest-anaheim.s3.amazonaws.com pinterest-anaheim.s3.us-east-1.amazonaws.com pinterest-media-upload.s3.amazonaws.com pinterest-media-upload.s3.us-east-1.amazonaws.com pinterest-media-upload.s3-accelerate.amazonaws.com pinterest-media-upload.s3-accelerate.us-east-1.amazonaws.com pinterest-milwaukee.s3.amazonaws.com pinterest-milwaukee.s3.us-east-1.amazonaws.com pinterest-poughkeepsie.s3.amazonaws.com pinterest-poughkeepsie.s3.us-east-1.amazonaws.com pinterest-waterloo.s3.amazonaws.com pinterest-waterloo.s3.us-east-1.amazonaws.com pinterest-plymouth.s3.amazonaws.com pinterest-plymouth.s3.us-east-1.amazonaws.com pinterest-salvador.s3.us-east-1.amazonaws.com .cedexis.com .cedexis-radar.net blob: .tvpixel.com api.pinadmin.com .live-video.net; media-src 'self' .pinimg.com blob: data: .live-video.net; object-src 'self'; form-action 'self'; frame-src 'self' .google.com .pinimg.com .pinterest.com .pinterdev.com .facebook.com content.googleapis.com .adyen.com .youtube.com .ytimg.com player.vimeo.com calendly.com vine.co bid.g.doubleclick.net .fls.doubleclick.net pinterest-milwaukee.s3.amazonaws.com pinterest-milwaukee.s3.us-east-1.amazonaws.com pinterest-waterloo.s3.amazonaws.com pinterest-waterloo.s3.us-east-1.amazonaws.com pinlogs.s3.amazonaws.com pinlogs.s3.us-east-1.amazonaws.com pinterest-hilo.s3.us-east-1.amazonaws.com pinterest-hilo.s3.amazonaws.com advertising-delivery-metric-reports.s3.amazonaws.com advertising-delivery-metric-reports.s3.us-east-1.amazonaws.com servedby.flashtalking.com pinterest-uk.admo.tv pinterest-uk-web.admo.tv fbrpc://call www.recaptcha.net px.ads.linkedin.com www-pinterest-ca.cdn.ampproject.org; worker-src 'self' blob: https://www-pinterest-com.cdn.ampproject.org 'unsafe-inline'; base-uri 'none'; report-uri /_/_/csp_report/?rid=1415020673898618; frame-ancestors 'self' , script-src 'nonce-315f7b0a22a19a59686fde8c811cafb0' 'report-sample' 'self' .pinterest.com .pinimg.com .google.com connect.facebook.net .google-analytics.com .facebook.com .googleadservices.com .doubleclick.net .googletagmanager.com .adyen.com .adyenpayments.com cdn.ampproject.org .cdn.ampproject.org radar.cedexis.com .cedexis-test.com www.gstatic.com/recaptcha/ www.recaptcha.net 'unsafe-inline' blob:; report-uri /_/_/csp_report/?rid=1415020673898618
Strict-Transport-Security	max-age=31536000 ; includeSubDomains ; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.pinterest.ca/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/csp-report

Response headers

content-security-policy: default-src 'self' 'unsafe-inline' blob: data: *.pinimg.com *.pinterest.com accounts.google.com fonts.gstatic.com fonts.googleapis.com use.typekit.net *.adyen.com *.adyenpayments.com; img-src * data: blob:; script-src 'nonce-315f7b0a22a19a59686fde8c811cafb0' 'strict-dynamic' 'report-sample' 'self' *.pinterest.com *.pinimg.com *.google.com connect.facebook.net *.google-analytics.com *.facebook.com *.googleadservices.com *.doubleclick.net *.googletagmanager.com *.adyen.com *.adyenpayments.com cdn.ampproject.org *.cdn.ampproject.org radar.cedexis.com *.cedexis-test.com www.gstatic.com/recaptcha/ www.recaptcha.net 'unsafe-inline' blob:; connect-src 'self' *.pinimg.com *.pinterest.com accounts.google.com *.facebook.com *.dropboxapi.com *.adyen.com *.adyenpayments.com cdn.ampproject.org *.cdn.ampproject.org pinterest-aberdeen.s3.amazonaws.com pinterest-aberdeen.s3.us-east-1.amazonaws.com pinterest-anaheim.s3.amazonaws.com pinterest-anaheim.s3.us-east-1.amazonaws.com pinterest-media-upload.s3.amazonaws.com pinterest-media-upload.s3.us-east-1.amazonaws.com pinterest-media-upload.s3-accelerate.amazonaws.com pinterest-media-upload.s3-accelerate.us-east-1.amazonaws.com pinterest-milwaukee.s3.amazonaws.com pinterest-milwaukee.s3.us-east-1.amazonaws.com pinterest-poughkeepsie.s3.amazonaws.com pinterest-poughkeepsie.s3.us-east-1.amazonaws.com pinterest-waterloo.s3.amazonaws.com pinterest-waterloo.s3.us-east-1.amazonaws.com pinterest-plymouth.s3.amazonaws.com pinterest-plymouth.s3.us-east-1.amazonaws.com pinterest-salvador.s3.us-east-1.amazonaws.com *.cedexis.com *.cedexis-radar.net blob: *.tvpixel.com api.pinadmin.com *.live-video.net; media-src 'self' *.pinimg.com blob: data: *.live-video.net; object-src 'self'; form-action 'self'; frame-src 'self' *.google.com *.pinimg.com *.pinterest.com *.pinterdev.com *.facebook.com content.googleapis.com *.adyen.com *.youtube.com *.ytimg.com player.vimeo.com calendly.com vine.co bid.g.doubleclick.net *.fls.doubleclick.net pinterest-milwaukee.s3.amazonaws.com pinterest-milwaukee.s3.us-east-1.amazonaws.com pinterest-waterloo.s3.amazonaws.com pinterest-waterloo.s3.us-east-1.amazonaws.com pinlogs.s3.amazonaws.com pinlogs.s3.us-east-1.amazonaws.com pinterest-hilo.s3.us-east-1.amazonaws.com pinterest-hilo.s3.amazonaws.com advertising-delivery-metric-reports.s3.amazonaws.com advertising-delivery-metric-reports.s3.us-east-1.amazonaws.com servedby.flashtalking.com pinterest-uk.admo.tv pinterest-uk-web.admo.tv fbrpc://call www.recaptcha.net px.ads.linkedin.com www-pinterest-ca.cdn.ampproject.org; worker-src 'self' blob: https://www-pinterest-com.cdn.ampproject.org 'unsafe-inline'; base-uri 'none'; report-uri /_/_/csp_report/?rid=1415020673898618; frame-ancestors 'self' , script-src 'nonce-315f7b0a22a19a59686fde8c811cafb0' 'report-sample' 'self' *.pinterest.com *.pinimg.com *.google.com connect.facebook.net *.google-analytics.com *.facebook.com *.googleadservices.com *.doubleclick.net *.googletagmanager.com *.adyen.com *.adyenpayments.com cdn.ampproject.org *.cdn.ampproject.org radar.cedexis.com *.cedexis-test.com www.gstatic.com/recaptcha/ www.recaptcha.net 'unsafe-inline' blob:; report-uri /_/_/csp_report/?rid=1415020673898618
x-content-type-options: nosniff
x-cdn: akamai
akamai-grn: 0.cc794668.1643205763.1c1cf820
content-security-policy-report-only: script-src 'nonce-315f7b0a22a19a59686fde8c811cafb0' 'strict-dynamic' 'report-sample' 'self' *.pinterest.com *.pinimg.com *.google.com connect.facebook.net *.online.tableau.com *.google-analytics.com *.facebook.com *.googleadservices.com *.doubleclick.net *.googletagmanager.com *.adyen.com *.adyenpayments.com cdn.ampproject.org *.cdn.ampproject.org radar.cedexis.com *.cedexis-test.com www.gstatic.com/recaptcha/ www.recaptcha.net 'unsafe-inline'; report-uri /_/_/csp_report/?reportonly , script-src 'report-sample' 'self' *.pinterest.com *.pinimg.com *.google.com connect.facebook.net *.online.tableau.com *.google-analytics.com *.facebook.com *.googleadservices.com *.doubleclick.net *.googletagmanager.com *.adyen.com *.adyenpayments.com cdn.ampproject.org *.cdn.ampproject.org radar.cedexis.com *.cedexis-test.com www.gstatic.com/recaptcha/ www.recaptcha.net 'unsafe-inline'; default-src 'self' 'unsafe-inline' blob: data: *.pinimg.com *.pinterest.com accounts.google.com fonts.gstatic.com fonts.googleapis.com use.typekit.net; frame-src *; img-src * data: blob:; connect-src *; worker-src * blob:; report-uri /_/_/csp_report/?reportonly
x-envoy-upstream-service-time: 29
vary: User-Agent, Accept-Encoding
x-pinterest-rid: 1415020673898618
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge
pinterest-version: 53d8ce3
referrer-policy: origin
x-frame-options: SAMEORIGIN
date: Wed, 26 Jan 2022 14:02:43 GMT
expect-ct: max-age=86400, report-uri="https://www.pinterest.com/_/_/expect_ct_report/"
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
pinterest-generated-by: coreapp-webapp-prod-0a03ebb6

POST
H2 204 collect Show response
j.clarity.ms/ 0
70 B 31ms
31ms XHR
text/plain 20.85.30.134
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://j.clarity.ms/collect
Requested by: Host: j.clarity.ms
URL: https://j.clarity.ms/s/0.6.31/clarity.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.85.30.134 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://www.thestar.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

access-control-allow-origin: https://www.thestar.com
date: Wed, 26 Jan 2022 14:02:43 GMT
access-control-allow-credentials: true
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
request-context: appId=cid-v1:3f60b293-70d6-4805-b0bb-3484f0a73bf0

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 118 B
589 B 168ms
167ms XHR
text/javascript 143.204.137.197
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.amazon-adsystem.com/e/dtb/bid?src=5028&u=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&pid=8LokDjdrx2wxc&cb=0&ws=1600x1200&v=7.72.0&t=2000&slots=%5B%7B%22sd%22%3A%22div-gpt-ad-large-sponsored_sections-1%22%2C%22s%22%3A%5B%221x1%22%5D%2C%22sn%22%3A%2258580620%2Fthestar.com%2Fsponsored_sections%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-large-sponsored_sections-2%22%2C%22s%22%3A%5B%22728x90%22%5D%2C%22sn%22%3A%2258580620%2Fthestar.com%2Fsponsored_sections%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-large-sponsored_sections-3%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%2258580620%2Fthestar.com%2Fsponsored_sections%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-large-sponsored_sections-4%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%2258580620%2Fthestar.com%2Fsponsored_sections%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-large-sponsored_sections-5%22%2C%22s%22%3A%5B%22134x170%22%5D%2C%22sn%22%3A%2258580620%2Fthestar.com%2Fsponsored_sections%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-large-sponsored_sections-6%22%2C%22s%22%3A%5B%22134x170%22%5D%2C%22sn%22%3A%2258580620%2Fthestar.com%2Fsponsored_sections%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-large-sponsored_sections-7%22%2C%22s%22%3A%5B%22134x170%22%5D%2C%22sn%22%3A%2258580620%2Fthestar.com%2Fsponsored_sections%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-large-sponsored_sections-8%22%2C%22s%22%3A%5B%22134x170%22%5D%2C%22sn%22%3A%2258580620%2Fthestar.com%2Fsponsored_sections%22%7D%5D&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.137.197 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-137-197.ewr52.r.cloudfront.net

Software

Server /

Resource Hash

a4ff587ec63d11ce6d3bdac8eb00ad87a15c545e5aae914977af3a596b1686fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:43 GMT
via: 1.1 b078462cffa3a81b6e262ef7f6040412.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: EWR52-C2
x-amz-rid: QBHBKQW4HJDP1W5DX61P
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://www.thestar.com
access-control-allow-credentials: true
permissions-policy: interest-cohort=()
strict-transport-security: max-age=47474747; includeSubDomains; preload
timing-allow-origin: *
content-length: 118
x-amz-cf-id: pxvdwxWsXdNrXrkWWoVOJhX_RHmSnhG5MgjWPytH2VIEu2Uwfta1NQ==

GET
H3

200

arj Show response
torontostar-d.openx.net/w/1.0/
Redirect Chain

https://torontostar-d.openx.net/w/1.0/arj?auid=540273844%2C540273840&aus=728x90%2C970x250%7C728x90&ju=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&jr=&ch=UT...
https://torontostar-d.openx.net/w/1.0/arj?cc=1&auid=540273844%2C540273840&aus=728x90%2C970x250%7C728x90&ju=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&jr=&...

232 B
241 B

138ms
124ms

XHR
application/json

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://torontostar-d.openx.net/w/1.0/arj?cc=1&auid=540273844%2C540273840&aus=728x90%2C970x250%7C728x90&ju=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&jr=&ch=UTF-8&tz=0&bc=hb_ix_2.1.3&be=1&res=1600x1200&tws=1600x1200&ifr=0&callback=window.headertag.OpenXHtb.adResponseCallbacks._OB3u7Bq5&cache=1643205763956&ttduuid=98ec7b18-03f3-4f38-9fd0-bab1d9f133a3
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/17.1.0 /
Resource Hash: bd30d6bb370215bd9d66c2f24267aec31b508689606412b82c5f4a39299267b3

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:44 GMT
content-encoding: gzip
server: OXGW/17.1.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://www.thestar.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 218
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

date: Wed, 26 Jan 2022 14:02:44 GMT
via: 1.1 google
server: OXGW/17.1.0
location: https://torontostar-d.openx.net/w/1.0/arj?cc=1&auid=540273844%2C540273840&aus=728x90%2C970x250%7C728x90&ju=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&jr=&ch=UTF-8&tz=0&bc=hb_ix_2.1.3&be=1&res=1600x1200&tws=1600x1200&ifr=0&callback=window.headertag.OpenXHtb.adResponseCallbacks._OB3u7Bq5&cache=1643205763956&ttduuid=98ec7b18-03f3-4f38-9fd0-bab1d9f133a3
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://www.thestar.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 34 KB
11 KB 133ms
132ms XHR
application/json 68.67.178.15
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/181778-254412191205210.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.178.15 Secaucus, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

633.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

9e1f018d61459b72d85b17e35be89314babf43e787526a23180fcdb31ddf9e6d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.thestar.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

Date: Wed, 26 Jan 2022 14:02:44 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 149.56.153.187; 149.56.153.187; 633.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: b19bea98-7ed0-4691-936b-bb69753f9d7f
Server: nginx/1.17.9
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://www.thestar.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 260 B
1 KB 185ms
112ms XHR
application/json 2602:803:c002:200::52
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=18488&size_id=2&rp_floor=0.01&rf=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&p_screen_res=1600x1200&site_id=205444&zone_id=1011818&kw=rp.fastlane&tk_flint=index&rand=0.12980638234531816&alt_size_ids=57
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/181778-254412191205210.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 2602:803:c002:200::52 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 0b5f16fa5f9a7d522591f39bdfe2961c4e77d4d2281c8a7883d1724eab94fb79

Request headers

Referer: https://www.thestar.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Wed, 26 Jan 2022 14:02:44 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://www.thestar.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 260
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 240 B
1 KB 119ms
46ms XHR
application/json 2602:803:c002:200::52
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=18488&size_id=2&rp_floor=0.01&rf=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&p_screen_res=1600x1200&site_id=205444&zone_id=1011818&kw=rp.fastlane&tk_flint=index&rand=0.19627681559740062
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/181778-254412191205210.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 2602:803:c002:200::52 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 15486ae0b475fb394d4c5ca29ac030f0d68a2c5c906afe9cc6b020627ebd8e1a

Request headers

Referer: https://www.thestar.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Wed, 26 Jan 2022 14:02:44 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://www.thestar.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 240
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
345 B 104ms
35ms XHR
application/json 3.92.156.8
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?cmd=bid&dcn=8a9698d20177773960f13aa96d380022&pos=the_star_desktop_8_btf_728x90_post2&secure=1
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/181778-254412191205210.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.92.156.8 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-92-156-8.compute-1.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: 0c5b74810ea1e16858fe56373ea9b0fa0a0671d8ef084a7e096086979c3d8637

Request headers

Referer: https://www.thestar.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Wed, 26 Jan 2022 14:02:44 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.thestar.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
343 B 104ms
36ms XHR
application/json 3.92.156.8
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?cmd=bid&dcn=8a9698d20177773960f13aa96d380022&pos=the_star_desktop_9_btf_970x250_pos2&secure=1
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/181778-254412191205210.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.92.156.8 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-92-156-8.compute-1.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: 63cea384f876e08336881b80d3594caa09df42aef38cf06992fbaace240346c1

Request headers

Referer: https://www.thestar.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Wed, 26 Jan 2022 14:02:44 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.thestar.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
545 B 102ms
34ms XHR
application/json 3.92.156.8
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?cmd=bid&dcn=8a9698d20177773960f13aa96d380022&pos=the_star_desktop_5_atf_728x90_pos1&secure=1
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/181778-254412191205210.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.92.156.8 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-92-156-8.compute-1.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: ca722692097e4c35b99ceb65de85743aa81692e6c683444505ac9e8d42fb5965

Request headers

Referer: https://www.thestar.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Wed, 26 Jan 2022 14:02:44 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.thestar.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 78 B
373 B 238ms
180ms XHR
text/javascript 96.6.23.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?v=7.2&s=157269&fn=headertag.IndexExchangeHtb.adResponseCallback&sd=1&r=%7B%22id%22%3A%2252449636%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html%22%7D%2C%22imp%22%3A%5B%7B%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A728%2C%22h%22%3A90%2C%22ext%22%3A%7B%22sid%22%3A%2223%22%2C%22siteID%22%3A%22157269%22%7D%7D%2C%7B%22w%22%3A970%2C%22h%22%3A250%2C%22ext%22%3A%7B%22sid%22%3A%2224%22%2C%22siteID%22%3A%22157269%22%7D%7D%5D%7D%2C%22id%22%3A%221%22%7D%2C%7B%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A728%2C%22h%22%3A90%2C%22ext%22%3A%7B%22sid%22%3A%2213%22%2C%22siteID%22%3A%22268340%22%7D%7D%2C%7B%22w%22%3A970%2C%22h%22%3A250%2C%22ext%22%3A%7B%22sid%22%3A%2214%22%2C%22siteID%22%3A%22268341%22%7D%7D%5D%7D%2C%22id%22%3A%222%22%7D%2C%7B%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A728%2C%22h%22%3A90%2C%22ext%22%3A%7B%22sid%22%3A%228%22%2C%22siteID%22%3A%22268335%22%7D%7D%5D%7D%2C%22id%22%3A%223%22%7D%5D%2C%22ext%22%3A%7B%22source%22%3A%22ixwrapper%22%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22adserver.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%2298ec7b18-03f3-4f38-9fd0-bab1d9f133a3%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID%22%7D%7D%2C%7B%22id%22%3A%22FALSE%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID_LOOKUP%22%7D%7D%2C%7B%22id%22%3A%222022-01-26T14%3A02%3A41%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID_CREATED_AT%22%7D%7D%5D%7D%5D%7D%7D
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/181778-254412191205210.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 96.6.23.240 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a96-6-23-240.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 417adb799f117f9f9845002eea4a607fb95d64e57db8feb1b9b573fe1e4fb600

Request headers

Referer: https://www.thestar.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:44 GMT
x-ak-initial-geo: CC:[CA], RC:[QC], CN:[NA], CIP:[149.56.153.187], XFF:[]
server: Apache
content-type: text/javascript
access-control-allow-origin: https://www.thestar.com
x-cs-client-geo: 19
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 78
x-ak-client-geo: 19
expires: Wed, 26 Jan 2022 14:02:44 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
134 B 99ms
98ms XHR
text/plain 104.16.190.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/b/v1

Requested by

Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/181778-254412191205210.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.190.66 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://www.thestar.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 26 Jan 2022 14:02:44 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: origin, Accept-Encoding
access-control-allow-methods: OPTIONS, POST
access-control-allow-origin: https://www.thestar.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 6d3a47d8de4bf97d-YYZ
access-control-allow-headers: origin, content-type

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
672 B 56ms
18ms XHR
text/html 68.67.161.205
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?id=14439268&size=728x90&callback=headertag.DistrictMHtb.adResponseCallback&callback_uid=LSAvplJ7&psa=0&promo_sizes=970x250&referrer=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html

Requested by

Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/181778-254412191205210.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.161.205 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

799.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.thestar.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Wed, 26 Jan 2022 14:02:44 GMT
X-Proxy-Origin: 149.56.153.187; 149.56.153.187; 799.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: a66bfd29-bd06-4754-86cc-ddffea5b3bcb
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.thestar.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK jpt Show response
secure.adnxs.com/ 0
672 B 60ms
23ms XHR
text/html 68.67.161.205
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/jpt?id=14439253&size=728x90&callback=headertag.DistrictMHtb.adResponseCallback&callback_uid=nwAtHUCX&psa=0&referrer=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html

Requested by

Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/181778-254412191205210.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.161.205 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

799.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.thestar.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Wed, 26 Jan 2022 14:02:44 GMT
X-Proxy-Origin: 149.56.153.187; 149.56.153.187; 799.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: 86365d24-c11d-4249-bc4c-18815109b5aa
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.thestar.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

iu3 Show response
s.amazon-adsystem.com/ Frame 2403
Redirect Chain

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=rbd_n-vmg_ox-db5_an-db5
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=rbd_n-vmg_ox-db5_an-db5&dcc=t

240 B
1 KB

47ms
47ms

Document
text/html

209.54.176.128
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=rbd_n-vmg_ox-db5_an-db5&dcc=t

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

a4014f0c8b9e63c213f09c9c16823fd64e9905c6008b94fb5ed8623be4ff0eb9

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/

Response headers

Server: Server
Date: Wed, 26 Jan 2022 14:02:44 GMT
Content-Type: text/html;charset=ISO-8859-1
Content-Length: 240
Connection: keep-alive
x-amz-rid: HFEESPP3NZ3C632A0P00
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Permissions-Policy: interest-cohort=()

Redirect headers

Server: Server
Date: Wed, 26 Jan 2022 14:02:44 GMT
Content-Length: 0
Connection: keep-alive
x-amz-rid: N81DK70VPVPSNXSC6JNP
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=rbd_n-vmg_ox-db5_an-db5&dcc=t
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Permissions-Policy: interest-cohort=()

GET
H/1.1 200
OK pr Show response
s.amazon-adsystem.com/v3/ Frame 9564 912 B
1 KB 28ms
28ms Document
text/html 209.54.176.128
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/v3/pr?exlist=ox-db5_rbd_n-vmg_an-db5&fv=1.0&a=cm&cm3ppd=1

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=rbd_n-vmg_ox-db5_an-db5&dcc=t

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

2073d4557f2b7323a2a0d6c656c478b031eb2c5b6190261d5fdccaed74c3f1b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=rbd_n-vmg_ox-db5_an-db5&dcc=t

Response headers

Server: Server
Date: Wed, 26 Jan 2022 14:02:44 GMT
Content-Type: text/html;charset=ISO-8859-1
Content-Length: 912
Connection: keep-alive
x-amz-rid: ERKWSEZEJ56049H1M2HZ
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Permissions-Policy: interest-cohort=()

GET
H2 200 cm Show response
u.openx.net/w/1.0/ Frame C01D 722 B
794 B 31ms
29ms Document
text/html 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://u.openx.net/w/1.0/cm?id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=ox-db5_rbd_n-vmg_an-db5&fv=1.0&a=cm&cm3ppd=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/17.1.0 /
Resource Hash: 6c903a1bde8e769429d7a9f38a47214a6ee15e31b407cc4436a40a230556e868

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

vary: Accept, Accept-Encoding
server: OXGW/17.1.0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 26 Jan 2022 14:02:44 GMT
content-type: text/html
content-length: 460
content-encoding: gzip
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame FBB4 281 B
554 B 105ms
34ms Document
text/html 104.105.42.146
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=ox-db5_rbd_n-vmg_an-db5&fv=1.0&a=cm&cm3ppd=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.105.42.146 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-105-42-146.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
ETag: "402b2-119-5d32342a551c0"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Wed, 26 Jan 2022 14:02:44 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame F0DF
Redirect Chain

https://ups.analytics.yahoo.com/ups/58251/sync?redir=true
https://s.amazon-adsystem.com/ecm3?ex=vmg.com&id=eS1vbG1aS2dkRTJ1TGg5YzRHTFJsb0g5QTRVNUNja1JyeX5B

43 B
556 B

55ms
30ms

Document
image/gif

209.54.176.128
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=vmg.com&id=eS1vbG1aS2dkRTJ1TGg5YzRHTFJsb0g5QTRVNUNja1JyeX5B

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=ox-db5_rbd_n-vmg_an-db5&fv=1.0&a=cm&cm3ppd=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

Server: Server
Date: Wed, 26 Jan 2022 14:02:44 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
x-amz-rid: 9P6M95HNDJBYSG5M6THJ
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Permissions-Policy: interest-cohort=()

Redirect headers

date: Wed, 26 Jan 2022 14:02:44 GMT
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
location: https://s.amazon-adsystem.com/ecm3?ex=vmg.com&id=eS1vbG1aS2dkRTJ1TGg5YzRHTFJsb0g5QTRVNUNja1JyeX5B
age: 0
server: ATS/9.1.0.33

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame 35BF
Redirect Chain

https://ib.adnxs.com/getuid?https://s.amazon-adsystem.com/ecm3?id=$UID&ex=appnexus.com
https://s.amazon-adsystem.com/ecm3?id=4244130733842794831&ex=appnexus.com

43 B
556 B

30ms
29ms

Document
image/gif

209.54.176.128
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?id=4244130733842794831&ex=appnexus.com

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=ox-db5_rbd_n-vmg_an-db5&fv=1.0&a=cm&cm3ppd=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

Server: Server
Date: Wed, 26 Jan 2022 14:02:44 GMT
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
x-amz-rid: 99AKY5AAH1DSV0CKPE5E
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Permissions-Policy: interest-cohort=()

Redirect headers

Server: nginx/1.17.9
Date: Wed, 26 Jan 2022 14:02:44 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 0
Connection: keep-alive
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Location: https://s.amazon-adsystem.com/ecm3?id=4244130733842794831&ex=appnexus.com
AN-X-Request-Uuid: a79346a1-024f-4111-8279-b20b6a8a37cc
X-Proxy-Origin: 149.56.153.187; 149.56.153.187; 633.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com

GET
H2 200 pd Show response
us-u.openx.net/w/1.0/ Frame 06D7 1 KB
983 B 31ms
29ms Document
text/html 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=b846aece-0593-4d62-982b-779a22b235ef&gdpr=0
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/181778-254412191205210.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/17.1.0 /
Resource Hash: 43a4b6225a3b99fa767109c00c59c2630eff4ec517d7254d573e505329446b2c

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/

Response headers

vary: Accept, Accept-Encoding
server: OXGW/17.1.0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 26 Jan 2022 14:02:44 GMT
content-type: text/html
content-length: 671
content-encoding: gzip
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

POST
H/1.1 200
OK headerstats Show response
as-sec.casalemedia.com/ 0
430 B 89ms
33ms XHR
text/plain 23.41.168.244
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/headerstats?s=157269&u=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&v=3
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/181778-254412191205210.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.41.168.244 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-41-168-244.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.thestar.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Wed, 26 Jan 2022 14:02:44 GMT
X-AK-INITIAL-GEO: CC:[CA], RC:[QC], CN:[NA], CIP:[149.56.153.187], XFF:[]
Server: Apache
Access-Control-Allow-Origin: https://www.thestar.com
X-CS-CLIENT-GEO: 19
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
X-AK-CLIENT-GEO: 19
Expires: Wed, 26 Jan 2022 14:02:44 GMT

GET
H3 200 integrator.js Show response
adservice.google.ca/adsid/ 107 B
122 B 70ms
41ms Script
application/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=www.thestar.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011002.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 26 Jan 2022 14:02:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 67ms
39ms Script
application/javascript 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.thestar.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011002.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 26 Jan 2022 14:02:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 222 KB
37 KB 684ms
655ms XHR
text/plain 142.251.40.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3317247262058880&correlator=136053626301556&output=ldjh&impl=fifs&eid=31063821&vrg=2022011002&ptt=17&sc=1&sfv=1-0-38&ecs=20220126&iu_parts=58580620%2Cthestar.com%2Csponsored_sections&enc_prev_ius=0%2F1%2F2%2C0%2F1%2F2%2C0%2F1%2F2%2C0%2F1%2F2%2C0%2F1%2F2%2C0%2F1%2F2%2C0%2F1%2F2%2C0%2F1%2F2&prev_iu_szs=1x1%2C728x90%2C728x90%7C970x250%2C728x90%7C970x250%2C134x170%2C134x170%2C134x170%2C134x170&prev_scp=pos%3D1%26amznbid%3D2%26amznp%3D2%7Cpos%3D1%26amznbid%3D2%26amznp%3D2%26ix_apnx_om%3D728x90_0%26ix_apnx_id%3D_MB51MzHq%7Cpos%3D2%26amznbid%3D2%26amznp%3D2%26ix_apnx_om%3D970x250_24%26ix_apnx_id%3D_msJzdiHM%7Cpos%3D3%26amznbid%3D2%26amznp%3D2%7Cpos%3D1%26polarAdDisplayType%3Dwith_column_image%26amznbid%3D2%26amznp%3D2%7Cpos%3D1%26polarAdDisplayType%3Dwith_column_image%26amznbid%3D2%26amznp%3D2%7Cpos%3D1%26polarAdDisplayType%3Dwith_column_image%26amznbid%3D2%26amznp%3D2%7Cpos%3D1%26polarAdDisplayType%3Dwith_column_image%26amznbid%3D2%26amznp%3D2&eri=1&cust_params=permutive%3D%26gs_channels%3Dts_hlth_meal_delivery%252Cts_tmtv_srvcs_t_srvc%252Cts_prsnl_fn_dbt_crdt_crds%252Cts_prsnl_fn_dbt_gnrl%252Cgs_event_euro_championship%252Cts_grcry_flwrs_gnrl%252Cpr_test%252Cgt_positive_happiness%252Cts_hlth_wheelchair%252Cgs_tech_computing%252Cts_pl_nws_lctns_cnd_ntnl%252Cgt_positive%252Cts_bz_b2b_fld_ccntng_fnnc%252Cgs_tech%252Cgs_business_careers%252Cts_rtl_cnsmr_lcs_hm_d_ccssry%252Cgs_business%252Cgs_society_misc%252Cgs_finance_loans%252Cgv_safe%26tkspo%3D10%26env%3Dbeta%26m_data%3D1%26m_safety%3Dsafe%26m_categories%3Dmoat_safe%26m_mv%3DnoHistData%26m_gv%3DnoHistData%26referrer%3Dunknown%26environment%3Dproduction%26cutpoint%3Dlarge%26subscribed%3Dno%26registered%3Dno%26assetid%3D21079e41-c286-489d-bc2d-08df311ab891%26key%3D%2520%26article_b%3Dtrue&cookie_enabled=1&bc=31&abxe=1&dt=1643205764234&lmt=1643205764&dlt=1643205760576&idt=1770&frm=20&biw=1600&bih=1200&oid=2&adxs=0%2C436%2C436%2C436%2C229%2C521%2C812%2C1104&adys=0%2C0%2C3392%2C4734%2C3560%2C3560%2C3560%2C3560&adks=1933731031%2C4178947147%2C2531193674%2C2531193673%2C2541567444%2C2541567445%2C2541567442%2C2541567443&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&dmc=8&url=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&vis=1&scr_x=0&scr_y=0&psz=1600x0%7C1600x90%7C728x90%7C728x90%7C267x0%7C267x0%7C267x0%7C267x0&msz=1x-1%7C1600x90%7C728x90%7C728x90%7C267x0%7C267x0%7C267x0%7C267x0&ga_vid=1142013295.1643205762&ga_sid=1643205764&ga_hid=385159083&ga_fc=true&fws=0%2C0%2C0%2C0%2C0%2C0%2C0%2C0&ohw=0%2C0%2C0%2C0%2C0%2C0%2C0%2C0&btvi=0%7C0%7C1%7C2%7C3%7C4%7C5%7C6&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011002.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s39-in-f2.1e100.net

Software

cafe /

Resource Hash

cacc1610c5d2cbb7adf910e2ccecd55b188d8ba786872e55017c77decbcf568a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:44 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37627
x-xss-protection: 0
google-lineitem-id: -2,5886483565,-1,-1,5846589504,5846589309,5893274797,5881063197
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2,138378060593,-1,-1,138376206644,138376206440,138379088782,138378342979
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.thestar.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 12 KB
9 KB 75ms
46ms XHR
application/json 2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022011002&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011002.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

08e927691b520077554f3074c594ab417fe6881d32bfc9c3d5e8515957afd2e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 26 Jan 2022 14:02:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9047
x-xss-protection: 0

GET
H2 200 container.html Show response
167d3cc6f273bda69ec806982123f22e.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 9F1A 6 KB
4 KB 112ms
31ms Document
text/html 2607:f8b0:4006:823::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://167d3cc6f273bda69ec806982123f22e.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011002.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Wed, 26 Jan 2022 14:02:44 GMT
expires: Thu, 26 Jan 2023 14:02:44 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame C01D 43 B
556 B 31ms
30ms Image
image/gif 209.54.176.128
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=openx.com&id=52ff0510-8768-8818-b003-acc03065b068

Requested by

Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 26 Jan 2022 14:02:44 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: K46VT8B82A9442ZZBFVY
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame C01D
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
https://us-u.openx.net/w/1.0/sd?id=537148856&val=YfFUggAAAE3qCwQr

43 B
61 B

28ms
28ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537148856&val=YfFUggAAAE3qCwQr
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/17.1.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:44 GMT
via: 1.1 google
server: OXGW/17.1.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:44 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1643205764.276660,VS0,VE0
x-served-by: cache-yul12823-YUL
x-cache: HIT
location: https://us-u.openx.net/w/1.0/sd?id=537148856&val=YfFUggAAAE3qCwQr
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2 200 9eee1f29-0b6e-a1ab-41da-38a2a701b6c1
pr-bh.ybp.yahoo.com/sync/openx/ Frame C01D 43 B
989 B 94ms
29ms Image
image/gif 2600:1f18:4e9:5a05:cbbe:ce00:264f:b9b8
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/openx/9eee1f29-0b6e-a1ab-41da-38a2a701b6c1?gdpr=0

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a05:cbbe:ce00:264f:b9b8 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:44 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame C01D
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=0a29796d-9bc2-33e2-700d-2e5758567b88&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=98ec7b18-03f3-4f38-9fd0-bab1d9f133a3&ttd_puid=0a29796d-9bc2-33e2-700d-2e5758567b88

43 B
62 B

33ms
32ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=98ec7b18-03f3-4f38-9fd0-bab1d9f133a3&ttd_puid=0a29796d-9bc2-33e2-700d-2e5758567b88
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/17.1.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:44 GMT
via: 1.1 google
server: OXGW/17.1.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:44 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=98ec7b18-03f3-4f38-9fd0-bab1d9f133a3&ttd_puid=0a29796d-9bc2-33e2-700d-2e5758567b88
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 293

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame C01D 170 B
243 B 96ms
34ms Image
image/png 142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MjY0NmFhYTctNTJiNS02ZDQ2LTY1ZWQtNzRlZTkyYjRiNWU4

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.72.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:44 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame C01D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEH_QCtTDjfH3wWmecouqdrI&google_cver=1

43 B
61 B

29ms
29ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEH_QCtTDjfH3wWmecouqdrI&google_cver=1
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/17.1.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:44 GMT
via: 1.1 google
server: OXGW/17.1.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:44 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEH_QCtTDjfH3wWmecouqdrI&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

204

sync
ups.analytics.yahoo.com/ups/58294/ Frame 06D7
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=9e0a35ea-c8e3-4b1b-9efa-4af6f54a373e&r=https://pixel.advertising.com/ups/58294/sync?_origin=1&uid={OPENX_ID}
https://pixel.advertising.com/ups/58294/sync?_origin=1&uid=24edfae4-43a8-09ab-232a-ef5dcff58fe1
https://pixel.advertising.com/ups/58294/sync?_origin=1&uid=24edfae4-43a8-09ab-232a-ef5dcff58fe1&verify=true
https://ups.analytics.yahoo.com/ups/58294/sync?_origin=1&uid=24edfae4-43a8-09ab-232a-ef5dcff58fe1&apid=UPa24aaec3-7eb0-11ec-bab7-0e3b021ff725

0
343 B

26ms
25ms

Image
text/plain

52.45.33.138
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58294/sync?_origin=1&uid=24edfae4-43a8-09ab-232a-ef5dcff58fe1&apid=UPa24aaec3-7eb0-11ec-bab7-0e3b021ff725

Requested by

Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=b846aece-0593-4d62-982b-779a22b235ef&gdpr=0

Protocol

Server

52.45.33.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-45-33-138.compute-1.amazonaws.com

Software

ATS/9.1.0.33 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:44 GMT
server: ATS/9.1.0.33
age: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location: https://ups.analytics.yahoo.com/ups/58294/sync?_origin=1&uid=24edfae4-43a8-09ab-232a-ef5dcff58fe1&apid=UPa24aaec3-7eb0-11ec-bab7-0e3b021ff725
date: Wed, 26 Jan 2022 14:02:44 GMT
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

458249.gif
idsync.rlcdn.com/ Frame 06D7
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fid.rlcdn.com%2F464246.gif%3Fpartner_uid%3D
https://id.rlcdn.com/464246.gif?partner_uid=5fef060b-5685-0582-2f74-aea461cd1a50
https://id.rlcdn.com/1000.gif?memo=CPaqHBIvCisIARCUaxokNWZlZjA2MGItNTY4NS0wNTgyLTJmNzQtYWVhNDYxY2QxYTUwEAAaDQiEqcWPBhIFCOgHEABCAEoA
https://pippio.com/api/sync?pid=5324&it=1&iv=4fa65bf84239c9840bba77367b0a1b347ffc82f12ba140869a7d2f0debbe61e1791426b5417dce21&_=2
https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlA0ZmE2NWJmODQyMzljOTg0MGJiYTc3MzY3YjBhMWIzNDdmZmM4MmYxMmJhMTQwODY5YTdkMmYwZGViYmU2MWUxNzkxNDI2YjU...
https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlA0ZmE2NWJmODQyMzljOTg0MGJiYTc3MzY3YjBhMWIzNDdmZmM4MmYxMmJhMTQwODY5YTdkMmYwZGViYmU2MWUxNzkxNDI2YjU0MTdkY2UyMRAAGgwIhKnFjwYSBAgCEABCAEoA&goog...
https://tags.rd.linksynergy.com/rcs?ns=lr&uid3=
https://idsync.rlcdn.com/458249.gif?partner_uid=6fc6f59f-0a70-43b4-8af8-ccf0ea43162a

42 B
317 B

52ms
41ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/458249.gif?partner_uid=6fc6f59f-0a70-43b4-8af8-ccf0ea43162a
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=b846aece-0593-4d62-982b-779a22b235ef&gdpr=0
Protocol: H2
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 26 Jan 2022 14:02:44 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

location: https://idsync.rlcdn.com/458249.gif?partner_uid=6fc6f59f-0a70-43b4-8af8-ccf0ea43162a
date: Wed, 26 Jan 2022 14:02:44 GMT
via: 1.1 google
x-samesite: secure
alt-svc: clear
content-length: 111
content-type: text/html; charset=utf-8

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 06D7
Redirect Chain

https://ib.adnxs.com/getuid?https://us-u.openx.net/w/1.0/sd?id=537072399&val=$UID
https://us-u.openx.net/w/1.0/sd?id=537072399&val=4244130733842794831

43 B
61 B

34ms
30ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072399&val=4244130733842794831
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=b846aece-0593-4d62-982b-779a22b235ef&gdpr=0
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/17.1.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:44 GMT
via: 1.1 google
server: OXGW/17.1.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 26 Jan 2022 14:02:44 GMT
X-Proxy-Origin: 149.56.153.187; 149.56.153.187; 633.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: 61814de8-0553-4598-be00-a336ee82f8ef
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://us-u.openx.net/w/1.0/sd?id=537072399&val=4244130733842794831
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame 06D7 43 B
932 B 80ms
31ms Image
image/gif 209.54.176.128
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=52ff0510-8768-8818-b003-acc03065b068

Requested by

Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=b846aece-0593-4d62-982b-779a22b235ef&gdpr=0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 26 Jan 2022 14:02:44 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: Q1ZMDYBA21Q7Q4DEHF8E
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 06D7
Redirect Chain

https://ad.turn.com/r/cs?pid=9&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073061&val=3326741634532946709&gdpr=0&gdpr_consent=&us_privacy=

43 B
61 B

28ms
27ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073061&val=3326741634532946709&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=b846aece-0593-4d62-982b-779a22b235ef&gdpr=0
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/17.1.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:44 GMT
via: 1.1 google
server: OXGW/17.1.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537073061&val=3326741634532946709&gdpr=0&gdpr_consent=&us_privacy=
pragma: no-cache
date: Wed, 26 Jan 2022 14:02:44 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 06D7
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
https://us-u.openx.net/w/1.0/sd?id=537148856&val=YfFUggAAAE3qCwQr

43 B
61 B

41ms
39ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537148856&val=YfFUggAAAE3qCwQr
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=b846aece-0593-4d62-982b-779a22b235ef&gdpr=0
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/17.1.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:44 GMT
via: 1.1 google
server: OXGW/17.1.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:44 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1643205764.287116,VS0,VE0
x-served-by: cache-yul12823-YUL
x-cache: HIT
location: https://us-u.openx.net/w/1.0/sd?id=537148856&val=YfFUggAAAE3qCwQr
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2 200 9eee1f29-0b6e-a1ab-41da-38a2a701b6c1
pr-bh.ybp.yahoo.com/sync/openx/ Frame 06D7 43 B
988 B 91ms
29ms Image
image/gif 2600:1f18:4e9:5a05:cbbe:ce00:264f:b9b8
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/openx/9eee1f29-0b6e-a1ab-41da-38a2a701b6c1?gdpr=0

Requested by

Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=b846aece-0593-4d62-982b-779a22b235ef&gdpr=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a05:cbbe:ce00:264f:b9b8 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:44 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 06D7
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=0a29796d-9bc2-33e2-700d-2e5758567b88&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=98ec7b18-03f3-4f38-9fd0-bab1d9f133a3&ttd_puid=0a29796d-9bc2-33e2-700d-2e5758567b88

43 B
62 B

33ms
32ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=98ec7b18-03f3-4f38-9fd0-bab1d9f133a3&ttd_puid=0a29796d-9bc2-33e2-700d-2e5758567b88
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=b846aece-0593-4d62-982b-779a22b235ef&gdpr=0
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/17.1.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:44 GMT
via: 1.1 google
server: OXGW/17.1.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:44 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=98ec7b18-03f3-4f38-9fd0-bab1d9f133a3&ttd_puid=0a29796d-9bc2-33e2-700d-2e5758567b88
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 293

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 06D7 170 B
232 B 95ms
35ms Image
image/png 142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MjY0NmFhYTctNTJiNS02ZDQ2LTY1ZWQtNzRlZTkyYjRiNWU4

Requested by

Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=b846aece-0593-4d62-982b-779a22b235ef&gdpr=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.72.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:44 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 06D7
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEH_QCtTDjfH3wWmecouqdrI&google_cver=1

43 B
61 B

29ms
28ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEH_QCtTDjfH3wWmecouqdrI&google_cver=1
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=b846aece-0593-4d62-982b-779a22b235ef&gdpr=0
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/17.1.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:44 GMT
via: 1.1 google
server: OXGW/17.1.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:44 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEH_QCtTDjfH3wWmecouqdrI&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame FBB4 32 KB
10 KB 34ms
32ms Script
text/html 104.105.42.146
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.105.42.146 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-105-42-146.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: dfaa9b38b6961e041aa90677d76e0ea5a4fd7ac176ba83694b18d57d809fd57e

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 26 Jan 2022 14:02:44 GMT
Content-Encoding: gzip
Last-Modified: Wed, 15 Dec 2021 23:04:16 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=74986
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9704
Expires: Thu, 27 Jan 2022 10:52:30 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 93ms
42ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011002.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 26 Jan 2022 14:02:44 GMT

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame FBB4
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=a9us&khaos=KYVMAA4U-Z-LMBI
https://s.amazon-adsystem.com/ecm3?id=KYVMAA4U-Z-LMBI&ex=d-rubiconproject.com&status=ok

43 B
556 B

29ms
29ms

Image
image/gif

209.54.176.128
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=KYVMAA4U-Z-LMBI&ex=d-rubiconproject.com&status=ok

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east

Protocol

HTTP/1.1

Server

209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 26 Jan 2022 14:02:44 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: P72DXQSKZM79989FZQS8
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://s.amazon-adsystem.com/ecm3?id=KYVMAA4U-Z-LMBI&ex=d-rubiconproject.com&status=ok
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 4f2e9ddc15e6cc2c3861f8e2683d2514
Expires: 0

GET
H2 200 e
d.ndg.io/ 68 B
325 B 72ms
24ms Image
image/gif 52.20.34.81
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.ndg.io/e?i=682122018&o=7266708795&uu=322b1f51-486c-846b-74a8-e2a9a3c535f8&ref=&ii=1&t=1&c=2022-01-26T14%3A02%3A43&au=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&cu=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&u=&adb=0&vis=1&sh_fb=0&sh_tw=0&sh_li=0&sh_pi=0&sh_ot=0&tt10=1&tt20=1&s=0.21004726063364257&rand=72322
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.20.34.81 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-20-34-81.compute-1.amazonaws.com
Software: /
Resource Hash: 63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058

Request headers

Referer: https://www.thestar.com/
Origin: https://www.thestar.com
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 26 Jan 2022 14:02:44 GMT
content-type: image/gif
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 68
access-control-allow-methods: GET, POST, OPTIONS
access-control-expose-headers: Content-Length,Content-Range

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 9967 13 KB
5 KB 47ms
19ms Document
text/html 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5046
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 26 Jan 2022 06:54:39 GMT
expires: Thu, 26 Jan 2023 06:54:39 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
content-type: text/html
age: 25685
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 9369 783 B
534 B 82ms
54ms Document
text/html 2607:f8b0:4006:822::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2004 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

c9d50fd70050a987d4599a9432e12e15d89f337f03237abc85bdff7a3aa33f97

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-4o02zukLeL3Ttv0mf2bT6A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Wed, 26 Jan 2022 14:02:44 GMT
date: Wed, 26 Jan 2022 14:02:44 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-4o02zukLeL3Ttv0mf2bT6A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 512
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame FBB4
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/ovJK-294_2l_7UmevbvGKg?csrc=
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=4693695464757336785

42 B
702 B

26ms
26ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=4693695464757336785
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 42
X-RPHost: 78008fe701b681dce86a72fc23cacc40
Content-Type: image/gif

Redirect headers

date: Wed, 26 Jan 2022 14:02:44 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=4693695464757336785
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame FBB4
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=98ec7b18-03f3-4f38-9fd0-bab1d9f133a3&gdpr=0&gdpr_consent=&expires=30

42 B
702 B

153ms
24ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=98ec7b18-03f3-4f38-9fd0-bab1d9f133a3&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 42
X-RPHost: 83041abbe8494cb29eff3083edd6dff6
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:44 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=98ec7b18-03f3-4f38-9fd0-bab1d9f133a3&gdpr=0&gdpr_consent=&expires=30
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 289

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame FBB4
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEKOfV0XkaBCpI7NBV5q5R_E&google_cver=1

42 B
702 B

110ms
25ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEKOfV0XkaBCpI7NBV5q5R_E&google_cver=1
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 42
X-RPHost: 0190a17a18f2299b1b85aeb1793e601c
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:44 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEKOfV0XkaBCpI7NBV5q5R_E&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

204

v1
ads.yahoo.com/cms/ Frame FBB4
Redirect Chain

https://token.rubiconproject.com/token?pid=26594
https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KYVMAA4U-Z-LMBI&sigv=1&esig=2~b0b665ca333e8d3b2b61849810632926ea7d07cc

0
194 B

181ms
25ms

Image
text/plain

2001:4998:1c:800::1000
YAHOO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KYVMAA4U-Z-LMBI&sigv=1&esig=2~b0b665ca333e8d3b2b61849810632926ea7d07cc

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east

Protocol

Server

2001:4998:1c:800::1000 New York, United States, ASN14779 (YAHOO, US),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:44 GMT
cache-control: no-store
x-content-type-options: nosniff
server: ATS
strict-transport-security: max-age=15552000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block

Redirect headers

Location: https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KYVMAA4U-Z-LMBI&sigv=1&esig=2~b0b665ca333e8d3b2b61849810632926ea7d07cc
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 0963d041a95f271fbba7f411adc03573
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame FBB4
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D191940%26nid%3D3778%26put%3D%24%7BUSER_ID%7D
https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=YfFUggAAAE3qCwQr

42 B
702 B

168ms
25ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=YfFUggAAAE3qCwQr
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 42
X-RPHost: 78008fe701b681dce86a72fc23cacc40
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:44 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1643205764.455636,VS0,VE0
x-served-by: cache-yul12823-YUL
x-cache: HIT
location: https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=YfFUggAAAE3qCwQr
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FBB4
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1lWTUFBNFUtWi1MTUJJ

170 B
188 B

39ms
39ms

Image
image/png

142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1lWTUFBNFUtWi1MTUJJ

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east

Protocol

Server

142.250.72.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:44 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1lWTUFBNFUtWi1MTUJJ
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: dbbc2dbf689859fb5870b364473d5441
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FBB4
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZjVmNjQxN2U5ODc5NjMwMWUwMTk0NjVjNmEyZmE2NWJmN2E5MTdlNw

170 B
188 B

38ms
38ms

Image
image/png

142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZjVmNjQxN2U5ODc5NjMwMWUwMTk0NjVjNmEyZmE2NWJmN2E5MTdlNw

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east

Protocol

Server

142.250.72.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:44 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZjVmNjQxN2U5ODc5NjMwMWUwMTk0NjVjNmEyZmE2NWJmN2E5MTdlNw
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: dbbc2dbf689859fb5870b364473d5441
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3 200 709414.gif
id.rlcdn.com/ Frame FBB4 42 B
60 B 42ms
41ms Image
image/gif 35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/709414.gif
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 26 Jan 2022 14:02:44 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

GET
H3 200 oVIaA8DHLQK8xPwSs1vijU2jqi1uqHC3deFYmTpVz9A.js Show response
pagead2.googlesyndication.com/bg/ Frame 9967 35 KB
13 KB 49ms
21ms Script
text/javascript 2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/oVIaA8DHLQK8xPwSs1vijU2jqi1uqHC3deFYmTpVz9A.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a1521a03c0c72d02bcc4fc12b35be28d4da3aa2d6ea870b775e158993a55cfd0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 25 Jan 2022 15:44:41 GMT
content-encoding: br
x-content-type-options: nosniff
age: 80283
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13582
x-xss-protection: 0
last-modified: Mon, 24 Jan 2022 14:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 25 Jan 2023 15:44:41 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 9369 0
0 50ms
49ms Image
text/html 2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022011002&jk=3317247262058880&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:80b::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 9967 0
9 B 19ms
18ms Image
text/plain 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?S7hq6w
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:817::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:44 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 82ms
82ms Image
image/gif 2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gpt_2022011002&jk=3317247262058880&bg=!6eql6q7NAAY6OBv_Ojg7ACkAdvg8Wv0FBwmRhweZCIuaYxsmRctIG9GCCX3fnWXvaH4gJ3VlJB9nWwIAAABQUgAAAANoAQeZArNJQ3eZHrh1d-kGB_3bd7qTcW6vYRHk83B0-dEd1LKyuno3jFWGDDZle3m6r7Oztj2nr2prg1DFnQs2A9nQ9XX-gyQAPZ34w0VdBNobZMXXwkZoPNpuFEYdjL4UDYjuLUgq2ARKbFW15hKHY8gr7_-w-dCWe0dQrQqTyS-f2u44EC0g02gxNtOQNn_k7_UPcog_Y8R5vezUO_P97dyOxhw1_KtmHzC0RqxQSf9eCaD7Ffj_seyiOdjcYfY51kMhSLSMrKGMnEXI_4QQFIEWAqftJOHMCjPqKDtYzFDlkjZApME5sTlEvlZxxQD7kVuGI-0JqYugyX8rFDXr1ZoWMtNTGYsML7LAEvGm2CdX2G7tFvdpRsTk93k6wfYdRy2PnffoERUtYXgguRFt0cSpBskShHF6DiOjVzdd-LiGA2sLtW0r0ohgX5bNzObJGK28tluao0LyfPE4xu9IIob7zeQ4uhqyNA-2J39s2Bqn3WOCqGXvhk9X7EVLNkc_Nrr_-TVoKtrtn6f0CxLPzBRMXQV07mtUE27clznsa3p_pkRs-3z_4mAlpVCVM5S4w1_c7RgA5QqYkLmNLUYZTbBNfKwQOD_bA--rabuvNWxEe0_fivIyGwLEq-_501_ceVuqbUMwZHAjzCUNukx4pfaQHfd8qR_rM-lugfoopy3ME3ggMLXat7XkzGeLkUB43BVUgy6KdNVL-NK4zmuB2kc_5LapUyvikdJFQCfZqKzCALwnJx2NfbxDbNg2sitpueLcU4vdKXCDWjZbk9QvprAGfYthsZK-wCEFcMQC0nXag7t6HikZ7nTEfgbr-ZNUyWofk2YPZMFTzsHatbBGH-A4z9hSl_kXg2kfaX0sE799XAmoEPcBqzvL37aC7q4-XEbD4FJZdUQCa4zlRHfbFZd8-NznrN8t

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:44 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame B15C 0
0 69ms
68ms Fetch
image/gif 142.251.40.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsud1mTmXpeWBhs6UpPHT8sHfMcPiZoX0tUz8SWfBU7_RWIAAkGnu3CAwHXuKxqDka2KvvaAC7lOiPnqByrx68gJTqJ5TNskVrAQXZWaJOVR8eYJ_HWwaRc-lzxGeNkNDeJtarHVJaU3u8V2o_nqqYuRVT02kwisx0sabCdDPU35rDgl_TggEkP4G0l6MTEE7Kt7ahSE7_0lxzQrm6BLSYME6tyDPS9Akk0z_8fN3QCmRazAhnGwBh-mhKvYduuF-vouZ0SPcpjkS_0P2RXaC6-jjO5bsA0OpwLgU7xr8rYLL_n9RekOfrKeWcdqQgchg_UaIjZPx0sNGncyWg&sig=Cg0ArKJSzLWl_UBy8_hjEAE&uach_m=[UACH]&adurl=

Requested by

Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s39-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 26 Jan 2022 14:02:45 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220120/r20110914/ Frame B15C 19 KB
8 KB 19ms
19ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220120/r20110914/abg_lite_fy2019.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011002.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2039446f8956518da2c2d70116d18c92fac3b04110942de074748aa4041067fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 13:50:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 735
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7881
x-xss-protection: 0
server: cafe
etag: 7605774008668088057
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Feb 2022 13:50:29 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220120/r20110914/client/ Frame B15C 2 KB
1 KB 20ms
19ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220120/r20110914/client/window_focus_fy2019.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011002.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:00:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 123
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Feb 2022 14:00:41 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame B15C 122 KB
37 KB 847ms
820ms Script
text/javascript 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011002.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2b3334ae35d100a66c0d08b4405e2e334f495cda27b564b38e7eabb08607fdee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38060
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1643027698847572"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 26 Jan 2022 14:02:45 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame B15C 0
0 36ms
36ms Image
text/html 2607:f8b0:4006:822::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQb89PZwJ-SEH4hotPV5j7jdVsCNUOawkJrV4uyUFS3i50qdTxhE5k5DZc53RTCHlFTuL_V1LKM7n7HJ4lOmloilnld3Q
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011002.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:822::2004 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H2 200 moatad.js Show response
z.moatads.com/torontostar63296366476/ Frame B15C 12 KB
5 KB 23ms
23ms Script
application/x-javascript 23.41.169.149
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/torontostar63296366476/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011002.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.41.169.149 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-41-169-149.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: cdd7ac545d67852a6b6bf724f0e2be2eca8c2d91a287435587a959c7debe1dbd

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 26 Jan 2022 14:02:44 GMT
content-encoding: gzip
last-modified: Thu, 20 Jan 2022 20:05:00 GMT
server: AmazonS3
x-amz-request-id: 7BP294RDSJWG8FDH
etag: "e81a32ce81e0deff893d68fd115dd3de"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=44302
accept-ranges: bytes
content-length: 4486
x-amz-id-2: 4KDWMiM0KmSAOGx0rmxAPQsRdzKBg9+qgQ4NO2+HubOTb68aCroK6mw8E0WasfeP6ddUtEeXC5s=

GET
H3 200 15907390127523807017
tpc.googlesyndication.com/simgad/ Frame B15C 50 KB
50 KB 20ms
20ms Image
image/png 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/15907390127523807017

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022011002.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

011ff3b020fb5d77556d53df2c959daa06d395d626fd98cacdfc0b16c1b71c02

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 22 Jan 2022 09:30:53 GMT
x-content-type-options: nosniff
age: 361911
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51627
x-xss-protection: 0
last-modified: Fri, 14 Jan 2022 15:39:59 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 22 Jan 2023 09:30:53 GMT

GET
H2 200 e
d.ndg.io/ 68 B
324 B 25ms
25ms Image
image/gif 52.20.34.81
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.ndg.io/e?i=682122018&o=7266708795&uu=322b1f51-486c-846b-74a8-e2a9a3c535f8&ref=&ii=0&t=1&c=2022-01-26T14%3A02%3A43&au=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&cu=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&u=&adb=0&vis=0&sh_fb=0&sh_tw=0&sh_li=0&sh_pi=0&sh_ot=0&s=0&rand=80888
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.20.34.81 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-20-34-81.compute-1.amazonaws.com
Software: /
Resource Hash: 63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058

Request headers

Referer: https://www.thestar.com/
Origin: https://www.thestar.com
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 26 Jan 2022 14:02:45 GMT
content-type: image/gif
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 68
access-control-allow-methods: GET, POST, OPTIONS
access-control-expose-headers: Content-Length,Content-Range

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame B15C 0
0 65ms
39ms Fetch
image/gif 142.251.40.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvVRaco6PCYgF9WeHe4H4Q_RMLccmIemo7-i7sNCYaf1I68SRc-sy7fgsQm2J-0_c52-Wf_3ucOy6V2oZwaGPZaujOz5u3wPSlXqyaPTqNZYhkgx4CG0juAYjkbEfF44cqtsFcGYoYh4iLN83UDG_fO0pQhYZmFvat65eUjNdxb0DeaTZ9_0Gj-B633_S_bBoBVNu02sWTEvQ64tTXl7cnGkLeUusx4StsfU_g1Ni_UA3mhBY9FWhdnLj3q6eoDrRIhtNkEI6yYpD3pTJHFjSNJydnsN5idduAB0Io4MThs6Tex0umrecozIchwBbrPXDJLYA-mhoU4f-tORw9C&sig=Cg0ArKJSzKxxmUBt3vd6EAE&uach_m=[UACH]&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s39-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 26 Jan 2022 14:02:45 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Wed, 26 Jan 2022 14:02:45 GMT

GET
DATA 200
OK truncated
/ Frame B15C 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: eb34b0470b3780cd63eb387e82351d1a9838287e5dc61a98e5c22dd447006d22

Request headers

Accept-Language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 pixel.gif
px.moatads.com/ Frame B15C 43 B
260 B 19ms
19ms Image
image/gif 23.41.169.149
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=0&d=TORONTOSTAR1%3A57580740%3A66521580%3A-&de=148388418917&t=1643205765876&i=MOAT_FEATHER_DEBUG1&gw=torontostar63296366476&cm=1&ac=1&f=0&bq=0&ar=5589d30d175-clean&iw=76fc135&dMoatOQs=moatClientLevel1%3D49786260%26moatClientLevel2%3D2966645182%26moatClientLevel3%3D5886483565%26moatClientLevel4%3D138378060593%26moatClientSlicer1%3D57580740%26moatClientSlicer2%3D66521580%26zMoatSZ%3D728x90%26zMoatMData%3D1%26zMoatMMV%3DnoHistData%26zMoatMGV%3DnoHistData%26zMoatMSafety%3Dsafe&fq=1&sy=1&gh=0&wb=0&g=0&na=362564854&cs=0
Requested by: Host: www.thestar.com
URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.41.169.149 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-41-169-149.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:45 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 26 Jan 2022 14:02:45 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 24ms
24ms Image
image/gif 23.41.169.149
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=TORONTOSTAR1&hp=1&wf=1&ra=6&pxm=4&sgs=3&vb=8&pl=0&kq=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&bq=11&f=0&j=&t=1643205761238&de=869732458394&rx=538703511803&m=0&ar=3902fe7180d-clean&iw=1fea951&q=2&cb=0&cu=1643205761238&ll=2&lm=0&ln=0&em=0&en=0&d=49786260%3A2966645182%3A5886483565%3A138378060593&cm=1&zMoatSZ=728x90&zMoatMData=1&zMoatMMV=noHistData&zMoatMMV_MAX=noHistData&zMoatMGV=noHistData&zMoatMSafety=safe&zMoatCURL=thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&zMoatDev=Desktop&zMoatOrigSlicer1=57580740&zMoatOrigSlicer2=66521580&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&id=1&ii=4&bo=57580740&bd=66521580&dfp=0%2C1&la=66521580&gw=torontoprebidheader623296055317&fd=1&ac=1&it=500&pe=1%3A881%3A1656%3A2792%3A899&iq=noHistData&tt=noHistData&tu=1&tp=safe&fs=196551&na=1882885977&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.41.169.149 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-41-169-149.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:45 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 26 Jan 2022 14:02:45 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 19ms
18ms Image
image/gif 23.41.169.149
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&ra=6&pxm=4&sgs=3&vb=8&kq=1&lo=0&uk=null&pk=0&wk=0&rk=1&tk=0&ak=https%3A%2F%2Ftpc.googlesyndication.com%2Fsimgad%2F15907390127523807017&i=TORONTOSTAR1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BYbjrG%3DH%3CU%3CO%24cRJ%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C2%2C2%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-vUthrZVsFccVxRDaTGndGCUc8IKBUGMSV3C%2FvEJM65hND7UVt69nIRrqyNQFcZFf7egP&rs=1-2Shgt24580cdYQ%3D%3D&sc=1&os=1-Bg%3D%3D&qp=10000&is=&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=11&g=0&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&h=90&w=728&rm=1&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&id=1&ii=4&pl=0&f=0&j=&t=1643205761238&de=869732458394&rx=538703511803&cu=1643205761238&m=4650&ar=3902fe7180d-clean&iw=1fea951&cb=0&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=5713&le=1&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A881%3A1656%3A2792%3A899&as=0&ag=108&an=0&gf=108&gg=0&ix=108&ic=108&ez=1&aj=1&pg=100&pf=0&ib=0&cc=0&bw=108&bx=0&dj=1&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=215&cd=0&ah=215&am=0&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=49786260%3A2966645182%3A5886483565%3A138378060593&cm=1&bo=57580740&bd=66521580&gw=torontoprebidheader623296055317&zMoatOrigSlicer1=57580740&zMoatOrigSlicer2=66521580&dfp=0%2C1&la=66521580&zMoatSZ=728x90&zMoatMData=1&zMoatMMV=noHistData&zMoatMMV_MAX=noHistData&zMoatMGV=noHistData&zMoatMSafety=safe&zMoatCURL=thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&zMoatDev=Desktop&dfpSlotId=div-gpt-ad-large-sponsored_sections-2&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&tz=div-gpt-ad-large-sponsored_sections-2&iq=noHistData&tt=noHistData&tu=1&tp=safe&tc=0&fs=196551&na=627556805&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.41.169.149 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-41-169-149.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:45 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 26 Jan 2022 14:02:45 GMT

GET
H2 200 e
d.ndg.io/ 68 B
324 B 25ms
24ms Image
image/gif 52.20.34.81
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.ndg.io/e?i=682122018&o=7266708795&uu=322b1f51-486c-846b-74a8-e2a9a3c535f8&ref=&ii=0&t=1&c=2022-01-26T14%3A02%3A43&au=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&cu=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&u=&adb=0&vis=0&sh_fb=0&sh_tw=0&sh_li=0&sh_pi=0&sh_ot=0&s=0&rand=98373
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.20.34.81 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-20-34-81.compute-1.amazonaws.com
Software: /
Resource Hash: 63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058

Request headers

Referer: https://www.thestar.com/
Origin: https://www.thestar.com
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 26 Jan 2022 14:02:46 GMT
content-type: image/gif
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 68
access-control-allow-methods: GET, POST, OPTIONS
access-control-expose-headers: Content-Length,Content-Range

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 23ms
23ms Image
image/gif 23.41.169.149
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=4&q=0&ai=5495&wr=5494&hp=1&wf=1&ra=5&pxm=4&sgs=6&vb=8&kq=1&lo=0&uk=null&pk=0&wk=0&rk=1&tk=0&ak=-&i=TORONTO_PREBID_HEADER1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BYbjrG%3DH%3CU%3CO%24cRJ%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C2%2C2%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-vUthrZVsFccVxRDaTGndGCUc8IKBUGMSV3C%2FvEJM65hND7UVt69nIRrqyNQFcZFf7egP&rs=1-2Shgt24580cdYQ%3D%3D&sc=1&os=1-Bg%3D%3D&qp=10000&is=&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=11&g=1&fl=1&j=&xc=0&xb=0&xa=0&md=0&mc=0&lb=5713&ld=0&lc=0&la=0&cw=1600&cx=1200&sh=5594&sr=0&sb=0&sq=0&sa=0&sn=0&sj=0&sm=0&si=0&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&h=4&w=4&rm=1&zGSRC=1&gu=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&id=1&ii=4&cm=1&zMoatIS=0&pl=1&f=0&t=1643205761238&de=619880097062&rx=538703511803&cu=1643205761238&m=5495&ar=3902fe7180d-clean&iw=1fea951&cb=0&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&le=1&ch=0&vv=0&vw=0%3A0%3A0&vp=undefined&vx=-%3A-%3A-&pe=1%3A881%3A1656%3A2792%3A899&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=3470&cd=0&ah=3470&am=0&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=thestar.com%3ASponsored%20%7C%20NORTON%20ROSE%20FULBRIGHT%20Enjoy%20complimentary%20Saturday%20Star%20Home%20Delivery%20with%20digital%20access%20or%20Digital%20Access%20only%3A__page__%3A-&gw=torontoprebidheader623296055317&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&ab=3&ac=1&fd=1&kt=null&it=500&oq=0&ot=0&zMoatJS=3%3A-&tc=0&fs=196551&na=899210489&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.41.169.149 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-41-169-149.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:46 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 26 Jan 2022 14:02:46 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 19ms
19ms Image
image/gif 23.41.169.149
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=4&q=0&ai=5495&wr=5494&hp=1&wf=1&ra=6&pxm=4&sgs=3&vb=8&kq=1&lo=0&uk=null&pk=0&wk=0&rk=1&tk=0&ak=-&i=TORONTOSTAR1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BYbjrG%3DH%3CU%3CO%24cRJ%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C2%2C2%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-vUthrZVsFccVxRDaTGndGCUc8IKBUGMSV3C%2FvEJM65hND7UVt69nIRrqyNQFcZFf7egP&rs=1-2Shgt24580cdYQ%3D%3D&sc=1&os=1-Bg%3D%3D&qp=10000&is=&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=11&g=1&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&h=90&w=728&rm=1&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&id=1&ii=4&pl=0&f=0&j=&t=1643205761238&de=869732458394&rx=538703511803&cu=1643205761238&m=5496&ar=3902fe7180d-clean&iw=1fea951&cb=0&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=5713&le=1&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A881%3A1656%3A2792%3A899&as=0&ag=923&an=108&gf=923&gg=108&ix=923&ic=923&ez=1&aj=1&pg=100&pf=100&ib=0&cc=0&bw=923&bx=108&dj=1&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1030&cd=215&ah=1030&am=215&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=49786260%3A2966645182%3A5886483565%3A138378060593&cm=1&bo=57580740&bd=66521580&gw=torontoprebidheader623296055317&zMoatOrigSlicer1=57580740&zMoatOrigSlicer2=66521580&dfp=0%2C1&la=66521580&zMoatSZ=728x90&zMoatMData=1&zMoatMMV=noHistData&zMoatMMV_MAX=noHistData&zMoatMGV=noHistData&zMoatMSafety=safe&zMoatCURL=thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&zMoatDev=Desktop&dfpSlotId=div-gpt-ad-large-sponsored_sections-2&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&tz=div-gpt-ad-large-sponsored_sections-2&iq=noHistData&tt=noHistData&tu=1&tp=safe&tc=0&fs=196551&na=354109609&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.41.169.149 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-41-169-149.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:46 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 26 Jan 2022 14:02:46 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame B15C 42 B
64 B 40ms
39ms Fetch
image/gif 2607:f8b0:4006:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu4W0FXdecbt537PaqTd-9spuuU41nKzf9W8VegaSI4bs9GaG0S0gy_9d6GIgRjcH7YDDtXxQuBL3Zu8lh61MuGDrEtFuY1677FkEkv6onVJU2vFJ9Q&sig=Cg0ArKJSzNzNFOVwxzvhEAE&id=lidar2&mcvt=1000&p=10,436,100,1164&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20220124&bin=7&avms=nio&bs=1600,1200&mc=1&app=0&itpl=3&adk=4178947147&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1643205764974&rpt=896&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80b::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:46 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 19ms
19ms Image
image/gif 23.41.169.149
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=37&q=0&hp=1&wf=1&ra=6&pxm=4&sgs=3&vb=8&kq=1&lo=0&uk=null&pk=0&wk=0&rk=1&tk=0&ak=-&i=TORONTOSTAR1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BYbjrG%3DH%3CU%3CO%24cRJ%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C2%2C2%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-vUthrZVsFccVxRDaTGndGCUc8IKBUGMSV3C%2FvEJM65hND7UVt69nIRrqyNQFcZFf7egP&rs=1-2Shgt24580cdYQ%3D%3D&sc=1&os=1-Bg%3D%3D&qp=10000&is=&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=11&g=2&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&h=90&w=728&rm=1&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&id=1&ii=4&pl=0&f=0&j=&t=1643205761238&de=869732458394&rx=538703511803&cu=1643205761238&m=5664&ar=3902fe7180d-clean&iw=1fea951&cb=0&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=5713&le=1&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A881%3A1656%3A2792%3A899&as=1&ag=1124&an=923&gi=1&gf=1124&gg=923&ix=1124&ic=1124&ez=1&ck=1124&kw=1030&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1124&bx=923&ci=1124&jz=1030&dj=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1030&cd=1030&ah=1030&am=1030&xd=00&rf=0&re=0&wb=1&ai=5495&wr=5494&cl=0&at=0&d=49786260%3A2966645182%3A5886483565%3A138378060593&cm=1&bo=57580740&bd=66521580&gw=torontoprebidheader623296055317&zMoatOrigSlicer1=57580740&zMoatOrigSlicer2=66521580&dfp=0%2C1&la=66521580&zMoatSZ=728x90&zMoatMData=1&zMoatMMV=noHistData&zMoatMMV_MAX=noHistData&zMoatMGV=noHistData&zMoatMSafety=safe&zMoatCURL=thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&zMoatDev=Desktop&dfpSlotId=div-gpt-ad-large-sponsored_sections-2&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&tz=div-gpt-ad-large-sponsored_sections-2&iq=noHistData&tt=noHistData&tu=1&tp=safe&tc=0&fs=196551&na=994215175&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.41.169.149 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-41-169-149.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:46 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 26 Jan 2022 14:02:46 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 20ms
20ms Image
image/gif 23.41.169.149
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=5&q=0&hp=1&wf=1&ra=6&pxm=4&sgs=3&vb=8&kq=1&lo=0&uk=null&pk=0&wk=0&rk=1&tk=0&ak=-&i=TORONTOSTAR1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BYbjrG%3DH%3CU%3CO%24cRJ%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C2%2C2%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-vUthrZVsFccVxRDaTGndGCUc8IKBUGMSV3C%2FvEJM65hND7UVt69nIRrqyNQFcZFf7egP&rs=1-2Shgt24580cdYQ%3D%3D&sc=1&os=1-Bg%3D%3D&qp=10000&is=&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=11&g=3&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&h=90&w=728&rm=1&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&id=1&ii=4&pl=0&f=0&j=&t=1643205761238&de=869732458394&rx=538703511803&cu=1643205761238&m=5664&ar=3902fe7180d-clean&iw=1fea951&cb=0&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=5713&le=1&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A881%3A1656%3A2792%3A899&as=1&ag=1124&an=1124&gi=1&gf=1124&gg=1124&ix=1124&ic=1124&ez=1&ck=1124&kw=1030&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1124&bx=1124&ci=1124&jz=1030&dj=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1030&cd=1030&ah=1030&am=1030&xd=00&rf=0&re=0&wb=1&ai=5495&wr=5494&cl=0&at=0&d=49786260%3A2966645182%3A5886483565%3A138378060593&cm=1&bo=57580740&bd=66521580&gw=torontoprebidheader623296055317&zMoatOrigSlicer1=57580740&zMoatOrigSlicer2=66521580&dfp=0%2C1&la=66521580&zMoatSZ=728x90&zMoatMData=1&zMoatMMV=noHistData&zMoatMMV_MAX=noHistData&zMoatMGV=noHistData&zMoatMSafety=safe&zMoatCURL=thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&zMoatDev=Desktop&dfpSlotId=div-gpt-ad-large-sponsored_sections-2&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&tz=div-gpt-ad-large-sponsored_sections-2&iq=noHistData&tt=noHistData&tu=1&tp=safe&tc=0&fs=196551&na=1910414321&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.41.169.149 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-41-169-149.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:46 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 26 Jan 2022 14:02:46 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 19ms
18ms Image
image/gif 23.41.169.149
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=37&q=1&hp=1&wf=1&ra=6&pxm=4&sgs=3&vb=8&kq=1&lo=0&uk=null&pk=0&wk=0&rk=1&tk=0&ak=-&i=TORONTOSTAR1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BYbjrG%3DH%3CU%3CO%24cRJ%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C2%2C2%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-vUthrZVsFccVxRDaTGndGCUc8IKBUGMSV3C%2FvEJM65hND7UVt69nIRrqyNQFcZFf7egP&rs=1-2Shgt24580cdYQ%3D%3D&sc=1&os=1-Bg%3D%3D&qp=10000&is=&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=11&g=4&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&h=90&w=728&rm=1&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&id=1&ii=4&pl=0&f=0&j=&t=1643205761238&de=869732458394&rx=538703511803&cu=1643205761238&m=5665&ar=3902fe7180d-clean&iw=1fea951&cb=0&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=5713&le=1&ch=0&vv=1&vw=1%3A0%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A881%3A1656%3A2792%3A899&as=1&ag=1124&an=1124&gi=1&gf=1124&gg=1124&ix=1124&ic=1124&ez=1&ck=1124&kw=1030&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1124&bx=1124&ci=1124&jz=1030&dj=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1030&cd=1030&ah=1030&am=1030&xd=00&rf=0&re=0&wb=1&ai=5495&wr=5494&cl=0&at=0&d=49786260%3A2966645182%3A5886483565%3A138378060593&cm=1&bo=57580740&bd=66521580&gw=torontoprebidheader623296055317&zMoatOrigSlicer1=57580740&zMoatOrigSlicer2=66521580&dfp=0%2C1&la=66521580&zMoatSZ=728x90&zMoatMData=1&zMoatMMV=noHistData&zMoatMMV_MAX=noHistData&zMoatMGV=noHistData&zMoatMSafety=safe&zMoatCURL=thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&zMoatDev=Desktop&dfpSlotId=div-gpt-ad-large-sponsored_sections-2&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&tz=div-gpt-ad-large-sponsored_sections-2&iq=noHistData&tt=noHistData&tu=1&tp=safe&tc=0&fs=196551&na=1945260973&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.41.169.149 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-41-169-149.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:46 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 26 Jan 2022 14:02:46 GMT

GET
H2 200 e
d.ndg.io/ 68 B
324 B 25ms
25ms Image
image/gif 52.20.34.81
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.ndg.io/e?i=682122018&o=7266708795&uu=322b1f51-486c-846b-74a8-e2a9a3c535f8&ref=&ii=0&t=1&c=2022-01-26T14%3A02%3A43&au=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&cu=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&u=&adb=0&vis=0&sh_fb=0&sh_tw=0&sh_li=0&sh_pi=0&sh_ot=0&s=0&rand=45938
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.20.34.81 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-20-34-81.compute-1.amazonaws.com
Software: /
Resource Hash: 63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058

Request headers

Referer: https://www.thestar.com/
Origin: https://www.thestar.com
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 26 Jan 2022 14:02:47 GMT
content-type: image/gif
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 68
access-control-allow-methods: GET, POST, OPTIONS
access-control-expose-headers: Content-Length,Content-Range

POST
H3 200 events Show response
api.permutive.com/v2.0/batch/ 101 B
131 B 95ms
95ms XHR
application/json 34.107.254.252
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.permutive.com/v2.0/batch/events?enrich=false&sdkp=true&k=025ad678-bf0a-4fe2-b383-8487592159bc
Requested by: Host: be54a597-6b6d-4e2d-9d31-642310a8db25.edge.permutive.app
URL: https://be54a597-6b6d-4e2d-9d31-642310a8db25.edge.permutive.app/be54a597-6b6d-4e2d-9d31-642310a8db25-web.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.107.254.252 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 252.254.107.34.bc.googleusercontent.com
Software: Permutive /
Resource Hash: 03675051dcfe2faeff99cb431518df44c07ca3ea15a48fe36c0ecc990fc136d1

Request headers

Referer: https://www.thestar.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
content-type: text/plain

Response headers

date: Wed, 26 Jan 2022 14:02:47 GMT
content-encoding: gzip
server: Permutive
vary: Origin,Access-Control-Request-Method
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: https://www.thestar.com
access-control-expose-headers: *
access-control-allow-credentials: true
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 110
via: 1.1 google

POST
H/1.1 200
OK attention-event Show response
sr.studiostack.com/track/ 0
396 B 32ms
31ms XHR
text/plain 20.49.104.19
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.studiostack.com/track/attention-event
Requested by: Host: sr.studiostack.com
URL: https://sr.studiostack.com/v3/services
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.49.104.19 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.thestar.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/json;charset=UTF-8

Response headers

Pragma: no-cache
Date: Wed, 26 Jan 2022 14:02:47 GMT
Access-Control-Allow-Methods: GET, POST, OPTIONS, HEAD, PUT
Access-Control-Allow-Origin: *
Expires: 0
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Content-Length: 0
request-context: appId=cid-v1:c374023b-8354-459d-b51b-039919730c2c

OPTIONS
H/1.1 200
OK attention-event
sr.studiostack.com/track/ Frame 0
0 30ms
30ms Preflight
text/html 20.49.104.19
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.studiostack.com/track/attention-event
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.49.104.19 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://www.thestar.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Allow: POST
Content-Length: 4
Content-Type: text/html; charset=utf-8
Expires: 0
ETag: W/"4-Yf+Bwwqjx254r+pisuO9HfpJ6FQ"
request-context: appId=cid-v1:c374023b-8354-459d-b51b-039919730c2c
Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Access-Control-Allow-Methods: GET, POST, OPTIONS, HEAD, PUT
Date: Wed, 26 Jan 2022 14:02:47 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 21ms
20ms Image
image/gif 23.41.169.149
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=31&hp=1&wf=1&ra=5&pxm=4&sgs=6&vb=8&kq=1&lo=0&uk=null&pk=0&wk=0&rk=1&tk=0&ak=-&i=TORONTO_PREBID_HEADER1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BYbjrG%3DH%3CU%3CO%24cRJ%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C2%2C2%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-vUthrZVsFccVxRDaTGndGCUc8IKBUGMSV3C%2FvEJM65hND7UVt69nIRrqyNQFcZFf7egP&rs=1-2Shgt24580cdYQ%3D%3D&sc=1&os=1-Bg%3D%3D&qp=10000&is=&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=11&g=2&fl=1&j=&xc=0&xb=0&xa=0&md=21&mc=0&lb=5713&ld=1200&lc=0&la=0&cw=1600&cx=1200&sh=5713&sr=0&sb=0&sq=0&sa=0&sn=0&sj=0&sm=0&si=0&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&h=4&w=4&rm=1&zGSRC=1&gu=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&id=1&ii=4&cm=1&zMoatIS=0&pl=1&f=0&t=1643205761238&de=619880097062&rx=538703511803&cu=1643205761238&m=6497&ar=3902fe7180d-clean&iw=1fea951&cb=0&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&le=1&ch=0&vv=0&vw=0%3A0%3A0&vp=undefined&vx=-%3A-%3A-&pe=1%3A881%3A1656%3A2792%3A899&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=4478&cd=3470&ah=4478&am=3470&xd=00&rf=0&re=0&wb=1&ai=5495&wr=5494&cl=0&at=0&d=thestar.com%3ASponsored%20%7C%20NORTON%20ROSE%20FULBRIGHT%20Enjoy%20complimentary%20Saturday%20Star%20Home%20Delivery%20with%20digital%20access%20or%20Digital%20Access%20only%3A__page__%3A-&gw=torontoprebidheader623296055317&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&ab=3&ac=1&fd=1&kt=null&it=500&oq=0&ot=0&zMoatJS=3%3A-&tc=0&fs=196551&na=960647706&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.41.169.149 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-41-169-149.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:47 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 26 Jan 2022 14:02:47 GMT

GET
H2 200 e
d.ndg.io/ 68 B
324 B 25ms
25ms Image
image/gif 52.20.34.81
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.ndg.io/e?i=682122018&o=7266708795&uu=322b1f51-486c-846b-74a8-e2a9a3c535f8&ref=&ii=0&t=1&c=2022-01-26T14%3A02%3A43&au=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&cu=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&u=&adb=0&vis=0&sh_fb=0&sh_tw=0&sh_li=0&sh_pi=0&sh_ot=0&s=0&rand=10031
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.20.34.81 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-20-34-81.compute-1.amazonaws.com
Software: /
Resource Hash: 63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058

Request headers

Referer: https://www.thestar.com/
Origin: https://www.thestar.com
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 26 Jan 2022 14:02:48 GMT
content-type: image/gif
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 68
access-control-allow-methods: GET, POST, OPTIONS
access-control-expose-headers: Content-Length,Content-Range

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 22ms
21ms Image
image/gif 23.41.169.149
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&wf=1&ra=5&pxm=4&sgs=6&vb=8&kq=1&lo=0&uk=null&pk=0&wk=0&rk=1&tk=0&ak=-&i=TORONTO_PREBID_HEADER1&ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5BYbjrG%3DH%3CU%3CO%24cRJ%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C2%2C2%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-vUthrZVsFccVxRDaTGndGCUc8IKBUGMSV3C%2FvEJM65hND7UVt69nIRrqyNQFcZFf7egP&rs=1-2Shgt24580cdYQ%3D%3D&sc=1&os=1-Bg%3D%3D&qp=10000&is=&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&vf=1&vg=100&bq=11&g=3&fl=1&j=&xc=0&xb=0&xa=0&md=21&mc=21&lb=5713&ld=1200&lc=1200&la=1200&cw=1600&cx=1200&sh=5713&sr=0&sb=0&sq=0&sa=0&sn=0&sj=0&sm=0&si=0&hq=0&hs=0&hu=0&hr=0&ht=1&dnt=0&h=4&w=4&rm=1&zGSRC=1&gu=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&id=1&ii=4&cm=1&zMoatIS=0&pl=1&f=0&t=1643205761238&de=619880097062&rx=538703511803&cu=1643205761238&m=7274&ar=3902fe7180d-clean&iw=1fea951&cb=0&ll=2&lm=0&ln=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&le=1&ch=0&vv=0&vw=0%3A0%3A0&vp=undefined&vx=-%3A-%3A-&pe=1%3A881%3A1656%3A2792%3A899&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5081&cd=4478&ah=5081&am=4478&xd=00&rf=0&re=0&wb=1&ai=5495&wr=5494&cl=0&at=0&d=thestar.com%3ASponsored%20%7C%20NORTON%20ROSE%20FULBRIGHT%20Enjoy%20complimentary%20Saturday%20Star%20Home%20Delivery%20with%20digital%20access%20or%20Digital%20Access%20only%3A__page__%3A-&gw=torontoprebidheader623296055317&zMoatOrigSlicer1=undefined&zMoatOrigSlicer2=undefined&ab=3&ac=1&fd=1&kt=null&it=500&oq=0&ot=0&zMoatJS=3%3A-&tc=0&fs=196551&na=341682067&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.41.169.149 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-41-169-149.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.thestar.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 26 Jan 2022 14:02:48 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 26 Jan 2022 14:02:48 GMT

GET
H2 200 e
d.ndg.io/ 68 B
324 B 25ms
25ms Image
image/gif 52.20.34.81
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.ndg.io/e?i=682122018&o=7266708795&uu=322b1f51-486c-846b-74a8-e2a9a3c535f8&ref=&ii=0&t=1&c=2022-01-26T14%3A02%3A43&au=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&cu=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&u=&adb=0&vis=0&sh_fb=0&sh_tw=0&sh_li=0&sh_pi=0&sh_ot=0&s=0&rand=15040
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.20.34.81 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-20-34-81.compute-1.amazonaws.com
Software: /
Resource Hash: 63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058

Request headers

Referer: https://www.thestar.com/
Origin: https://www.thestar.com
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 26 Jan 2022 14:02:49 GMT
content-type: image/gif
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
content-length: 68
access-control-allow-methods: GET, POST, OPTIONS
access-control-expose-headers: Content-Length,Content-Range

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: form.jotform.com
URL: https://form.jotform.com/jsform/220106406818247

Verdicts & Comments Add Verdict or Comment

237 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

109 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
e377.thestar.com/DG/DEFAULT	1970-01-20 10:02:45	Name: BCSessionID Value: 577e82e5-7a36-4085-9532-1930d371ab2b
torstar.blueconic.net/DG/DEFAULT	1970-01-20 09:12:21	Name: BCSessionID Value: 577e82e5-7a36-4085-9532-1930d371ab2b
www.thestar.com/	1970-01-20 09:12:21	Name: last_visit_bc Value: 1643205760704
.thestar.com/	1970-01-20 09:12:21	Name: bc_tstgrp Value: 5
.thestar.com/	1970-01-20 09:13:48	Name: _vwo_uuid_v2 Value: D32289A8ADD8292F80FE3620CD2E37C46\|f5e1c18143697ad9f787ca5374be0cba
.thestar.com/	1970-01-21 02:45:00	Name: permutive-id Value: 4be339fa-5317-4caa-bd13-9fdc1b54f761
.be54a597-6b6d-4e2d-9d31-642310a8db25.prmutv.co/	1970-01-20 02:36:21	Name: pxid Value: cb640cef-920d-46eb-9d06-c5979d20b6b9
.thestar.com/	1970-01-20 02:50:45	Name: _vis_opt_s Value: 1%7C
.thestar.com/	1969-12-31 23:59:59	Name: _vis_opt_test_cookie Value: 1
.thestar.com/	1970-01-23 16:02:45	Name: _vwo_uuid Value: D32289A8ADD8292F80FE3620CD2E37C46
.thestar.com/	1970-01-20 00:26:47	Name: _vwo_sn Value: 0%3A1
.thestar.com/	1970-01-20 02:36:21	Name: _vwo_ds Value: 3%3Aa_0%2Ct_0%3A-1%241643205760%3A79.08264089%3A%3A47_0%2C45_0%2C44_0%2C43_0%2C42_0%2C35_0%2C34_0%2C32_0%2C26_0%3A3_0%2C2_0%3A0
.t.co/	1970-01-20 17:57:57	Name: muc_ads Value: e101bc72-51e9-4ec3-8036-82342f050ce6
.adsrvr.org/	1970-01-20 09:12:21	Name: TDID Value: 98ec7b18-03f3-4f38-9fd0-bab1d9f133a3
.twitter.com/	1970-01-20 17:57:57	Name: personalization_id Value: "v1_1H3G6Zl7cpE0OTJDcm2wGg=="
www.thestar.com/	1970-01-20 01:09:57	Name: AccessToken Value: idv2kyvma8ailz4gqjb58dffewbgaiznnk
www.thestar.com/	1970-01-20 00:28:12	Name: ios-smart-banner-shown Value: true
.scorecardresearch.com/	1970-01-20 17:43:33	Name: UID Value: 173fd2c7e1d6f6e36ce383c1643205761
www.thestar.com/	1969-12-31 23:59:59	Name: userSegmentLogin Value: false
.thestar.com/	1969-12-31 23:59:59	Name: _igt Value: 58c11ba5-8125-4232-ccc6-ee35c98f349a
.thestar.com/	1970-01-20 09:12:21	Name: _ig Value: bc8d10ba-d37a-4195-968e-892d5ffe5c12
.thestar.com/	1970-01-20 17:57:57	Name: _ga Value: GA1.2.1142013295.1643205762
.thestar.com/	1970-01-20 00:28:12	Name: _gid Value: GA1.2.125428799.1643205762
.thestar.com/	1970-01-20 00:26:45	Name: _gat_UA-70431129-1 Value: 1
.thestar.com/	1970-01-20 00:26:45	Name: _gat_UA-73335503-3 Value: 1
.thestar.com/	1970-01-20 00:26:47	Name: _parsely_session Value: {%22sid%22:1%2C%22surl%22:%22https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html%22%2C%22sref%22:%22%22%2C%22sts%22:1643205762170%2C%22slts%22:0}
www.thestar.com/	1969-12-31 23:59:59	Name: BCSessionID Value: 577e82e5-7a36-4085-9532-1930d371ab2b
www.thestar.com/	1969-12-31 23:59:59	Name: latestContentTier Value: 0
torstar.blueconic.net/	1970-01-20 00:36:50	Name: AWSALBCORS Value: 40CZNAwSvRSYvNPb1b2txLY83jIHsfPFjQotS82gGlnaj2MYEo4LLyaH+Oclb+hQUj6zYnypo1lzAHBMb2kKI8DUUA0FFzfF3ukkibLP+9FQ3cBgxUN5FcPK5ApP
.thestar.com/	1970-01-20 09:56:09	Name: _parsely_visitor Value: {%22id%22:%22pid=fbe81301c2fea280f1d4fad0829c1671%22%2C%22session_count%22:1%2C%22last_session_ts%22:1643205762170}
www.thestar.com/	1970-01-20 09:12:21	Name: rememberMeML Value: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html
e377.thestar.com/	1970-01-20 00:36:50	Name: AWSALB Value: bEOKIsGH0mCUE/3rXHGhpogfxExp2pEeyu7MsU59yIB7pJ9O8Ck0V83tOx0CS9MgLCYoGOPBHmZx2fdfvhERfeVmEdTOOr8c9g032aTnzjfCo4Gkq+WWGdNAxt9j
e377.thestar.com/	1970-01-20 00:36:50	Name: AWSALBCORS Value: bEOKIsGH0mCUE/3rXHGhpogfxExp2pEeyu7MsU59yIB7pJ9O8Ck0V83tOx0CS9MgLCYoGOPBHmZx2fdfvhERfeVmEdTOOr8c9g032aTnzjfCo4Gkq+WWGdNAxt9j
.demdex.net/	1970-01-20 04:45:57	Name: demdex Value: 29182792948317073581956995184761942639
.thestar.com/	1969-12-31 23:59:59	Name: AMCVS_19A568F454F72DAF0A4C98A6%40AdobeOrg Value: 1
.creativecdn.com/	1970-01-20 09:12:21	Name: u Value: s0WRDZ573Zm9mQraswGZ
.creativecdn.com/	1970-01-20 09:12:21	Name: ts Value: 1643205762
.acuityplatform.com/	1970-01-20 09:12:21	Name: auid Value: 642723330272
.acuityplatform.com/	1970-01-20 09:12:21	Name: aum Value: "OikKAfqbdXNlck1hdGNoQnlVc2VyTWF0Y2hpbmdJZE1hcPqCMTM3+o11c2VyTWF0Y2hpbmdJZCQEkpFsYXN0RHJvcFRpbWVNaWxsaXMlAT8lViFrlJhsYXN0U3VjY2Vzc2Z1bE1hdGNoTWlsbGlzJQE/JVYha5SPdGhpcmRQYXJ0eVVzZXJJZCH7+4Z2ZXJzaW9uwvs="
sync.srv.stackadapt.com/	1970-01-20 09:12:21	Name: sa-user-id Value: s%3A0-db73f390-5b4d-4fdb-6c70-5984f519002d.61tV5sxsVA7bCo9ijz3f8gLNlhXifARGIZc4XVvADlw
.srv.stackadapt.com/	1970-01-20 09:12:21	Name: sa-user-id-v2 Value: s%3A0-db73f390-5b4d-4fdb-6c70-5984f519002d%24ip%24149.56.153.187.G0X66T8jxuluDFQS3GGUjXW5vPPwOjTTbZGjLdOBR5A
.dotomi.com/	1970-01-20 00:26:45	Name: DotomiTest Value: 6485acaf3a99120c
www.thestar.com/	1970-01-20 00:31:04	Name: digitalAccessOverlayStatus Value: nextPage
www.thestar.com/	1970-01-20 00:33:57	Name: digitalAccessOverlaySubscriberStatus Value: nextPage
.thestar.com/	1969-12-31 23:59:59	Name: __psid Value: 1643205762513
.everesttech.net/	1970-01-20 09:12:21	Name: everest_g_v2 Value: g_surferid~YfFUggAAAE3qCwQr
.thestar.com/	1970-01-20 17:57:57	Name: s_ecid Value: MCMID%7C29146150011500704841956147357525731429
.dpm.demdex.net/	1970-01-20 04:45:57	Name: dpm Value: 29182792948317073581956995184761942639
.thestar.com/	1970-01-20 02:36:21	Name: _fbp Value: fb.1.1643205762667.2117303762
.thestar.com/	1970-01-20 17:57:57	Name: AMCV_19A568F454F72DAF0A4C98A6%40AdobeOrg Value: -2121179033%7CMCIDTS%7C19019%7CMCMID%7C29146150011500704841956147357525731429%7CMCAAMLH-1643810562%7C9%7CMCAAMB-1643810562%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1643212962s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-19026%7CvVersion%7C5.3.0
.facebook.com/	1970-01-20 02:36:21	Name: fr Value: 0YoXwFaVfsQQI4vGb..Bh8VSC...1.0.Bh8VSC.
.thestar.com/	1970-01-20 02:36:21	Name: _gcl_au Value: 1.1.2126384688.1643205763
.districtm.io/	1970-01-20 00:52:40	Name: _dm_uid Value: eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJzaWQiOjEwMDAwLCJ1c3IiOiJxZ2E0QWJJR0d6STBSWEJ0ZVVkWGNEYzVaRE5wV1hsWGJIUjZVWG8wYW5Ock1ib0dJQWlYVGhJYlFVRkJSMkZGT1RsbWEzSkRlVkZPU1VSV2NFeEJRVUZCUVVGQnVnWVZDS0JPRWhCWlprWlZaMmRCUW1WT2VuUnhRVUpJdWdZUkNLWk9FZ3cyTkRJM01qTXpNekF5TnpLNkJpQUlxazRTR3pJelVIcHJSblJPVkRsMGMyTkdiVVU1VW10QlRGcFZORzFpYzdvR0dRaXJUaElVY3pCWFVrUmFOVGN6V20wNWJWRnlZWE4zUjFxNkJnTUlyazY2QmdNSXNFND0iLCJpYXQiOjE2NDMyMDU3NjJ9.AqLZtnvzeNWHwvhe_DFTWu0C03Mxm93S9r4WaRux4dz00CxeUBmNSv6sLiVNNPKorkYVg0wb_qT4ldw3ZnB9RA
.thestar.com/	1970-01-20 09:12:21	Name: _pin_unauth Value: dWlkPVpURXpNVGs0TlRVdE5HUm1OaTAwT0dFM0xUZzVaVGN0WXpSaE16VTBNMkpsTkRVdw
.thestar.com/	1970-01-20 02:36:21	Name: _rdt_uuid Value: 1643205763314.b42580f3-d5ff-44f7-94bb-f0b64ca49a72
.bing.com/	1970-01-20 09:48:21	Name: MUID Value: 2B4417828F086C17380906BA8EA26D60
.bat.bing.com/	1970-01-20 00:36:50	Name: MR Value: 0
.thestar.com/	1970-01-20 00:28:12	Name: _uetsid Value: a1ac28107eb011eca6a46d9669f272e3
.thestar.com/	1970-01-20 09:48:21	Name: _uetvid Value: a1aca6e07eb011ecb27795ca4526572b
.thestar.com/	1970-01-20 17:57:57	Name: ndg Value: 322b1f51-486c-846b-74a8-e2a9a3c535f8
.thestar.com/	1970-01-20 01:09:57	Name: s_nr Value: 1643205763460-New
.thestar.com/	1970-01-20 09:12:21	Name: s_nr2 Value: 1643205763461-New
.thestar.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.doubleclick.net/	1970-01-20 17:57:57	Name: IDE Value: AHWqTUk1GpmVChIN5M7K7qfZCA4CYwVIgtBJ7nB5M6m3dBkadhEmMhe7ZHRNqWwyQV4
.linkedin.com/	1970-01-20 02:36:21	Name: li_sugr Value: 73ec822e-514c-4c2d-b5ea-aa4ff5250b72
.ads.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.linkedin.com/	1970-01-20 17:58:39	Name: bcookie Value: "v=2&3a5742df-60d7-4866-838b-d4b17d8b531e"
.linkedin.com/	1970-01-20 00:28:12	Name: lidc Value: "b=VGST06:s=V:r=V:a=V:p=V:g=2288:u=1:x=1:i=1643205763:t=1643292163:v=2:sig=AQFjFv2FUIXo5TNpo9P3Uvowh9HP4-s8"
.linkedin.com/	1970-01-20 01:09:57	Name: UserMatchHistory Value: AQLjkF4tYYTLoAAAAX6WsiGzXuXYKAoxoIc-jYdIq4iOzQwfLi1pFBLLsbWV0FDIbNSH6PLAmKKgQQ
.linkedin.com/	1970-01-20 01:09:57	Name: AnalyticsSyncHistory Value: AQJTJG_NAt1mHwAAAX6WsiGzb7XouYWxrnzcpQPGd-5X6TZgtwyLqI4Tw2t7yayL9KpNaH8IConMwBT4ERXzWg
www.pinterest.ca/	1970-01-20 09:05:09	Name: _pinterest_sess Value: TWc9PSZ3RXJySzcrdk5XN3pGNW9sdjhIZXlkYnBCc0FOdUhrZWFjTXBIMDBTUVB6MkFsMFdKWmd2TUhuUDlQbTEvL0JjT1pjUmMwSE0ybDFNcjBTY09LWGVBZVN3L0VuZit5ODFSZlNwWjdheVZ4WT0mSlE4akc3SmpxSzBuU1JkKzN2dUVjSFE3N0hFPQ==
.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.www.linkedin.com/	1970-01-20 17:58:39	Name: bscookie Value: "v=1&20220126140243fffcce37-f1ef-4913-8b41-da71d2547dc9AQGl7tn1gD8y3M5l_rSE3g66PMnzAQtu"
.thestar.com/	1970-01-20 09:12:21	Name: _clck Value: o7f9jb\|1\|eyg\|0
.c.bing.com/	1970-01-20 00:36:50	Name: MR Value: 0
.c.bing.com/	1970-01-20 09:48:21	Name: SRM_B Value: 2B4417828F086C17380906BA8EA26D60
.c.clarity.ms/	1969-12-31 23:59:59	Name: SM Value: C
.clarity.ms/	1970-01-20 09:48:21	Name: MUID Value: 2B4417828F086C17380906BA8EA26D60
.c.clarity.ms/	1970-01-20 00:36:50	Name: MR Value: 0
.c.clarity.ms/	1970-01-20 00:26:46	Name: ANONCHK Value: 0
.thestar.com/	1970-01-20 00:28:12	Name: _clsk Value: 11yollq\|1643205763752\|1\|0\|j.clarity.ms/collect
.adsymptotic.com/	1970-01-20 02:36:21	Name: U Value: 2d5176e89829613b39ae6a7748697224
.openx.net/	1970-01-20 09:12:21	Name: i Value: d9854634-3245-0c15-2adb-e6bf3c714875\|1643205764
.yahoo.com/	1970-01-20 09:12:43	Name: A3 Value: d=AQABBIRU8WECEP6_tcHIuf7FlZxfFMFX5UQFEgEBAQGm8mH7YQAAAAAA_eMAAA&S=AQAAAotzgovIUKf57ifOX72kt3o
.rubiconproject.com/	1969-12-31 23:59:59	Name: rsid Value: 1\|AsOwY0YD/NGDdiiv4cs9DA3hi90NfvHF0Bo+SpLxVVZ2/pSVYm6PRMWYCqaOieGkTxzCtT3GWjvGeUmnD2WgFA74oVwAuQdeukQVJpiMCxkjzG3GXfABU6uTSg==
.adnxs.com/	1970-01-20 02:36:21	Name: icu Value: ChgIw7JKEAoYASABKAEwhKnFjwY4AUABSAEQhKnFjwYYAA..
.adnxs.com/	1970-01-20 02:36:21	Name: uuid2 Value: 4244130733842794831
.amazon-adsystem.com/	1970-01-20 06:23:52	Name: ad-id Value: AwfeT6pwg05nnAEcjW-9fh4
.amazon-adsystem.com/	1970-01-21 21:49:48	Name: ad-privacy Value: 0
.rubiconproject.com/	1970-01-20 09:12:21	Name: khaos Value: KYVMAA4U-Z-LMBI
.openx.net/	1970-01-20 00:48:21	Name: pd Value: v2\|1643205764\|vMbwgag2gKvPhEkWgyiK
.openx.net/	1970-01-20 00:48:21	Name: univ_id Value: 537072971\|98ec7b18-03f3-4f38-9fd0-bab1d9f133a3\|1643205764323241
.thestar.com/	1970-01-20 00:26:47	Name: _ndg Value: c41dcfbe-4adc-87ea-395a-a53e834e21f7
.rlcdn.com/	1970-01-20 09:12:21	Name: rlas3 Value: 7whCdaDfLFyIoXS/wy/6zgi3P/ALG/S5wsy85ITfwco=
.advertising.com/	1970-01-20 09:13:48	Name: APID Value: UPa24aaec3-7eb0-11ec-bab7-0e3b021ff725
.turn.com/	1970-01-20 04:45:57	Name: uid Value: 3326741634532946709
.rlcdn.com/	1970-01-20 01:53:09	Name: pxrc Value: CISpxY8GEgUI6AcQABIFCOhHEAA=
.analytics.yahoo.com/	1970-01-20 09:13:48	Name: IDSYNC Value: "18y3~22vq:18za~22vq"
.yahoo.com/	1970-01-20 00:34:33	Name: APID Value: UPa24aaec3-7eb0-11ec-bab7-0e3b021ff725
.yahoo.com/	1970-01-20 00:28:12	Name: APIDTS Value: 1643205764
.adsrvr.org/	1970-01-20 09:12:21	Name: TDCPM Value: CAESFAoFb3BlbngSCwiw-bbs0bewOhAFEhYKB3J1Ymljb24SCwiy0M_t0bewOhAFGAEgASgCMgsIssjSmui3sDoQBTgBWgdydWJpY29uYAI.
.pippio.com/	1970-01-20 09:12:21	Name: did Value: 8lsAnouNonyWfP8c
.pippio.com/	1970-01-20 09:12:21	Name: didts Value: 1643205764
.pippio.com/	1970-01-20 01:53:09	Name: nnls Value:
.pippio.com/	1970-01-20 01:53:09	Name: pxrc Value: CISpxY8GEgQIAhAAEgYI7OsBEAA=
.linksynergy.com/	1970-01-20 09:12:21	Name: rmuid Value: 6fc6f59f-0a70-43b4-8af8-ccf0ea43162a
.linksynergy.com/	1970-01-20 09:12:21	Name: icts Value: 2022-01-26T14:02:44Z
.rubiconproject.com/	1970-01-20 09:12:21	Name: audit Value: 1\|clb2f5t+FPovUX98Kci0Ve1WuCoMxA8a+JUixCbOKdrWDxYPRcXl/B71tf7iY8+WJnVK4du/kQYBe6rrPfJxN+CAnekPgJibPXCGP7cmfNfQD5U7tEfUTQ==
.thestar.com/	1970-01-20 09:48:21	Name: __gads Value: ID=e3c103196e01636e:T=1643205764:S=ALNI_MYXWihJ7NcNMcvUtzhDjdylorC7Bg

21 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html(Line 122) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://dev.visualwebsiteoptimizer.com/deploy/js_visitor_settings.php?v=1&a=354908&url=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&random=0.8738423212808157, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html(Line 122) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://dev.visualwebsiteoptimizer.com/deploy/js_visitor_settings.php?v=1&a=354908&url=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&random=0.8738423212808157, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://dev.visualwebsiteoptimizer.com/deploy/js_visitor_settings.php?v=1&a=354908&url=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&random=0.8738423212808157(Line 2) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://dev.visualwebsiteoptimizer.com/7.0/track-3a8c03cc83fd9c554b5af6e1cc1ffa80.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://dev.visualwebsiteoptimizer.com/deploy/js_visitor_settings.php?v=1&a=354908&url=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&random=0.8738423212808157(Line 2) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://dev.visualwebsiteoptimizer.com/7.0/track-3a8c03cc83fd9c554b5af6e1cc1ffa80.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://dev.visualwebsiteoptimizer.com/deploy/js_visitor_settings.php?v=1&a=354908&url=https%3A%2F%2Fwww.thestar.com%2Fsponsored_sections%2F2022%2F01%2F13%2Fnortonrose.html&random=0.8738423212808157(Line 2) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://dev.visualwebsiteoptimizer.com/analysis/4.0/opa-608d8314e5c4b9c6caefe04b8ad484ca.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html(Line 140) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://d5phz18u4wuww.cloudfront.net/vis_opt.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://www.thestar.com/sponsored_sections/2022/01/13/nortonrose.html(Line 140) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://d5phz18u4wuww.cloudfront.net/vis_opt.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://d5phz18u4wuww.cloudfront.net/vis_opt.js(Line 218) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://dev.visualwebsiteoptimizer.com/7.0/vis_opt-3a8c03cc83fd9c554b5af6e1cc1ffa80.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://d5phz18u4wuww.cloudfront.net/vis_opt.js(Line 218) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://dev.visualwebsiteoptimizer.com/7.0/vis_opt-3a8c03cc83fd9c554b5af6e1cc1ffa80.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network	error	URL: https://api.rlcdn.com/api/identity?pid=2&rt=envelope Message: Failed to load resource: the server responded with a status of 451 ()
network	error	URL: https://www.thestar.com/api/overlaydatarule/2021-q1-shop-low Message: Failed to load resource: the server responded with a status of 404 ()
other	warning	URL: https://www.googletagmanager.com/gtag/js?id=DC-10230056(Line 40) Message: Unrecognized feature: 'attribution-reporting'.
other	warning	URL: https://www.googletagmanager.com/gtag/js?id=DC-10230056(Line 40) Message: Unrecognized feature: 'conversion-measurement'.
javascript	warning	URL: https://ad.doubleclick.net/ddm/adj/N7050.197812.NSO.CODESRV/B24540798.279406836;sz=1x2;ord=193952878358? Message: Failed to execute 'write' on 'Document': It isn't possible to write into a document from an asynchronously-loaded external script unless it is explicitly opened.
javascript	warning	URL: https://ad.doubleclick.net/ddm/adj/N7050.197812.NSO.CODESRV/B24540798.279406836;sz=1x2;ord=193952878358?(Line 142) Message: Failed to execute 'write' on 'Document': It isn't possible to write into a document from an asynchronously-loaded external script unless it is explicitly opened.
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'nonce-c1ce432cc49b7d7374f3af83a5df075c' 'strict-dynamic' 'report-sample' 'self' .pinterest.com .pinimg.com .google.com connect.facebook.net .online.tableau.com .google-analytics.com .facebook.com .googleadservices.com .doubleclick.net .googletagmanager.com .adyen.com .adyenpayments.com cdn.ampproject.org .cdn.ampproject.org radar.cedexis.com *.cedexis-test.com www.gstatic.com/recaptcha/ www.recaptcha.net 'unsafe-inline'".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'report-sample' 'self' .pinterest.com .pinimg.com .google.com connect.facebook.net .online.tableau.com .google-analytics.com .facebook.com .googleadservices.com .doubleclick.net .googletagmanager.com .adyen.com .adyenpayments.com cdn.ampproject.org .cdn.ampproject.org radar.cedexis.com *.cedexis-test.com www.gstatic.com/recaptcha/ www.recaptcha.net 'unsafe-inline'".
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'interest-cohort'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'interest-cohort'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'interest-cohort'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'interest-cohort'.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

10230056.fls.doubleclick.net
167d3cc6f273bda69ec806982123f22e.safeframe.googlesyndication.com
ad.doubleclick.net
ad.turn.com
ads.yahoo.com
adserver.pressboard.ca
adservice.google.ca
adservice.google.com
alb.reddit.com
analytics.twitter.com
api.permutive.com
api.rlcdn.com
as-sec.casalemedia.com
bat.bing.com
be54a597-6b6d-4e2d-9d31-642310a8db25.edge.permutive.app
be54a597-6b6d-4e2d-9d31-642310a8db25.prmutv.co
c.amazon-adsystem.com
c.bing.com
c.clarity.ms
c2shb.ssp.yahoo.com
cdn.districtm.io
cdn.jotfor.ms
cdn.ndg.io
cdn.parsely.com
cdn.petametrics.com
cdn01.jotfor.ms
cdn02.jotfor.ms
cdn03.jotfor.ms
cdnjs.cloudflare.com
cm.everesttech.net
cm.g.doubleclick.net
connect.facebook.net
ct.pinterest.com
d.ndg.io
d1nxn87txdj54y.cloudfront.net
d1z2jf7jlzjs58.cloudfront.net
d5phz18u4wuww.cloudfront.net
dev.visualwebsiteoptimizer.com
districtm-match.dotomi.com
dmx.districtm.io
dmx.us-east-34.districtm.io
dpm.demdex.net
e377.thestar.com
eus.rubiconproject.com
events.jotform.com
fastlane.rubiconproject.com
form.jotform.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
hb.districtm.io
htlb.casalemedia.com
ib.adnxs.com
id.rlcdn.com
idsync.rlcdn.com
images.thestar.com
j.clarity.ms
js-sec.indexww.com
match.adsrvr.org
mb.moatads.com
p.adsymptotic.com
p1.parsely.com
pagead2.googlesyndication.com
pippio.com
pixel-us-east.rubiconproject.com
pixel.advertising.com
pixel.rubiconproject.com
platform.twitter.com
pr-bh.ybp.yahoo.com
px.ads.linkedin.com
px.moatads.com
px4.ads.linkedin.com
query.petametrics.com
resources.thestar.com
s.amazon-adsystem.com
s.pinimg.com
s.thestar.com
sb.scorecardresearch.com
secure.adnxs.com
securepubads.g.doubleclick.net
sejs.moatads.com
snap.licdn.com
sr.studiostack.com
static.ads-twitter.com
stats.g.doubleclick.net
sync-tm.everesttech.net
sync.srv.stackadapt.com
t.co
tags.rd.linksynergy.com
token.rubiconproject.com
torontostar-d.openx.net
torontostarnewspaperslimited.demdex.net
torstar.blueconic.net
torstar.gscontxt.net
tpc.googlesyndication.com
u.openx.net
ums.acuityplatform.com
unpkg.com
ups.analytics.yahoo.com
us-u.openx.net
us.creativecdn.com
www.facebook.com
www.google-analytics.com
www.google.ca
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.googletagservices.com
www.linkedin.com
www.pinterest.ca
www.pinterest.com
www.redditstatic.com
www.thestar.com
z.moatads.com
form.jotform.com
104.105.42.146
104.16.190.66
104.18.101.194
104.244.42.133
104.244.42.195
104.77.220.247
107.178.254.65
108.174.10.14
129.213.193.172
13.225.214.17
13.225.63.104
13.225.66.81
13.226.25.39
13.226.31.20
13.226.39.10
13.33.81.146
142.250.64.102
142.250.64.66
142.250.72.98
142.250.80.70
142.251.40.130
142.251.40.226
143.204.137.197
151.101.1.140
151.101.130.49
151.139.128.11
18.233.32.212
185.184.10.30
199.232.64.157
20.36.253.92
20.49.104.19
20.85.30.134
2001:4998:1c:800::1000
209.54.176.128
23.41.168.244
23.41.169.149
2600:1400:b000:5a7::1931
2600:141b:13::17d7:826a
2600:1f18:4e9:5a05:cbbe:ce00:264f:b9b8
2602:803:c002:200::52
2606:2800:220:de:468:2285:c1:4a3
2606:4700:11::6817:850b
2606:4700:20::681a:686
2606:4700:20::ac43:49b8
2606:4700:3033::ac43:c8a1
2606:4700::6810:135e
2606:4700::6810:7caf
2606:4700::6812:451
2606:ae80:1450:15::1720
2607:f8b0:4006:80b::2002
2607:f8b0:4006:80d::2002
2607:f8b0:4006:817::2001
2607:f8b0:4006:81e::2002
2607:f8b0:4006:81e::2003
2607:f8b0:4006:81e::200e
2607:f8b0:4006:81f::2008
2607:f8b0:4006:820::2002
2607:f8b0:4006:822::2004
2607:f8b0:4006:823::2001
2607:f8b0:4023:1404::9c
2620:112:f002:bbbb::21
2620:1ec:21::14
2620:1ec:c11::200
2a03:2880:f012:10c:face:b00c:0:3
2a03:2880:f112:182:face:b00c:0:25de
2a04:4e42:200::396
3.213.3.60
3.33.220.150
3.92.156.8
34.107.254.252
34.120.155.137
34.193.47.203
34.210.248.36
34.73.194.24
34.96.102.137
34.98.64.218
34.98.67.3
35.174.252.231
35.190.14.224
35.190.60.146
35.201.118.58
35.241.9.51
52.20.34.81
52.40.172.46
52.45.33.138
52.88.252.250
54.144.144.142
54.175.198.118
68.67.161.205
68.67.178.15
69.173.151.100
69.90.254.78
8.39.36.142
96.6.23.240
99.84.125.59
99.84.42.91
011ff3b020fb5d77556d53df2c959daa06d395d626fd98cacdfc0b16c1b71c02
03675051dcfe2faeff99cb431518df44c07ca3ea15a48fe36c0ecc990fc136d1
04686da390f8eec3ccd75869fa71e22cad452cfcff6ffa31c979f599d64831d8
046ff6f854bf54aea753da921e703c5a8eb91e52ddda852f7ac18f8cec09ebf8
04d439e000eb278a036c741b3a0b3ddb4b22087ff0bbb9342a6be5dc7d1ab60a
05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf
0659a91e86a2de4047daaefdc9c513c051bd54135347ba21788a345e19114fcd
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
08e927691b520077554f3074c594ab417fe6881d32bfc9c3d5e8515957afd2e1
098ac1fe26b8dcbf76d32aa5db27e6112d093743f9a3e4df1dc529c131df4363
0aade1454de72aaab14b0ce231e3be92dffd5fe6ff7c1d97498612a0c377edd8
0ae8edb5535f481c43a3f80a93269bba430ba3e6503de152f1dfec02cea97e03
0b5f16fa5f9a7d522591f39bdfe2961c4e77d4d2281c8a7883d1724eab94fb79
0b60c250ebdecf0f6c1098a8304ca46a7b20deccf0e6865e169a49dcdb590f6f
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0c5b74810ea1e16858fe56373ea9b0fa0a0671d8ef084a7e096086979c3d8637
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
133d99ecc7e1f65d2e0bdc9d04fae746f2e9b820213b2a2df7fed60ba073475e
1433f4f745ede48da1ce2bacdd82721a8b2ca9ed3edad5efa507e59edf5289ce
144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8
15486ae0b475fb394d4c5ca29ac030f0d68a2c5c906afe9cc6b020627ebd8e1a
163afcf9152c411190e29bb5595f6873816972adbe66e178f9fb6f43e07ad91e
1847a20221574e502fe81b1b8fd77734dc3ae378bc7b2745cd2144980ed9e365
1e14a0ec1e855669dc3808b149b8cf9c63c115ba3f601c051a26d8b6b05d92ba
1e56b1a64dbd16a02a66360643e5b260c0cfeacc5cb7c0422b99064f3edb2951
1e74a5d864922eeebc4a67c92658e7b78a7bafc674fc7c4425d5b97ffc76dc5a
2039446f8956518da2c2d70116d18c92fac3b04110942de074748aa4041067fb
2073d4557f2b7323a2a0d6c656c478b031eb2c5b6190261d5fdccaed74c3f1b6
23d33ed5ec9e53a9ee4e4b65c9b53755c6dc806e7faf661c41aec564c7f30fef
257897a5abe39df95df7900e51d84f4de85877513337efdf2e97e0ef36622ae2
261b19d19129e9475642603543d240ff2a024a5a5d34cf9e95048bb1df789769
27beeba23682336597600e18159da8ff6bb418008f46b6ad7b6a790585105986
28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9
2a767bbec1a4ac999a027520af58a654b74e2e54f6af0960b46384f00b550481
2a9985346636b1ba338c34b11e4083dc11cec0b1067d396dc2c44c685ae03a01
2b3334ae35d100a66c0d08b4405e2e334f495cda27b564b38e7eabb08607fdee
2c39fecd7b1515602418dcb155b2f45bcd23b3b71c95c0d5b21c9f06c937cbac
2c920092a8bfebe9b51a94ca573807f4e38de67289b06013c954f4743dff5cc7
2d4905abac6646552652568b8199976a4fea4098ebf9126d41da554902f1da05
2d767fe00284ba315844a0f61f8f69721df84ca58781e8b960455fee618c9778
30abb3e0f8dc461f6e1a3e5d8ed0116d97a75e31343af1714188ca19c7fd7644
31231837ec68070c16a8cdedebef3c1d353b9d320e3d84a0f79bb08e01604e58
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
37b17c5135a176a9474521af147d96dfa1fb4ca0f43f00d1400bd1885be3ab9b
38254c821b6bec9ee36bb8116cf81a16b0a9c2a51f97cacdb483b4fdeb6e3821
3b398752b22b0bc3f5bd5d8deec5f57f87d29d476d0e98c8aaebab7513e4cd4f
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390
40549bcca36cf054154743c855e0e25f7c34a77bd58809b62e1d037b17cfe661
417adb799f117f9f9845002eea4a607fb95d64e57db8feb1b9b573fe1e4fb600
4317eb61f84a1debbcbc4de453ed70ddf585e25d3a519edd5cf086829127cbb3
43a4b6225a3b99fa767109c00c59c2630eff4ec517d7254d573e505329446b2c
4466f366b2897f4839ba95e1b5d96fa3c3e11cadb7fe0096afb3a5a97b872ffb
448edd4a71b4ca28931010c1c2166872801702a420ff549a7c757edf863d7530
473b0dcf052a646dc08b2f0d32f96ac6cb8ed5dfbdb215212c7cc8f97ff7dc46
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
48e6d618b95c55074ab9b47a6e7bd966c9fd434b874e2c2e2606c5ec0f992982
49176b244de4b07d2a8a79cd8663a2fced053acc22b1807929521665d09f3e3a
49d65831c7e98a7d885d223699a41198204329efff9d1904c8af71323f613d68
4b123f8e3a4b0db9c32f6add4b53ac3b66afecd0ac6c0b17a90e1451642f7418
4c9a6bfaa9eb3219c33fe9a77d13c5aa2f6eb17a72bb5c09372e56351a57ea0c
4d23d35ef196077142ffcc5a4557a98e5a0b3dc1ba7432d103efcd5aa5bb138d
4da3e3aa30b5b06390d7e7e3fcfb16d648909eb429d161c2748bd6d79a7ec5fb
4da8f4d2d20833c254b092ab30d0ebaee5e3d93716e320773ff55c27c353796b
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f42b355fb802a26059b40048576fe9e61ab5a4ee39971b20a812ca10b2da540
4f72b8caea92dbc2422817753915f814b16ef6def30a2b6c6a109fb0c6cecf00
502a19bd8010b390245ee5ce7cab84a4250da24d548828b555a53a68cfbd8db9
503cb1783296b0f0af11e1761b11d57f89cab27954558c0dae6940943ca6eed7
52cac1193a3683e35353723a38e01a9bcc0c5f9bf2be42d29c96905527c7923d
53e47f0803e3983ae0b26db5f39e87c0bfd327981749c02c9e2f955341e34d7b
54ecac46ec4e41cab653a43dc1b9b094a1195bbfe300fd2b5ca791168c3dcae3
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
55c9d2f019f9d7ddfd69b2ad0351c5617338a222362aebb02b3b98a4dbc18486
5955908348c9dc49badb9b08e2448d49db335f16720edaf1bf6cbe67692129ae
5c3dbfb84c509437cbbb9209c8717e0df34927af36cdfd8456e3debd02f3ac4e
5cb58980d85cf281723d540bba89bab8667e9929132da9cf516b39cbf6afb4c1
5eececf03caa91176a2c2a3cbd5a38e49f3533d7591d3d659b61db5993355254
5f5466f44e74c501df50e271f39051d8ca297bfcb1dd30e963df88964152c8db
5f8f2739eab8542e8316b8d27f96040f31ae37bba3f5247dc55a7a32d1eac773
60338a45007e4d21670374bab19b7df2bde9acd957067c181a065263eeac77a1
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
62f586be8571b23584eb4a60a45a3157ff7c8388b1b1e3b4e8890e243b3e47de
6386a77fe21e1406592d82339e40a525295b5a3f389ee8832376b13773112400
63cea384f876e08336881b80d3594caa09df42aef38cf06992fbaace240346c1
63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058
65464aa39ed3fa1bc0c92afd3b67a1c45297705189b59a7db860137278c1de7e
66304453632b6c45dc2ade3790861f135aac13f668c74fd64eca4f5fb6bf5707
69773e0e2625f165da9eac9c1272f990a8c1307e13e2d8b2d078261a8f4210f2
69ae5b8ad4472b900290fbd0a5cb90813eedcd0f9f364badd2236eb9ae622b96
6a5d134ce0702f55663b83e6d4a9d300e38f9328f96f1651419111712f9f02cb
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6c6bd4f1d599be4d43843b7dbf5ec5e134cd7aec0c900ac1c030ead10bbe4ea1
6c903a1bde8e769429d7a9f38a47214a6ee15e31b407cc4436a40a230556e868
71824f15db54e51d373424315230faff0acab475cd1a062a1830ef7366942052
73b783357e1ed270e36ebc7846a8477f3d0d44e457405f46926ee2dc2a7db692
776083d5db69f039483812ca84197495adbbd0bc69de4e967bf201d3c0e625ac
77c78b15436725243d182c25b4887bf8c7377ee3658b27de524ff767493daa7b
78ebbfd435720d8bf86585473506389f98cb639207589f6280d1a9a141df866d
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7c83d8a33e5c560ed77f4c04f0238ec3ecad5b838104c844b7f42b10342c95d3
7d5f456fd98c1b919d5f1df7e888587605996d471a6bc33ef5da733b002c1373
81b7b28fdb0ee6ed7f0a1452ca13473a59c9e2c0b1bd560ab5b4bb2371120389
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
86c766a629561f83ab93e2ed07dd397c504811f05e9eb6f97d0c33ace663c607
87e3314fa5f650d537089a1858ef876765aabbbf6aec26de82fb48f80c35b4ce
88a204ed5ddd9041bfb6b1f4cc99579ac4b8c0dcd0ad3efdf7d590f84229834a
8cbd246e3c6473e7a092ad1c202fa0ed50c2fafac6ee80b8295a3ba2982d6ec6
8cf597f90b8dea903f8bd2caa32e7a8ca9b220c2a2d28a1a70d14a46e2dce11a
9043405e2f76688f3c01c480555dfd1c453fdcd6508319991c926e65b9d124d9
930e145b4ec9b56aa495a4cb5f87269e3c8076d644f6d35ee90b19f948c92105
943c463a554b176fa14b6855041dedbf3432b7549faa14edd2e7f6b0d92fb5d5
945fa1102d7171aaa3abdb1b5dcef89476989aca1bc640ef30cf3643cd719de4
9474557b14923e78c9b0b7b44bccd0d7018187fb0150095946932a071f155933
95f4db14172013eb07b61d3933cdcee02d39e70569f86e2d445e637db2d62547
982aa9ad2147f7acf4693df772516b751a9c128c41fbec55d057b8e19e42f8de
989d94d8baba214a6dcc1ba6795c35dc9ce9cf94863248b8970cd8e864674347
99affd7a1c868ecf15a0789fc85e87ca23ae783e7916aee316e6282d9777369c
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9b3f8f4f322b5b7c3fa18a87e5193818dab66fa8f89af5d0b5bd0839a95adcd3
9b4fd2bac023c59fa666614872a2a06a413659ca1b03eb71c3ad32298b2366dd
9dcb057b6332f78f4e69a8393f2666e34b96a7d90f1efa010cbac0db8426195e
9e1f018d61459b72d85b17e35be89314babf43e787526a23180fcdb31ddf9e6d
9e8686ffee1ae1ccecf16477cfcec31813e6d86c10116afefe315a74ccdc7686
a1521a03c0c72d02bcc4fc12b35be28d4da3aa2d6ea870b775e158993a55cfd0
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79
a32864919f884a41f1c9ddca9e8b12da54017b7d4a80e888db92bdd453a0d963
a4014f0c8b9e63c213f09c9c16823fd64e9905c6008b94fb5ed8623be4ff0eb9
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a4ff587ec63d11ce6d3bdac8eb00ad87a15c545e5aae914977af3a596b1686fb
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
a85ea540e774d24b3472a92b0e69b48634c76af3a0dfce7d10ed473163285984
aaa9be8950626f7ddaab3a34bf3ce7a213ab3d592490879345177bf635089bf0
ab199625a90b8111a0ae408ef6b43ae28dd55ad6d2fa2524666c169b5b1262bc
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ace17341101ef0613bf776951455c946cf1bd7a9916e67deb171d360343a687c
acf47ed08e03deb30050e6cc80f2972698f083352e87deda1ef3f3b1bef79e1a
aebd50af0cd8da2f314a52e2088788775d1a441bd674ef9379578e7bc1b5ad50
b0ab2f21243b940db6c6b986e1cedb149ffcc296b62b326e9214366585d1040d
b1246a60434515e315bdbfe6b797b7cf1af383f58046a9799ea024e89fe5fc2e
b2d2f11eb78159e31bce4355ffd5e696717de4270a77ba1d2038e066462008ad
b3abab8c0524b6f876d36f99aedd1fb14317c2e3758d2bdf093362d458f6f199
b599a8df8f60d928de0574b54137aebe0638c4ef7f4930f3cd10cadd61014ea5
b86e803713989a0638834bc4a95c891ba13a9ab7ff572eff1e8a914dd9c86c3e
b8927d9b7dcdd432392b97412a737a4589c5ec7485c5009a9720941647c2eb7e
b8dd12b4cc0283b0d20c31c231b8ae14fa61c1b64d594cd8f8c0ed1948acb3b5
b8e8734d09cbff47f0afe26e91200cd19071e79647f718cd7b5c2ba16a13ebf7
bb029bb9408d25cd51359856c56d0ab8a14121f654757aabb313b366764a6686
bb2a058ef665ad543aa4f39aaa339534d6bede84617e637e85298e845a2f6bce
bc2dee2d7bba673bee2abc6490f270aedec3e93055882daa0cd0a474388265b9
bce8546e091fc6b313d77b803148c20b50e9f31a5ec1abf70ddfed46d5833765
bd30d6bb370215bd9d66c2f24267aec31b508689606412b82c5f4a39299267b3
be2277c99594557635d0993ac606fdc4994494e43408bc1be5c6ac9bfabc5dac
c15a91ba12b87eb2962f296bddc411b12646183318a05ce6577ed88301eca6dd
c2063881a851c763485fce5ef18fb40175ed4d14367815bb66e8d2d1989b4b3a
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c5115d063f4f808fc2970e842ee45561e768b711d50d61cb59430b5a96247b28
c55508ea7ce1ad08364772fbfadb835d2b1d1b9238d345c45eee1943ada4ff6f
c7360a9b46fde11845b3090ca0034fb409d92398a71f3ae15fac3a2fa29ae6cc
c877f8c89d3bafae866c9a60e67251614f74f266c70334ae05c8ac21b07c11e2
c9d50fd70050a987d4599a9432e12e15d89f337f03237abc85bdff7a3aa33f97
ca722692097e4c35b99ceb65de85743aa81692e6c683444505ac9e8d42fb5965
cacc1610c5d2cbb7adf910e2ccecd55b188d8ba786872e55017c77decbcf568a
cdd7ac545d67852a6b6bf724f0e2be2eca8c2d91a287435587a959c7debe1dbd
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cfe210b9b960e92d867cb501ba3cb9b03c4c66b816dd2427566bed986fb1c00f
d155b999575e8cd4779daab89ad9bba91c3d0ab95ea3b6bab430f05b93c1f8a8
d541e3936c89d10117581b2153619b370ec875729e5bae24000c547d06090e15
d85850c885fe92574f866d77f638250a2747c691aa7f537b4922e28b368cd51a
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
dfaa9b38b6961e041aa90677d76e0ea5a4fd7ac176ba83694b18d57d809fd57e
dfed159907574337d5a3198b898e17e6f0d6c5c325d8ee2fd2343b7cddb34994
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3c7b3ec49bc0c4ce6840a3eaa580e5dbeb5a69ae074f9e88ceb572b8a2567f6
e540888c6295f4ad15bf07006ade70719c76979fbb399b87759dadaf0e3c92f6
e6144aaf9c84548c0fa1cf4a3a11b186ea92d7818742dd13689ff64ca5637e8e
e6b51a277a3aef17a2d98430577d8d969f53370803a59592e44c46a14f91fef4
e81ebf18c5f2590cb50e192f40aca6daf2d9d19ba826d6f016c9c00c3b63ef77
e87e542e34fc3af7847f53ae5c258f82ff2d8739646ed8d249c9a54ede9f7128
e916478d94814b1a0c2680424c323db0514f4a022d16835cd7bcc754722308f4
e96ee4202dd697f4757a0c1502f5b3ae79c0d59d0823d80a80ac3ed97132d861
eb34b0470b3780cd63eb387e82351d1a9838287e5dc61a98e5c22dd447006d22
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f233da668d7c3ccfa794e982c4d12665f67c1e572c6396a8672fc0c8430a037d
f3e4a06f8518d0b05c817c35ab157d8f171674c4c96144db765d15fd2870900a
f752ad8cf812a358129aac3fd9784b0baf6f19899eb49116f08a1afab1fa133e
fa7f953e8f4f0d1eaca1c0952f8841238c9c191df4051076dc5bb108d468fdfc
fed785a6a8ca96fb67230fec5d85f9c508db49f4075aa0ef284af56cd89813e3

www.thestar.com Open in urlscan Pro 99.84.42.91 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

275 Requests

87 %HTTPS

32 %IPv6

62 Domains

113 Subdomains

83 IPs

3 Countries

3940 kBTransfer

11839 kBSize

109 Cookies

18 Outgoing links

Redirected requests

275 HTTP transactions Everything HTML Script AJAX CSS Image Expand all -1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.thestar.com Open in urlscan Pro
99.84.42.91 Public Scan

Screenshot
Live screenshot

Full Image

275
Requests

87 %
HTTPS

32 %
IPv6

62
Domains

113
Subdomains

83
IPs

3
Countries

3940 kB
Transfer

11839 kB
Size

109
Cookies

275 HTTP transactions
-1 data transactions