secure.winred.com Open in urlscan Pro
2606:4700::6812:9c15 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://click.email.donaldjtrump.com/?qs=3264ddca0103607f932445c8df3129909d3910ffb74d51daa3291561deef758c47e43da8bc7a05c0078f76920b34...
Effective URL:
https://secure.winred.com/save-america-joint-fundraising-committee/feb22-eom-7x/?recurring=true&money_pledge=true&amount=5...
Submission: On March 06 via manual (March 6th 2022, 1:22:05 am UTC) from CA — Scanned from CA

Summary HTTP 150 Redirects Links 5 Behaviour Indicators

Summary

This website contacted 26 IPs in 1 countries across 20 domains to perform 150 HTTP transactions. The main IP is 2606:4700::6812:9c15, located in United States and belongs to CLOUDFLARENET, US. The main domain is secure.winred.com. The Cisco Umbrella rank of the primary domain is 73057.
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on October 5th 2021. Valid for: a year.

This is the only time secure.winred.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	13.110.196.229 13.110.196.229	14340 (SALESFORCE) (SALESFORCE)
10	2606:4700::68... 2606:4700::6812:9c15	13335 (CLOUDFLAR...) (CLOUDFLARENET)
29	151.101.64.176 151.101.64.176	54113 (FASTLY) (FASTLY)
4	2607:f8b0:400... 2607:f8b0:4006:823::200a	15169 (GOOGLE) (GOOGLE)
4	13.225.221.129 13.225.221.129	16509 (AMAZON-02) (AMAZON-02)
3	2607:f8b0:400... 2607:f8b0:4006:80f::2008	15169 (GOOGLE) (GOOGLE)
42	54.186.23.98 54.186.23.98	16509 (AMAZON-02) (AMAZON-02)
4	2607:f8b0:402... 2607:f8b0:4023:1404::5c	15169 (GOOGLE) (GOOGLE)
6	2607:f8b0:400... 2607:f8b0:4006:820::200e	15169 (GOOGLE) (GOOGLE)
1 2	142.250.80.38 142.250.80.38	15169 (GOOGLE) (GOOGLE)
2	13.225.229.246 13.225.229.246	16509 (AMAZON-02) (AMAZON-02)
4	2a03:2880:f01... 2a03:2880:f012:8:face:b00c:0:1	32934 (FACEBOOK) (FACEBOOK)
1	2600:141b:13:... 2600:141b:13::b833:92a3	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2607:f8b0:402... 2607:f8b0:4023:1407::9d	15169 (GOOGLE) (GOOGLE)
1 2	2600:141b:13:... 2600:141b:13::b833:9291	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 5	35.186.226.184 35.186.226.184	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:816::2002	15169 (GOOGLE) (GOOGLE)
3	2607:f8b0:400... 2607:f8b0:4006:80d::2004	15169 (GOOGLE) (GOOGLE)
3	2607:f8b0:400... 2607:f8b0:4006:80e::2003	15169 (GOOGLE) (GOOGLE)
1	54.200.96.253 54.200.96.253	16509 (AMAZON-02) (AMAZON-02)
5	2607:f8b0:400... 2607:f8b0:4006:81c::2003	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f11... 2a03:2880:f112:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	18.212.208.179 18.212.208.179	14618 (AMAZON-AES) (AMAZON-AES)
1	2607:f8b0:400... 2607:f8b0:4006:822::2002	15169 (GOOGLE) (GOOGLE)
2 2	107.178.246.49 107.178.246.49	15169 (GOOGLE) (GOOGLE)
13	2607:f8b0:400... 2607:f8b0:4006:81f::200e	15169 (GOOGLE) (GOOGLE)
1	142.251.40.130 142.251.40.130	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:80c::2002	15169 (GOOGLE) (GOOGLE)
150	26

1 13.110.196.229 (United States) 1 redirects

ASN14340 (SALESFORCE, US)
PTR: click.email.donaldjtrump.com

click.email.donaldjtrump.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2606:4700::6812:9c15 (United States)

ASN13335 (CLOUDFLARENET, US)

secure.winred.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
app.winred.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

29 151.101.64.176 (United States)

ASN54113 (FASTLY, US)

js.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
m.stripe.network	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4006:823::200a (Queens, United States)

ASN15169 (GOOGLE, US)

maps.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 13.225.221.129 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-221-129.jfk51.r.cloudfront.net

d35ligi1n5bgzc.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4006:80f::2008 (Queens, United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

42 54.186.23.98 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ip-54-186-23-98.stripe.com

q.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
r.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4023:1404::5c (Columbus, United States)

ASN15169 (GOOGLE, US)

pay.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2607:f8b0:4006:820::200e (Queens, United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.80.38 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: lga34s34-in-f6.1e100.net

9381094.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.225.229.246 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-229-246.jfk51.r.cloudfront.net

sc-static.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f012:8:face:b00c:0:1 (Secaucus, United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:141b:13::b833:92a3 (New York, United States)

ASN20940 (AKAMAI-ASN1, NL)

rtxpx-a.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4023:1407::9d (Columbus, United States)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:141b:13::b833:9291 (New York, United States) 1 redirects

ASN20940 (AKAMAI-ASN1, NL)

stickyid-a.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 35.186.226.184 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 184.226.186.35.bc.googleusercontent.com

tr.snapchat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:816::2002 (Queens, United States)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4006:80d::2004 (Queens, United States)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4006:80e::2003 (Queens, United States)

ASN15169 (GOOGLE, US)

www.google.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.200.96.253 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-200-96-253.us-west-2.compute.amazonaws.com

m.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2607:f8b0:4006:81c::2003 (Queens, United States)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f112:83:face:b00c:0:25de (Secaucus, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.212.208.179 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-212-208-179.compute-1.amazonaws.com

rtclx.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:822::2002 (Queens, United States)

ASN15169 (GOOGLE, US)

adservice.google.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 107.178.246.49 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 49.246.178.107.bc.googleusercontent.com

pixel.tapad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2607:f8b0:4006:81f::200e (Queens, United States)

ASN15169 (GOOGLE, US)

play.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.40.130 (United States)

ASN15169 (GOOGLE, US)
PTR: lga25s80-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:80c::2002 (Queens, United States)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
70	stripe.com js.stripe.com — Cisco Umbrella Rank: 894 q.stripe.com — Cisco Umbrella Rank: 5856 r.stripe.com — Cisco Umbrella Rank: 3909 m.stripe.com — Cisco Umbrella Rank: 854	749 KB
21	google.com pay.google.com — Cisco Umbrella Rank: 2999 adservice.google.com — Cisco Umbrella Rank: 57 www.google.com — Cisco Umbrella Rank: 2 play.google.com — Cisco Umbrella Rank: 32	387 KB
10	winred.com secure.winred.com — Cisco Umbrella Rank: 73057 app.winred.com — Cisco Umbrella Rank: 188227	252 KB
6	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 31	40 KB
5	gstatic.com www.gstatic.com	104 KB
5	snapchat.com 1 redirects tr.snapchat.com — Cisco Umbrella Rank: 955	1 KB
5	doubleclick.net 1 redirects 9381094.fls.doubleclick.net — Cisco Umbrella Rank: 516912 stats.g.doubleclick.net — Cisco Umbrella Rank: 68 googleads.g.doubleclick.net — Cisco Umbrella Rank: 38	4 KB
4	google.ca www.google.ca — Cisco Umbrella Rank: 8822 adservice.google.ca — Cisco Umbrella Rank: 13075	2 KB
4	facebook.net connect.facebook.net — Cisco Umbrella Rank: 124	222 KB
4	cloudfront.net d35ligi1n5bgzc.cloudfront.net	325 KB
4	googleapis.com maps.googleapis.com — Cisco Umbrella Rank: 316	171 KB
3	akamaihd.net 1 redirects rtxpx-a.akamaihd.net — Cisco Umbrella Rank: 67572 stickyid-a.akamaihd.net — Cisco Umbrella Rank: 63979	32 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 54	166 KB
2	tapad.com 2 redirects pixel.tapad.com — Cisco Umbrella Rank: 365	886 B
2	rtclx.com rtclx.com — Cisco Umbrella Rank: 15568	1 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 96	624 B
2	stripe.network m.stripe.network — Cisco Umbrella Rank: 948	17 KB
2	sc-static.net sc-static.net — Cisco Umbrella Rank: 1102	13 KB
1	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 101	15 KB
1	donaldjtrump.com 1 redirects click.email.donaldjtrump.com — Cisco Umbrella Rank: 209517	479 B
150	20

	Domain	Requested by
34	r.stripe.com	js.stripe.com
27	js.stripe.com	secure.winred.com js.stripe.com
13	play.google.com	www.gstatic.com
9	secure.winred.com	secure.winred.com
8	q.stripe.com	secure.winred.com
6	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com secure.winred.com www.gstatic.com
5	www.gstatic.com	pay.google.com www.gstatic.com
5	tr.snapchat.com	1 redirects sc-static.net secure.winred.com
4	connect.facebook.net	secure.winred.com connect.facebook.net
4	pay.google.com	js.stripe.com pay.google.com secure.winred.com www.gstatic.com
4	d35ligi1n5bgzc.cloudfront.net	secure.winred.com
4	maps.googleapis.com	secure.winred.com maps.googleapis.com
3	www.google.ca	secure.winred.com
3	www.google.com	secure.winred.com
3	www.googletagmanager.com	secure.winred.com www.googletagmanager.com
2	pixel.tapad.com	2 redirects
2	rtclx.com	rtxpx-a.akamaihd.net
2	www.facebook.com	secure.winred.com
2	stickyid-a.akamaihd.net	1 redirects secure.winred.com
2	stats.g.doubleclick.net	www.google-analytics.com
2	m.stripe.network	js.stripe.com m.stripe.network
2	sc-static.net	secure.winred.com tr.snapchat.com
2	9381094.fls.doubleclick.net	1 redirects www.googletagmanager.com
1	googleads.g.doubleclick.net	www.googleadservices.com
1	www.googleadservices.com	www.googletagmanager.com
1	adservice.google.ca	adservice.google.com
1	m.stripe.com	m.stripe.network
1	adservice.google.com	9381094.fls.doubleclick.net
1	rtxpx-a.akamaihd.net	secure.winred.com
1	app.winred.com	secure.winred.com
1	click.email.donaldjtrump.com	1 redirects
150	31

This site contains links to these domains. Also see Links.

Domain
winred.com

Subject Issuer	Validity	Valid
www.winred.com DigiCert SHA2 Extended Validation Server CA	`2021-10-05` - `2022-10-26`	a year	crt.sh
a.stripecdn.com DigiCert SHA2 Extended Validation Server CA	`2022-01-26` - `2022-05-04`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-02-17` - `2022-05-12`	3 months	crt.sh
*.cloudfront.net Amazon	`2022-02-01` - `2023-01-31`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-02-17` - `2022-05-12`	3 months	crt.sh
*.stripe.com DigiCert SHA2 Secure Server CA	`2021-09-08` - `2022-09-07`	a year	crt.sh
*.google.com GTS CA 1C3	`2022-02-17` - `2022-05-12`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2022-02-17` - `2022-05-12`	3 months	crt.sh
sc-static.net DigiCert TLS RSA SHA256 2020 CA1	`2022-01-27` - `2023-01-27`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-12-13` - `2022-03-13`	3 months	crt.sh
a248.e.akamai.net DigiCert SHA2 Secure Server CA	`2021-07-15` - `2022-07-20`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-02-17` - `2022-05-12`	3 months	crt.sh
tr.snapchat.com DigiCert TLS RSA SHA256 2020 CA1	`2022-01-13` - `2023-01-13`	a year	crt.sh
www.google.com GTS CA 1C3	`2022-02-17` - `2022-05-12`	3 months	crt.sh
*.google.ca GTS CA 1C3	`2022-02-17` - `2022-05-12`	3 months	crt.sh
m.stripe.com DigiCert TLS RSA SHA256 2020 CA1	`2022-01-11` - `2022-05-04`	4 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-02-17` - `2022-05-12`	3 months	crt.sh
1p1eqpotato.com Sectigo RSA Domain Validation Secure Server CA	`2021-03-15` - `2022-03-24`	a year	crt.sh
www.googleadservices.com GTS CA 1C3	`2022-02-17` - `2022-05-12`	3 months	crt.sh

This page contains 16 frames:

Primary Page: https://secure.winred.com/save-america-joint-fundraising-committee/feb22-eom-7x/?recurring=true&money_pledge=true&amount=5&amt1=5&amt2=10&amt3=15&amt4=20&utm_medium=email_hf&utm_source=et_10_bu1nd&utm_campaign=20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa&utm_content=donate_button_cpyrs_9683
Frame ID: E036F95024A4485B86501F3E4A373D40
Requests: 50 HTTP requests in this frame

Frame: https://js.stripe.com/v3/m-outer-ce3cdfac755a319f13136d294df99983.html
Frame ID: F35F2D436E5FCCB5BCB8691BF94B88B4
Requests: 3 HTTP requests in this frame

Frame: https://js.stripe.com/v3/controller-8eaf2b5821da35282d2b7d6bb23c61b7.html
Frame ID: 17750AAA3D9133E3C37E104DDF620B62
Requests: 17 HTTP requests in this frame

Frame: https://js.stripe.com/v3/elements-inner-card-7e7a4364bbc6e7bb352eb5e868854d25.html
Frame ID: 8920BCEFAEF819D90CF8A6C90A4C14DF
Requests: 7 HTTP requests in this frame

Frame: https://js.stripe.com/v3/controller-8eaf2b5821da35282d2b7d6bb23c61b7.html
Frame ID: 938D8A308DA1C7BFD139317EF1890678
Requests: 25 HTTP requests in this frame

Frame: https://js.stripe.com/v3/payment-request-inner-google-pay-7748a799a43dc1c19c3f76068b488cc0.html
Frame ID: E84433878568D599C8FA1FBD58B82010
Requests: 5 HTTP requests in this frame

Frame: https://js.stripe.com/v3/payment-request-inner-browser-84cab574109b83e4fd99b1e43087523e.html
Frame ID: 917F512177B57BB1CC3B0C03F6E7D06E
Requests: 4 HTTP requests in this frame

Frame: https://9381094.fls.doubleclick.net/activityi;dc_pre=CLqZkZipsPYCFVoGwwodmw4AVg;src=9381094;type=pagev0;cat=djt_p0;ord=8914804603096;gtm=2wg320;auiddc=1960786444.1646529719;~oref=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Ffeb22-eom-7x%2F%3Frecurring%3Dtrue%26money_pledge%3Dtrue%26amount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26utm_medium%3Demail_hf%26utm_source%3Det_10_bu1nd%26utm_campaign%3D20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa%26utm_content%3Ddonate_button_cpyrs_9683
Frame ID: DF16C3E1479D9B12D0D874010BAFB06F
Requests: 1 HTTP requests in this frame

Frame: https://m.stripe.network/inner.html
Frame ID: 757966D048428D87DB9DC5261ED83A7F
Requests: 4 HTTP requests in this frame

Frame: https://pay.google.com/gp/p/ui/payframe?origin=https%3A%2F%2Fjs.stripe.com&mid=
Frame ID: A904F1FDDB128EBF17C4F056F343B018
Requests: 16 HTTP requests in this frame

Frame: https://adservice.google.com/ddm/fls/i/dc_pre=CLqZkZipsPYCFVoGwwodmw4AVg;src=9381094;type=pagev0;cat=djt_p0;ord=8914804603096;gtm=2wg320;auiddc=1960786444.1646529719;~oref=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Ffeb22-eom-7x%2F%3Frecurring%3Dtrue%26money_pledge%3Dtrue%26amount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26utm_medium%3Demail_hf%26utm_source%3Det_10_bu1nd%26utm_campaign%3D20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa%26utm_content%3Ddonate_button_cpyrs_9683
Frame ID: 1D5FD29064A7D4641EC1B52077222F5E
Requests: 1 HTTP requests in this frame

Frame: https://tr.snapchat.com/cm/i?pid=7d4b8c98-0f71-4e52-97e5-4fc263ec23eb
Frame ID: C5686B1D5C9BAB4C07F649FAF552EA90
Requests: 2 HTTP requests in this frame

Frame: https://tr.snapchat.com/p
Frame ID: F6F08D227696A9E7045E31C11382F235
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.ca/ddm/fls/i/dc_pre=CLqZkZipsPYCFVoGwwodmw4AVg;src=9381094;type=pagev0;cat=djt_p0;ord=8914804603096;gtm=2wg320;auiddc=1960786444.1646529719;~oref=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Ffeb22-eom-7x%2F%3Frecurring%3Dtrue%26money_pledge%3Dtrue%26amount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26utm_medium%3Demail_hf%26utm_source%3Det_10_bu1nd%26utm_campaign%3D20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa%26utm_content%3Ddonate_button_cpyrs_9683
Frame ID: F2ED04F484652874A1FDFC8CA6CAD748
Requests: 1 HTTP requests in this frame

Frame: https://tr.snapchat.com/cm/p?rand=1646489169018&pnid=140&pcid=2863ea0b-8c55-475a-9fcf-e5da86d61b36
Frame ID: A33209590203CB7B50CEE4BC7C3C8734
Requests: 1 HTTP requests in this frame

Frame: https://js.stripe.com/v3/elements-inner-payment-request-c053232a40284e9f033e830c33130af9.html
Frame ID: 4D0A5D2E680610BD5CD31F88B8851087
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://click.email.donaldjtrump.com/?qs=3264ddca0103607f932445c8df3129909d3910ffb74d51daa3291561deef758c47e43da8... HTTP 302
https://secure.winred.com/save-america-joint-fundraising-committee/feb22-eom-7x/?recurring=true&money_... Page URL

Detected technologies

Google Maps (Maps) Expand

Overall confidence: 100%
Detected patterns

//maps\.google(?:apis)?\.com/maps/api/js

Google Pay (Payment processors) Expand

Overall confidence: 100%
Detected patterns

pay\.google\.com/([a-z/]+)/pay\.js

Stripe (Payment Processors) Expand

Overall confidence: 100%
Detected patterns

js\.stripe\.com

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/ns\.html[^>]+></iframe>
googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Page Statistics

150
Requests

99 %
HTTPS

61 %
IPv6

20
Domains

31
Subdomains

26
IPs

1
Countries

2499 kB
Transfer

7968 kB
Size

28
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: https://winred.com/terms/donor-terms/
Title: terms of use

Search URL Search Domain Scan URL

URL: https://winred.com/privacy
Title: privacy policy

Search URL Search Domain Scan URL

URL: https://winred.com/
Title: Powered by

Search URL Search Domain Scan URL

URL: https://winred.com/about-our-ads/
Title: About Our Ads

Search URL Search Domain Scan URL

URL: https://winred.com/support/
Title: Questions about your charge? Go to our Support Center

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://click.email.donaldjtrump.com/?qs=3264ddca0103607f932445c8df3129909d3910ffb74d51daa3291561deef758c47e43da8bc7a05c0078f76920b3494d126c2eb9e0ecddfdb HTTP 302
https://secure.winred.com/save-america-joint-fundraising-committee/feb22-eom-7x/?recurring=true&money_pledge=true&amount=5&amt1=5&amt2=10&amt3=15&amt4=20&utm_medium=email_hf&utm_source=et_10_bu1nd&utm_campaign=20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa&utm_content=donate_button_cpyrs_9683 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 44

https://9381094.fls.doubleclick.net/activityi;src=9381094;type=pagev0;cat=djt_p0;ord=8914804603096;gtm=2wg320;auiddc=1960786444.1646529719;~oref=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Ffeb22-eom-7x%2F%3Frecurring%3Dtrue%26money_pledge%3Dtrue%26amount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26utm_medium%3Demail_hf%26utm_source%3Det_10_bu1nd%26utm_campaign%3D20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa%26utm_content%3Ddonate_button_cpyrs_9683 HTTP 302
https://9381094.fls.doubleclick.net/activityi;dc_pre=CLqZkZipsPYCFVoGwwodmw4AVg;src=9381094;type=pagev0;cat=djt_p0;ord=8914804603096;gtm=2wg320;auiddc=1960786444.1646529719;~oref=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Ffeb22-eom-7x%2F%3Frecurring%3Dtrue%26money_pledge%3Dtrue%26amount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26utm_medium%3Demail_hf%26utm_source%3Det_10_bu1nd%26utm_campaign%3D20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa%26utm_content%3Ddonate_button_cpyrs_9683

Request Chain 62

https://stickyid-a.akamaihd.net/id?o=https%3A%2F%2Fsecure.winred.com HTTP 302
https://stickyid-a.akamaihd.net/id?cc=1&o=https%3A%2F%2Fsecure.winred.com

Request Chain 103

https://tr.snapchat.com/cm/s?bt=__LIVE__&pnid=140&cb=1646529719869 HTTP 302
https://pixel.tapad.com/idsync/ex/push?partner_id=2884&partner_url=https%3A%2F%2Ftr.snapchat.com%2Fcm%2Fp%3Frand%3D1646489169018%26pnid%3D140%26pcid%3D%24%7BTA_DEVICE_ID%7D HTTP 302
https://pixel.tapad.com/idsync/ex/push/check?partner_id=2884&partner_url=https%3A%2F%2Ftr.snapchat.com%2Fcm%2Fp%3Frand%3D1646489169018%26pnid%3D140%26pcid%3D%24%7BTA_DEVICE_ID%7D HTTP 302
https://tr.snapchat.com/cm/p?rand=1646489169018&pnid=140&pcid=2863ea0b-8c55-475a-9fcf-e5da86d61b36

150 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
secure.winred.com/save-america-joint-fundraising-committee/feb22-eom-7x/
Redirect Chain

https://click.email.donaldjtrump.com/?qs=3264ddca0103607f932445c8df3129909d3910ffb74d51daa3291561deef758c47e43da8bc7a05c0078f76920b3494d126c2eb9e0ecddfdb
https://secure.winred.com/save-america-joint-fundraising-committee/feb22-eom-7x/?recurring=true&money_pledge=true&amount=5&amt1=5&amt2=10&amt3=15&amt4=20&utm_medium=email_hf&utm_source=et_10_bu1nd&...

47 KB
13 KB

188ms
91ms

Document
text/html

2606:4700::6812:9c15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/save-america-joint-fundraising-committee/feb22-eom-7x/?recurring=true&money_pledge=true&amount=5&amt1=5&amt2=10&amt3=15&amt4=20&utm_medium=email_hf&utm_source=et_10_bu1nd&utm_campaign=20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa&utm_content=donate_button_cpyrs_9683

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:9c15 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9f899afe0f97d6ed10fb1a00823f1f85ccb99f58a8b77e70441434e050c14691

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

date: Sun, 06 Mar 2022 01:21:58 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
cache-control: no-store, no-cache, must-revalidate, private, max-age=0
x-revv-cache: Hit from Revv
x-request-id: be156e8e-2c8b-4a55-9200-0136b0b1ed37
x-runtime: 0.040252
x-rack-cors: miss; no-origin
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6e7747122cd17150-YUL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

Redirect headers

Cache-Control: private
Content-Type: text/html; charset=utf-8
Location: https://secure.winred.com/save-america-joint-fundraising-committee/feb22-eom-7x/?recurring=true&money_pledge=true&amount=5&amt1=5&amt2=10&amt3=15&amt4=20&utm_medium=email_hf&utm_source=et_10_bu1nd&utm_campaign=20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa&utm_content=donate_button_cpyrs_9683
Date: Sun, 06 Mar 2022 01:21:57 GMT
Connection: close
Content-Length: 461

GET
H2 200 / Show response
js.stripe.com/v3/ 279 KB
67 KB 59ms
10ms Script
application/javascript 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/feb22-eom-7x/?recurring=true&money_pledge=true&amount=5&amt1=5&amt2=10&amt3=15&amt4=20&utm_medium=email_hf&utm_source=et_10_bu1nd&utm_campaign=20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa&utm_content=donate_button_cpyrs_9683

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

28fc5d82e4ecd4cce7cfad5b143d78dfeaaa428d19e8bf520fe7aeba3961ae49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
age: 50
x-cache: HIT
content-length: 68201
etag: "bdc9a518a9204e05b7af3a87471d9d77"
x-request-id: cf9fc5f5-65e6-4df3-8f59-e1645566e95a
x-served-by: cache-yul12820-YUL
access-control-allow-origin: *
last-modified: Fri, 04 Mar 2022 19:45:31 GMT
server: Fastly
date: Sun, 06 Mar 2022 01:21:58 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: max-age=60
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 36

GET
H2 200 landing_page-042aeaab4cd016f542d1c7661d8793be9cb8f12180baf4823ef715a030b30751.css
secure.winred.com/assets/ 217 KB
34 KB 38ms
37ms Stylesheet
text/css 2606:4700::6812:9c15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/assets/landing_page-042aeaab4cd016f542d1c7661d8793be9cb8f12180baf4823ef715a030b30751.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:9c15 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

325626e5a0d6feaed002bf86ca081e947a201b18692bae00aab06e7b23537309

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/save-america-joint-fundraising-committee/feb22-eom-7x/?recurring=true&money_pledge=true&amount=5&amt1=5&amt2=10&amt3=15&amt4=20&utm_medium=email_hf&utm_source=et_10_bu1nd&utm_campaign=20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa&utm_content=donate_button_cpyrs_9683
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 06 Mar 2022 01:21:58 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1637
cf-polished: origSize=225753
last-modified: Thu, 17 Feb 2022 01:47:11 GMT
strict-transport-security: max-age=0; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: X8JW567NAYGSSS8R
x-amz-id-2: tRsUaxzvZ5umPYnwE6gQkrXExvgHCRFQW0WiUmoW/I+BKW8gyHnm2nFiyCZXledPRVXdZmk6QEQ=
cf-bgj: minify
server: cloudflare
etag: W/"b9b0a06e5252fd065b0a96153d58c5e3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
x-amz-version-id: q1n7m0SHxTUUkRE7PAiS_JXTXduvAXgb
cf-ray: 6e774712fddb7150-YUL
expires: Sun, 06 Mar 2022 05:21:58 GMT

GET
H2 200 1645644564.css
secure.winred.com/stylesheets/rv_page_01fvacrgg4tdn29c944zzwxgb4/ 7 KB
2 KB 27ms
26ms Stylesheet
text/css 2606:4700::6812:9c15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/stylesheets/rv_page_01fvacrgg4tdn29c944zzwxgb4/1645644564.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:9c15 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

17fa6b4f8631c4f48f6275ddcaec3a6adec86b149e7a1d37af5986037aac4877

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/save-america-joint-fundraising-committee/feb22-eom-7x/?recurring=true&money_pledge=true&amount=5&amt1=5&amt2=10&amt3=15&amt4=20&utm_medium=email_hf&utm_source=et_10_bu1nd&utm_campaign=20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa&utm_content=donate_button_cpyrs_9683
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-rack-cors: miss; no-origin
date: Sun, 06 Mar 2022 01:21:58 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 122207
cf-polished: origSize=7160
cf-bgj: minify
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
x-request-id: d5760b07-8bdf-4e50-aa9f-4146cbb9fa51
x-runtime: 0.030231
last-modified: Fri, 04 Mar 2022 15:25:11 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains
content-type: text/css; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=31556952
cf-ray: 6e774712fdde7150-YUL
expires: Mon, 06 Mar 2023 07:11:10 GMT

GET
H2 200 js Show response
maps.googleapis.com/maps/api/ 161 KB
53 KB 107ms
50ms Script
text/javascript 2607:f8b0:4006:823::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::200a Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

mafe /

Resource Hash

250d870553534742edd49cdec823b70f8171e89c315e899ed586a91911c3c57b

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 06 Mar 2022 01:21:58 GMT
content-encoding: gzip
vary: Accept-Language
server: mafe
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1800
cross-origin-resource-policy: cross-origin
server-timing: gfet4t7; dur=22
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 53729
x-xss-protection: 0
expires: Sun, 06 Mar 2022 01:51:58 GMT

GET
H2 200 application-landing-page-bce7a02820776c838a4d8d582967b7de1ea4672c113ee8495d074b328fc05268.js Show response
secure.winred.com/assets/ 614 KB
173 KB 52ms
51ms Script
application/javascript 2606:4700::6812:9c15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/assets/application-landing-page-bce7a02820776c838a4d8d582967b7de1ea4672c113ee8495d074b328fc05268.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:9c15 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

44937d2b1f36d2962e30ca860e2367179210a22f56d90ea7b439d6aff0b67dce

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/save-america-joint-fundraising-committee/feb22-eom-7x/?recurring=true&money_pledge=true&amount=5&amt1=5&amt2=10&amt3=15&amt4=20&utm_medium=email_hf&utm_source=et_10_bu1nd&utm_campaign=20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa&utm_content=donate_button_cpyrs_9683
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 06 Mar 2022 01:21:58 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1637
cf-polished: origSize=628991
last-modified: Thu, 17 Feb 2022 01:47:09 GMT
strict-transport-security: max-age=0; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: XKXSKT21QF0DX74M
x-amz-id-2: YcxzsDz7PGyXARE/rxv4Gej2N78E151N7QRXYkAQFqwgXScGmFmFD2pAZyERu/Mjhc6SEILGxtY=
cf-bgj: minify
server: cloudflare
etag: W/"769aba082ad008db74dd1573d8b18318"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=14400
x-amz-version-id: V79_PopCA.DTSRlvTzhFkS6zD6PAqwmX
cf-ray: 6e774712fddf7150-YUL
expires: Sun, 06 Mar 2022 05:21:58 GMT

GET
H3 200 api.js Show response
secure.winred.com/cdn-cgi/bm/cv/669835187/ 35 KB
9 KB 18ms
17ms Script
text/javascript 2606:4700::6812:9c15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/cdn-cgi/bm/cv/669835187/api.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:9c15 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0d3118e306c6a26f1d2efcb698984e6922c5e7e155c94a84760e36e5592a3c11

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/save-america-joint-fundraising-committee/feb22-eom-7x/?recurring=true&money_pledge=true&amount=5&amt1=5&amt2=10&amt3=15&amt4=20&utm_medium=email_hf&utm_source=et_10_bu1nd&utm_campaign=20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa&utm_content=donate_button_cpyrs_9683
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 06 Mar 2022 01:21:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains
content-type: text/javascript
vary: Accept-Encoding
cache-control: max-age=604800, public
cf-ray: 6e7747139eaf7150-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 SaveAmericaPAC_Logo_RGB.png
d35ligi1n5bgzc.cloudfront.net/logos/logo_assets/000/075/635/large/ 7 KB
8 KB 82ms
26ms Image
image/png 13.225.221.129
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d35ligi1n5bgzc.cloudfront.net/logos/logo_assets/000/075/635/large/SaveAmericaPAC_Logo_RGB.png
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/feb22-eom-7x/?recurring=true&money_pledge=true&amount=5&amt1=5&amt2=10&amt3=15&amt4=20&utm_medium=email_hf&utm_source=et_10_bu1nd&utm_campaign=20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa&utm_content=donate_button_cpyrs_9683
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.221.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-221-129.jfk51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: cf4bf73b7c49f47411971fecc9b5a50a7726be6a7cd6bc1413fd56d8fcfc221d

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-amz-version-id: wuVmUgpz7rY7t0ORjTAvluytxJmwIuSP
via: 1.1 086617c9385713660fb060f989a2a626.cloudfront.net (CloudFront)
etag: "3f033a8b8af2707e6e15b423d5261020"
last-modified: Sun, 28 Feb 2021 21:08:00 GMT
server: AmazonS3
age: 75931
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: image/png
date: Sat, 05 Mar 2022 04:16:28 GMT
x-amz-cf-pop: JFK51-C1
accept-ranges: bytes
content-length: 7634
x-amz-cf-id: 5qSCR8uO2shUE8vrQR0S3y9KFGw4NReu3ts8hHaCHMhAqV3KqzmjfA==

GET
H2 200 20210818_Save-america_pop-ups-01.png
d35ligi1n5bgzc.cloudfront.net/widget_images/images/000/109/095/medium/ 74 KB
74 KB 122ms
66ms Image
image/png 13.225.221.129
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d35ligi1n5bgzc.cloudfront.net/widget_images/images/000/109/095/medium/20210818_Save-america_pop-ups-01.png
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/feb22-eom-7x/?recurring=true&money_pledge=true&amount=5&amt1=5&amt2=10&amt3=15&amt4=20&utm_medium=email_hf&utm_source=et_10_bu1nd&utm_campaign=20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa&utm_content=donate_button_cpyrs_9683
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.221.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-221-129.jfk51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a0866740279bed67814464f6fdab00b3d01783731bf500e4a5289bb868264bc8

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Sat, 05 Mar 2022 11:57:51 GMT
via: 1.1 086617c9385713660fb060f989a2a626.cloudfront.net (CloudFront)
last-modified: Thu, 19 Aug 2021 15:04:56 GMT
server: AmazonS3
age: 48248
etag: "f22ecd08b590d1c088a9f8841de39f57"
x-cache: Hit from cloudfront
x-amz-version-id: 9YmzTQ6iaRvW5vWynM1kcflKgqdDLofj
x-amz-cf-pop: JFK51-C1
accept-ranges: bytes
content-type: image/png
content-length: 75521
x-amz-cf-id: jh0JwRa4wZuYSunV-Ot0kXRlNkNzRZzCp5ftcGhzymtKA5CC_-oxwQ==

GET
H2 200 potus_headshot.png
d35ligi1n5bgzc.cloudfront.net/profiles/images/000/068/512/square/ 22 KB
22 KB 84ms
28ms Image
image/png 13.225.221.129
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d35ligi1n5bgzc.cloudfront.net/profiles/images/000/068/512/square/potus_headshot.png
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/feb22-eom-7x/?recurring=true&money_pledge=true&amount=5&amt1=5&amt2=10&amt3=15&amt4=20&utm_medium=email_hf&utm_source=et_10_bu1nd&utm_campaign=20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa&utm_content=donate_button_cpyrs_9683
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.221.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-221-129.jfk51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4ec0827f796bdadb833f52dd7ea841e12158d9f488554ecb73479cc2ea6f6d8e

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Sat, 05 Mar 2022 02:40:47 GMT
via: 1.1 086617c9385713660fb060f989a2a626.cloudfront.net (CloudFront)
last-modified: Sat, 17 Jul 2021 20:11:51 GMT
server: AmazonS3
age: 81672
etag: "e595f679c10699fedef3c779e864cdd9"
x-cache: Hit from cloudfront
x-amz-version-id: 6HYtNhcBxi6F_uJ2AY87Rc_xOq3TeHoz
x-amz-cf-pop: JFK51-C1
accept-ranges: bytes
content-type: image/png
content-length: 22449
x-amz-cf-id: dxU_rTob2nbLr4MeHXHiNLIztL22qLK7JuJCf63p8Qmpy1cOVCuBRQ==

GET
H3 200 win-red-mark-small-24c5e97a925e2a929cae4a87ecdfcdf27f56974fd8172bdd34af91145aebca91.png
secure.winred.com/assets/ 9 KB
9 KB 31ms
29ms Image
image/webp 2606:4700::6812:9c15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.winred.com/assets/win-red-mark-small-24c5e97a925e2a929cae4a87ecdfcdf27f56974fd8172bdd34af91145aebca91.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:9c15 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

36f0bf882a876b13aeb20cf7a495421a43f336da5422072a58f58ce303fb6284

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/save-america-joint-fundraising-committee/feb22-eom-7x/?recurring=true&money_pledge=true&amount=5&amt1=5&amt2=10&amt3=15&amt4=20&utm_medium=email_hf&utm_source=et_10_bu1nd&utm_campaign=20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa&utm_content=donate_button_cpyrs_9683
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 06 Mar 2022 01:21:58 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 689
cf-polished: origFmt=png, origSize=11635
content-length: 8708
content-disposition: inline; filename="win-red-mark-small-24c5e97a925e2a929cae4a87ecdfcdf27f56974fd8172bdd34af91145aebca91.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: ASTYN8JBBYFSVWVP
x-amz-id-2: q1HWYCQqeUChr/R85W4oU8833YmQj/8BVUj6/0vMpNpMwKI8jQA/yXSLvWo3osSdKzQaLrmSLnE=
expires: Sun, 06 Mar 2022 05:21:58 GMT
last-modified: Thu, 17 Feb 2022 01:47:12 GMT
server: cloudflare
etag: "972c0cca8d1e490484e89513f902e847"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains
content-type: image/webp
vary: Accept
cache-control: public, max-age=14400
x-amz-version-id: 1Aj8JfpIDnNF3BWVzNdA94bskB..R78j
accept-ranges: bytes
cf-ray: 6e7747141f7b7150-YUL
cf-bgj: imgq:85,h2pri

GET
H3 200 win-red-full-red-5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848.svg
secure.winred.com/assets/ 19 KB
8 KB 33ms
32ms Image
image/svg+xml 2606:4700::6812:9c15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.winred.com/assets/win-red-full-red-5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848.svg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:9c15 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/save-america-joint-fundraising-committee/feb22-eom-7x/?recurring=true&money_pledge=true&amount=5&amt1=5&amt2=10&amt3=15&amt4=20&utm_medium=email_hf&utm_source=et_10_bu1nd&utm_campaign=20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa&utm_content=donate_button_cpyrs_9683
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 06 Mar 2022 01:21:58 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1637
content-type: image/svg+xml
strict-transport-security: max-age=0; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: GXB7HQG06TVYNCCT
x-amz-id-2: 8/V6Zi84jTHrMFL6cQQTia1sRnOZl6qIler41ya+gIG+NmkHFG5n7YZIXvjNxpqN9/AAoV35sis=
last-modified: Thu, 17 Feb 2022 01:47:12 GMT
server: cloudflare
etag: W/"d31530d4186af669daf4f47099614593"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: HqQ9EKe6kyQUJkdvA.tAlnE2vTO2it8l
cache-control: public, max-age=14400
cf-ray: 6e7747141f7d7150-YUL
expires: Sun, 06 Mar 2022 05:21:58 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 280 KB
65 KB 98ms
50ms Script
application/javascript 2607:f8b0:4006:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::2008 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e42a0f3b15eb6dd2b630c0b09dc48211c93f351e1dc1b55413674e4333dbb79f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 06 Mar 2022 01:21:58 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 66122
x-xss-protection: 0
last-modified: Sun, 06 Mar 2022 00:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 06 Mar 2022 01:21:58 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 177 KB
62 KB 92ms
44ms Script
application/javascript 2607:f8b0:4006:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::2008 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9973a2be15613093f613aba028652084dcaa9f66c7825a7894d57ff4a42d2348

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 06 Mar 2022 01:21:58 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 63013
x-xss-protection: 0
last-modified: Sun, 06 Mar 2022 00:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 06 Mar 2022 01:21:58 GMT

GET
H2 200 20211118_save-america_nov-eom_winred-desktop.png
d35ligi1n5bgzc.cloudfront.net/backgrounds/images/000/221/537/large/ 220 KB
221 KB 99ms
45ms Image
image/png 13.225.221.129
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d35ligi1n5bgzc.cloudfront.net/backgrounds/images/000/221/537/large/20211118_save-america_nov-eom_winred-desktop.png
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/stylesheets/rv_page_01fvacrgg4tdn29c944zzwxgb4/1645644564.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.221.129 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-221-129.jfk51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e2c9ff6883c2d567e3c23791b004e7a830f40648330ac00c3fb748ce29158345

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Sat, 05 Mar 2022 22:50:03 GMT
via: 1.1 086617c9385713660fb060f989a2a626.cloudfront.net (CloudFront)
last-modified: Mon, 21 Feb 2022 19:34:37 GMT
server: AmazonS3
age: 9116
etag: "05a5123076de6733cccf4692752a27f5"
x-cache: Hit from cloudfront
x-amz-version-id: qkYuu89nRuyVe4ulAQv2G76JQ8mzNwFN
x-amz-cf-pop: JFK51-C1
accept-ranges: bytes
content-type: image/png
content-length: 225299
x-amz-cf-id: G07RjvqLVJvr-BPDlLhhivhehgizzSGPJ0UC7RErxt7aYfzgQpkcwQ==

GET
H3 200 gen_204 Show response
maps.googleapis.com/maps/api/mapsjs/ 3 B
45 B 95ms
36ms XHR
application/json 2607:f8b0:4006:823::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::200a Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 06 Mar 2022 01:21:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
server: scaffolding on HTTPServer2
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://secure.winred.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
vary: Origin, X-Origin, Referer
content-length: 23
x-xss-protection: 0

GET
H2 200 m-outer-ce3cdfac755a319f13136d294df99983.html Show response
js.stripe.com/v3/ Frame F35F 240 B
536 B 14ms
11ms Document
text/html 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/m-outer-ce3cdfac755a319f13136d294df99983.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

39274d16fe03d66d8a425007eeb00f2d51496db71e847a0940a1b3ae12c42fed

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src https://m.stripe.network; img-src https://q.stripe.com; font-src 'none'; media-src 'none'; object-src 'none'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/

Response headers

last-modified: Mon, 28 Feb 2022 20:02:46 GMT
etag: "ce3cdfac755a319f13136d294df99983"
cache-control: max-age=31536000
content-type: text/html; charset=utf-8
content-security-policy: default-src 'self'; connect-src 'self' https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src https://m.stripe.network; img-src https://q.stripe.com; font-src 'none'; media-src 'none'; object-src 'none'; report-uri https://q.stripe.com/csp-report
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
access-control-allow-origin: *
server: Fastly
content-encoding: br
accept-ranges: bytes
date: Sun, 06 Mar 2022 01:21:58 GMT
via: 1.1 varnish
age: 451023
x-request-id: cab7394b-11d9-4360-985f-131d8c9fb214
x-served-by: cache-yul12820-YUL
x-cache: HIT
x-cache-hits: 194567
vary: Accept-Encoding
timing-allow-origin: *
content-length: 142

GET
H2 200 controller-8eaf2b5821da35282d2b7d6bb23c61b7.html Show response
js.stripe.com/v3/ Frame 1775 349 B
556 B 12ms
12ms Document
text/html 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/controller-8eaf2b5821da35282d2b7d6bb23c61b7.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

ceaef34a80b252b73f3750d108fe17cea748f64d4c5695ce482eec1c65edeef9

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/

Response headers

last-modified: Fri, 04 Mar 2022 19:26:43 GMT
etag: "8eaf2b5821da35282d2b7d6bb23c61b7"
cache-control: max-age=60
content-type: text/html; charset=utf-8
content-security-policy: default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self'; report-uri https://q.stripe.com/csp-report
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
access-control-allow-origin: *
server: Fastly
content-encoding: br
accept-ranges: bytes
date: Sun, 06 Mar 2022 01:21:58 GMT
via: 1.1 varnish
age: 9
x-request-id: 64988991-2f0c-4495-b64c-981fa3e610f0
x-served-by: cache-yul12820-YUL
x-cache: HIT
x-cache-hits: 6
vary: Accept-Encoding
timing-allow-origin: *
content-length: 167

GET
H2 200 elements-inner-card-7e7a4364bbc6e7bb352eb5e868854d25.html Show response
js.stripe.com/v3/ Frame 8920 6 KB
1 KB 11ms
11ms Document
text/html 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/elements-inner-card-7e7a4364bbc6e7bb352eb5e868854d25.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

678c51cc48293e85c0fc68235c35479471a8ca7aef69a1c5c343e91faa4c1d3e

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/

Response headers

last-modified: Fri, 04 Mar 2022 19:26:42 GMT
etag: "7e7a4364bbc6e7bb352eb5e868854d25"
cache-control: max-age=31536000
content-type: text/html; charset=utf-8
content-security-policy: default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self'; report-uri https://q.stripe.com/csp-report
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
access-control-allow-origin: *
server: Fastly
content-encoding: br
accept-ranges: bytes
date: Sun, 06 Mar 2022 01:21:58 GMT
via: 1.1 varnish
age: 107518
x-request-id: f3717daa-4618-4960-93af-5445f9633e89
x-served-by: cache-yul12820-YUL
x-cache: HIT
x-cache-hits: 6747
vary: Accept-Encoding
timing-allow-origin: *
content-length: 1172

GET
H2 200 current_with_info Show response
app.winred.com/api/v3/users/ 162 B
2 KB 134ms
105ms XHR
application/vnd.api+json 2606:4700::6812:9c15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.winred.com/api/v3/users/current_with_info?organization_token=rv_org_6KNvU36Z2qWJ2gfUBWqGZGoc&redirect=https://secure.winred.com/save-america-joint-fundraising-committee/feb22-eom-7x?recurring=true&money_pledge=true&amount=5&amt1=5&amt2=10&amt3=15&amt4=20&utm_medium=email_hf&utm_source=et_10_bu1nd&utm_campaign=20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa&utm_content=donate_button_cpyrs_9683

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/assets/application-landing-page-bce7a02820776c838a4d8d582967b7de1ea4672c113ee8495d074b328fc05268.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:9c15 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9c298871bc7286c4a2e4983863187e5a65b1fb6055467b41580a825c124e006f

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://secure.winred.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-rack-cors-original-access-control-allow-origin: https://secure.winred.com
date: Sun, 06 Mar 2022 01:21:58 GMT
x-rack-cors-original-access-control-max-age: 0
x-rack-cors-original-access-control-allow-credentials: true
cf-cache-status: DYNAMIC
x-rack-cors-original-access-control-allow-methods: GET, POST, OPTIONS
access-control-max-age: 0
x-rack-cors-original-access-control-expose-headers
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-request-id: 62419113-e872-4764-a9bb-bc66f62816a9
x-runtime: 0.008698
server: cloudflare
etag: W/"9c298871bc7286c4a2e4983863187e5a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/vnd.api+json
access-control-allow-origin: https://secure.winred.com
vary: Origin
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
cf-ray: 6e7747161b367150-YUL
x-rack-cors: hit
x-content-type-options: nosniff
access-control-expose-headers

POST
H3 201 live Show response
secure.winred.com/api/v3/donations/ 411 B
2 KB 197ms
197ms XHR
application/json 2606:4700::6812:9c15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/api/v3/donations/live

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/assets/application-landing-page-bce7a02820776c838a4d8d582967b7de1ea4672c113ee8495d074b328fc05268.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:9c15 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

69a0ba454cdfc6a96e543b4d045749243959cc3cafd2001de6d993d9faf34e86

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

X-CSRF-Token: dc6texb8KvQt8cts71N5pZroGTuJyffXLZRAwYgfY625ncFDjJQXqNGY4bhUFEEtU9wRp7FmLFXPw+LtNKmfTw==
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept: application/json, text/javascript, */*; q=0.01
Referer: https://secure.winred.com/save-america-joint-fundraising-committee/feb22-eom-7x/?recurring=true&money_pledge=true&amount=5&amt1=5&amt2=10&amt3=15&amt4=20&utm_medium=email_hf&utm_source=et_10_bu1nd&utm_campaign=20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa&utm_content=donate_button_cpyrs_9683
X-Requested-With: XMLHttpRequest
X-Revv-Apikey: cnZfb3JnXzAxZXpnOHR3MGY2ajlhOHcxYXljN2JjZHBrOjpkWEpOaDI2MFpkV1Z1WHFVWGkxUmlnPT1SRW0wcDhaUkcrZjNLV09MTzlUUC8raExxclpyb1dyZWJvNE5WQXhyY3o0VnVJYitTdGhjU3loV1lKYkJodEJpSHJNVnBzbEg0YlNhRUlUUnBocW93RUpqS0IzdDhJY1dqaHIwcXpKTmlnPT0=

Response headers

x-rack-cors-original-access-control-allow-origin: https://secure.winred.com
date: Sun, 06 Mar 2022 01:21:58 GMT
x-rack-cors-original-access-control-max-age: 0
x-rack-cors-original-access-control-allow-credentials: true
cf-cache-status: DYNAMIC
x-rack-cors-original-access-control-allow-methods: GET, POST, OPTIONS
access-control-max-age: 0
x-rack-cors-original-access-control-expose-headers
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-request-id: 4fba4ad9-a663-47b5-a376-9c7d16f86b54
x-runtime: 0.103952
server: cloudflare
etag: W/"69a0ba454cdfc6a96e543b4d04574924"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://secure.winred.com
vary: Origin
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
cf-ray: 6e774715faf57150-YUL
x-rack-cors: hit
x-content-type-options: nosniff
access-control-expose-headers

GET
H2 200 controller-8eaf2b5821da35282d2b7d6bb23c61b7.html Show response
js.stripe.com/v3/ Frame 938D 349 B
419 B 19ms
19ms Document
text/html 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/controller-8eaf2b5821da35282d2b7d6bb23c61b7.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

ceaef34a80b252b73f3750d108fe17cea748f64d4c5695ce482eec1c65edeef9

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/

Response headers

last-modified: Fri, 04 Mar 2022 19:26:43 GMT
etag: "8eaf2b5821da35282d2b7d6bb23c61b7"
cache-control: max-age=60
content-type: text/html; charset=utf-8
content-security-policy: default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self'; report-uri https://q.stripe.com/csp-report
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
access-control-allow-origin: *
server: Fastly
content-encoding: br
accept-ranges: bytes
date: Sun, 06 Mar 2022 01:21:58 GMT
via: 1.1 varnish
age: 9
x-request-id: 8ddf4a88-a107-4d71-be17-cd9a5b1eb0d4
x-served-by: cache-yul12820-YUL
x-cache: HIT
x-cache-hits: 7
vary: Accept-Encoding
timing-allow-origin: *
content-length: 167

GET
H2 200 payment-request-inner-google-pay-7748a799a43dc1c19c3f76068b488cc0.html Show response
js.stripe.com/v3/ Frame E844 434 B
593 B 15ms
15ms Document
text/html 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/payment-request-inner-google-pay-7748a799a43dc1c19c3f76068b488cc0.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

260b900af6b748db1f0e34e740101c1318cc7d89529dface75c10dd7ddb6055b

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; connect-src 'self' https://r.stripe.com https://google.com/pay https://pay.google.com; script-src 'self' https://pay.google.com; style-src 'self' 'unsafe-inline'; frame-src https://pay.google.com; img-src https://q.stripe.com https://www.gstatic.com; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/

Response headers

last-modified: Fri, 04 Mar 2022 19:25:54 GMT
etag: "7748a799a43dc1c19c3f76068b488cc0"
cache-control: max-age=60
content-type: text/html; charset=utf-8
content-security-policy: default-src 'none'; connect-src 'self' https://r.stripe.com https://google.com/pay https://pay.google.com; script-src 'self' https://pay.google.com; style-src 'self' 'unsafe-inline'; frame-src https://pay.google.com; img-src https://q.stripe.com https://www.gstatic.com; report-uri https://q.stripe.com/csp-report
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
access-control-allow-origin: *
server: Fastly
content-encoding: br
accept-ranges: bytes
date: Sun, 06 Mar 2022 01:21:58 GMT
via: 1.1 varnish
age: 50
x-request-id: 039181b1-1bd2-4532-9702-15c294399cc1
x-served-by: cache-yul12820-YUL
x-cache: HIT
x-cache-hits: 5
vary: Accept-Encoding
timing-allow-origin: *
content-length: 197

GET
H2 200 payment-request-inner-browser-84cab574109b83e4fd99b1e43087523e.html Show response
js.stripe.com/v3/ Frame 917F 370 B
593 B 11ms
11ms Document
text/html 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/payment-request-inner-browser-84cab574109b83e4fd99b1e43087523e.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

288221dc44603c78df9ef97005ac06d9663c02254ec920802bd8acf4ce2479e6

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://google.com/pay https://pay.google.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com https://www.gstatic.com; font-src data: https:; media-src 'none'; object-src 'self'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/

Response headers

last-modified: Fri, 04 Mar 2022 19:26:42 GMT
etag: "84cab574109b83e4fd99b1e43087523e"
cache-control: max-age=60
content-type: text/html; charset=utf-8
content-security-policy: default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://google.com/pay https://pay.google.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com https://www.gstatic.com; font-src data: https:; media-src 'none'; object-src 'self'; report-uri https://q.stripe.com/csp-report
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
access-control-allow-origin: *
server: Fastly
content-encoding: br
accept-ranges: bytes
date: Sun, 06 Mar 2022 01:21:58 GMT
via: 1.1 varnish
age: 15
x-request-id: b1dc3f2a-9cb4-4ca7-9e3c-a7e7ef205d3f
x-served-by: cache-yul12820-YUL
x-cache: HIT
x-cache-hits: 4
vary: Accept-Encoding
timing-allow-origin: *
content-length: 178

POST
H2 200 csp-report
q.stripe.com/ Frame F35F 0
357 B 251ms
77ms Other
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://q.stripe.com/csp-report
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/feb22-eom-7x/?recurring=true&money_pledge=true&amount=5&amt1=5&amt2=10&amt3=15&amt4=20&utm_medium=email_hf&utm_source=et_10_bu1nd&utm_campaign=20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa&utm_content=donate_button_cpyrs_9683
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Sun, 06 Mar 2022 01:21:58 GMT
server: nginx
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://js.stripe.com
access-control-expose-headers: Server, Range, Content-Type
x-envoy-upstream-service-time: 1
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
content-length: 0

POST
H2 200 csp-report
q.stripe.com/ Frame 1775 0
356 B 246ms
77ms Other
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://q.stripe.com/csp-report
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/feb22-eom-7x/?recurring=true&money_pledge=true&amount=5&amt1=5&amt2=10&amt3=15&amt4=20&utm_medium=email_hf&utm_source=et_10_bu1nd&utm_campaign=20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa&utm_content=donate_button_cpyrs_9683
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Sun, 06 Mar 2022 01:21:58 GMT
server: nginx
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://js.stripe.com
access-control-expose-headers: Server, Range, Content-Type
x-envoy-upstream-service-time: 1
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
content-length: 0

POST
H2 200 csp-report
q.stripe.com/ Frame 8920 0
356 B 316ms
152ms Other
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://q.stripe.com/csp-report
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/feb22-eom-7x/?recurring=true&money_pledge=true&amount=5&amt1=5&amt2=10&amt3=15&amt4=20&utm_medium=email_hf&utm_source=et_10_bu1nd&utm_campaign=20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa&utm_content=donate_button_cpyrs_9683
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Sun, 06 Mar 2022 01:21:59 GMT
server: nginx
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://js.stripe.com
access-control-expose-headers: Server, Range, Content-Type
x-envoy-upstream-service-time: 1
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
content-length: 0

POST
H2 200 csp-report
q.stripe.com/ Frame 938D 0
356 B 312ms
153ms Other
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://q.stripe.com/csp-report
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/feb22-eom-7x/?recurring=true&money_pledge=true&amount=5&amt1=5&amt2=10&amt3=15&amt4=20&utm_medium=email_hf&utm_source=et_10_bu1nd&utm_campaign=20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa&utm_content=donate_button_cpyrs_9683
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Sun, 06 Mar 2022 01:21:59 GMT
server: nginx
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://js.stripe.com
access-control-expose-headers: Server, Range, Content-Type
x-envoy-upstream-service-time: 0
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
content-length: 0

POST
H2 200 csp-report
q.stripe.com/ Frame 917F 0
356 B 300ms
151ms Other
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://q.stripe.com/csp-report
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/feb22-eom-7x/?recurring=true&money_pledge=true&amount=5&amt1=5&amt2=10&amt3=15&amt4=20&utm_medium=email_hf&utm_source=et_10_bu1nd&utm_campaign=20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa&utm_content=donate_button_cpyrs_9683
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Sun, 06 Mar 2022 01:21:59 GMT
server: nginx
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://js.stripe.com
access-control-expose-headers: Server, Range, Content-Type
x-envoy-upstream-service-time: 0
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
content-length: 0

POST
H2 200 csp-report
q.stripe.com/ Frame E844 0
356 B 299ms
152ms Other
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://q.stripe.com/csp-report
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/feb22-eom-7x/?recurring=true&money_pledge=true&amount=5&amt1=5&amt2=10&amt3=15&amt4=20&utm_medium=email_hf&utm_source=et_10_bu1nd&utm_campaign=20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa&utm_content=donate_button_cpyrs_9683
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Sun, 06 Mar 2022 01:21:59 GMT
server: nginx
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://js.stripe.com
access-control-expose-headers: Server, Range, Content-Type
x-envoy-upstream-service-time: 1
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
content-length: 0

GET
H2 200 m-outer-67740208de0918bdf73920776d3deaed.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame F35F 1 KB
800 B 23ms
22ms Script
application/javascript 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/m-outer-67740208de0918bdf73920776d3deaed.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/m-outer-ce3cdfac755a319f13136d294df99983.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

990a970d0b13f02acfecc901ef01c6d8fd87b05fbb7173e2a1ecb5ffbc3ef514

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/m-outer-ce3cdfac755a319f13136d294df99983.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
age: 36
x-cache: HIT
content-length: 645
etag: "d0c7e21ec457b6a134a496f107c3ca93"
x-request-id: 23ab01cc-0372-49d0-b7e8-0fb5ee8347e9
x-served-by: cache-yul12820-YUL
access-control-allow-origin: *
last-modified: Mon, 28 Feb 2022 20:03:13 GMT
server: Fastly
date: Sun, 06 Mar 2022 01:21:58 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: max-age=60
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 43

GET
H2 200 shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 1775 206 KB
50 KB 18ms
13ms Script
application/javascript 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/controller-8eaf2b5821da35282d2b7d6bb23c61b7.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

72d846435cbbd1ca41996ccbb63b934550ba3b23693f1da4827a148126183d3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/controller-8eaf2b5821da35282d2b7d6bb23c61b7.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
age: 2
x-cache: HIT
content-length: 51539
etag: "585a3dd1f903391f15ef0b0ae3492717"
x-request-id: 2e5c9f65-2b29-4e01-87b8-7817f2b63090
x-served-by: cache-yul12820-YUL
access-control-allow-origin: *
last-modified: Fri, 04 Mar 2022 19:26:02 GMT
server: Fastly
date: Sun, 06 Mar 2022 01:21:58 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: max-age=60
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 4

GET
H2 200 controller-a9f6cb0fddd49d309a87b91867df07e5.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 1775 331 KB
84 KB 15ms
11ms Script
application/javascript 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/controller-a9f6cb0fddd49d309a87b91867df07e5.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/controller-8eaf2b5821da35282d2b7d6bb23c61b7.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

d92368b6b477aa5816b65de648b901b23638fbe5b4ee34a90314b4c142ce79a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/controller-8eaf2b5821da35282d2b7d6bb23c61b7.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
age: 43
x-cache: HIT
content-length: 85182
etag: "170fe52d5e55166f41313a5972d8246a"
x-request-id: 3bbd7978-544a-47af-8afa-08ac5e317342
x-served-by: cache-yul12820-YUL
access-control-allow-origin: *
last-modified: Wed, 02 Mar 2022 22:17:17 GMT
server: Fastly
date: Sun, 06 Mar 2022 01:21:58 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: max-age=60
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 18

GET
H2 200 ui-shared-46e93b3755a485133d7e5e7e1db48eaf.css
js.stripe.com/v3/fingerprinted/css/ Frame 8920 15 KB
3 KB 18ms
14ms Stylesheet
text/css 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/css/ui-shared-46e93b3755a485133d7e5e7e1db48eaf.css

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-card-7e7a4364bbc6e7bb352eb5e868854d25.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

d9f33ed9fdd936a670993b9a8e6ca44e7a358d0f7b217b6c6638b502f66a8015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-card-7e7a4364bbc6e7bb352eb5e868854d25.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
age: 89
x-cache: HIT
content-length: 2474
etag: "7c0a4ba6a732ed01cc27774f97bbe8bd"
x-request-id: 5a59a6f6-43a4-45bd-b480-0ddc278f5714
x-served-by: cache-yul12820-YUL
access-control-allow-origin: *
last-modified: Wed, 12 Jan 2022 18:02:17 GMT
server: Fastly
date: Sun, 06 Mar 2022 01:21:58 GMT
vary: Accept-Encoding
content-type: text/css
via: 1.1 varnish
cache-control: max-age=60
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 26

GET
H2 200 shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 8920 206 KB
50 KB 15ms
12ms Script
application/javascript 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-card-7e7a4364bbc6e7bb352eb5e868854d25.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

72d846435cbbd1ca41996ccbb63b934550ba3b23693f1da4827a148126183d3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-card-7e7a4364bbc6e7bb352eb5e868854d25.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
age: 2
x-cache: HIT
content-length: 51539
etag: "585a3dd1f903391f15ef0b0ae3492717"
x-request-id: 5591f8ee-5c20-47a5-a4df-87cd260a5c57
x-served-by: cache-yul12820-YUL
access-control-allow-origin: *
last-modified: Fri, 04 Mar 2022 19:26:02 GMT
server: Fastly
date: Sun, 06 Mar 2022 01:21:58 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: max-age=60
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 5

GET
H2 200 ui-shared-8d92a34ff0de1bd66f84f68818549ef1.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 8920 216 KB
62 KB 18ms
16ms Script
application/javascript 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/ui-shared-8d92a34ff0de1bd66f84f68818549ef1.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-card-7e7a4364bbc6e7bb352eb5e868854d25.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

20db312f001c56801189799d4ea159c5b2e1bb726845543bbf5d890921c7cd03

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-card-7e7a4364bbc6e7bb352eb5e868854d25.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
age: 40
x-cache: HIT
content-length: 62889
etag: "0dd79493bde3ff2dfa1c01e8623c4628"
x-request-id: 89ad120b-d711-4c31-95cc-7e835d732cfa
x-served-by: cache-yul12820-YUL
access-control-allow-origin: *
last-modified: Wed, 23 Feb 2022 22:00:53 GMT
server: Fastly
date: Sun, 06 Mar 2022 01:21:58 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: max-age=60
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 12

GET
H2 200 elements-inner-card-59ff8c4fb0d882d8cb03a9bb9969860f.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 8920 46 KB
12 KB 40ms
38ms Script
application/javascript 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/elements-inner-card-59ff8c4fb0d882d8cb03a9bb9969860f.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-card-7e7a4364bbc6e7bb352eb5e868854d25.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

0d0e14cc50017fea4210952d4eaff897a2a0401bb5ab641abdf05817a52b5a2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-card-7e7a4364bbc6e7bb352eb5e868854d25.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
age: 89
x-cache: HIT
content-length: 11632
etag: "30a25c9465d6fbc4ec5770bf42e7cd9c"
x-request-id: 3951797c-90e0-480b-8254-44b261d4970e
x-served-by: cache-yul12820-YUL
access-control-allow-origin: *
last-modified: Tue, 15 Feb 2022 21:03:04 GMT
server: Fastly
date: Sun, 06 Mar 2022 01:21:58 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: max-age=60
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 20

GET
H2 200 shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 938D 206 KB
50 KB 17ms
13ms Script
application/javascript 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/controller-8eaf2b5821da35282d2b7d6bb23c61b7.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

72d846435cbbd1ca41996ccbb63b934550ba3b23693f1da4827a148126183d3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/controller-8eaf2b5821da35282d2b7d6bb23c61b7.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
age: 2
x-cache: HIT
content-length: 51539
etag: "585a3dd1f903391f15ef0b0ae3492717"
x-request-id: 95e714c2-43c0-4115-bfab-8bdf73546087
x-served-by: cache-yul12820-YUL
access-control-allow-origin: *
last-modified: Fri, 04 Mar 2022 19:26:02 GMT
server: Fastly
date: Sun, 06 Mar 2022 01:21:58 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: max-age=60
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 4

GET
H2 200 controller-a9f6cb0fddd49d309a87b91867df07e5.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 938D 331 KB
83 KB 39ms
37ms Script
application/javascript 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/controller-a9f6cb0fddd49d309a87b91867df07e5.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/controller-8eaf2b5821da35282d2b7d6bb23c61b7.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

d92368b6b477aa5816b65de648b901b23638fbe5b4ee34a90314b4c142ce79a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/controller-8eaf2b5821da35282d2b7d6bb23c61b7.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
age: 43
x-cache: HIT
content-length: 85182
etag: "170fe52d5e55166f41313a5972d8246a"
x-request-id: 87577764-0ec2-48b5-917c-82eb68a52763
x-served-by: cache-yul12820-YUL
access-control-allow-origin: *
last-modified: Wed, 02 Mar 2022 22:17:17 GMT
server: Fastly
date: Sun, 06 Mar 2022 01:21:58 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: max-age=60
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 19

GET
H2 200 shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 917F 206 KB
50 KB 19ms
15ms Script
application/javascript 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/payment-request-inner-browser-84cab574109b83e4fd99b1e43087523e.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

72d846435cbbd1ca41996ccbb63b934550ba3b23693f1da4827a148126183d3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/payment-request-inner-browser-84cab574109b83e4fd99b1e43087523e.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
age: 2
x-cache: HIT
content-length: 51539
etag: "585a3dd1f903391f15ef0b0ae3492717"
x-request-id: ad8fecad-d587-484f-8072-0b5f5bb461d0
x-served-by: cache-yul12820-YUL
access-control-allow-origin: *
last-modified: Fri, 04 Mar 2022 19:26:02 GMT
server: Fastly
date: Sun, 06 Mar 2022 01:21:58 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: max-age=60
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 6

GET
H2 200 payment-request-inner-browser-05b583a5141366a84c20134c0f02eea9.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 917F 11 KB
4 KB 39ms
37ms Script
application/javascript 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/payment-request-inner-browser-05b583a5141366a84c20134c0f02eea9.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/payment-request-inner-browser-84cab574109b83e4fd99b1e43087523e.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

5ed01afec7a8885ac179d8946a1b9e8ea751051ec8495ba1c51c4b66367f69a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/payment-request-inner-browser-84cab574109b83e4fd99b1e43087523e.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
age: 15
x-cache: HIT
content-length: 4063
etag: "ecab91c8eef71666a31a979393e13ad5"
x-request-id: d30f0c44-17da-40da-bcf4-492d88f30dad
x-served-by: cache-yul12820-YUL
access-control-allow-origin: *
last-modified: Mon, 28 Feb 2022 20:03:15 GMT
server: Fastly
date: Sun, 06 Mar 2022 01:21:58 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: max-age=60
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 4

GET
H2 200 pay.js Show response
pay.google.com/gp/p/js/ Frame E844 95 KB
31 KB 169ms
86ms Script
application/javascript 2607:f8b0:4023:1404::5c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pay.google.com/gp/p/js/pay.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/payment-request-inner-google-pay-7748a799a43dc1c19c3f76068b488cc0.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4023:1404::5c Columbus, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

0ecde91d88dbb2ac0fee3fd1fbb92977853f7e91ba1977c2c33b04d237165693

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-r7lCmIsL3C4dJDwkaaoEfA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendHttp/cspreport;worker-src 'self', script-src 'nonce-r7lCmIsL3C4dJDwkaaoEfA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendHttp/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 06 Mar 2022 01:21:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
server: ESF
cross-origin-opener-policy: same-origin; report-to="InstantbuyFrontendHttp"
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
report-to: {"group":"InstantbuyFrontendHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/InstantbuyFrontendHttp/external"}]}
content-type: application/javascript; charset=utf-8
cache-control: private, max-age=600
content-security-policy: script-src 'report-sample' 'nonce-r7lCmIsL3C4dJDwkaaoEfA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendHttp/cspreport;worker-src 'self', script-src 'nonce-r7lCmIsL3C4dJDwkaaoEfA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendHttp/cspreport
expires: Sun, 06 Mar 2022 01:21:58 GMT

GET
H2 200 shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame E844 206 KB
51 KB 50ms
48ms Script
application/javascript 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/payment-request-inner-google-pay-7748a799a43dc1c19c3f76068b488cc0.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

72d846435cbbd1ca41996ccbb63b934550ba3b23693f1da4827a148126183d3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/payment-request-inner-google-pay-7748a799a43dc1c19c3f76068b488cc0.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
age: 2
x-cache: HIT
content-length: 51539
etag: "585a3dd1f903391f15ef0b0ae3492717"
x-request-id: 52a0aca9-495b-4313-9f0b-c1e5dbe35835
x-served-by: cache-yul12820-YUL
access-control-allow-origin: *
last-modified: Fri, 04 Mar 2022 19:26:02 GMT
server: Fastly
date: Sun, 06 Mar 2022 01:21:58 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: max-age=60
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 7

GET
H2 200 payment-request-inner-google-pay-3a221349d0a7cd26d82a3c576de27ad1.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame E844 13 KB
4 KB 50ms
48ms Script
application/javascript 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/payment-request-inner-google-pay-3a221349d0a7cd26d82a3c576de27ad1.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/payment-request-inner-google-pay-7748a799a43dc1c19c3f76068b488cc0.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

9fa1f1dceac33f775634364cfd5f6f7ac199c8d8835584150fa3bfdb90c14c06

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/payment-request-inner-google-pay-7748a799a43dc1c19c3f76068b488cc0.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
age: 59
x-cache: HIT
content-length: 4384
etag: "22a6f248aafd8317728a0f81adec422e"
x-request-id: 40e3286a-a27c-4f6b-a31f-359a96c2e7d1
x-served-by: cache-yul12820-YUL
access-control-allow-origin: *
last-modified: Mon, 28 Feb 2022 20:03:12 GMT
server: Fastly
date: Sun, 06 Mar 2022 01:21:58 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: max-age=60
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 5

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 66ms
19ms Script
text/javascript 2607:f8b0:4006:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::200e Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 2282
date: Sun, 06 Mar 2022 00:43:56 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Sun, 06 Mar 2022 02:43:56 GMT

GET
H3

200

activityi;dc_pre=CLqZkZipsPYCFVoGwwodmw4AVg;src=9381094;type=pagev0;cat=djt_p0;ord=8914804603096;gtm=2wg320;auiddc=1960786444.1646529719;~oref=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-f... Show response
9381094.fls.doubleclick.net/ Frame DF16
Redirect Chain

https://9381094.fls.doubleclick.net/activityi;src=9381094;type=pagev0;cat=djt_p0;ord=8914804603096;gtm=2wg320;auiddc=1960786444.1646529719;~oref=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint...
https://9381094.fls.doubleclick.net/activityi;dc_pre=CLqZkZipsPYCFVoGwwodmw4AVg;src=9381094;type=pagev0;cat=djt_p0;ord=8914804603096;gtm=2wg320;auiddc=1960786444.1646529719;~oref=https%3A%2F%2Fsecu...

808 B
592 B

67ms
40ms

Document
text/html

142.250.80.38
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://9381094.fls.doubleclick.net/activityi;dc_pre=CLqZkZipsPYCFVoGwwodmw4AVg;src=9381094;type=pagev0;cat=djt_p0;ord=8914804603096;gtm=2wg320;auiddc=1960786444.1646529719;~oref=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Ffeb22-eom-7x%2F%3Frecurring%3Dtrue%26money_pledge%3Dtrue%26amount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26utm_medium%3Demail_hf%26utm_source%3Det_10_bu1nd%26utm_campaign%3D20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa%26utm_content%3Ddonate_button_cpyrs_9683?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.38 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s34-in-f6.1e100.net

Software

cafe /

Resource Hash

dc3d7278103d3e68eb8b462355a11ed115341d43b801cfc5ae2ced575278a4f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: about:blank

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sun, 06 Mar 2022 01:21:59 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
pragma: no-cache
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 567
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sun, 06 Mar 2022 01:21:59 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://9381094.fls.doubleclick.net/activityi;dc_pre=CLqZkZipsPYCFVoGwwodmw4AVg;src=9381094;type=pagev0;cat=djt_p0;ord=8914804603096;gtm=2wg320;auiddc=1960786444.1646529719;~oref=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Ffeb22-eom-7x%2F%3Frecurring%3Dtrue%26money_pledge%3Dtrue%26amount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26utm_medium%3Demail_hf%26utm_source%3Det_10_bu1nd%26utm_campaign%3D20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa%26utm_content%3Ddonate_button_cpyrs_9683?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 scevent.min.js Show response
sc-static.net/ 17 KB
7 KB 97ms
42ms Script
application/javascript 13.225.229.246
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sc-static.net/scevent.min.js
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/feb22-eom-7x/?recurring=true&money_pledge=true&amount=5&amt1=5&amt2=10&amt3=15&amt4=20&utm_medium=email_hf&utm_source=et_10_bu1nd&utm_campaign=20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa&utm_content=donate_button_cpyrs_9683
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.229.246 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-229-246.jfk51.r.cloudfront.net
Software: CloudFront /
Resource Hash: f2f087eac841d5433c3c3fa9ea481b474ff8370b9d9eec1ace18f0300a76ffd8

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 06 Mar 2022 01:21:59 GMT
content-encoding: gzip
server: CloudFront
x-amz-cf-pop: JFK51-C1
x-cache: LambdaGeneratedResponse from cloudfront
content-type: application/javascript;charset=utf-8
access-control-allow-origin: *
cache-control: private, s-maxage=0, max-age=600
access-control-allow-headers: Content-Type
content-length: 6336
via: 1.1 fb134201578e9706e0dd8abdab0f2abe.cloudfront.net (CloudFront)
x-amz-cf-id: zGIqoL-IAP4csWxHrV8xRt_NbZ33lel6LRTPo06irplhYSerilCZjw==

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 99 KB
27 KB 72ms
18ms Script
application/x-javascript 2a03:2880:f012:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

f2649db29712c0b6bb0702c7c4b1187b10ec39f238ddee4f17a614fa64ce31f3

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 26291
x-xss-protection: 0
pragma: public
x-fb-debug: tQfF3SLirWAsJW2d3gm2bj4xy1Y+0zHxKpYGxpX7Z6WjxPdXo72rAZimotOMxtfhGHP/7St880dwSdn9eFqKzg==
x-fb-trip-id: 1512268381
x-frame-options: DENY
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Sun, 06 Mar 2022 01:21:59 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK main.js Show response
rtxpx-a.akamaihd.net/ 91 KB
31 KB 155ms
25ms Script
application/javascript 2600:141b:13::b833:92a3
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://rtxpx-a.akamaihd.net/main.js
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/feb22-eom-7x/?recurring=true&money_pledge=true&amount=5&amt1=5&amt2=10&amt3=15&amt4=20&utm_medium=email_hf&utm_source=et_10_bu1nd&utm_campaign=20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa&utm_content=donate_button_cpyrs_9683
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2600:141b:13::b833:92a3 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1cd6e55f30592f2d07f9d038d85872e5d4fe5b079c86cadf29a3776694593d7b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 06 Mar 2022 01:21:59 GMT
Content-Encoding: gzip
x-amz-request-id: 69F032B63988C729
Connection: keep-alive
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
Content-Length: 30922
x-amz-id-2: qh1E7bnGQ+vD6sEAHBnEDpXEACYR6NO6Vt6mFsJgC50R2pbIqNZRu9VnaLKN9FR8PAgWIKYBOs0=
Pragma: no-cache
Last-Modified: Thu, 28 Jan 2021 21:02:34 GMT
Server: AmazonS3
ETag: "0e00eda4d7973d0a511ce8aae95bef1c"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=0, no-cache, no-store
Accept-Ranges: bytes
Expires: Sun, 06 Mar 2022 01:21:59 GMT

GET
H2 200 inner.html Show response
m.stripe.network/ Frame 7579 932 B
1 KB 31ms
13ms Document
text/html 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.network/inner.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/m-outer-67740208de0918bdf73920776d3deaed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

ed34a59f182c66e2b25c602f3c9b0f21435a8f475d5dbc9e6830ff4c7929f5cd

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src https://m.stripe.network https://m.stripe.com; default-src 'none'; font-src https://m.stripe.network https://fonts.gstatic.com; form-action 'none'; frame-src https://m.stripe.network https://js.stripe.com; img-src https://m.stripe.network https://m.stripe.com https://b.stripecdn.com; script-src https://m.stripe.network 'sha256-Qj6AdMOUjZkBBUTjGW/OORBoqx2Pohcq8Bg/ZvZzgYw=' 'report-sample'; style-src https://m.stripe.network 'report-sample'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/

Response headers

content-type: text/html; charset=utf-8
cache-control: max-age=300, public
content-security-policy: base-uri 'none'; connect-src https://m.stripe.network https://m.stripe.com; default-src 'none'; font-src https://m.stripe.network https://fonts.gstatic.com; form-action 'none'; frame-src https://m.stripe.network https://js.stripe.com; img-src https://m.stripe.network https://m.stripe.com https://b.stripecdn.com; script-src https://m.stripe.network 'sha256-Qj6AdMOUjZkBBUTjGW/OORBoqx2Pohcq8Bg/ZvZzgYw=' 'report-sample'; style-src https://m.stripe.network 'report-sample'; report-uri https://q.stripe.com/csp-report
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
server: Fastly
content-encoding: gzip
accept-ranges: bytes
date: Sun, 06 Mar 2022 01:21:59 GMT
via: 1.1 varnish
age: 15
x-request-id: d18ae6de-c118-4680-b090-fe1fab3a9529
x-served-by: cache-yul12820-YUL
x-cache: HIT
x-cache-hits: 15
x-timer: S1646529719.089290,VS0,VE0
vary: Accept-Encoding, Origin
content-length: 528

POST
H3 204 result Show response
secure.winred.com/cdn-cgi/bm/cv/ 0
495 B 19ms
18ms XHR
text/plain 2606:4700::6812:9c15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/cdn-cgi/bm/cv/result?req_id=6e7747122cd17150

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/cdn-cgi/bm/cv/669835187/api.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:9c15 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/save-america-joint-fundraising-committee/feb22-eom-7x/?recurring=true&money_pledge=true&amount=5&amt1=5&amt2=10&amt3=15&amt4=20&utm_medium=email_hf&utm_source=et_10_bu1nd&utm_campaign=20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa&utm_content=donate_button_cpyrs_9683
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/json

Response headers

strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
server: cloudflare
date: Sun, 06 Mar 2022 01:21:59 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
cf-ray: 6e7747187f877150-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

POST
H2 200 csp-report
q.stripe.com/ Frame 7579 0
130 B 77ms
77ms Other
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://m.stripe.network/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Sun, 06 Mar 2022 01:21:59 GMT
x-envoy-upstream-service-time: 1
server: nginx
content-length: 0
strict-transport-security: max-age=31556926; includeSubDomains; preload

POST
H2 200 0 Show response
r.stripe.com/ Frame 1775 0
127 B 88ms
79ms XHR
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/0
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://js.stripe.com
date: Sun, 06 Mar 2022 01:21:59 GMT
access-control-allow-credentials: true
server: nginx
content-length: 0
content-type: text/plain

POST
H2 200 0 Show response
r.stripe.com/ Frame 938D 0
127 B 80ms
80ms XHR
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/0
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://js.stripe.com
date: Sun, 06 Mar 2022 01:21:59 GMT
access-control-allow-credentials: true
server: nginx
content-length: 0
content-type: text/plain

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 60ms
33ms XHR
text/plain 2607:f8b0:4006:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1475714957&t=pageview&_s=1&dl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Ffeb22-eom-7x%2F%3Frecurring%3Dtrue%26money_pledge%3Dtrue%26amount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26utm_medium%3Demail_hf%26utm_source%3Det_10_bu1nd%26utm_campaign%3D20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa%26utm_content%3Ddonate_button_cpyrs_9683&ul=en-us&de=UTF-8&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAAC~&jid=1264765907&gjid=633342322&cid=1621494761.1646529719&tid=UA-60901920-1&_gid=1912252907.1646529719&_r=1&gtm=2wg320M27JCG&z=1546744860

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::200e Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 06 Mar 2022 01:21:59 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
443 B 126ms
52ms XHR
text/plain 2607:f8b0:4023:1407::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-73658561-7&cid=1621494761.1646529719&jid=1651263045&gjid=522220437&_gid=1912252907.1646529719&_u=YGDAiEABBAAAAG~&z=1337698149

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4023:1407::9d Columbus, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Sun, 06 Mar 2022 01:21:59 GMT
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 21ms
19ms Image
image/gif 2607:f8b0:4006:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::200e Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Mar 2022 18:42:03 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 23996
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 21ms
20ms Image
image/gif 2607:f8b0:4006:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1475714957&t=pageview&_s=1&dl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Ffeb22-eom-7x%2F%3Frecurring%3Dtrue%26money_pledge%3Dtrue%26amount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26utm_medium%3Demail_hf%26utm_source%3Det_10_bu1nd%26utm_campaign%3D20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa%26utm_content%3Ddonate_button_cpyrs_9683&ul=en-us&de=UTF-8&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGDAiEABBAAAAC~&jid=1651263045&gjid=522220437&cid=1621494761.1646529719&tid=UA-73658561-7&_gid=1912252907.1646529719&gtm=2wg320NTQZ9N&cd61=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Ffeb22-eom-7x%2F%3Frecurring%3Dtrue%26money_pledge%3Dtrue%26amount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26utm_medium%3Demail_hf%26utm_source%3Det_10_bu1nd%26utm_campaign%3D20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa%26utm_content%3Ddonate_button_cpyrs_9683&z=1629333990

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::200e Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Mar 2022 18:42:03 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 23996
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 20ms
20ms Image
image/gif 2607:f8b0:4006:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1475714957&t=event&ni=0&_s=1&dl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Ffeb22-eom-7x%2F%3Frecurring%3Dtrue%26money_pledge%3Dtrue%26amount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26utm_medium%3Demail_hf%26utm_source%3Det_10_bu1nd%26utm_campaign%3D20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa%26utm_content%3Ddonate_button_cpyrs_9683&ul=en-us&de=UTF-8&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=donation%20landing%20page&ea=user%20session%20start&el=landing%20page%20settings&_u=YGDAiEABBAAAAG~&jid=&gjid=&cid=1621494761.1646529719&tid=UA-73658561-7&_gid=1912252907.1646529719&gtm=2wg320NTQZ9N&cd41=anonymous&cd58=f&cd61=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Ffeb22-eom-7x%2F%3Frecurring%3Dtrue%26money_pledge%3Dtrue%26amount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26utm_medium%3Demail_hf%26utm_source%3Det_10_bu1nd%26utm_campaign%3D20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa%26utm_content%3Ddonate_button_cpyrs_9683&z=666067427

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::200e Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 05 Mar 2022 18:42:03 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 23996
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 countryRanges-ed6f8980af15d82ca172d25916879a5c.json Show response
js.stripe.com/v3/fingerprinted/data/ Frame 8920 143 KB
36 KB 12ms
12ms XHR
application/json 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/data/countryRanges-ed6f8980af15d82ca172d25916879a5c.json

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

5785c083b1cf0a752958975ebf6365d60896c3e809e7fd9bd94dc6e11bc75004

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://js.stripe.com/v3/elements-inner-card-7e7a4364bbc6e7bb352eb5e868854d25.html
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
age: 96
x-cache: HIT
content-length: 36350
etag: "ed6f8980af15d82ca172d25916879a5c"
x-request-id: a64a1e66-849e-41a4-91c6-3f546449bb62
x-served-by: cache-yul12820-YUL
access-control-allow-origin: *
last-modified: Wed, 12 Jan 2022 18:02:32 GMT
server: Fastly
date: Sun, 06 Mar 2022 01:21:59 GMT
vary: Accept-Encoding
content-type: application/json
via: 1.1 varnish
cache-control: max-age=60
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1

GET
H2 200 out-4.5.41.js Show response
m.stripe.network/ Frame 7579 85 KB
16 KB 11ms
11ms Script
text/javascript 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.network/out-4.5.41.js

Requested by

Host: m.stripe.network
URL: https://m.stripe.network/inner.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

a2f6b81396ab1150effea054efbf1623212ea0419976389ce8f10e909d39e4c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://m.stripe.network/inner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 113
x-cache: HIT
content-length: 15786
x-request-id: 4c745c3d-c658-48a1-8b12-f58d103d5a66
x-served-by: cache-yul12820-YUL
server: Fastly
x-timer: S1646529719.416080,VS0,VE0
date: Sun, 06 Mar 2022 01:21:59 GMT
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=utf-8
via: 1.1 varnish
cache-control: max-age=300, public
accept-ranges: bytes
x-cache-hits: 102

GET
H3 200 payframe Show response
pay.google.com/gp/p/ui/ Frame A904 18 KB
7 KB 149ms
105ms Document
text/html 2607:f8b0:4023:1404::5c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pay.google.com/gp/p/ui/payframe?origin=https%3A%2F%2Fjs.stripe.com&mid=

Requested by

Host: pay.google.com
URL: https://pay.google.com/gp/p/js/pay.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4023:1404::5c Columbus, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e5359ea0952ab336ac660ca899756a18fcfa05cce2d0d1f1cbc2dc83b263989e

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-qxF1sKF9jSelUwO/R6v1oA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport;worker-src 'self' script-src 'nonce-qxF1sKF9jSelUwO/R6v1oA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport/allowlist require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/

Response headers

content-type: text/html; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-ua-compatible: IE=edge
expires: Sun, 06 Mar 2022 01:21:59 GMT
date: Sun, 06 Mar 2022 01:21:59 GMT
cache-control: private, max-age=3600
strict-transport-security: max-age=31536000
report-to: {"group":"InstantbuyFrontendBuyflowPayframeUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/InstantbuyFrontendBuyflowPayframeUi/external"}]}
cross-origin-resource-policy: same-site
cross-origin-opener-policy: same-origin; report-to="InstantbuyFrontendBuyflowPayframeUi"
content-security-policy: script-src 'report-sample' 'nonce-qxF1sKF9jSelUwO/R6v1oA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport;worker-src 'self' script-src 'nonce-qxF1sKF9jSelUwO/R6v1oA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport/allowlist require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
25 B 94ms
51ms XHR
text/plain 2607:f8b0:4023:1407::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-60901920-1&cid=1621494761.1646529719&jid=1264765907&gjid=633342322&_gid=1912252907.1646529719&_u=YEBAAEAAAAAAAC~&z=1994778416

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4023:1407::9d Columbus, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Sun, 06 Mar 2022 01:21:59 GMT
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050

200

id Show response
stickyid-a.akamaihd.net/
Redirect Chain

https://stickyid-a.akamaihd.net/id?o=https%3A%2F%2Fsecure.winred.com
https://stickyid-a.akamaihd.net/id?cc=1&o=https%3A%2F%2Fsecure.winred.com

90 B
542 B

62ms
27ms

XHR
application/json

2600:141b:13::b833:9291
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://stickyid-a.akamaihd.net/id?cc=1&o=https%3A%2F%2Fsecure.winred.com
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/feb22-eom-7x/?recurring=true&money_pledge=true&amount=5&amt1=5&amt2=10&amt3=15&amt4=20&utm_medium=email_hf&utm_source=et_10_bu1nd&utm_campaign=20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa&utm_content=donate_button_cpyrs_9683
Protocol: H3-Q050
Server: 2600:141b:13::b833:9291 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiGHost /
Resource Hash: e63174db91b1ab04d1697f6448e84f0461a4072732ffe98209f564a1db2c9ea2

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 06 Mar 2022 01:21:59 GMT
server: AkamaiGHost
etag: "d2715d34e10e5a9f3692d96bd0fbb282:1592835897"
quic-version: Q050
p3p: CP="We do not have a P3P policy."
access-control-allow-origin: https://secure.winred.com
cache-control: max-age=0, no-cache, no-store, private
access-control-allow-credentials: true
content-length: 90
content-type: application/json
alt-svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
mime-version: 1.0
expires: Sun, 06 Mar 2022 01:21:59 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 06 Mar 2022 01:21:59 GMT
Server: AkamaiGHost
Mime-Version: 1.0
ETag: "d2715d34e10e5a9f3692d96bd0fbb282:1592835897"
Location: /id?cc=1&o=https%3A%2F%2Fsecure.winred.com
P3P: CP="We do not have a P3P policy."
Access-Control-Allow-Origin: https://secure.winred.com
Cache-Control: max-age=0, no-cache, no-store, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
Content-Length: 154
Expires: Sun, 06 Mar 2022 01:21:59 GMT

GET
H3 200 identity.js Show response
connect.facebook.net/signals/plugins/ 64 KB
20 KB 39ms
18ms Script
application/x-javascript 2a03:2880:f012:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/plugins/identity.js?v=2.9.55

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

ddbc1a158d7d13b63c0fda8fd2ece421016468e9e88914d2b81d3e8929c19df1

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 20661
x-xss-protection: 0
pragma: public
x-fb-debug: xejIwOz4C/8LOHpwVl9v9rYYq96z2N46PbxQjevkk4qIAJlkkNy5G2wWyzHGqaBIJbg9ppdymkB1+E+sTuyYiA==
x-frame-options: DENY
date: Sun, 06 Mar 2022 01:21:59 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 2558854747672869 Show response
connect.facebook.net/signals/config/ 308 KB
87 KB 54ms
35ms Script
application/x-javascript 2a03:2880:f012:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/2558854747672869?v=2.9.55&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

0db6cb950dcb73185a53aa0fc5aff29a822b87759f56922271d83bd07e4a653a

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 89351
x-xss-protection: 0
pragma: public
x-fb-debug: 7kgrkFah4wnbLEePH0pWAJPxi0FfUy+OijKWLDKZJznKrz+qp8KWiNX284K1D1dfD2cL9o0Z6yTlH8RCe+Qw4Q==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Sun, 06 Mar 2022 01:21:59 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H2 200 0 Show response
r.stripe.com/ Frame 1775 0
127 B 82ms
82ms XHR
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/0
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://js.stripe.com
date: Sun, 06 Mar 2022 01:21:59 GMT
access-control-allow-credentials: true
server: nginx
content-length: 0
content-type: text/plain

POST
H2 200 0 Show response
r.stripe.com/ Frame 1775 0
127 B 79ms
79ms XHR
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/0
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://js.stripe.com
date: Sun, 06 Mar 2022 01:21:59 GMT
access-control-allow-credentials: true
server: nginx
content-length: 0
content-type: text/plain

POST
H2 200 0 Show response
r.stripe.com/ Frame 1775 0
127 B 83ms
83ms XHR
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/0
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://js.stripe.com
date: Sun, 06 Mar 2022 01:21:59 GMT
access-control-allow-credentials: true
server: nginx
content-length: 0
content-type: text/plain

POST
H2 200 0 Show response
r.stripe.com/ Frame 1775 0
127 B 81ms
81ms XHR
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/0
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://js.stripe.com
date: Sun, 06 Mar 2022 01:21:59 GMT
access-control-allow-credentials: true
server: nginx
content-length: 0
content-type: text/plain

POST
H2 200 0 Show response
r.stripe.com/ Frame 1775 0
127 B 80ms
79ms XHR
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/0
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://js.stripe.com
date: Sun, 06 Mar 2022 01:21:59 GMT
access-control-allow-credentials: true
server: nginx
content-length: 0
content-type: text/plain

POST
H2 200 0 Show response
r.stripe.com/ Frame 1775 0
127 B 79ms
79ms XHR
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/0
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://js.stripe.com
date: Sun, 06 Mar 2022 01:21:59 GMT
access-control-allow-credentials: true
server: nginx
content-length: 0
content-type: text/plain

GET
H2 200 is_enabled Show response
tr.snapchat.com/collector/ 46 B
313 B 70ms
41ms Fetch
application/json 35.186.226.184
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.snapchat.com/collector/is_enabled?pids=7d4b8c98-0f71-4e52-97e5-4fc263ec23eb

Requested by

Host: sc-static.net
URL: https://sc-static.net/scevent.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.186.226.184 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

184.226.186.35.bc.googleusercontent.com

Software

nginx/1.19.6 /

Resource Hash

ac9f1bf5cbe4ff1fbb62d50d4c2747b3696a94493c96abd6138ff88bc3dc72b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 06 Mar 2022 01:21:59 GMT
via: 1.1 google
server: nginx/1.19.6
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/json
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46

POST
H2 200 0 Show response
r.stripe.com/ Frame 938D 0
127 B 79ms
78ms XHR
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/0
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://js.stripe.com
date: Sun, 06 Mar 2022 01:21:59 GMT
access-control-allow-credentials: true
server: nginx
content-length: 0
content-type: text/plain

POST
H2 200 0 Show response
r.stripe.com/ Frame 938D 0
127 B 79ms
78ms XHR
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/0
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://js.stripe.com
date: Sun, 06 Mar 2022 01:21:59 GMT
access-control-allow-credentials: true
server: nginx
content-length: 0
content-type: text/plain

POST
H2 200 0 Show response
r.stripe.com/ Frame 938D 0
127 B 79ms
79ms XHR
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/0
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://js.stripe.com
date: Sun, 06 Mar 2022 01:21:59 GMT
access-control-allow-credentials: true
server: nginx
content-length: 0
content-type: text/plain

POST
H2 200 0 Show response
r.stripe.com/ Frame 938D 0
127 B 127ms
127ms XHR
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/0
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://js.stripe.com
date: Sun, 06 Mar 2022 01:21:59 GMT
access-control-allow-credentials: true
server: nginx
content-length: 0
content-type: text/plain

POST
H2 200 0 Show response
r.stripe.com/ Frame 938D 0
127 B 79ms
79ms XHR
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/0
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://js.stripe.com
date: Sun, 06 Mar 2022 01:21:59 GMT
access-control-allow-credentials: true
server: nginx
content-length: 0
content-type: text/plain

POST
H2 200 0 Show response
r.stripe.com/ Frame 938D 0
127 B 129ms
128ms XHR
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/0
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://js.stripe.com
date: Sun, 06 Mar 2022 01:21:59 GMT
access-control-allow-credentials: true
server: nginx
content-length: 0
content-type: text/plain

POST
H2 200 0 Show response
r.stripe.com/ Frame 938D 0
127 B 126ms
126ms XHR
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/0
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://js.stripe.com
date: Sun, 06 Mar 2022 01:21:59 GMT
access-control-allow-credentials: true
server: nginx
content-length: 0
content-type: text/plain

POST
H2 200 0 Show response
r.stripe.com/ Frame 938D 0
127 B 128ms
128ms XHR
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/0
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://js.stripe.com
date: Sun, 06 Mar 2022 01:21:59 GMT
access-control-allow-credentials: true
server: nginx
content-length: 0
content-type: text/plain

POST
H2 200 0 Show response
r.stripe.com/ Frame 938D 0
127 B 127ms
126ms XHR
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/0
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://js.stripe.com
date: Sun, 06 Mar 2022 01:21:59 GMT
access-control-allow-credentials: true
server: nginx
content-length: 0
content-type: text/plain

POST
H2 200 0 Show response
r.stripe.com/ Frame 938D 0
127 B 123ms
122ms XHR
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/0
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://js.stripe.com
date: Sun, 06 Mar 2022 01:21:59 GMT
access-control-allow-credentials: true
server: nginx
content-length: 0
content-type: text/plain

POST
H2 200 0 Show response
r.stripe.com/ Frame 938D 0
127 B 120ms
119ms XHR
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/0
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://js.stripe.com
date: Sun, 06 Mar 2022 01:21:59 GMT
access-control-allow-credentials: true
server: nginx
content-length: 0
content-type: text/plain

GET
H2 200 dc_pre=CLqZkZipsPYCFVoGwwodmw4AVg;src=9381094;type=pagev0;cat=djt_p0;ord=8914804603096;gtm=2wg320;auiddc=1960786444.1646529719;~oref=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising... Show response
adservice.google.com/ddm/fls/i/ Frame 1D5F 807 B
1 KB 108ms
51ms Document
text/html 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/ddm/fls/i/dc_pre=CLqZkZipsPYCFVoGwwodmw4AVg;src=9381094;type=pagev0;cat=djt_p0;ord=8914804603096;gtm=2wg320;auiddc=1960786444.1646529719;~oref=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Ffeb22-eom-7x%2F%3Frecurring%3Dtrue%26money_pledge%3Dtrue%26amount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26utm_medium%3Demail_hf%26utm_source%3Det_10_bu1nd%26utm_campaign%3D20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa%26utm_content%3Ddonate_button_cpyrs_9683

Requested by

Host: 9381094.fls.doubleclick.net
URL: https://9381094.fls.doubleclick.net/activityi;dc_pre=CLqZkZipsPYCFVoGwwodmw4AVg;src=9381094;type=pagev0;cat=djt_p0;ord=8914804603096;gtm=2wg320;auiddc=1960786444.1646529719;~oref=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Ffeb22-eom-7x%2F%3Frecurring%3Dtrue%26money_pledge%3Dtrue%26amount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26utm_medium%3Demail_hf%26utm_source%3Det_10_bu1nd%26utm_campaign%3D20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa%26utm_content%3Ddonate_button_cpyrs_9683?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

09fae7e31cfadcb57f0472477a5a10a512af66638c425824a946c9796a732f89

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://9381094.fls.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sun, 06 Mar 2022 01:21:59 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
content-type: text/html; charset=UTF-8
pragma: no-cache
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 567
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 0 Show response
r.stripe.com/ Frame 1775 0
127 B 114ms
114ms XHR
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/0
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://js.stripe.com
date: Sun, 06 Mar 2022 01:21:59 GMT
access-control-allow-credentials: true
server: nginx
content-length: 0
content-type: text/plain

GET
H2 200 i Show response
tr.snapchat.com/cm/ Frame C568 672 B
1 KB 78ms
50ms Document
text/html 35.186.226.184
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.snapchat.com/cm/i?pid=7d4b8c98-0f71-4e52-97e5-4fc263ec23eb

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.186.226.184 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

184.226.186.35.bc.googleusercontent.com

Software

nginx/1.19.6 /

Resource Hash

6501140033c3bb20da4b5ac73c90f687ba8a2053c4ba37c4b6f5275166db7fa6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/

Response headers

server: nginx/1.19.6
date: Sun, 06 Mar 2022 01:21:59 GMT
content-type: text/html
content-length: 672
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 94ms
45ms Image
image/gif 2607:f8b0:4006:80d::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-73658561-7&cid=1621494761.1646529719&jid=1651263045&_u=YGDAiEABBAAAAG~&z=1290795320

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::2004 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 06 Mar 2022 01:21:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.ca/ads/ 42 B
107 B 98ms
39ms Image
image/gif 2607:f8b0:4006:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-73658561-7&cid=1621494761.1646529719&jid=1651263045&_u=YGDAiEABBAAAAG~&z=1290795320

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2003 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 06 Mar 2022 01:21:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
501 B 87ms
39ms Image
image/gif 2607:f8b0:4006:80d::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-60901920-1&cid=1621494761.1646529719&jid=1264765907&_u=YEBAAEAAAAAAAC~&z=931277257

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::2004 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 06 Mar 2022 01:21:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.ca/ads/ 42 B
501 B 95ms
38ms Image
image/gif 2607:f8b0:4006:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-60901920-1&cid=1621494761.1646529719&jid=1264765907&_u=YEBAAEAAAAAAAC~&z=931277257

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2003 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 06 Mar 2022 01:21:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 0 Show response
r.stripe.com/ Frame 1775 0
127 B 82ms
82ms XHR
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/0
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://js.stripe.com
date: Sun, 06 Mar 2022 01:21:59 GMT
access-control-allow-credentials: true
server: nginx
content-length: 0
content-type: text/plain

POST
H2 200 0 Show response
r.stripe.com/ Frame 1775 0
127 B 80ms
80ms XHR
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/0
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://js.stripe.com
date: Sun, 06 Mar 2022 01:21:59 GMT
access-control-allow-credentials: true
server: nginx
content-length: 0
content-type: text/plain

POST
H2 200 0 Show response
r.stripe.com/ Frame 1775 0
127 B 80ms
80ms XHR
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/0
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://js.stripe.com
date: Sun, 06 Mar 2022 01:21:59 GMT
access-control-allow-credentials: true
server: nginx
content-length: 0
content-type: text/plain

POST
H3 404 cspreport
pay.google.com/_/InstantbuyFrontendBuyflowPayframeUi/ Frame A904 2 KB
2 KB 36ms
36ms Other
text/html 2607:f8b0:4023:1404::5c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://pay.google.com/_/InstantbuyFrontendBuyflowPayframeUi/cspreport
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/feb22-eom-7x/?recurring=true&money_pledge=true&amount=5&amt1=5&amt2=10&amt3=15&amt4=20&utm_medium=email_hf&utm_source=et_10_bu1nd&utm_campaign=20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa&utm_content=donate_button_cpyrs_9683
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4023:1404::5c Columbus, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: d6ff339ddb4525268c21fa26ded66b0703f177e742281dc9bcd558288f8e1101

Request headers

Referer: https://pay.google.com/gp/p/ui/payframe?origin=https%3A%2F%2Fjs.stripe.com&mid=
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Sun, 06 Mar 2022 01:21:59 GMT
referrer-policy: no-referrer
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1608
content-type: text/html; charset=UTF-8

POST
H3 200 p Show response
tr.snapchat.com/ Frame F6F0 0
14 B 59ms
45ms Document
text/html 35.186.226.184
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.snapchat.com/p

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

35.186.226.184 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

184.226.186.35.bc.googleusercontent.com

Software

nginx/1.19.6 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
Origin: https://secure.winred.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/

Response headers

server: nginx/1.19.6
date: Sun, 06 Mar 2022 01:21:59 GMT
content-type: text/html
content-length: 0
access-control-allow-origin: *
cache-control: no-cache, no-transform
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 6 Show response
m.stripe.com/ Frame 7579 156 B
523 B 258ms
85ms XHR
application/json 54.200.96.253
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.com/6

Requested by

Host: m.stripe.network
URL: https://m.stripe.network/out-4.5.41.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.200.96.253 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-200-96-253.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

12b4366b33e29570f8d6547eba74c476ed386560b952ba8fe7235aeb809f1d9c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://m.stripe.network/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Sun, 06 Mar 2022 01:21:59 GMT
x-content-type-options: nosniff
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/json;charset=utf-8
access-control-allow-origin: https://m.stripe.network
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 156

GET
H2 200 m=_b,_tp Show response
www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.K8z_up_A0go.es5.O/am=DAAE/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AM... Frame A904 149 KB
53 KB 76ms
20ms Script
text/javascript 2607:f8b0:4006:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.K8z_up_A0go.es5.O/am=DAAE/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrheYKZJGqpjnhl_Smn6nf5IVRkAyA/m=_b,_tp

Requested by

Host: pay.google.com
URL: https://pay.google.com/gp/p/ui/payframe?origin=https%3A%2F%2Fjs.stripe.com&mid=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2003 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8d823780073bf1c60a427a944cfcbcf16d6d915757baec43dee029aa1122357a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 04 Mar 2022 17:16:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 115548
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/payments-consumer-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 53505
x-xss-protection: 0
last-modified: Fri, 04 Mar 2022 02:36:30 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="boq-infra/payments-consumer-boq-js-css-signers"
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/payments-consumer-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/payments-consumer-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Sat, 04 Mar 2023 17:16:11 GMT

GET
H3 200 181084665799192 Show response
connect.facebook.net/signals/config/ 308 KB
87 KB 19ms
19ms Script
application/x-javascript 2a03:2880:f012:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/181084665799192?v=2.9.55&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

8734e3e73c6ecdc285bf5f56dbd5419be6a84b8cb403786b554b0e319e9a3bcc

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 89351
x-xss-protection: 0
pragma: public
x-fb-debug: IdSbKw+wSa5I/r8pZiXt8+f3EGVn6QRIOlA2aJxx+SLhSpBlrBYNQxUPwoyeojnqGt3LlGk6Kt9tK1ICbujRIw==
x-frame-options: DENY
date: Sun, 06 Mar 2022 01:21:59 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
410 B 84ms
20ms Image
image/gif 2a03:2880:f112:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=2558854747672869&ev=PageView&dl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Ffeb22-eom-7x%2F%3Frecurring%3Dtrue%26money_pledge%3Dtrue%26amount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26utm_medium%3Demail_hf%26utm_source%3Det_10_bu1nd%26utm_campaign%3D20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa%26utm_content%3Ddonate_button_cpyrs_9683&rl=&if=false&ts=1646529719793&sw=1600&sh=1200&v=2.9.55&r=stable&ec=0&o=29&fbp=fb.1.1646529719791.2118330028&it=1646529719469&coo=false&exp=p0&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 06 Mar 2022 01:21:59 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 44
expires: Sun, 06 Mar 2022 01:21:59 GMT

POST
H2 204 /
rtclx.com/s/ 0
663 B 98ms
25ms Ping
text/plain 18.212.208.179
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rtclx.com/s/?p=7532
Requested by: Host: rtxpx-a.akamaihd.net
URL: https://rtxpx-a.akamaihd.net/main.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.212.208.179 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-208-179.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://secure.winred.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://secure.winred.com
access-control-allow-credentials: true
access-control-allow-headers: DNT,User-Agent,X-Requested-With,X-Forwarded-For,X-Forwarded-Proto,If-Modified-Since,referer,Cache-Control,Content-Type,Range,Pragma,Accept,Accept-Encoding,Accept-Language
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 scevent.min.js Show response
sc-static.net/ Frame C568 17 KB
7 KB 19ms
18ms Script
application/javascript 13.225.229.246
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sc-static.net/scevent.min.js
Requested by: Host: tr.snapchat.com
URL: https://tr.snapchat.com/cm/i?pid=7d4b8c98-0f71-4e52-97e5-4fc263ec23eb
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.229.246 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-229-246.jfk51.r.cloudfront.net
Software: CloudFront /
Resource Hash: f2f087eac841d5433c3c3fa9ea481b474ff8370b9d9eec1ace18f0300a76ffd8

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://tr.snapchat.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sat, 05 Mar 2022 02:00:09 GMT
content-encoding: gzip
server: CloudFront
age: 84110
etag: 0d6e407936704bd380072f5891d28b0e
x-cache: Hit from cloudfront
content-type: application/javascript;charset=utf-8
access-control-allow-origin: *
cache-control: public, s-maxage=86400, max-age=600
x-amz-cf-pop: JFK51-C1
access-control-allow-headers: Content-Type
content-length: 6336
via: 1.1 fb134201578e9706e0dd8abdab0f2abe.cloudfront.net (CloudFront)
x-amz-cf-id: UqElU9iU8sXR5MLiOOaSxjiKzGbkKjgQnWC6ZXLRQsMQfy7Ag5uarA==

GET
H2 200 dc_pre=CLqZkZipsPYCFVoGwwodmw4AVg;src=9381094;type=pagev0;cat=djt_p0;ord=8914804603096;gtm=2wg320;auiddc=1960786444.1646529719;~oref=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising... Show response
adservice.google.ca/ddm/fls/i/ Frame F2ED 194 B
870 B 163ms
86ms Document
text/html 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/ddm/fls/i/dc_pre=CLqZkZipsPYCFVoGwwodmw4AVg;src=9381094;type=pagev0;cat=djt_p0;ord=8914804603096;gtm=2wg320;auiddc=1960786444.1646529719;~oref=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Ffeb22-eom-7x%2F%3Frecurring%3Dtrue%26money_pledge%3Dtrue%26amount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26utm_medium%3Demail_hf%26utm_source%3Det_10_bu1nd%26utm_campaign%3D20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa%26utm_content%3Ddonate_button_cpyrs_9683

Requested by

Host: adservice.google.com
URL: https://adservice.google.com/ddm/fls/i/dc_pre=CLqZkZipsPYCFVoGwwodmw4AVg;src=9381094;type=pagev0;cat=djt_p0;ord=8914804603096;gtm=2wg320;auiddc=1960786444.1646529719;~oref=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Ffeb22-eom-7x%2F%3Frecurring%3Dtrue%26money_pledge%3Dtrue%26amount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26utm_medium%3Demail_hf%26utm_source%3Det_10_bu1nd%26utm_campaign%3D20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa%26utm_content%3Ddonate_button_cpyrs_9683

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://adservice.google.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sun, 06 Mar 2022 01:21:59 GMT
expires: Sun, 06 Mar 2022 01:21:59 GMT
cache-control: private, max-age=0
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 177
x-xss-protection: 0
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"

GET
H2 200 /
www.facebook.com/tr/ 44 B
214 B 22ms
21ms Image
image/gif 2a03:2880:f112:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=181084665799192&ev=PageView&dl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Ffeb22-eom-7x%2F%3Frecurring%3Dtrue%26money_pledge%3Dtrue%26amount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26utm_medium%3Demail_hf%26utm_source%3Det_10_bu1nd%26utm_campaign%3D20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa%26utm_content%3Ddonate_button_cpyrs_9683&rl=&if=false&ts=1646529719854&sw=1600&sh=1200&v=2.9.55&r=stable&a=tmgoogletagmanager&ec=0&o=29&fbp=fb.1.1646529719791.2118330028&it=1646529719469&coo=false&exp=p0&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 06 Mar 2022 01:21:59 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 44
expires: Sun, 06 Mar 2022 01:21:59 GMT

GET
H3

200

p Show response
tr.snapchat.com/cm/ Frame A332
Redirect Chain

https://tr.snapchat.com/cm/s?bt=__LIVE__&pnid=140&cb=1646529719869
https://pixel.tapad.com/idsync/ex/push?partner_id=2884&partner_url=https%3A%2F%2Ftr.snapchat.com%2Fcm%2Fp%3Frand%3D1646489169018%26pnid%3D140%26pcid%3D%24%7BTA_DEVICE_ID%7D
https://pixel.tapad.com/idsync/ex/push/check?partner_id=2884&partner_url=https%3A%2F%2Ftr.snapchat.com%2Fcm%2Fp%3Frand%3D1646489169018%26pnid%3D140%26pcid%3D%24%7BTA_DEVICE_ID%7D
https://tr.snapchat.com/cm/p?rand=1646489169018&pnid=140&pcid=2863ea0b-8c55-475a-9fcf-e5da86d61b36

0
15 B

61ms
60ms

Document
text/html

35.186.226.184
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tr.snapchat.com/cm/p?rand=1646489169018&pnid=140&pcid=2863ea0b-8c55-475a-9fcf-e5da86d61b36

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

35.186.226.184 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

184.226.186.35.bc.googleusercontent.com

Software

nginx/1.19.6 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://tr.snapchat.com/

Response headers

server: nginx/1.19.6
date: Sun, 06 Mar 2022 01:22:00 GMT
content-type: text/html
content-length: 0
access-control-allow-origin: *
cache-control: no-cache, no-transform
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

date: Sun, 06 Mar 2022 01:22:00 GMT
strict-transport-security: max-age=31536000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
location: https://tr.snapchat.com/cm/p?rand=1646489169018&pnid=140&pcid=2863ea0b-8c55-475a-9fcf-e5da86d61b36
content-length: 0
via: 1.1 google
alt-svc: clear

GET
H3 200 m=byfTOb,lsjVmc,LEikZe Show response
www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.K8z_up_A0go.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.caH... Frame A904 36 KB
13 KB 48ms
20ms Script
text/javascript 2607:f8b0:4006:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.K8z_up_A0go.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.caHDU0FH7Jk.L.B1.O/am=DAAE/d=1/exm=_b,_tp/excm=_b,_tp,payframeview/esmo=1/ed=1/wt=2/rs=AMitfrimdNHdiIZjWjGS3Pp9VGMincJUog/ee=cEt90b:ws9Tlc;rXjWyb:VWuaCc;uY49fb:COQbmf;yEQyxe:p8L0ob;yxTchf:KUM7Z;qddgKe:xQtZb;wR5FRb:siKnQd;iFQyKf:vfuNJf;dIoSBb:SpsfSb;nAFL3:NTMZac;oGtAuc:sOXFj;eBAeSb:zbML3c;NPKaK:PVlQOd;LBgRLc:XVMNvd;NSEoX:lazG7b;io8t5d:yDVVkb;j7137d:KG2eXe;Oj465e:KG2eXe;ul9GGd:JrBFQb;sP4Vbe:VwDzFe;kMFpHd:blwjVc;SNUn3:ZwDk9d/m=byfTOb,lsjVmc,LEikZe

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.K8z_up_A0go.es5.O/am=DAAE/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrheYKZJGqpjnhl_Smn6nf5IVRkAyA/m=_b,_tp

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2003 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b47846d59819f5bc3041c35b8aaeafb6977766a23d55453170a89dfbe7f28d02

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 04 Mar 2022 17:23:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 115107
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/payments-consumer-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13516
x-xss-protection: 0
last-modified: Fri, 04 Mar 2022 00:42:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="boq-infra/payments-consumer-boq-js-css-signers"
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/payments-consumer-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/payments-consumer-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Sat, 04 Mar 2023 17:23:32 GMT

GET
H3 200 m=IZT63,ws9Tlc,p8L0ob,vfuNJf,PrPYRd,Ru0Pgb,hc6Ubd,ZyYHPb,Das5Le Show response
www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.K8z_up_A0go.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.caH... Frame A904 75 KB
27 KB 46ms
23ms Script
text/javascript 2607:f8b0:4006:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.K8z_up_A0go.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.caHDU0FH7Jk.L.B1.O/am=DAAE/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,payframeview/esmo=1/ed=1/wt=2/rs=AMitfrimdNHdiIZjWjGS3Pp9VGMincJUog/ee=cEt90b:ws9Tlc;rXjWyb:VWuaCc;uY49fb:COQbmf;yEQyxe:p8L0ob;yxTchf:KUM7Z;qddgKe:xQtZb;wR5FRb:siKnQd;iFQyKf:vfuNJf;dIoSBb:SpsfSb;nAFL3:NTMZac;oGtAuc:sOXFj;eBAeSb:zbML3c;NPKaK:PVlQOd;LBgRLc:XVMNvd;NSEoX:lazG7b;io8t5d:yDVVkb;j7137d:KG2eXe;Oj465e:KG2eXe;ul9GGd:JrBFQb;sP4Vbe:VwDzFe;kMFpHd:blwjVc;SNUn3:ZwDk9d/m=IZT63,ws9Tlc,p8L0ob,vfuNJf,PrPYRd,Ru0Pgb,hc6Ubd,ZyYHPb,Das5Le

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.K8z_up_A0go.es5.O/am=DAAE/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrheYKZJGqpjnhl_Smn6nf5IVRkAyA/m=_b,_tp

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2003 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1153e7d2d0a02ceea958e286133284b5e60e852698e307a3d4d9bb14b2009161

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 04 Mar 2022 17:23:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 115107
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/payments-consumer-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27951
x-xss-protection: 0
last-modified: Fri, 04 Mar 2022 00:42:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="boq-infra/payments-consumer-boq-js-css-signers"
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/payments-consumer-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/payments-consumer-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Sat, 04 Mar 2023 17:23:32 GMT

GET
H3 200 analytics.js Show response
www.google-analytics.com/ Frame A904 49 KB
20 KB 25ms
25ms Script
text/javascript 2607:f8b0:4006:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.K8z_up_A0go.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.caHDU0FH7Jk.L.B1.O/am=DAAE/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,payframeview/esmo=1/ed=1/wt=2/rs=AMitfrimdNHdiIZjWjGS3Pp9VGMincJUog/ee=cEt90b:ws9Tlc;rXjWyb:VWuaCc;uY49fb:COQbmf;yEQyxe:p8L0ob;yxTchf:KUM7Z;qddgKe:xQtZb;wR5FRb:siKnQd;iFQyKf:vfuNJf;dIoSBb:SpsfSb;nAFL3:NTMZac;oGtAuc:sOXFj;eBAeSb:zbML3c;NPKaK:PVlQOd;LBgRLc:XVMNvd;NSEoX:lazG7b;io8t5d:yDVVkb;j7137d:KG2eXe;Oj465e:KG2eXe;ul9GGd:JrBFQb;sP4Vbe:VwDzFe;kMFpHd:blwjVc;SNUn3:ZwDk9d/m=IZT63,ws9Tlc,p8L0ob,vfuNJf,PrPYRd,Ru0Pgb,hc6Ubd,ZyYHPb,Das5Le

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::200e Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 2284
date: Sun, 06 Mar 2022 00:43:56 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Sun, 06 Mar 2022 02:43:56 GMT

GET
H3 200 pay Show response
pay.google.com/gp/p/ui/ Frame A904 1 MB
345 KB 94ms
92ms XHR
text/html 2607:f8b0:4023:1404::5c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pay.google.com/gp/p/ui/pay

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.K8z_up_A0go.es5.O/am=DAAE/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrheYKZJGqpjnhl_Smn6nf5IVRkAyA/m=_b,_tp

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4023:1404::5c Columbus, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ec1e4cb859ae10b2d6add74575d13cf51807a2e566e931f47541c39bcff6bdb9

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-fWH5tOBA3DmHgwT3KPxQCA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport;worker-src 'self', script-src 'nonce-fWH5tOBA3DmHgwT3KPxQCA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com https://sandbox.google.com https://payments.google.com https://pay.google.com https://pay.sandbox.google.com;report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: same-site
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
x-ua-compatible: IE=edge
server: ESF
cross-origin-opener-policy: unsafe-none; report-to="InstantbuyFrontendBuyflowPayUi"
date: Sun, 06 Mar 2022 01:22:00 GMT
x-frame-options: DENY
report-to: {"group":"InstantbuyFrontendBuyflowPayUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/InstantbuyFrontendBuyflowPayUi/external"}]}
content-type: text/html; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
cache-control: private, max-age=3600
content-security-policy: script-src 'report-sample' 'nonce-fWH5tOBA3DmHgwT3KPxQCA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport;worker-src 'self', script-src 'nonce-fWH5tOBA3DmHgwT3KPxQCA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com https://sandbox.google.com https://payments.google.com https://pay.google.com https://pay.sandbox.google.com;report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport
expires: Sun, 06 Mar 2022 01:22:00 GMT

POST
H3 200 log Show response
play.google.com/ Frame A904 131 B
152 B 97ms
69ms XHR
text/plain 2607:f8b0:4006:81f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.K8z_up_A0go.es5.O/am=DAAE/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrheYKZJGqpjnhl_Smn6nf5IVRkAyA/m=_b,_tp

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::200e Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pay.google.com/
X-Goog-AuthUser: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Sun, 06 Mar 2022 01:22:00 GMT
content-encoding: gzip
server: Playlog
access-control-allow-headers: X-Playlog-Web
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131
x-xss-protection: 0

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 82ms
31ms Preflight
text/plain 2607:f8b0:4006:81f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81f::200e Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: x-goog-authuser
Origin: https://pay.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: https://pay.google.com
access-control-allow-methods: GET, POST, OPTIONS
access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
content-type: text/plain; charset=UTF-8
date: Sun, 06 Mar 2022 01:22:00 GMT
server: Playlog
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 log Show response
play.google.com/ Frame A904 131 B
152 B 94ms
66ms XHR
text/plain 2607:f8b0:4006:81f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.K8z_up_A0go.es5.O/am=DAAE/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrheYKZJGqpjnhl_Smn6nf5IVRkAyA/m=_b,_tp

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::200e Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pay.google.com/
X-Goog-AuthUser: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Sun, 06 Mar 2022 01:22:00 GMT
content-encoding: gzip
server: Playlog
access-control-allow-headers: X-Playlog-Web
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131
x-xss-protection: 0

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 75ms
33ms Preflight
text/plain 2607:f8b0:4006:81f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81f::200e Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: x-goog-authuser
Origin: https://pay.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: https://pay.google.com
access-control-allow-methods: GET, POST, OPTIONS
access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
content-type: text/plain; charset=UTF-8
date: Sun, 06 Mar 2022 01:22:00 GMT
server: Playlog
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 log Show response
play.google.com/ Frame A904 131 B
152 B 96ms
69ms XHR
text/plain 2607:f8b0:4006:81f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.K8z_up_A0go.es5.O/am=DAAE/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrheYKZJGqpjnhl_Smn6nf5IVRkAyA/m=_b,_tp

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::200e Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pay.google.com/
X-Goog-AuthUser: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Sun, 06 Mar 2022 01:22:00 GMT
content-encoding: gzip
server: Playlog
access-control-allow-headers: X-Playlog-Web
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131
x-xss-protection: 0

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 67ms
34ms Preflight
text/plain 2607:f8b0:4006:81f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81f::200e Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: x-goog-authuser
Origin: https://pay.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: https://pay.google.com
access-control-allow-methods: GET, POST, OPTIONS
access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
content-type: text/plain; charset=UTF-8
date: Sun, 06 Mar 2022 01:22:00 GMT
server: Playlog
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 log Show response
play.google.com/ Frame A904 131 B
152 B 97ms
69ms XHR
text/plain 2607:f8b0:4006:81f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.K8z_up_A0go.es5.O/am=DAAE/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrheYKZJGqpjnhl_Smn6nf5IVRkAyA/m=_b,_tp

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::200e Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pay.google.com/
X-Goog-AuthUser: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Sun, 06 Mar 2022 01:22:00 GMT
content-encoding: gzip
server: Playlog
access-control-allow-headers: X-Playlog-Web
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131
x-xss-protection: 0

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 54ms
32ms Preflight
text/plain 2607:f8b0:4006:81f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81f::200e Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: x-goog-authuser
Origin: https://pay.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: https://pay.google.com
access-control-allow-methods: GET, POST, OPTIONS
access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
content-type: text/plain; charset=UTF-8
date: Sun, 06 Mar 2022 01:22:00 GMT
server: Playlog
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 log Show response
play.google.com/ Frame A904 131 B
152 B 95ms
68ms XHR
text/plain 2607:f8b0:4006:81f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.K8z_up_A0go.es5.O/am=DAAE/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrheYKZJGqpjnhl_Smn6nf5IVRkAyA/m=_b,_tp

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::200e Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pay.google.com/
X-Goog-AuthUser: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Sun, 06 Mar 2022 01:22:00 GMT
content-encoding: gzip
server: Playlog
access-control-allow-headers: X-Playlog-Web
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131
x-xss-protection: 0

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 45ms
33ms Preflight
text/plain 2607:f8b0:4006:81f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81f::200e Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: x-goog-authuser
Origin: https://pay.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: https://pay.google.com
access-control-allow-methods: GET, POST, OPTIONS
access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
content-type: text/plain; charset=UTF-8
date: Sun, 06 Mar 2022 01:22:00 GMT
server: Playlog
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 m=Wt6vjf,hhhU8,FCpbqb,WhJNk Show response
www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.K8z_up_A0go.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.caH... Frame A904 17 KB
7 KB 20ms
19ms Script
text/javascript 2607:f8b0:4006:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.K8z_up_A0go.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.caHDU0FH7Jk.L.B1.O/am=DAAE/d=1/exm=Das5Le,IZT63,LEikZe,PrPYRd,Ru0Pgb,ZyYHPb,_b,_tp,byfTOb,hc6Ubd,lsjVmc,p8L0ob,vfuNJf,ws9Tlc/excm=_b,_tp,payframeview/esmo=1/ed=1/wt=2/rs=AMitfrimdNHdiIZjWjGS3Pp9VGMincJUog/ee=cEt90b:ws9Tlc;rXjWyb:VWuaCc;uY49fb:COQbmf;yEQyxe:p8L0ob;yxTchf:KUM7Z;qddgKe:xQtZb;wR5FRb:siKnQd;iFQyKf:vfuNJf;dIoSBb:SpsfSb;nAFL3:NTMZac;oGtAuc:sOXFj;eBAeSb:zbML3c;NPKaK:PVlQOd;LBgRLc:XVMNvd;NSEoX:lazG7b;io8t5d:yDVVkb;j7137d:KG2eXe;Oj465e:KG2eXe;ul9GGd:JrBFQb;sP4Vbe:VwDzFe;kMFpHd:blwjVc;SNUn3:ZwDk9d/m=Wt6vjf,hhhU8,FCpbqb,WhJNk

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.K8z_up_A0go.es5.O/am=DAAE/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrheYKZJGqpjnhl_Smn6nf5IVRkAyA/m=_b,_tp

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2003 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

83a63dae231522d6c04826215d08c5a7a7aaa48b9110c0e532f9702bf2266107

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 04 Mar 2022 17:23:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 115108
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/payments-consumer-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7213
x-xss-protection: 0
last-modified: Fri, 04 Mar 2022 00:42:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="boq-infra/payments-consumer-boq-js-css-signers"
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/payments-consumer-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/payments-consumer-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Sat, 04 Mar 2023 17:23:32 GMT

GET
H3 200 m=lwddkf,EFQ78c Show response
www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.K8z_up_A0go.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.caH... Frame A904 7 KB
3 KB 22ms
21ms Script
text/javascript 2607:f8b0:4006:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.K8z_up_A0go.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.caHDU0FH7Jk.L.B1.O/am=DAAE/d=1/exm=Das5Le,FCpbqb,IZT63,LEikZe,PrPYRd,Ru0Pgb,WhJNk,Wt6vjf,ZyYHPb,_b,_tp,byfTOb,hc6Ubd,hhhU8,lsjVmc,p8L0ob,vfuNJf,ws9Tlc/excm=_b,_tp,payframeview/esmo=1/ed=1/wt=2/rs=AMitfrimdNHdiIZjWjGS3Pp9VGMincJUog/ee=cEt90b:ws9Tlc;rXjWyb:VWuaCc;uY49fb:COQbmf;yEQyxe:p8L0ob;yxTchf:KUM7Z;qddgKe:xQtZb;wR5FRb:siKnQd;iFQyKf:vfuNJf;dIoSBb:SpsfSb;nAFL3:NTMZac;oGtAuc:sOXFj;eBAeSb:zbML3c;NPKaK:PVlQOd;LBgRLc:XVMNvd;NSEoX:lazG7b;io8t5d:yDVVkb;j7137d:KG2eXe;Oj465e:KG2eXe;ul9GGd:JrBFQb;sP4Vbe:VwDzFe;kMFpHd:blwjVc;SNUn3:ZwDk9d/m=lwddkf,EFQ78c

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.K8z_up_A0go.es5.O/am=DAAE/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrheYKZJGqpjnhl_Smn6nf5IVRkAyA/m=_b,_tp

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2003 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0f3bf38d15ca87941065130968d3bb9dc1d35aac389723568eacba720d0bb177

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 04 Mar 2022 17:23:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 115108
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/payments-consumer-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3041
x-xss-protection: 0
last-modified: Fri, 04 Mar 2022 00:42:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="boq-infra/payments-consumer-boq-js-css-signers"
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/payments-consumer-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/payments-consumer-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Sat, 04 Mar 2023 17:23:32 GMT

POST
H3 200 log Show response
play.google.com/ Frame A904 131 B
152 B 71ms
69ms XHR
text/plain 2607:f8b0:4006:81f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.K8z_up_A0go.es5.O/am=DAAE/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrheYKZJGqpjnhl_Smn6nf5IVRkAyA/m=_b,_tp

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::200e Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://pay.google.com/
X-Goog-AuthUser: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Sun, 06 Mar 2022 01:22:00 GMT
content-encoding: gzip
server: Playlog
access-control-allow-headers: X-Playlog-Web
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131
x-xss-protection: 0

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 32ms
32ms Preflight
text/plain 2607:f8b0:4006:81f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81f::200e Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: x-goog-authuser
Origin: https://pay.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: https://pay.google.com
access-control-allow-methods: GET, POST, OPTIONS
access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
content-type: text/plain; charset=UTF-8
date: Sun, 06 Mar 2022 01:22:00 GMT
server: Playlog
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 0 Show response
r.stripe.com/ Frame 938D 0
127 B 79ms
79ms XHR
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/0
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://js.stripe.com
date: Sun, 06 Mar 2022 01:22:00 GMT
access-control-allow-credentials: true
server: nginx
content-length: 0
content-type: text/plain

POST
H2 200 0 Show response
r.stripe.com/ Frame 938D 0
127 B 80ms
79ms XHR
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/0
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://js.stripe.com
date: Sun, 06 Mar 2022 01:22:00 GMT
access-control-allow-credentials: true
server: nginx
content-length: 0
content-type: text/plain

POST
H2 200 0 Show response
r.stripe.com/ Frame 938D 0
127 B 81ms
81ms XHR
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/0
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://js.stripe.com
date: Sun, 06 Mar 2022 01:22:00 GMT
access-control-allow-credentials: true
server: nginx
content-length: 0
content-type: text/plain

POST
H2 200 0 Show response
r.stripe.com/ Frame 938D 0
127 B 81ms
81ms XHR
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/0
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://js.stripe.com
date: Sun, 06 Mar 2022 01:22:00 GMT
access-control-allow-credentials: true
server: nginx
content-length: 0
content-type: text/plain

GET
H2 200 elements-inner-payment-request-c053232a40284e9f033e830c33130af9.html Show response
js.stripe.com/v3/ Frame 4D0A 8 KB
2 KB 14ms
13ms Document
text/html 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/elements-inner-payment-request-c053232a40284e9f033e830c33130af9.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

41e913a65798ac51868018852dd7c3f49d0ec5f5e635edc51be95ef30166114c

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/

Response headers

last-modified: Fri, 04 Mar 2022 19:26:43 GMT
etag: "c053232a40284e9f033e830c33130af9"
cache-control: max-age=31536000
content-type: text/html; charset=utf-8
content-security-policy: default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self'; report-uri https://q.stripe.com/csp-report
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
access-control-allow-origin: *
server: Fastly
content-encoding: br
accept-ranges: bytes
date: Sun, 06 Mar 2022 01:22:00 GMT
via: 1.1 varnish
age: 107328
x-request-id: 8d288129-7c3e-4a09-b69d-e3529a01c01d
x-served-by: cache-yul12820-YUL
x-cache: HIT
x-cache-hits: 895
vary: Accept-Encoding
timing-allow-origin: *
content-length: 1758

POST
H2 200 0 Show response
r.stripe.com/ Frame 1775 0
127 B 140ms
139ms XHR
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/0
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://js.stripe.com
date: Sun, 06 Mar 2022 01:22:00 GMT
access-control-allow-credentials: true
server: nginx
content-length: 0
content-type: text/plain

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 99 KB
39 KB 69ms
41ms Script
application/javascript 2607:f8b0:4006:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-880442929

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80f::2008 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

7fef8398f20bb11e5dc1abb97915208d75e44098600c2c07b37db0b292e0e87c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 06 Mar 2022 01:22:00 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40080
x-xss-protection: 0
last-modified: Sun, 06 Mar 2022 00:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 06 Mar 2022 01:22:00 GMT

POST
H2 204 /
rtclx.com/s/ 0
663 B 33ms
30ms Ping
text/plain 18.212.208.179
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://rtclx.com/s/?p=7535
Requested by: Host: rtxpx-a.akamaihd.net
URL: https://rtxpx-a.akamaihd.net/main.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.212.208.179 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-208-179.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://secure.winred.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://secure.winred.com
access-control-allow-credentials: true
access-control-allow-headers: DNT,User-Agent,X-Requested-With,X-Forwarded-For,X-Forwarded-Proto,If-Modified-Since,referer,Cache-Control,Content-Type,Range,Pragma,Accept,Accept-Encoding,Accept-Language
access-control-allow-methods: GET, POST, OPTIONS
expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H3 200 log Show response
play.google.com/ Frame A904 131 B
152 B 73ms
70ms XHR
text/plain 2607:f8b0:4006:81f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.K8z_up_A0go.es5.O/am=DAAE/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrheYKZJGqpjnhl_Smn6nf5IVRkAyA/m=_b,_tp

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::200e Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://pay.google.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Sun, 06 Mar 2022 01:22:00 GMT
content-encoding: gzip
server: Playlog
access-control-allow-headers: X-Playlog-Web
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131
x-xss-protection: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 938D 0
127 B 115ms
114ms XHR
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/0
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://js.stripe.com
date: Sun, 06 Mar 2022 01:22:00 GMT
access-control-allow-credentials: true
server: nginx
content-length: 0
content-type: text/plain

POST
H2 200 0 Show response
r.stripe.com/ Frame 938D 0
127 B 115ms
114ms XHR
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/0
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://js.stripe.com
date: Sun, 06 Mar 2022 01:22:00 GMT
access-control-allow-credentials: true
server: nginx
content-length: 0
content-type: text/plain

POST
H2 200 csp-report
q.stripe.com/ Frame 4D0A 0
356 B 97ms
95ms Other
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://q.stripe.com/csp-report
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/feb22-eom-7x/?recurring=true&money_pledge=true&amount=5&amt1=5&amt2=10&amt3=15&amt4=20&utm_medium=email_hf&utm_source=et_10_bu1nd&utm_campaign=20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa&utm_content=donate_button_cpyrs_9683
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Sun, 06 Mar 2022 01:22:00 GMT
server: nginx
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://js.stripe.com
access-control-expose-headers: Server, Range, Content-Type
x-envoy-upstream-service-time: 0
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
content-length: 0

GET
H2 200 ui-shared-46e93b3755a485133d7e5e7e1db48eaf.css
js.stripe.com/v3/fingerprinted/css/ Frame 4D0A 15 KB
3 KB 14ms
12ms Stylesheet
text/css 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/css/ui-shared-46e93b3755a485133d7e5e7e1db48eaf.css

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-payment-request-c053232a40284e9f033e830c33130af9.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

d9f33ed9fdd936a670993b9a8e6ca44e7a358d0f7b217b6c6638b502f66a8015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-payment-request-c053232a40284e9f033e830c33130af9.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
age: 90
x-cache: HIT
content-length: 2474
etag: "7c0a4ba6a732ed01cc27774f97bbe8bd"
x-request-id: f182049a-28b6-4282-8067-4a42954e9f63
x-served-by: cache-yul12820-YUL
access-control-allow-origin: *
last-modified: Wed, 12 Jan 2022 18:02:17 GMT
server: Fastly
date: Sun, 06 Mar 2022 01:22:00 GMT
vary: Accept-Encoding
content-type: text/css
via: 1.1 varnish
cache-control: max-age=60
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 27

GET
H2 200 shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 4D0A 206 KB
51 KB 14ms
13ms Script
application/javascript 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-payment-request-c053232a40284e9f033e830c33130af9.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

72d846435cbbd1ca41996ccbb63b934550ba3b23693f1da4827a148126183d3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-payment-request-c053232a40284e9f033e830c33130af9.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
age: 4
x-cache: HIT
content-length: 51539
etag: "585a3dd1f903391f15ef0b0ae3492717"
x-request-id: 2b1117b1-e09f-4ece-8a95-a7e32dd6eaa4
x-served-by: cache-yul12820-YUL
access-control-allow-origin: *
last-modified: Fri, 04 Mar 2022 19:26:02 GMT
server: Fastly
date: Sun, 06 Mar 2022 01:22:00 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: max-age=60
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 8

GET
H2 200 ui-shared-8d92a34ff0de1bd66f84f68818549ef1.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 4D0A 216 KB
62 KB 16ms
15ms Script
application/javascript 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/ui-shared-8d92a34ff0de1bd66f84f68818549ef1.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-payment-request-c053232a40284e9f033e830c33130af9.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

20db312f001c56801189799d4ea159c5b2e1bb726845543bbf5d890921c7cd03

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-payment-request-c053232a40284e9f033e830c33130af9.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
age: 41
x-cache: HIT
content-length: 62889
etag: "0dd79493bde3ff2dfa1c01e8623c4628"
x-request-id: 9243bd8e-8a5a-400f-92e5-4b15a91a5096
x-served-by: cache-yul12820-YUL
access-control-allow-origin: *
last-modified: Wed, 23 Feb 2022 22:00:53 GMT
server: Fastly
date: Sun, 06 Mar 2022 01:22:00 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: max-age=60
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 13

GET
H2 200 elements-inner-payment-request-e9304cdf935734973721bbccaa5af81c.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 4D0A 44 KB
13 KB 16ms
15ms Script
application/javascript 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/elements-inner-payment-request-e9304cdf935734973721bbccaa5af81c.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-payment-request-c053232a40284e9f033e830c33130af9.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

52659ee3f09b60a34fe0630ddc8de9eb942cf481054761f6c0bc704d43318635

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-payment-request-c053232a40284e9f033e830c33130af9.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
age: 41
x-cache: HIT
content-length: 13176
etag: "cacf1c345540918bcfbd67d35866955e"
x-request-id: 6cb94932-f2d2-4c2d-b30b-30595ecd9b91
x-served-by: cache-yul12820-YUL
access-control-allow-origin: *
last-modified: Mon, 28 Feb 2022 20:03:04 GMT
server: Fastly
date: Sun, 06 Mar 2022 01:22:00 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: max-age=60
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 5

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 39 KB
15 KB 108ms
59ms Script
text/javascript 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-880442929

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s80-in-f2.1e100.net

Software

cafe /

Resource Hash

cae0ae2d67aac89367108586ebd25e00afc5d0f8110e6eb71b8d274037f7a5d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sun, 06 Mar 2022 01:22:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14884
x-xss-protection: 0
server: cafe
etag: 16747055602125368176
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sun, 06 Mar 2022 01:22:00 GMT

POST
H2 200 0 Show response
r.stripe.com/ Frame 938D 0
127 B 80ms
80ms XHR
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/0
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://js.stripe.com
date: Sun, 06 Mar 2022 01:22:00 GMT
access-control-allow-credentials: true
server: nginx
content-length: 0
content-type: text/plain

POST
H2 200 0 Show response
r.stripe.com/ Frame 938D 0
127 B 81ms
81ms XHR
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/0
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://js.stripe.com
date: Sun, 06 Mar 2022 01:22:00 GMT
access-control-allow-credentials: true
server: nginx
content-length: 0
content-type: text/plain

POST
H2 200 0 Show response
r.stripe.com/ Frame 938D 0
127 B 80ms
79ms XHR
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/0
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://js.stripe.com
date: Sun, 06 Mar 2022 01:22:00 GMT
access-control-allow-credentials: true
server: nginx
content-length: 0
content-type: text/plain

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/880442929/ 3 KB
2 KB 88ms
41ms Script
text/javascript 2607:f8b0:4006:80c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/880442929/?random=1646529720435&cv=9&fst=1646529720435&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa320&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Ffeb22-eom-7x%2F%3Frecurring%3Dtrue%26money_pledge%3Dtrue%26amount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26utm_medium%3Demail_hf%26utm_source%3Det_10_bu1nd%26utm_campaign%3D20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa%26utm_content%3Ddonate_button_cpyrs_9683&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

29e35ed61deeeec62702f466e84456fb9d55f81e4e6d0bba8436f8e997546762

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 06 Mar 2022 01:22:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1195
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/880442929/ 42 B
64 B 139ms
108ms Image
image/gif 2607:f8b0:4006:80d::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/880442929/?random=1646529720435&cv=9&fst=1646528400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa320&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Ffeb22-eom-7x%2F%3Frecurring%3Dtrue%26money_pledge%3Dtrue%26amount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26utm_medium%3Demail_hf%26utm_source%3Det_10_bu1nd%26utm_campaign%3D20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa%26utm_content%3Ddonate_button_cpyrs_9683&async=1&fmt=3&is_vtc=1&random=2707807789&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2004 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 06 Mar 2022 01:22:00 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.ca/pagead/1p-user-list/880442929/ 42 B
64 B 70ms
42ms Image
image/gif 2607:f8b0:4006:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-user-list/880442929/?random=1646529720435&cv=9&fst=1646528400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa320&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Ffeb22-eom-7x%2F%3Frecurring%3Dtrue%26money_pledge%3Dtrue%26amount%3D5%26amt1%3D5%26amt2%3D10%26amt3%3D15%26amt4%3D20%26utm_medium%3Demail_hf%26utm_source%3Det_10_bu1nd%26utm_campaign%3D20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa%26utm_content%3Ddonate_button_cpyrs_9683&async=1&fmt=3&is_vtc=1&random=2707807789&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80e::2003 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 06 Mar 2022 01:22:00 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 common.js Show response
maps.googleapis.com/maps-api-v3/api/js/48/3/ 78 KB
28 KB 47ms
19ms Script
text/javascript 2607:f8b0:4006:823::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps-api-v3/api/js/48/3/common.js

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::200a Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5e83bab2d43e3373a21521b43b81110100223e34fa7b2460582826decacbf59c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sat, 05 Mar 2022 09:20:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 57716
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29041
x-xss-protection: 0
last-modified: Mon, 28 Feb 2022 20:24:34 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="maps-api-js"
vary: Accept-Encoding, Origin
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 05 Mar 2023 09:20:07 GMT

GET
H3 200 util.js Show response
maps.googleapis.com/maps-api-v3/api/js/48/3/ 295 KB
90 KB 48ms
21ms Script
text/javascript 2607:f8b0:4006:823::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps-api-v3/api/js/48/3/util.js

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::200a Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0cd4adf2b91ae844e996f1b986a3efd7788a7158f33059bdfa94d0eda5770c70

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 03 Mar 2022 16:39:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 204132
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 92136
x-xss-protection: 0
last-modified: Mon, 28 Feb 2022 20:24:34 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="maps-api-js"
vary: Accept-Encoding, Origin
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 03 Mar 2023 16:39:51 GMT

GET
H2 200 trusted-types-checker-79a96411cda1ad4b6763ce22787d473d.js Show response
js.stripe.com/v3/fingerprinted/js/ 172 B
270 B 11ms
10ms Script
application/javascript 151.101.64.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/trusted-types-checker-79a96411cda1ad4b6763ce22787d473d.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.64.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

44817c16b84ba3d2522ea47f3b6c94758f334739fbe91443e0e3a2085f637022

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
age: 49
x-cache: HIT
content-length: 118
etag: "d2c1d1f45a2ae4aca2c4e7d33040ceb7"
x-request-id: c0949515-1068-4bd5-b8b8-bf65cf7de7fd
x-served-by: cache-yul12820-YUL
access-control-allow-origin: *
last-modified: Mon, 07 Feb 2022 21:04:47 GMT
server: Fastly
date: Sun, 06 Mar 2022 01:22:05 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: max-age=60
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 11

POST
H2 200 0 Show response
r.stripe.com/ Frame 1775 0
127 B 79ms
79ms XHR
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/0
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-31b5b9a24bb85cb2d1ed3ce8345f61dc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-186-23-98.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://js.stripe.com
date: Sun, 06 Mar 2022 01:22:05 GMT
access-control-allow-credentials: true
server: nginx
content-length: 0
content-type: text/plain

Verdicts & Comments Add Verdict or Comment

72 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

28 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
sc-static.net/scevent.min.js	1970-01-20 01:23:36	Name: X-AB Value: 0d6e407936704bd380072f5891d28b0e
app.winred.com/api/v3/users	1970-01-21 21:11:36	Name: rvid Value: 3b8f32e5-3477-4b73-87c4-d1cd63fcb349
secure.winred.com/	1969-12-31 23:59:59	Name: origin_url Value: https://secure.winred.com/save-america-joint-fundraising-committee/feb22-eom-7x/?recurring=true&money_pledge=true&amount=5&amt1=5&amt2=10&amt3=15&amt4=20&utm_medium=email_hf&utm_source=et_10_bu1nd&utm_campaign=20220228_feb22-eom-final-day-asking_trumpdeadlinealert_sa&utm_content=donate_button_cpyrs_9683
.winred.com/	1969-12-31 23:59:59	Name: _revv_v3_session Value: NU4vdkw0VFdKa3dxMkViaG9lcHZOR3BOQWxYbHhvbU91SEdRUTNlTkZHcEUwV2tGYjJ0LzNFblVXV1BIRHJ2MFkzbTJvTVpSZ3pUVjZKOFJTSUwwNExHR2xYMjhnRUcvWnowUytUZXFERU5oUTc2MnJjM2RYcEJCaWdtaUo0aS9DWHNDMmpybUVqRUtVNGVyQ1VWSlZaNVFZVHlWNjBsQXJjTkEvbHU4OXJLd1pBTXo2VUdZelBVVG1nRkxNb2lHbHVPV3pzQkpUR3QwRVRoelpkQWxKajJqOHpZYUpieVVQOUlWME9BTVFKM3VRR2crcXZvaU9sTXhOYm1lejNNTEFEakJyTkhjVFNXZi9mUlYvdDdFVzd0VGVNcENYTWh3SUxNQ3IvaDN2aWdMVEgrbFRlb1NPSHgvMjgyNThmOWdjUWN3NkNwQ05XUXNKSE9heVQ4S3dRSnA5eHpDMC9VSis0RnhDVU85ckdDdmlxWUkxS1FydVRUeEpxMmdyVnlteXVldlhQWEVnK0RoQWlJWFNGMGhWSFN0Q0phczRJWndhWjk3UHFuNDVaQWpnWW4xNVRrQnZiQ3hBUzJ1N0N5WmRTWWc1dzQ0K3QyVmo2YnIvVUw0Q2dSTm9VNFIrOTJaYnBRMnIrYWViSlNvZ1FkMXNwRnhDNU9VVThVempxOUM3VXplWWVUazNSS2ZERFlLR3BNbEFUQndUNWorckRBTVdrZFBuUmkvU2hCUkIxLzdMdnlGclhWdEZBVWpsMkpGR0ZZWUhVWHJXcmdHNTQxbXRIclRrTnpDMk4ydWVuRzFJNllVK1kvdHFqVCtadDFqemZMdE42UUwydW1nNEF1aGhURC9zcVNBMlY2MlhNQmlVcFZPNEpyRlRtN0hNYytYZ2hObTVqYnY3MU9FN0FYTFJjRkRwcjQ3clEwaHZjREF2dS9DbWxRTTc0R1h1c0ZvRklyTGYzN0tUSmo3NExLMTFPTlJSZ3F1bUs1MFpxNXVoNVpDWXZmVVh3OStObW51aWVGWlAydUZGaWgvUGp6NlMzQXpDdz09LS1EekFzbGVXNXJ2cWxrbVZLWE93TldRPT0%3D--f2a26b6b0b5706f5dcf057465c4fdce9ed4ecac0
.winred.com/	1970-01-20 03:31:45	Name: _gcl_au Value: 1.1.1960786444.1646529719
.google.com/	1970-01-20 05:45:40	Name: NID Value: 511=q8T5_cg2EjFL0GA7IVfISSHSAqc2cDTWZYoYtZpF8h5n_zfJ_NdpupfOML1b8EFNgf8ZQQVyx9WYtyZXMYJj_rBsefN7OZvRPqkewCgTRgBW95PFwzsY1mQQkiCE2b2R54eFPPKkUluGo5GupYMjpqi91ML1SPuXbWftzTbR5fM
secure.winred.com/	1969-12-31 23:59:59	Name: sso_tries Value: 1
secure.winred.com/	1970-01-21 21:10:09	Name: rvid Value: 3b8f32e5-3477-4b73-87c4-d1cd63fcb349
.secure.winred.com/	1970-01-20 01:22:11	Name: __cf_bm Value: rNo3uQU6_R2rN2KE.V6SwTcSkWF.VyfQVFB512XilX4-1646529719-0-AepzgnNKeJ2X+9aNY8g/2PfNtjU3bhW1o3ESRNnH7OHl8eIg+o1nhjNPjXTQnfGf0nbQhROr3XEea3cRcG1Pv25PXwfLPViOwvt8NVyAAsLW8CCQM1iSnuzHsaZ6fQiKOt3sg6YG+CpiYGrotaofJBnvClO18vCz6KKSU0s4DOIwnm5IklM1gaknFdT9a6VFXg==
.winred.com/	1970-01-20 18:53:21	Name: _ga Value: GA1.2.1621494761.1646529719
.winred.com/	1970-01-20 01:23:36	Name: _gid Value: GA1.2.1912252907.1646529719
.winred.com/	1970-01-20 01:22:09	Name: _gat_UA-60901920-1 Value: 1
.winred.com/	1970-01-20 01:22:09	Name: _dc_gtm_UA-73658561-7 Value: 1
.winred.com/	1970-01-20 10:51:56	Name: _scid Value: 3f116973-5ca2-4274-b039-634860b33397
.akamaihd.net/	1970-01-20 10:07:45	Name: b53eedc13__ Value: cb5882509267f59f122e16ffbd9a1cad892ef844b.1646529719
.winred.com/	1970-01-20 03:31:45	Name: _fbp Value: fb.1.1646529719791.2118330028
.facebook.com/	1970-01-20 03:31:45	Name: fr Value: 0H7yXwcIiEJ8B0lZV..BiJAy3...1.0.BiJAy3.
.rtclx.com/	1970-01-20 02:05:21	Name: tp_usr Value: cb5882509267f59f122e16ffbd9a1cad892ef844b
.rtclx.com/	1970-01-20 02:05:21	Name: tp_dfp Value: d22bb4f79ceb11ec81930242ac110003
.tapad.com/	1970-01-20 02:48:33	Name: TapAd_TS Value: 1646529719979
.tapad.com/	1970-01-20 02:48:33	Name: TapAd_DID Value: 2863ea0b-8c55-475a-9fcf-e5da86d61b36
m.stripe.com/	1970-01-20 18:53:21	Name: m Value: 5809f755-7ad9-43ba-9eca-7b719dff1751cf4150
.tapad.com/	1970-01-20 02:48:33	Name: TapAd_3WAY_SYNCS Value:
.snapchat.com/	1970-01-20 10:43:45	Name: sc_at Value: v2\|H4sIAAAAAAAAAE3JwQ3AMAgEsImQjoRArtuAqkzB8O0zP0tOLfgMCgxb7KxXKnIKysl/WMhWw6NuvgZjoC/iA8ScYjtAAAAA
.secure.winred.com/	1970-01-20 10:07:45	Name: __stripe_mid Value: 525c4541-c341-4da6-a0be-c57641fb34bc9e7235
.secure.winred.com/	1970-01-20 01:22:11	Name: __stripe_sid Value: 6354922c-a620-41f4-a4a5-b6a8d503c27b7cf1c0
.winred.com/	1970-01-20 10:51:56	Name: _sctr Value: 1\|1646524800000
.doubleclick.net/	1970-01-20 18:53:21	Name: IDE Value: AHWqTUk4HYFgwJug5sv03wmxosXSloNbN-H5U6CM3CKHvZM5LTN2y0s6ro2NXzhk

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG(Line 40) Message: Unrecognized feature: 'attribution-reporting'.
security	error	(Line 6) Message: This document requires 'TrustedScript' assignment.
network	error	URL: https://pay.google.com/_/InstantbuyFrontendBuyflowPayframeUi/cspreport Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

9381094.fls.doubleclick.net
adservice.google.ca
adservice.google.com
app.winred.com
click.email.donaldjtrump.com
connect.facebook.net
d35ligi1n5bgzc.cloudfront.net
googleads.g.doubleclick.net
js.stripe.com
m.stripe.com
m.stripe.network
maps.googleapis.com
pay.google.com
pixel.tapad.com
play.google.com
q.stripe.com
r.stripe.com
rtclx.com
rtxpx-a.akamaihd.net
sc-static.net
secure.winred.com
stats.g.doubleclick.net
stickyid-a.akamaihd.net
tr.snapchat.com
www.facebook.com
www.google-analytics.com
www.google.ca
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.gstatic.com
107.178.246.49
13.110.196.229
13.225.221.129
13.225.229.246
142.250.80.38
142.251.40.130
151.101.64.176
18.212.208.179
2600:141b:13::b833:9291
2600:141b:13::b833:92a3
2606:4700::6812:9c15
2607:f8b0:4006:80c::2002
2607:f8b0:4006:80d::2004
2607:f8b0:4006:80e::2003
2607:f8b0:4006:80f::2008
2607:f8b0:4006:816::2002
2607:f8b0:4006:81c::2003
2607:f8b0:4006:81f::200e
2607:f8b0:4006:820::200e
2607:f8b0:4006:822::2002
2607:f8b0:4006:823::200a
2607:f8b0:4023:1404::5c
2607:f8b0:4023:1407::9d
2a03:2880:f012:8:face:b00c:0:1
2a03:2880:f112:83:face:b00c:0:25de
35.186.226.184
54.186.23.98
54.200.96.253
05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf
09fae7e31cfadcb57f0472477a5a10a512af66638c425824a946c9796a732f89
0cd4adf2b91ae844e996f1b986a3efd7788a7158f33059bdfa94d0eda5770c70
0d0e14cc50017fea4210952d4eaff897a2a0401bb5ab641abdf05817a52b5a2a
0d3118e306c6a26f1d2efcb698984e6922c5e7e155c94a84760e36e5592a3c11
0db6cb950dcb73185a53aa0fc5aff29a822b87759f56922271d83bd07e4a653a
0ecde91d88dbb2ac0fee3fd1fbb92977853f7e91ba1977c2c33b04d237165693
0f3bf38d15ca87941065130968d3bb9dc1d35aac389723568eacba720d0bb177
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
1153e7d2d0a02ceea958e286133284b5e60e852698e307a3d4d9bb14b2009161
12b4366b33e29570f8d6547eba74c476ed386560b952ba8fe7235aeb809f1d9c
17fa6b4f8631c4f48f6275ddcaec3a6adec86b149e7a1d37af5986037aac4877
1cd6e55f30592f2d07f9d038d85872e5d4fe5b079c86cadf29a3776694593d7b
20db312f001c56801189799d4ea159c5b2e1bb726845543bbf5d890921c7cd03
250d870553534742edd49cdec823b70f8171e89c315e899ed586a91911c3c57b
260b900af6b748db1f0e34e740101c1318cc7d89529dface75c10dd7ddb6055b
288221dc44603c78df9ef97005ac06d9663c02254ec920802bd8acf4ce2479e6
28fc5d82e4ecd4cce7cfad5b143d78dfeaaa428d19e8bf520fe7aeba3961ae49
29e35ed61deeeec62702f466e84456fb9d55f81e4e6d0bba8436f8e997546762
325626e5a0d6feaed002bf86ca081e947a201b18692bae00aab06e7b23537309
36f0bf882a876b13aeb20cf7a495421a43f336da5422072a58f58ce303fb6284
39274d16fe03d66d8a425007eeb00f2d51496db71e847a0940a1b3ae12c42fed
41e913a65798ac51868018852dd7c3f49d0ec5f5e635edc51be95ef30166114c
44817c16b84ba3d2522ea47f3b6c94758f334739fbe91443e0e3a2085f637022
44937d2b1f36d2962e30ca860e2367179210a22f56d90ea7b439d6aff0b67dce
4ec0827f796bdadb833f52dd7ea841e12158d9f488554ecb73479cc2ea6f6d8e
502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358
52659ee3f09b60a34fe0630ddc8de9eb942cf481054761f6c0bc704d43318635
5785c083b1cf0a752958975ebf6365d60896c3e809e7fd9bd94dc6e11bc75004
5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848
5e83bab2d43e3373a21521b43b81110100223e34fa7b2460582826decacbf59c
5ed01afec7a8885ac179d8946a1b9e8ea751051ec8495ba1c51c4b66367f69a3
6501140033c3bb20da4b5ac73c90f687ba8a2053c4ba37c4b6f5275166db7fa6
678c51cc48293e85c0fc68235c35479471a8ca7aef69a1c5c343e91faa4c1d3e
69a0ba454cdfc6a96e543b4d045749243959cc3cafd2001de6d993d9faf34e86
72d846435cbbd1ca41996ccbb63b934550ba3b23693f1da4827a148126183d3d
7fef8398f20bb11e5dc1abb97915208d75e44098600c2c07b37db0b292e0e87c
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
83a63dae231522d6c04826215d08c5a7a7aaa48b9110c0e532f9702bf2266107
8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50
8734e3e73c6ecdc285bf5f56dbd5419be6a84b8cb403786b554b0e319e9a3bcc
8d823780073bf1c60a427a944cfcbcf16d6d915757baec43dee029aa1122357a
990a970d0b13f02acfecc901ef01c6d8fd87b05fbb7173e2a1ecb5ffbc3ef514
9973a2be15613093f613aba028652084dcaa9f66c7825a7894d57ff4a42d2348
9c298871bc7286c4a2e4983863187e5a65b1fb6055467b41580a825c124e006f
9f899afe0f97d6ed10fb1a00823f1f85ccb99f58a8b77e70441434e050c14691
9fa1f1dceac33f775634364cfd5f6f7ac199c8d8835584150fa3bfdb90c14c06
a0866740279bed67814464f6fdab00b3d01783731bf500e4a5289bb868264bc8
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a2f6b81396ab1150effea054efbf1623212ea0419976389ce8f10e909d39e4c7
ac9f1bf5cbe4ff1fbb62d50d4c2747b3696a94493c96abd6138ff88bc3dc72b9
b47846d59819f5bc3041c35b8aaeafb6977766a23d55453170a89dfbe7f28d02
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cae0ae2d67aac89367108586ebd25e00afc5d0f8110e6eb71b8d274037f7a5d8
ceaef34a80b252b73f3750d108fe17cea748f64d4c5695ce482eec1c65edeef9
cf4bf73b7c49f47411971fecc9b5a50a7726be6a7cd6bc1413fd56d8fcfc221d
d6ff339ddb4525268c21fa26ded66b0703f177e742281dc9bcd558288f8e1101
d92368b6b477aa5816b65de648b901b23638fbe5b4ee34a90314b4c142ce79a8
d9f33ed9fdd936a670993b9a8e6ca44e7a358d0f7b217b6c6638b502f66a8015
dc3d7278103d3e68eb8b462355a11ed115341d43b801cfc5ae2ced575278a4f1
ddbc1a158d7d13b63c0fda8fd2ece421016468e9e88914d2b81d3e8929c19df1
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e2c9ff6883c2d567e3c23791b004e7a830f40648330ac00c3fb748ce29158345
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e42a0f3b15eb6dd2b630c0b09dc48211c93f351e1dc1b55413674e4333dbb79f
e5359ea0952ab336ac660ca899756a18fcfa05cce2d0d1f1cbc2dc83b263989e
e63174db91b1ab04d1697f6448e84f0461a4072732ffe98209f564a1db2c9ea2
ec1e4cb859ae10b2d6add74575d13cf51807a2e566e931f47541c39bcff6bdb9
ed34a59f182c66e2b25c602f3c9b0f21435a8f475d5dbc9e6830ff4c7929f5cd
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f2649db29712c0b6bb0702c7c4b1187b10ec39f238ddee4f17a614fa64ce31f3
f2f087eac841d5433c3c3fa9ea481b474ff8370b9d9eec1ace18f0300a76ffd8

secure.winred.com Open in urlscan Pro 2606:4700::6812:9c15 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

150 Requests

99 %HTTPS

61 %IPv6

20 Domains

31 Subdomains

26 IPs

1 Countries

2499 kBTransfer

7968 kBSize

28 Cookies

5 Outgoing links

Page URL History

Redirected requests

150 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

secure.winred.com Open in urlscan Pro
2606:4700::6812:9c15 Public Scan

Screenshot
Live screenshot

Full Image

150
Requests

99 %
HTTPS

61 %
IPv6

20
Domains

31
Subdomains

26
IPs

1
Countries

2499 kB
Transfer

7968 kB
Size

28
Cookies

150 HTTP transactions
0 data transactions