www.nextstepu.com Open in urlscan Pro
2606:4700:3108::ac42:2b6e Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.nextstepu.com/winfreetuition/
Submission: On February 13 via manual (February 13th 2022, 10:52:46 pm UTC) from CA — Scanned from CA

Summary HTTP 172 Redirects Links 15 Behaviour Indicators

Summary

This website contacted 45 IPs in 7 countries across 51 domains to perform 172 HTTP transactions. The main IP is 2606:4700:3108::ac42:2b6e, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.nextstepu.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 26th 2021. Valid for: a year.

This is the only time www.nextstepu.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 47	2606:4700:310... 2606:4700:3108::ac42:2b6e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:2b	20446 (HIGHWINDS3) (HIGHWINDS3)
2	2606:4700::68... 2606:4700::6812:bcf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2606:4700::68... 2606:4700::6810:5f41	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 23	172.66.41.9 172.66.41.9	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	2607:f8b0:400... 2607:f8b0:4006:816::2002	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:816::200a	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:823::200a	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:4006:80d::2002	15169 (GOOGLE) (GOOGLE)
1 7	68.67.179.91 68.67.179.91	29990 (ASN-APPNEX) (ASN-APPNEX)
1	142.251.40.130 142.251.40.130	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:820::2002	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:80f::2002	15169 (GOOGLE) (GOOGLE)
1 4	2620:100:a001::c 2620:100:a001::c	19750 (AS-CRITEO) (AS-CRITEO)
3	23.221.202.212 23.221.202.212	16625 (AKAMAI-AS) (AKAMAI-AS)
4	23.52.160.130 23.52.160.130	16625 (AKAMAI-AS) (AKAMAI-AS)
7	68.67.179.121 68.67.179.121	29990 (ASN-APPNEX) (ASN-APPNEX)
6	44.232.111.221 44.232.111.221	16509 (AMAZON-02) (AMAZON-02)
2 8	68.67.179.173 68.67.179.173	29990 (ASN-APPNEX) (ASN-APPNEX)
3	2607:f8b0:400... 2607:f8b0:4006:80d::200e	15169 (GOOGLE) (GOOGLE)
1	2606:4700:20:... 2606:4700:20::681a:7b4	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2607:f8b0:400... 2607:f8b0:4006:80c::2001	15169 (GOOGLE) (GOOGLE)
1	172.66.42.247 172.66.42.247	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	67.202.105.33 67.202.105.33	32748 (STEADFAST) (STEADFAST)
2 9	23.221.203.181 23.221.203.181	16625 (AKAMAI-AS) (AKAMAI-AS)
1	51.222.239.230 51.222.239.230	16276 (OVH) (OVH)
9 9	8.28.7.82 8.28.7.82	62713 (AS-PUBMATIC) (AS-PUBMATIC)
5 6	142.251.35.162 142.251.35.162	15169 (GOOGLE) (GOOGLE)
3 3	104.36.115.109 104.36.115.109	62713 (AS-PUBMATIC) (AS-PUBMATIC)
3 3	104.36.113.24 104.36.113.24	62713 (AS-PUBMATIC) (AS-PUBMATIC)
2 2	34.98.64.218 34.98.64.218	15169 (GOOGLE) (GOOGLE)
4 4	54.175.87.114 54.175.87.114	14618 (AMAZON-AES) (AMAZON-AES)
4 4	199.127.204.142 199.127.204.142	26120 (RHYTHMONE) (RHYTHMONE)
8 9	35.71.131.137 35.71.131.137	16509 (AMAZON-02) (AMAZON-02)
2 2	64.74.236.95 64.74.236.95	19024 (INTERNAP-...) (INTERNAP-BLK5)
1 1	173.223.56.123 173.223.56.123	16625 (AKAMAI-AS) (AKAMAI-AS)
1 1	72.34.250.75 72.34.250.75	27630 (AS-XFERNET) (AS-XFERNET)
1	34.246.235.84 34.246.235.84	16509 (AMAZON-02) (AMAZON-02)
1 1	174.137.133.49 174.137.133.49	27257 (WEBAIR-IN...) (WEBAIR-INTERNET)
2 2	52.204.139.121 52.204.139.121	14618 (AMAZON-AES) (AMAZON-AES)
2 2	54.84.98.244 54.84.98.244	14618 (AMAZON-AES) (AMAZON-AES)
1 2	38.27.122.158 38.27.122.158	174 (COGENT-174) (COGENT-174)
1 1	198.148.27.139 198.148.27.139	19189 (PULSEPOINT) (PULSEPOINT)
2 2	63.251.114.137 63.251.114.137	29791 (VOXEL-DOT...) (VOXEL-DOT-NET)
1 1	199.38.167.129 199.38.167.129	54312 (ROCKETFUEL) (ROCKETFUEL)
7 7	67.202.105.22 67.202.105.22	32748 (STEADFAST) (STEADFAST)
2 2	13.226.31.35 13.226.31.35	16509 (AMAZON-02) (AMAZON-02)
1 2	13.226.31.74 13.226.31.74	16509 (AMAZON-02) (AMAZON-02)
1	23.52.161.180 23.52.161.180	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2607:f8b0:400... 2607:f8b0:4006:823::2004	15169 (GOOGLE) (GOOGLE)
1 1	23.50.66.244 23.50.66.244	16625 (AKAMAI-AS) (AKAMAI-AS)
2	23.57.136.222 23.57.136.222	16625 (AKAMAI-AS) (AKAMAI-AS)
3 3	35.211.178.172 35.211.178.172	15169 (GOOGLE) (GOOGLE)
1 1	3.227.228.140 3.227.228.140	14618 (AMAZON-AES) (AMAZON-AES)
6	34.117.239.71 34.117.239.71	15169 (GOOGLE) (GOOGLE)
3 3	103.229.205.242 103.229.205.242	30419 (MEDIAMATH...) (MEDIAMATH-INC)
4 4	2606:ae80:145... 2606:ae80:1451:22::760	25751 (VALUECLICK) (VALUECLICK)
1 3	209.54.180.3 209.54.180.3	16509 (AMAZON-02) (AMAZON-02)
1 2	52.40.93.193 52.40.93.193	16509 (AMAZON-02) (AMAZON-02)
2 2	185.167.164.42 185.167.164.42	198622 (ADFORM) (ADFORM)
4 9	69.173.151.100 69.173.151.100	26667 (RUBICONPR...) (RUBICONPROJECT)
2	74.119.119.139 74.119.119.139	19750 (AS-CRITEO) (AS-CRITEO)
1 1	8.43.72.97 8.43.72.97	26667 (RUBICONPR...) (RUBICONPROJECT)
1	35.190.60.146 35.190.60.146	15169 (GOOGLE) (GOOGLE)
1	2001:4998:1c:... 2001:4998:1c:800::1001	14779 (YAHOO) (YAHOO)
1 1	2600:1f18:4e9... 2600:1f18:4e9:5a01:5d12:a26d:2c7b:2781	14618 (AMAZON-AES) (AMAZON-AES)
2 2	151.101.194.49 151.101.194.49	54113 (FASTLY) (FASTLY)
1	54.36.109.183 54.36.109.183	16276 (OVH) (OVH)
1	34.120.155.137 34.120.155.137	15169 (GOOGLE) (GOOGLE)
1	18.233.240.143 18.233.240.143	14618 (AMAZON-AES) (AMAZON-AES)
172	45

47 2606:4700:3108::ac42:2b6e (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

www.nextstepu.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:2b (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:bcf (United States)

ASN13335 (CLOUDFLARENET, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6810:5f41 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

23 172.66.41.9 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

resources.infolinks.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
router.infolinks.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2607:f8b0:4006:816::2002 (Queens, United States)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:816::200a (Queens, United States)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:823::200a (Queens, United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:80d::2002 (Queens, United States)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 68.67.179.91 (Secaucus, United States) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 576.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.40.130 (United States)

ASN15169 (GOOGLE, US)
PTR: lga25s80-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:820::2002 (Queens, United States)

ASN15169 (GOOGLE, US)

adservice.google.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:80f::2002 (Queens, United States)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:100:a001::c (United States) 1 redirects

ASN19750 (AS-CRITEO, US)

gum.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.221.202.212 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-221-202-212.deploy.static.akamaitechnologies.com

acdn.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 23.52.160.130 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-52-160-130.deploy.static.akamaitechnologies.com

cdn.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
crcdn01.adnxs-simple.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 68.67.179.121 (Secaucus, United States)

ASN29990 (ASN-APPNEX, US)
PTR: 578.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

nym1-ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 44.232.111.221 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-44-232-111-221.us-west-2.compute.amazonaws.com

www.genmeo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 68.67.179.173 (Secaucus, United States) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 569.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4006:80d::200e (Queens, United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::681a:7b4 (United States)

ASN13335 (CLOUDFLARENET, US)

browser-update.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4006:80c::2001 (Queens, United States)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.66.42.247 (United States)

ASN13335 (CLOUDFLARENET, US)

rt3010.infolinks.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 67.202.105.33 (United States) 1 redirects

ASN32748 (STEADFAST, US)
PTR: ip33.67-202-105.static.steadfastdns.net

de.tynt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
hde.tynt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 23.221.203.181 (New York, United States) 2 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-221-203-181.deploy.static.akamaitechnologies.com

ssum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dsum.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 51.222.239.230 (Canada)

ASN16276 (OVH, FR)
PTR: ip230.ip-51-222-239.net

onetag-sys.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 8.28.7.82 (United States) 9 redirects

ASN62713 (AS-PUBMATIC, US)

image8.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.251.35.162 (United States) 5 redirects

ASN15169 (GOOGLE, US)
PTR: lga25s78-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.36.115.109 (United States) 3 redirects

ASN62713 (AS-PUBMATIC, US)

image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.36.113.24 (United States) 3 redirects

ASN62713 (AS-PUBMATIC, US)

image4.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.98.64.218 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 218.64.98.34.bc.googleusercontent.com

u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 54.175.87.114 (Ashburn, United States) 4 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-175-87-114.compute-1.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 199.127.204.142 (United States) 4 redirects

ASN26120 (RHYTHMONE, US)

sync.1rx.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync.targeting.unrulymedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 35.71.131.137 (United States) 8 redirects

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 64.74.236.95 (United States) 2 redirects

ASN19024 (INTERNAP-BLK5, US)
PTR: chi.outbrain.com

b1sync.zemanta.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 173.223.56.123 (Secaucus, United States) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a173-223-56-123.deploy.static.akamaitechnologies.com

stags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 72.34.250.75 (United States) 1 redirects

ASN27630 (AS-XFERNET, US)

sync.go.sonobi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.246.235.84 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-246-235-84.eu-west-1.compute.amazonaws.com

s.cpx.to	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 174.137.133.49 (United States) 1 redirects

ASN27257 (WEBAIR-INTERNET, US)

dsp.adkernel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.204.139.121 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-204-139-121.compute-1.amazonaws.com

ad.360yield.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.84.98.244 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-84-98-244.compute-1.amazonaws.com

pixel.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 38.27.122.158 (United States) 1 redirects

ASN174 (COGENT-174, US)

match.bnmla.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 198.148.27.139 (New York, United States) 1 redirects

ASN19189 (PULSEPOINT, US)

bh.contextweb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 63.251.114.137 (United States) 2 redirects

ASN29791 (VOXEL-DOT-NET, US)

ap.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.38.167.129 (United States) 1 redirects

ASN54312 (ROCKETFUEL, US)

p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 67.202.105.22 (United States) 7 redirects

ASN32748 (STEADFAST, US)
PTR: ip22.67-202-105.static.steadfastdns.net

ssc-cms.33across.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.226.31.35 (United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: server-13-226-31-35.ewr53.r.cloudfront.net

sync.intentiq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync1.intentiq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.226.31.74 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-13-226-31-74.ewr53.r.cloudfront.net

api.intentiq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.52.161.180 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-52-161-180.deploy.static.akamaitechnologies.com

ads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:823::2004 (Queens, United States)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.50.66.244 (New York, United States) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-50-66-244.deploy.static.akamaitechnologies.com

secure-assets.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.57.136.222 (Piscataway, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-57-136-222.deploy.static.akamaitechnologies.com

eus.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.211.178.172 (North Charleston, United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: 172.178.211.35.bc.googleusercontent.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.227.228.140 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-227-228-140.compute-1.amazonaws.com

cms-xch.33across.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 34.117.239.71 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 71.239.117.34.bc.googleusercontent.com

cms-xch-chicago.33across.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 103.229.205.242 (Singapore) 3 redirects

ASN30419 (MEDIAMATH-INC, US)

sync.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:ae80:1451:22::760 (United States) 4 redirects

ASN25751 (VALUECLICK, US)

33across-match.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
casale-match.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 209.54.180.3 (Ashburn, United States) 1 redirects

ASN16509 (AMAZON-02, US)

s.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.40.93.193 (Boardman, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-40-93-193.us-west-2.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.167.164.42 (Denmark) 2 redirects

ASN198622 (ADFORM, DK)

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 69.173.151.100 (United States) 4 redirects

ASN26667 (RUBICONPROJECT, US)

token.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 74.119.119.139 (United States)

ASN19750 (AS-CRITEO, US)

mug.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 8.43.72.97 (United States) 1 redirects

ASN26667 (RUBICONPROJECT, US)

pixel-us-east.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.60.146 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 146.60.190.35.bc.googleusercontent.com

id.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4998:1c:800::1001 (United States)

ASN14779 (YAHOO, US)

ads.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:4e9:5a01:5d12:a26d:2c7b:2781 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.194.49 (United States) 2 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.36.109.183 (France)

ASN16276 (OVH, FR)
PTR: p08.id5-sync.com

id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.120.155.137 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 137.155.120.34.bc.googleusercontent.com

api.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.233.240.143 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-233-240-143.compute-1.amazonaws.com

id.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
47	nextstepu.com 1 redirects www.nextstepu.com	422 KB
28	adnxs.com 3 redirects secure.adnxs.com — Cisco Umbrella Rank: 350 acdn.adnxs.com — Cisco Umbrella Rank: 547 cdn.adnxs.com — Cisco Umbrella Rank: 1304 nym1-ib.adnxs.com — Cisco Umbrella Rank: 1243 ib.adnxs.com — Cisco Umbrella Rank: 210	172 KB
24	infolinks.com 1 redirects resources.infolinks.com — Cisco Umbrella Rank: 7889 router.infolinks.com — Cisco Umbrella Rank: 2364 rt3010.infolinks.com — Cisco Umbrella Rank: 68806	66 KB
16	pubmatic.com 15 redirects image8.pubmatic.com — Cisco Umbrella Rank: 543 image2.pubmatic.com — Cisco Umbrella Rank: 752 image4.pubmatic.com — Cisco Umbrella Rank: 738 ads.pubmatic.com — Cisco Umbrella Rank: 429	66 KB
14	33across.com 8 redirects ssc-cms.33across.com — Cisco Umbrella Rank: 760 cms-xch.33across.com — Cisco Umbrella Rank: 2652 cms-xch-chicago.33across.com — Cisco Umbrella Rank: 1338	5 KB
13	rubiconproject.com 6 redirects secure-assets.rubiconproject.com — Cisco Umbrella Rank: 917 eus.rubiconproject.com — Cisco Umbrella Rank: 512 token.rubiconproject.com — Cisco Umbrella Rank: 593 pixel-us-east.rubiconproject.com — Cisco Umbrella Rank: 935 pixel.rubiconproject.com — Cisco Umbrella Rank: 288	17 KB
11	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 92 tpc.googlesyndication.com — Cisco Umbrella Rank: 120	296 KB
9	adsrvr.org 8 redirects match.adsrvr.org — Cisco Umbrella Rank: 295	5 KB
9	casalemedia.com 2 redirects ssum-sec.casalemedia.com — Cisco Umbrella Rank: 463 dsum-sec.casalemedia.com — Cisco Umbrella Rank: 488 dsum.casalemedia.com — Cisco Umbrella Rank: 1042	10 KB
8	doubleclick.net 5 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 37 cm.g.doubleclick.net — Cisco Umbrella Rank: 175	7 KB
6	yahoo.com 5 redirects ups.analytics.yahoo.com — Cisco Umbrella Rank: 269 ads.yahoo.com — Cisco Umbrella Rank: 835 pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 419	2 KB
6	genmeo.com www.genmeo.com	17 KB
6	criteo.com 1 redirects gum.criteo.com — Cisco Umbrella Rank: 355 mug.criteo.com — Cisco Umbrella Rank: 3197	2 KB
4	dotomi.com 4 redirects 33across-match.dotomi.com — Cisco Umbrella Rank: 2416 casale-match.dotomi.com — Cisco Umbrella Rank: 2279	1 KB
4	intentiq.com 3 redirects sync.intentiq.com — Cisco Umbrella Rank: 1294 sync1.intentiq.com — Cisco Umbrella Rank: 5653 api.intentiq.com — Cisco Umbrella Rank: 1622	4 KB
3	amazon-adsystem.com 1 redirects s.amazon-adsystem.com — Cisco Umbrella Rank: 266	2 KB
3	mathtag.com 3 redirects sync.mathtag.com — Cisco Umbrella Rank: 387	2 KB
3	bidswitch.net 3 redirects x.bidswitch.net — Cisco Umbrella Rank: 265	2 KB
3	1rx.io 3 redirects sync.1rx.io — Cisco Umbrella Rank: 480	2 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 31	20 KB
3	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 1184	16 KB
2	everesttech.net 2 redirects sync-tm.everesttech.net — Cisco Umbrella Rank: 491	629 B
2	rlcdn.com id.rlcdn.com — Cisco Umbrella Rank: 548 api.rlcdn.com — Cisco Umbrella Rank: 739	704 B
2	adform.net 2 redirects c1.adform.net — Cisco Umbrella Rank: 529	952 B
2	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 187	2 KB
2	lijit.com 2 redirects ap.lijit.com — Cisco Umbrella Rank: 598	1 KB
2	bnmla.com 1 redirects match.bnmla.com — Cisco Umbrella Rank: 1320	1 KB
2	advertising.com 2 redirects pixel.advertising.com — Cisco Umbrella Rank: 307	674 B
2	360yield.com 2 redirects ad.360yield.com — Cisco Umbrella Rank: 621	645 B
2	zemanta.com 2 redirects b1sync.zemanta.com — Cisco Umbrella Rank: 523	1 KB
2	openx.net 2 redirects u.openx.net — Cisco Umbrella Rank: 636	383 B
2	tynt.com 1 redirects de.tynt.com — Cisco Umbrella Rank: 1078 hde.tynt.com — Cisco Umbrella Rank: 3924	3 KB
2	google.com adservice.google.com — Cisco Umbrella Rank: 59 www.google.com — Cisco Umbrella Rank: 2	2 KB
2	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 250 fonts.googleapis.com — Cisco Umbrella Rank: 35	62 KB
2	bootstrapcdn.com maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 610	70 KB
1	crwdcntrl.net id.crwdcntrl.net — Cisco Umbrella Rank: 1645	906 B
1	id5-sync.com id5-sync.com — Cisco Umbrella Rank: 493	2 KB
1	rfihub.com 1 redirects p.rfihub.com — Cisco Umbrella Rank: 615	756 B
1	contextweb.com 1 redirects bh.contextweb.com — Cisco Umbrella Rank: 516	690 B
1	adkernel.com 1 redirects dsp.adkernel.com — Cisco Umbrella Rank: 3831	308 B
1	cpx.to s.cpx.to — Cisco Umbrella Rank: 1709	944 B
1	sonobi.com 1 redirects sync.go.sonobi.com — Cisco Umbrella Rank: 811	660 B
1	bluekai.com 1 redirects stags.bluekai.com — Cisco Umbrella Rank: 447	960 B
1	unrulymedia.com 1 redirects sync.targeting.unrulymedia.com — Cisco Umbrella Rank: 821	591 B
1	onetag-sys.com onetag-sys.com — Cisco Umbrella Rank: 865	814 B
1	browser-update.org browser-update.org — Cisco Umbrella Rank: 5302	5 KB
1	adnxs-simple.com crcdn01.adnxs-simple.com — Cisco Umbrella Rank: 3431	30 KB
1	google.ca adservice.google.ca — Cisco Umbrella Rank: 12901	792 B
1	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 741	644 B
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 546	6 KB
0	beeker.io Failed beeker.io Failed
172	51

	Domain	Requested by
47	www.nextstepu.com	1 redirects www.nextstepu.com static.cloudflareinsights.com
20	router.infolinks.com	1 redirects resources.infolinks.com router.infolinks.com ssum-sec.casalemedia.com
9	match.adsrvr.org	8 redirects ads.pubmatic.com
9	image8.pubmatic.com	9 redirects
8	ib.adnxs.com	2 redirects acdn.adnxs.com
8	pagead2.googlesyndication.com	www.nextstepu.com pagead2.googlesyndication.com tpc.googlesyndication.com
7	ssc-cms.33across.com	7 redirects
7	nym1-ib.adnxs.com	cdn.adnxs.com secure.adnxs.com
7	secure.adnxs.com	1 redirects www.nextstepu.com secure.adnxs.com
6	cms-xch-chicago.33across.com	hde.tynt.com eus.rubiconproject.com
6	cm.g.doubleclick.net	5 redirects eus.rubiconproject.com
6	www.genmeo.com	www.nextstepu.com www.genmeo.com
5	pixel.rubiconproject.com	1 redirects eus.rubiconproject.com
5	dsum-sec.casalemedia.com	1 redirects ssum-sec.casalemedia.com
4	token.rubiconproject.com	3 redirects eus.rubiconproject.com
4	ups.analytics.yahoo.com	4 redirects
4	gum.criteo.com	1 redirects secure.adnxs.com
3	s.amazon-adsystem.com	1 redirects ssum-sec.casalemedia.com eus.rubiconproject.com
3	sync.mathtag.com	3 redirects
3	x.bidswitch.net	3 redirects
3	sync.1rx.io	3 redirects
3	image4.pubmatic.com	3 redirects
3	image2.pubmatic.com	3 redirects
3	ssum-sec.casalemedia.com	1 redirects router.infolinks.com ssum-sec.casalemedia.com
3	tpc.googlesyndication.com	pagead2.googlesyndication.com tpc.googlesyndication.com
3	www.google-analytics.com	www.nextstepu.com www.google-analytics.com
3	cdn.adnxs.com	www.nextstepu.com secure.adnxs.com
3	acdn.adnxs.com	www.nextstepu.com secure.adnxs.com
3	resources.infolinks.com	www.nextstepu.com router.infolinks.com
3	static.cloudflareinsights.com	www.nextstepu.com
2	sync-tm.everesttech.net	2 redirects
2	mug.criteo.com
2	c1.adform.net	2 redirects
2	dpm.demdex.net	1 redirects ssum-sec.casalemedia.com
2	casale-match.dotomi.com	2 redirects
2	33across-match.dotomi.com	2 redirects
2	eus.rubiconproject.com	hde.tynt.com eus.rubiconproject.com
2	api.intentiq.com	1 redirects
2	ap.lijit.com	2 redirects
2	match.bnmla.com	1 redirects router.infolinks.com
2	pixel.advertising.com	2 redirects
2	ad.360yield.com	2 redirects
2	b1sync.zemanta.com	2 redirects
2	u.openx.net	2 redirects
2	googleads.g.doubleclick.net	pagead2.googlesyndication.com
2	maxcdn.bootstrapcdn.com	www.nextstepu.com maxcdn.bootstrapcdn.com
1	id.crwdcntrl.net	ads.pubmatic.com
1	api.rlcdn.com	ads.pubmatic.com
1	id5-sync.com	ads.pubmatic.com
1	pr-bh.ybp.yahoo.com	1 redirects
1	ads.yahoo.com	eus.rubiconproject.com
1	id.rlcdn.com	eus.rubiconproject.com
1	pixel-us-east.rubiconproject.com	1 redirects
1	dsum.casalemedia.com	ssum-sec.casalemedia.com
1	cms-xch.33across.com	1 redirects
1	secure-assets.rubiconproject.com	1 redirects
1	www.google.com	tpc.googlesyndication.com
1	ads.pubmatic.com	resources.infolinks.com
1	sync1.intentiq.com	1 redirects
1	sync.intentiq.com	1 redirects
1	p.rfihub.com	1 redirects
1	bh.contextweb.com	1 redirects
1	dsp.adkernel.com	1 redirects
1	s.cpx.to	router.infolinks.com
1	sync.go.sonobi.com	1 redirects
1	stags.bluekai.com	1 redirects
1	sync.targeting.unrulymedia.com	1 redirects
1	onetag-sys.com	router.infolinks.com
1	hde.tynt.com	router.infolinks.com
1	de.tynt.com	1 redirects
1	rt3010.infolinks.com	resources.infolinks.com
1	browser-update.org	www.nextstepu.com
1	crcdn01.adnxs-simple.com
1	adservice.google.com	pagead2.googlesyndication.com
1	adservice.google.ca	pagead2.googlesyndication.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	fonts.googleapis.com	www.nextstepu.com
1	ajax.googleapis.com	www.nextstepu.com
1	code.jquery.com	www.nextstepu.com
0	beeker.io Failed
172	80

This site contains links to these domains. Also see Links.

Domain
pinterest.com
blog.nextstepu.com
www.facebook.com
www.twitter.com
magazine.nextstepu.com
docs.google.com
nym1-ib.adnxs.com
www.reptidemedia.com
www.genmeo.com
scholarshipowl.com
tracking.scholarshipowl.com
twitter.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-26` - `2022-07-25`	a year	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-14` - `2022-08-14`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
*.google.ca GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
*.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-02-04` - `2022-05-03`	3 months	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2021-03-05` - `2022-02-19`	a year	crt.sh
cdn.adnxs.com GeoTrust RSA CA 2018	`2021-12-10` - `2022-12-09`	a year	crt.sh
genmeo.com R3	`2022-01-26` - `2022-04-26`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
*.tynt.com Sectigo RSA Domain Validation Secure Server CA	`2021-09-23` - `2022-09-30`	a year	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2021-12-12` - `2022-12-13`	a year	crt.sh
*.onetag-sys.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-01-10` - `2023-01-03`	a year	crt.sh
*.pubmatic.com DigiCert SHA2 Secure Server CA	`2022-02-04` - `2023-02-03`	a year	crt.sh
www.google.com GTS CA 1C3	`2022-01-17` - `2022-04-11`	3 months	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2021-04-01` - `2022-04-04`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2022-02-03` - `2023-02-25`	a year	crt.sh
*.id5-sync.com R3	`2021-12-20` - `2022-03-20`	3 months	crt.sh
*.crwdcntrl.net Go Daddy Secure Certificate Authority - G2	`2021-04-29` - `2022-05-31`	a year	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2021-03-18` - `2022-04-19`	a year	crt.sh

This page contains 14 frames:

Primary Page: https://www.nextstepu.com/winfreetuition/
Frame ID: 3D144E2B90551C7E0935D331D07729B7
Requests: 101 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220210/r20190131/zrt_lookup.html
Frame ID: 5F14FB856B133EC01D544C2D583011DC
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3687838056419034&output=html&adk=2926845670&adf=1797764267&lmt=1644792760&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.nextstepu.com%2Fwinfreetuition%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644792760420&bpp=4&bdt=483&idt=163&shv=r20220210&mjsv=m202202030101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=8455416896218&frm=20&pv=2&ga_vid=1106375528.1644792761&ga_sid=1644792761&ga_hid=927442201&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44758229&oid=2&pvsid=878527974903673&pem=744&tmod=858405443&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=183
Frame ID: DE399C426A7B2501132EB48E94C902AA
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=1568&pub_id=1374716
Frame ID: 2817D93A4B7EAE2294FAF4A8EB27EE9A
Requests: 3 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=1568&pub_id=1374716
Frame ID: ABE937F5CC5D6F6F8C3FD675F1E65E9D
Requests: 3 HTTP requests in this frame

Frame: https://secure.adnxs.com/tt?id=14248747
Frame ID: BCCE96E672B010DA729DFBDC38FFB301
Requests: 6 HTTP requests in this frame

Frame: https://router.infolinks.com/usync/manage?pid=3303138&wsid=0&pdom=www.nextstepu.com&purl=https%3A%2F%2Fwww.nextstepu.com%2Fwinfreetuition%2F
Frame ID: 16F1356E19AE4FE449792F31B4BE7A17
Requests: 18 HTTP requests in this frame

Frame: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Frame ID: 8049D426619A89D4AD01AD4FA5E4E6C7
Requests: 6 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Frame ID: C7AEBACF92FAE79FFC5589BFE86241E4
Requests: 10 HTTP requests in this frame

Frame: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90
Frame ID: C4690E344F09DF280D6D30031787B412
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 150CE784AF13CA54D80481105C1D4607
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 20E17BC613EFCF8A89779700C918CC6A
Requests: 2 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=1568&pub_id=1374716
Frame ID: 3EE5158BA9EC40706091EFC8591164E2
Requests: 3 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Frame ID: 7BD93DBBCBC4EFE3D9DA941977D1EB8B
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

NextStepU > Win Free Tuition

Detected technologies

DNN (CMS) Expand

Overall confidence: 100%
Detected patterns

/js/dnncore\.js

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

<(?:iframe|img)[^>]+adnxs\.(?:net|com)
adnxs\.(?:net|com)

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js

Prebid (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.com/[^"]*(?:prebid|/pb\.js)

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery UI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)/jquery-ui(?:\.min)?\.js
jquery-ui.*\.js

Page Statistics

172
Requests

75 %
HTTPS

26 %
IPv6

51
Domains

80
Subdomains

45
IPs

7
Countries

1284 kB
Transfer

3285 kB
Size

108
Cookies

15 Outgoing links

These are links going to different origins than the main page.

URL: https://pinterest.com/nextstepu/

Search URL Search Domain Scan URL

URL: https://blog.nextstepu.com/

Search URL Search Domain Scan URL

URL: https://www.facebook.com/NextStepUcom

Search URL Search Domain Scan URL

URL: https://www.twitter.com/NextStepUnivers

Search URL Search Domain Scan URL

URL: http://magazine.nextstepu.com/
Title: Magazine

Search URL Search Domain Scan URL

URL: https://docs.google.com/forms/d/1VYcGgFAWNFjPbgZyrhrkd026sogOXbCpN6mCEARJp1o/viewform
Title: Bugs & Feedback

Search URL Search Domain Scan URL

URL: https://nym1-ib.adnxs.com/click?mpmZmZmZuT-amZmZmZm5PwAAAKCZmbk_mpmZmZmZuT-amZmZmZm5P5x9HqTJX1InJbGd8UB7eBW4iwliAAAAABBr2QAgBgAAIAYAAAIAAACB3zUUdv8ZAAAAAABVU0QAVVNEANgCWgBGqgAAAAABAgMCAAAAAIQAPicsEwAAAAA./bcr=AAAAAAAA8D8=/cnd=%21lRTNVAjjvokMEIG_16EBGPb-ZyAEKAAxmpmZmZmZuT86CU5ZTTI6NDkxM0DOLUkAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAAAAAA../cca=MTU2OCNOWU0yOjQ5MTM=/bn=89494/clickenc=https%3A%2F%2Ftracking.scholarshipowl.com%2Faff_c%3Foffer_id%3D24%26aff_id%3D1209%26url_id%3D202

Search URL Search Domain Scan URL

URL: http://www.reptidemedia.com/

Search URL Search Domain Scan URL

URL: https://www.genmeo.com/click/ad_5908abc28daba/35

Search URL Search Domain Scan URL

URL: https://www.genmeo.com/click/ad_5908abc28daba/27

Search URL Search Domain Scan URL

URL: https://www.genmeo.com/click/ad_5908abc28daba/40

Search URL Search Domain Scan URL

URL: https://www.genmeo.com/click/ad_5908abc28daba/43

Search URL Search Domain Scan URL

URL: https://scholarshipowl.com/awards/you-deserve-it-scholarship?transaction_id=102862580e028cbb45e4c60e9d03a7&offer_id=24&affiliate_id=1209&aff_sub=&aff_sub2=&aff_sub3=&aff_sub4=&aff_sub5=

Search URL Search Domain Scan URL

URL: https://tracking.scholarshipowl.com/aff_c?offer_id=24&aff_id=1209

Search URL Search Domain Scan URL

URL: https://twitter.com/NextStepUnivers

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 18

https://www.nextstepu.com/portals/0/Images/wft-2015.png HTTP 302
https://www.nextstepu.com/404.aspx?aspxerrorpath=/404.aspx

Request Chain 52

https://secure.adnxs.com/ttj?id=14248720 HTTP 307
https://secure.adnxs.com/bounce?%2Fttj%3Fid%3D14248720

Request Chain 101

https://de.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV HTTP 307
https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1

Request Chain 102

https://ssum-sec.casalemedia.com/usermatch?s=191306&cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D HTTP 302
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1

Request Chain 104

https://image8.pubmatic.com/AdServer/ImgSync?p=156872&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156872%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infolinks.com%252Fdyn%252Fpbm-usync%253Fuid%253D%2523PMUID HTTP 302
https://image8.pubmatic.com/AdServer/ImgSync?p=156872&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156872%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infolinks.com%252Fdyn%252Fpbm-usync%253Fuid%253D%2523PMUID&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=Q0Q0N0M3NkEtMjcwRi00MUNFLTgzN0EtQzkwQzk4QjU3NTk0&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent= HTTP 302
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
https://image4.pubmatic.com/AdServer/SPug?p=156872&pmc=1&pr=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fpbm-usync%3Fuid%3DCD47C76A-270F-41CE-837A-C90C98B57594 HTTP 302
https://router.infolinks.com/dyn/pbm-usync?uid=CD47C76A-270F-41CE-837A-C90C98B57594

Request Chain 105

https://ib.adnxs.com/getuid?https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fapn-usync%3Fuser_id%3D%24UID HTTP 302
https://router.infolinks.com/dyn/apn-usync?user_id=1547121990863532325

Request Chain 106

https://u.openx.net/w/1.0/cm?id=9b5994f2-035d-46de-8c12-bc0e9a4e66c2&r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fox-usync%3Fuid%3D HTTP 302
https://u.openx.net/w/1.0/cm?cc=1&id=9b5994f2-035d-46de-8c12-bc0e9a4e66c2&r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fox-usync%3Fuid%3D HTTP 302
https://router.infolinks.com/dyn/ox-usync?uid=3c523f8c-edfd-4519-858b-0ee0bf19f22f

Request Chain 107

https://ups.analytics.yahoo.com/ups/58422/occ HTTP 302
https://ups.analytics.yahoo.com/ups/58422/occ?verify=true HTTP 302
https://router.infolinks.com/dyn/VR-usync?uid=y-fNt3yHtE2uE52zVPiPg2JrNOIZdBnrmCoeTgz5U-~A

Request Chain 108

https://sync.1rx.io/usersync2/infolinks HTTP 302
https://sync.1rx.io/usersync2/infolinks?zcc=1&cb=1644792761552 HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=1649246671 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=1649246671 HTTP 302
https://sync.1rx.io/usersync/tradedesk/cb317987-537c-4a92-9217-723fac1e61b6 HTTP 302
https://sync.targeting.unrulymedia.com/csync/RX-b82f4669-7c78-445d-b697-59f8e17403f8-005?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fr1-usync%3Fuid%3DRX-b82f4669-7c78-445d-b697-59f8e17403f8-005 HTTP 302
https://router.infolinks.com/dyn/r1-usync?uid=RX-b82f4669-7c78-445d-b697-59f8e17403f8-005

Request Chain 109

https://b1sync.zemanta.com/usersync/infolinks/?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fzmn-usync%3Fuid%3D__ZUID__ HTTP 302
https://stags.bluekai.com/site/23178?id=F1-PFmtqDImzyXRbJv5f&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64TPOV2GK4RONFXGM33MNFXGW4ZOMNXW2L3EPFXC66TNNYWXK43ZNZRT6ZLYMNUGC3THMU6WS3TGN5WGS3TLOMTHK2LEHVDDCLKQIZWXI4KEJFWXU6KYKJREU5RVMY HTTP 302
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS64TPOV2GK4RONFXGM33MNFXGW4ZOMNXW2L3EPFXC66TNNYWXK43ZNZRT6ZLYMNUGC3THMU6WS3TGN5WGS3TLOMTHK2LEHVDDCLKQIZWXI4KEJFWXU6KYKJREU5RVMY HTTP 302
https://router.infolinks.com/dyn/zmn-usync?uid=F1-PFmtqDImzyXRbJv5f

Request Chain 110

https://sync.go.sonobi.com/us?loc=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsonobi-usync%3Fuid%3D%5BUID%5D HTTP 302
https://router.infolinks.com/dyn/sonobi-usync?uid=116b46d0-8a62-4111-8744-962064a800f7

Request Chain 111

https://ib.adnxs.com/getuid?https://s.cpx.to/ca.png?ref=https%253A%252F%252Fwww.nextstepu.com%252Fwinfreetuition%252F&pid=12306&adnxs_uid=$UID HTTP 302
https://s.cpx.to/ca.png?ref=https%3A%2F%2Fwww.nextstepu.com%2Fwinfreetuition%2F&pid=12306&adnxs_uid=1547121990863532325

Request Chain 112

https://dsp.adkernel.com/sync?exchange=202&r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fearn-usync%3Fuid%3D%7BUID%7D HTTP 302
https://router.infolinks.com/dyn/earn-usync?uid=A1863792558695749414

Request Chain 113

https://ad.360yield.com/server_match?r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fimd-usync%3Fuser_id%3D%7BPUB_USER_ID%7D%26partner_id%3D1531 HTTP 302
https://ad.360yield.com/ul_cb/server_match?r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fimd-usync%3Fuser_id%3D%7BPUB_USER_ID%7D%26partner_id%3D1531 HTTP 302
https://router.infolinks.com/dyn/imd-usync?user_id=4271937e-f8ec-4d53-b0ee-abf0ef4cf643&partner_id=1531

Request Chain 114

https://pixel.advertising.com/ups/58237/sync?&gdpr=&gdpr_consent=&redir=true HTTP 302
https://pixel.advertising.com/ups/58237/sync?&gdpr=&gdpr_consent=&redir=true&verify=true HTTP 302
https://ups.analytics.yahoo.com/ups/58237/sync?&gdpr=&gdpr_consent=&redir=true&apid=UPa65c447e-8d1f-11ec-a226-0ad2e9c1cf5b HTTP 302
https://router.infolinks.com/dyn/outh-usync?uid=y-9Y7AeYlE2uHhFZnSHyTJAK0rv8MGVgFW~A~UPa65c447e-8d1f-11ec-a226-0ad2e9c1cf5b

Request Chain 115

https://match.bnmla.com/usersync?sspid=1000361&redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fenbd-usync%3Fuid%3D%5BUUID%5D HTTP 302
https://bh.contextweb.com/bh/rtset?pid=558752&ev=1&us_privacy=${us_privacy}&rurl=https%3A%2F%2Fmatch.bnmla.com%2Fusersync%3Fdspid%3D1%26uuid%3D%25%25VGUID%25%25 HTTP 302
https://match.bnmla.com/usersync?dspid=1&uuid=pEHL4HSY45Ej&ev=1&us_privacy=${us_privacy}&pid=558752

Request Chain 116

https://ap.lijit.com/pixel?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsovrn-usync%3Fuid%3D%24UID HTTP 307
https://ap.lijit.com/pixel?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsovrn-usync%3Fuid%3D%24UID&sovrn_retry=true HTTP 307
https://router.infolinks.com/dyn/sovrn-usync?uid=9edce594a4f3e8efd4d260d0

Request Chain 117

https://image8.pubmatic.com/AdServer/ImgSync?p=60809&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D60809%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infolinks.com%252Fdyn%252Fusersync%253Fpmuservalue%253D%2523PMUID HTTP 302
https://image8.pubmatic.com/AdServer/ImgSync?p=60809&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D60809%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infolinks.com%252Fdyn%252Fusersync%253Fpmuservalue%253D%2523PMUID&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=ODk5MkQ0QjgtRTA0Ny00MUU3LTgzQkYtN0UwN0VBQ0YwNzQz&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent= HTTP 302
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
https://image4.pubmatic.com/AdServer/SPug?p=156872&pmc=1&pr=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fpbm-usync%3Fuid%3DCD47C76A-270F-41CE-837A-C90C98B57594 HTTP 302
https://router.infolinks.com/dyn/pbm-usync?uid=CD47C76A-270F-41CE-837A-C90C98B57594

Request Chain 118

https://p.rfihub.com/cm?pub=43153&in=1 HTTP 302
https://router.infolinks.com/dyn/zeta-usync?uid=978758876949750219

Request Chain 119

https://ssc-cms.33across.com/ps/?ri=0010b00002CpYhEAAV&ru=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2F33a-usync%3Fuid%3D33XUSERID33X HTTP 302
https://router.infolinks.com/dyn/33a-usync?uid=1904621968638

Request Chain 120

https://router.infolinks.com/dyn/iq-usync HTTP 302
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=1509139146&pcid=33cbf679-c6a2-4a4f-b8ca-c0675fa1ad16&3rddpi=2023874098&3rdpcid=YgmLuamgwVw.TzHFDVXq8AAA%26542&3rddpi=1639354730&3rdpcid=y-9Y7AeYlE2uHhFZnSHyTJAK0rv8MGVgFW%7EA%7EUPa65c447e-8d1f-11ec-a226-0ad2e9c1cf5b&3rddpi=445262707&3rdpcid=&3rddpi=1402230080&3rdpcid=&3rddpi=541745869&3rdpcid=&3rddpi=1177082855&3rdpcid=&3rddpi=1213503647&3rdpcid=y-fNt3yHtE2uE52zVPiPg2JrNOIZdBnrmCoeTgz5U-%7EA&3rddpi=1541423991&3rdpcid=&3rddpi=1239766150&3rdpcid=3c523f8c-edfd-4519-858b-0ee0bf19f22f HTTP 302
https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=1509139146&pcid=33cbf679-c6a2-4a4f-b8ca-c0675fa1ad16&3rddpi=2023874098&3rdpcid=YgmLuamgwVw.TzHFDVXq8AAA%26542&3rddpi=1639354730&3rdpcid=y-9Y7AeYlE2uHhFZnSHyTJAK0rv8MGVgFW%7EA%7EUPa65c447e-8d1f-11ec-a226-0ad2e9c1cf5b&3rddpi=445262707&3rdpcid=&3rddpi=1402230080&3rdpcid=&3rddpi=541745869&3rdpcid=&3rddpi=1177082855&3rdpcid=&3rddpi=1213503647&3rdpcid=y-fNt3yHtE2uE52zVPiPg2JrNOIZdBnrmCoeTgz5U-%7EA&3rddpi=1541423991&3rdpcid=&3rddpi=1239766150&3rdpcid=3c523f8c-edfd-4519-858b-0ee0bf19f22f&ckls=true&ci=fC6WM0SQKV&nc=false&trid=1451735092 HTTP 302
https://image8.pubmatic.com/AdServer/ImgSync?p=156872&pu=https%3A%2F%2Fsync1.intentiq.com%2Fprofiles_engine%2FProfilesEngineServlet%3Fat%3D20%26dpi%3D1402230080%26mi%3D10%26csh%3D1509139146%26rnd%3D-1605889006%26pcid%3D%23PMUID HTTP 302
https://image8.pubmatic.com/AdServer/ImgSync?p=156872&pu=https%3A%2F%2Fsync1.intentiq.com%2Fprofiles_engine%2FProfilesEngineServlet%3Fat%3D20%26dpi%3D1402230080%26mi%3D10%26csh%3D1509139146%26rnd%3D-1605889006%26pcid%3D%23PMUID&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=NjQyOUFFOUEtMUIwQy00NUI3LUI5OTYtNUZBOEU3MTY0QzM0&gdpr=0&gdpr_consent= HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent= HTTP 302
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
https://image4.pubmatic.com/AdServer/SPug?p=156872&pmc=1&pr=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fpbm-usync%3Fuid%3DCD47C76A-270F-41CE-837A-C90C98B57594 HTTP 302
https://router.infolinks.com/dyn/pbm-usync?uid=CD47C76A-270F-41CE-837A-C90C98B57594

Request Chain 121

https://api.intentiq.com/profiles_engine/ProfilesEngineServlet?at=39&mi=10&dpi=1509139146&pt=17&dpn=1&idtype=0&pcid=33cbf679-c6a2-4a4f-b8ca-c0675fa1ad16&iiqidtype=2&iiqpcid=a4d8c31a-7106-411d-be7a-0c233774f4d0&iiqpciddate=1644792761444&dbsaved=true&fbp=2503514549 HTTP 302
https://api.intentiq.com/profiles_engine/ProfilesEngineServlet?at=39&mi=10&dpi=1509139146&pt=17&dpn=1&idtype=0&pcid=33cbf679-c6a2-4a4f-b8ca-c0675fa1ad16&iiqidtype=2&iiqpcid=a4d8c31a-7106-411d-be7a-0c233774f4d0&iiqpciddate=1644792761444&dbsaved=true&fbp=2503514549&ckls=true&ci=LYWiKC4NKI&nc=false&trid=573280304

Request Chain 132

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=33across&endpoint=us-east&us_privacy= HTTP 301
https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=

Request Chain 133

https://x.bidswitch.net/sync?ssp=the33across&us_privacy= HTTP 302
https://x.bidswitch.net/ul_cb/sync?ssp=the33across&us_privacy= HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=bidswitch&ttd_tpi=1&ttd_puid=the33across&gdpr=&gdpr_consent= HTTP 302
https://x.bidswitch.net/sync?dsp_id=93&user_id=cb317987-537c-4a92-9217-723fac1e61b6&expires=30&ssp=the33across&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT_21} HTTP 302
https://ssc-cms.33across.com/ps/?gdpr_consent=&ri=10&ru=https%3A%2F%2Fcms-xch.33across.com%2Fmatch%3Fgdpr_58%3D%24gdpr_58%26gdpr%3D%24%7Bgdpr%7D%26gdpr_consent%3D%24%7Bgdpr_consent%7D%26bidder_id%3D10%26external_user_id%3Df43c2f25-d675-4781-a3cc-7d84422ea1e8 HTTP 302
https://cms-xch.33across.com/match?gdpr_58=&gdpr=0&gdpr_consent=&bidder_id=10&external_user_id=f43c2f25-d675-4781-a3cc-7d84422ea1e8 HTTP 301
https://cms-xch-chicago.33across.com/match?gdpr_58=&gdpr=0&gdpr_consent=&bidder_id=10&external_user_id=f43c2f25-d675-4781-a3cc-7d84422ea1e8

Request Chain 134

https://ssc-cms.33across.com/ps/?us_privacy=&ts=1644792761564.3&ri=1&ru=https%3A%2F%2Fsync.mathtag.com%2Fsync%2Fimg%3Fus_privacy%3D%24%7BUS_PRIVACY%7D%26mt_exid%3D73%26redir%3Dhttps%253A%252F%252Fcms-xch-chicago.33across.com%252Fmatch%253Fliv%253Dh%2526us_privacy%253D%24%7BUS_PRIVACY%7D%2526bidder_id%253D1%2526external_user_id%253D%255BMM_UUID%255D HTTP 302
https://sync.mathtag.com/sync/img?us_privacy=&mt_exid=73&redir=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D1%26external_user_id%3D%5BMM_UUID%5D HTTP 302
https://cms-xch-chicago.33across.com/match?liv=h&us_privacy=&bidder_id=1&external_user_id=48bc6209-8bba-4a00-9040-40694d9b9d4b

Request Chain 135

https://ups.analytics.yahoo.com/ups/58350/sync?redir=true HTTP 302
https://ssc-cms.33across.com/ps/?xi=99&us_privacy=&xu=y-_.5YbNxE2uHOQ1ueDW32TPx.n_wBR34s~A HTTP 302
https://cms-xch-chicago.33across.com/match?bidder_id=99&external_user_id=y-_.5YbNxE2uHOQ1ueDW32TPx.n_wBR34s%7EA&ts=1644792762&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

Request Chain 136

https://33across-match.dotomi.com/match/bounce/current?networkId=78390&version=1&us_privacy= HTTP 302
https://33across-match.dotomi.com/match/bounce/current?DotomiTest=6eaff6b087c11227&is_secure=true&networkId=78390&version=1&us_privacy= HTTP 302
https://ssc-cms.33across.com/ps?xi=64&xu=AAAGcp0MlcnbUwMxa5gMAAAAAAA&expiration=1644879161&is_secure=true&us_privacy= HTTP 302
https://cms-xch-chicago.33across.com/match?bidder_id=64&external_user_id=AAAGcp0MlcnbUwMxa5gMAAAAAAA&ts=1644792762&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

Request Chain 137

https://match.adsrvr.org/track/cmf/generic?ttd_pid=f0v35ew&ttd_tpi=1&us_privacy= HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=f0v35ew&ttd_tpi=1&us_privacy= HTTP 302
https://ssc-cms.33across.com/ps/?ri=102&ru=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fbidder_id%3D102%26ttl%3D1647384761%26external_user_id%3Dcb317987-537c-4a92-9217-723fac1e61b6 HTTP 302
https://cms-xch-chicago.33across.com/match?bidder_id=102&ttl=1647384761&external_user_id=cb317987-537c-4a92-9217-723fac1e61b6

Request Chain 138

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=YgmLuamgwVw.TzHFDVXq8AAA HTTP 302
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESECN8sQklmIGhAIJNM17QZYI&google_cver=1&google_hm=2

Request Chain 139

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=YgmLuamgwVw-TzHFDVXq8AAAAh4AAAAB&gdpr_consent=&us_privacy=&gdpr= HTTP 302
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESELRcfGDZU-K3SNWubd0QOFQ&google_cver=1

Request Chain 140

https://match.adsrvr.org/track/cmf/casale HTTP 302
https://match.adsrvr.org/track/cmb/casale HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=cb317987-537c-4a92-9217-723fac1e61b6&expiration=1647384761&gdpr=0&gdpr_consent=

Request Chain 141

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=YgmLuamgwVw-TzHFDVXq8AAAAh4AAAAB HTTP 302
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=YgmLuamgwVw-TzHFDVXq8AAAAh4AAAAB&dcc=t

Request Chain 142

https://casale-match.dotomi.com/match/bounce/current?networkId=19998&version=1 HTTP 302
https://casale-match.dotomi.com/match/bounce/current?DotomiTest=1df38d08eb371227&is_secure=true&networkId=19998&version=1 HTTP 302
https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=AAAGc1LytjWCpQM624D3AAAAAAA&expiration=1644879161&is_secure=true

Request Chain 143

https://sync.mathtag.com/sync/img?mt_exid=15&redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D3%26external_user_id%3D%5BMM_UUID%5D HTTP 302
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=3c6a6209-8bba-4900-a64c-754564e030f5

Request Chain 144

https://dpm.demdex.net/ibs:dpid=23728&dpuuid=YgmLuamgwVw.TzHFDVXq8AAA%26542?gdpr_consent=&us_privacy=&gdpr= HTTP 302
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=23728&dpuuid=YgmLuamgwVw.TzHFDVXq8AAA%26542

Request Chain 145

https://c1.adform.net/serving/cookie/match?party=29 HTTP 302
https://c1.adform.net/serving/cookie/match?CC=1&party=29 HTTP 302
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=111&external_user_id=5219957225041795101&expiration=1646002361

Request Chain 154

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.nextstepu.com%2F&domain=www.nextstepu.com&cw=1&lsw=1 HTTP 302
https://mug.criteo.com/sid?cpp=Uxvxy3xzYnlVU0FBSTRvNWFnMm9Id09FSVJQcWZMb1hyUkVPNDUycEJ2MFJFUjlnSXgzYmpVK2owS2paSTF5cUdzV1FXSUtRa21iK1lodVluZ2NmY1JFTjgyTndldVA2dVZac1doV3ZMdVprSEpWcGJYNXQ1amZ3T1JjK1VUMnVaZVE2bVlDeGtCcjRNRWw2THF2OCtibXB0YTFHeTkvcDBBS2pNRmN4Tm5CcVBQUjVVWHFYOC9BWFAvbmdIZ2U3bTBwT3VJd09mWUw1N3Q5azRycWhrSnVqSGpuYXUzNGd4YU9vZUsrZVlmQ1NidGI4PXw&cppv=2

Request Chain 155

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=33across&us_privacy=&khaos=KZLV55NP-1M-DRWQ HTTP 302
https://ssc-cms.33across.com/ps/?xi=1&xu=KZLV55NP-1M-DRWQ HTTP 302
https://cms-xch-chicago.33across.com/match?bidder_id=30&external_user_id=KZLV55NP-1M-DRWQ&ts=1644792762&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

Request Chain 158

https://match.adsrvr.org/track/cmf/rubicon HTTP 302
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=cb317987-537c-4a92-9217-723fac1e61b6&gdpr=0&gdpr_consent=&expires=30

Request Chain 159

https://token.rubiconproject.com/token?pid=26594 HTTP 302
https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KZLV55NP-1M-DRWQ&sigv=1&esig=2~74000f1ed1c914bc0fc9e2b622d8361540ec677d

Request Chain 160

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1 HTTP 302
https://pr-bh.ybp.yahoo.com/sync/rubicon/ZdePO7YkSHdRmR3A7qrZJsn5EUdSAgOZEtemQ7w0kco?csrc= HTTP 302
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=6850550879117786175

Request Chain 161

https://sync.mathtag.com/sync/img?mt_exid=9&redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D4222%26nid%3D1512%26put%3D%5BMM_UUID%5D HTTP 302
https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=4e156209-8bba-4f00-84b5-aaa985d9130a

Request Chain 162

https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D191940%26nid%3D3778%26put%3D%24%7BUSER_ID%7D HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D191940%26nid%3D3778%26put%3D%24%7BUSER_ID%7D&_test=YgmLugAGAtqkaQBB HTTP 302
https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=YgmLugAGAtqkaQBB&_test=YgmLugAGAtqkaQBB

Request Chain 163

https://token.rubiconproject.com/token?pid=2249&pt=n HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MmUyMzU0ZDJlZDlkMjBjMzg3ZDc0NTQ5OWFmNzkxN2U5MWJmYTI4OQ

Request Chain 164

https://pixel.rubiconproject.com/exchange/sync.php?p=a9us HTTP 302
https://s.amazon-adsystem.com/ecm3?id=KZLV55NP-1M-DRWQ&ex=d-rubiconproject.com&status=ok

172 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.nextstepu.com/winfreetuition/ 104 KB
28 KB 388ms
332ms Document
text/html 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.nextstepu.com/winfreetuition/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: e013fdf05469dd63dff29fb9b1a07235261572c621710397836449892904696f

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

date: Sun, 13 Feb 2022 22:52:39 GMT
content-type: text/html; charset=utf-8
cache-control: private
access-control-allow-origin: * *
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NYUAWOIGG5tJOC9dlMDTQSnfXg%2BII4Tn2kkGyxTm2CX7CmJjAAomdFLT6cRaZoWcXfOvO%2FUKh1YAAdJPbr0wkBeP3ob0wBsFK76LXmX%2BOCz5fMq0pmMeJGokdOy8LRcuMOW8BEB7b669povWGtZzmQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 6dd1a0db8a754bc5-YUL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 font-awesome.min.css
www.nextstepu.com/Portals/_default/Skins/NextStep/js/font-awesome/css/ 22 KB
5 KB 22ms
20ms Stylesheet
text/css 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.nextstepu.com/Portals/_default/Skins/NextStep/js/font-awesome/css/font-awesome.min.css
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/winfreetuition/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 43a400cc4c30fc5e45147e54c0de460616b91a9b51714f249ca9af92e8585af9

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/winfreetuition/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:39 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 341251
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 14 Jun 2018 04:44:56 GMT
server: cloudflare
etag: W/"67799b719a3d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=J2%2BO6u5OVrqg4k1KoZhBBFz0Jp4uDyvqe5YkDHJSVsJW0jm3OemwySjgxWo9A3BV%2F9q2ng3knLr6L1R0onjx3v5q42GmQHt6Ly1ibXHiZgxGzgCU7kdfglyoNFANcKEtdVHpsHOi5bqyz8h6L%2B3q2Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *, *
cache-control: max-age=604800
cf-ray: 6dd1a0dddd0f4bc5-YUL

GET
H2 200 default.css
www.nextstepu.com/Portals/_default/ 49 KB
11 KB 23ms
22ms Stylesheet
text/css 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.nextstepu.com/Portals/_default/default.css?cdv=23
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/winfreetuition/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 69480f14e126a0ddbc6368a75aca2bc94477cdf7bfff525f31cf0b8ec761afa4

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/winfreetuition/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:39 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 341251
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 07 Oct 2013 15:26:44 GMT
server: cloudflare
etag: W/"f79f77a171c3ce1:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QCHwDLF8X%2Bf5T%2BwiAZ8BnoRRcqeV3mgYadVZrTGre%2BQAuHg6bPCPMFLp8y2cmt6hONLnoFhHBmnIUDRmh4kfdnQW6UjWbY6Q2UdU05NLxI1ehCNUpm%2F8JT%2BRcdstznDLrwVpfo7u3VWVwe%2FPQ6WAMg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *, *
cache-control: max-age=604800
cf-polished: origSize=77944
cf-ray: 6dd1a0dddd104bc5-YUL
cf-bgj: minify

GET
H2 200 skin.css
www.nextstepu.com/Portals/_default/Skins/NextStep/ 0
398 B 18ms
16ms Stylesheet
text/css 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.nextstepu.com/Portals/_default/Skins/NextStep/skin.css?cdv=23
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/winfreetuition/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/winfreetuition/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:39 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 414114
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
last-modified: Thu, 14 Jun 2018 04:45:05 GMT
server: cloudflare
etag: "7f7215779a3d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Wem4GVwo%2BqrI9QQTQEyP12HDkPmR1%2FDO1Xre%2FzXz9TmD5lGeiZC3TrToXb3OdqCSIGIx4p798O8pNboAB4szFIBK7WEjXq3KMTI7Cx3n0aS09KAUeKXaOxnotnedRMe9YrHiyRy%2FV%2FAvXuMhjKYD6Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *, *
cache-control: max-age=604800
cf-polished: origSize=456
accept-ranges: bytes
cf-ray: 6dd1a0dddd114bc5-YUL
cf-bgj: minify

GET
H2 200 container.css
www.nextstepu.com/Portals/_default/Containers/NextStep/ 295 B
480 B 21ms
20ms Stylesheet
text/css 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.nextstepu.com/Portals/_default/Containers/NextStep/container.css?cdv=23
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/winfreetuition/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: f68a7330be05739601a1c7b4498d5fb0ada04ddbe4ee75d38fb8cb377403e7da

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/winfreetuition/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:39 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 341251
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Sun, 18 Aug 2013 05:12:00 GMT
server: cloudflare
etag: W/"010c277d19bce1:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JC1HSOIsOBH4Hv6dK3NDk15dmUK7c1Mmp5F5zpAbHnxFfurZyufJ9%2Fkmu8AQ0%2FAHCoIbHN0m0kWOqMkQtlD3qFk4jEZZgnUqEf7kF%2FuTu9iHU1JJqxr8O96nCkw06j8EgbauhCPjnDPDiN42bK%2Ff7g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *, *
cache-control: max-age=604800
cf-polished: origSize=434
cf-ray: 6dd1a0dddd124bc5-YUL
cf-bgj: minify

GET
H2 200 portal.css
www.nextstepu.com/Portals/0/ 1 KB
775 B 21ms
20ms Stylesheet
text/css 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.nextstepu.com/Portals/0/portal.css?cdv=23
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/winfreetuition/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: b6d4a694a00b024663439bcd8b46f31a8f07e4cf36661fcd74fef48295dd3665

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/winfreetuition/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:39 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 297747
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Sun, 18 Aug 2013 05:09:18 GMT
server: cloudflare
etag: W/"0d33217d19bce1:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cfF24vakjmqXwrS3ra8CeiB8h5y1gT8wDqWDeKN%2F9JVh0WCTIfqdyIA3PIsFfRDwNvOaIuRVrWFF9RHmRHWgcw%2B64UrHoANv7ZgcQEct%2BNRA2I0PhFYUe6J9Qh9pUxZDCqBdi%2FOCq4c92a%2BIHiSD9A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *, *
cache-control: max-age=604800
cf-polished: origSize=3696
cf-ray: 6dd1a0dddd134bc5-YUL
cf-bgj: minify

GET
H2 200 print.css
www.nextstepu.com/Portals/_default/Skins/NextStep/css/ 863 B
834 B 21ms
21ms Stylesheet
text/css 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.nextstepu.com/Portals/_default/Skins/NextStep/css/print.css
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/winfreetuition/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 89871b910c20b1510814279d9d6064e990c308e5f13f7af1ddef05c6a9f67078

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/winfreetuition/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:39 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 414114
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 14 Jun 2018 04:43:07 GMT
server: cloudflare
etag: W/"20cdae309a3d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=z06RDAOcFRlZxlPlqngzHsWV9D9nPbtXrKgTd3CnxQb2kHjUadYz4ctiROIHBQKRdBdk%2BELm5VyLFixIN18oI29bpH1l3xHBkkGUQ6o43AL2SYyqWkXkEi%2BRkyLqYlx8NF3CtN4Vd3SIGUxVSSm4wg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *, *
cache-control: max-age=604800
cf-polished: origSize=2044
cf-ray: 6dd1a0dddd144bc5-YUL
cf-bgj: minify

GET
H2 200 jquery-ui.css
code.jquery.com/ui/1.10.0/themes/base/ 32 KB
6 KB 114ms
32ms Stylesheet
text/css 2001:4de0:ac18::1:a:2b
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/ui/1.10.0/themes/base/jquery-ui.css
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/winfreetuition/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:2b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 13f19abef22e15d47becccea1abbf814849afbea505423d18c108fc831e65e93

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:40 GMT
content-encoding: gzip
last-modified: Fri, 20 Aug 2021 17:47:54 GMT
server: nginx
etag: W/"611feaca-7e0d"
vary: Accept-Encoding
x-hw: 1644792760.dop047.dc2.t,1644792760.cds202.dc2.hn,1644792760.cds166.dc2.c
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 5912

GET
H2 200 foundation.css
www.nextstepu.com/Portals/_default/Skins/NextStep/css/ 82 KB
15 KB 22ms
20ms Stylesheet
text/css 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.nextstepu.com/Portals/_default/Skins/NextStep/css/foundation.css
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/winfreetuition/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: d6b3fe665c12f36f3dfc1f69d5dcf2683470df42cb2af5e8f0c0c28f6b3c4498

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/winfreetuition/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:39 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 523407
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 14 Jun 2018 04:43:08 GMT
server: cloudflare
etag: W/"2ceb50319a3d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=y3nPnUOhJd8g02HnrFpZmnwPOVhlHukVGwVckXx190hfKQy4oqziheKy7qh23dyy4PsW06Vn502s6G6BnAXqSRKkVksH%2FfGHkAtDa%2BhqUfpQiP8mdhwxdq%2BkqyD6YIlk5TsAKbdsnv7vayB5%2Fk4blQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *, *
cache-control: max-age=604800
cf-polished: origSize=104434
cf-ray: 6dd1a0dded2d4bc5-YUL
cf-bgj: minify

GET
H2 200 app.css
www.nextstepu.com/Portals/_default/Skins/NextStep/css/ 62 KB
13 KB 51ms
50ms Stylesheet
text/css 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.nextstepu.com/Portals/_default/Skins/NextStep/css/app.css?v1.2
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/winfreetuition/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 80c364483d47c76870e1f9a274d0198330c56558eaf0dd829f079780d7a324f6

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/winfreetuition/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:40 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 414114
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 14 Jun 2018 04:43:02 GMT
server: cloudflare
etag: W/"145caa2d9a3d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lM2QnP5L3n7g2%2Bx1%2FUurXmMYCXawdL99D8T8tkOAirHtvNsXuzGuCB6KQjsYRImfw1NztPoqBN6pGgrzQ6COg%2BZGSiWtSgYau866XsBGDBCaIlLpL6M3D6WfSxx%2BaVHW9AGbpeF0cbRI38c0JTs6vw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *, *
cache-control: max-age=604800
cf-polished: status=cannot_optimize
cf-ray: 6dd1a0dded2f4bc5-YUL
cf-bgj: minify

GET
H2 200 ui.css
www.nextstepu.com/Portals/_default/Skins/NextStep/css/ 9 KB
3 KB 18ms
16ms Stylesheet
text/css 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.nextstepu.com/Portals/_default/Skins/NextStep/css/ui.css
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/winfreetuition/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: e218337b64d8998ecca6944b7fedebc9c4bb83a18fc703a0f3504dafc4bc5eba

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/winfreetuition/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:39 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 180039
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 14 Jun 2018 04:43:10 GMT
server: cloudflare
etag: W/"442795329a3d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7xNTRL2H4QjXtzYCOI6Cr2zXHKIhrgrS61vYdfzQptdSgwQrMBTvovIultOxjRxq2URoJ2v3BNHUCx1x9CpCmAdg8dGlUts5uoOaTfpv%2BzpIOsJnhKYUVGL2QmLMQW2O6FhtzxrbwKwB%2BR2Ww0IztA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *, *
cache-control: max-age=604800
cf-polished: origSize=14219
cf-ray: 6dd1a0dded304bc5-YUL
cf-bgj: minify

GET
H2 200 registration.css
www.nextstepu.com/Portals/_default/Skins/NextStep/css/ 27 KB
6 KB 22ms
20ms Stylesheet
text/css 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.nextstepu.com/Portals/_default/Skins/NextStep/css/registration.css
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/winfreetuition/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 142b5cbc5c2d5839f95cf9c04f80986739d7354a69feb9cce4698a0aedc54616

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/winfreetuition/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:39 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2238
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 14 Jun 2018 04:43:09 GMT
server: cloudflare
etag: W/"fa31db319a3d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9GbcKpS8FXcik8Svq1ab6mPBXOJ2dZqEzs1AXS4G2ZyWvgUzg59BH5lOnY0VmIoJsmWNyZiTuqQWM7XChiu4KURTF1LlN6h1COPmemDiuxCfjhw2GfCM%2FbtX%2F6%2Fzsl7syAIWGU9HC1KQ3cIxSNE0%2FQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *, *
cache-control: max-age=604800
cf-polished: status=cannot_optimize
cf-ray: 6dd1a0dded314bc5-YUL
cf-bgj: minify

GET
H2 200 font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.4.0/css/ 26 KB
6 KB 62ms
19ms Stylesheet
text/css 2606:4700::6812:bcf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/font-awesome/4.4.0/css/font-awesome.min.css

Requested by

Host: www.nextstepu.com
URL: https://www.nextstepu.com/winfreetuition/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

936ffccdc35bc55221e669d0e76034af76ba8c080c1b1149144dbbd3b5311829

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:40 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 617
age: 25619353
cdn-cachedat: 2021-03-10 13:26:25
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
timing-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:54 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 79a9e73e89cbd0cbd1a3409a60e22da0
cdn-requestcountrycode: US
cf-ray: 6dd1a0de2ba84bd6-YUL
cdn-cache: HIT
cdn-requestpullsuccess: True

GET
H2 200 nextstepu-color-web.png
www.nextstepu.com/images/ 5 KB
5 KB 22ms
20ms Image
image/png 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.nextstepu.com/images/nextstepu-color-web.png
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/winfreetuition/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 8b324607f3277432aa256b0f49bf75ef6e9951d448d4795f42f8eca2d59d442e

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/winfreetuition/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:39 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 523406
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4950
last-modified: Tue, 01 Sep 2015 18:20:49 GMT
server: cloudflare
etag: "8be996ede2e4d01:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VqwkX4fOuzk82XF%2BeWHyZvztVHmD3RdQgscFTRgN63JcDkhzyUTABM%2F%2FRhnDlCWpG5OG%2FBKZIDDioMKWphK7yhSJ4u5Bkc00UVwRFqExfqN44nNVixIuNpxhD%2FewJ%2BZdNj%2B7KSdVuqwgu9aGbTPrIA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *, *
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 6dd1a0dded354bc5-YUL

GET
H2 200 path-white-90x90.png
www.nextstepu.com/Portals/_default/Skins/NextStep/images/ 4 KB
5 KB 18ms
16ms Image
image/png 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.nextstepu.com/Portals/_default/Skins/NextStep/images/path-white-90x90.png
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/winfreetuition/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: a3206bf77d72f3601d218fa7d75a2dc958d827efe22f441414b803d55b542427

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/winfreetuition/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:39 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 297746
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4372
last-modified: Thu, 14 Jun 2018 04:44:27 GMT
server: cloudflare
etag: "135b3a609a3d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NFb%2F39YnRiX7fXsrdmRfMzT8C8d7vgYxAoxNx8T2bkczhxj6WFTYL6SEKAFxtd90%2BWzXzZkNAhLyuoNNCZ2O8H2VafEnHCnLvF5EeulgHx%2F%2BvSGl8pfMQlGNldLqUFRxdQg5HFAWLi53gBFX69ktkQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *, *
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 6dd1a0dded364bc5-YUL

GET
H2 200 articles-white-90x90.png
www.nextstepu.com/Portals/_default/Skins/NextStep/images/ 4 KB
4 KB 21ms
19ms Image
image/png 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.nextstepu.com/Portals/_default/Skins/NextStep/images/articles-white-90x90.png
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/winfreetuition/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: c62551dd0ee07b06310c7ae17466e1b9509fffdc878026ca3ab4f464fe7ca616

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/winfreetuition/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:39 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 523407
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 3693
last-modified: Thu, 14 Jun 2018 04:43:16 GMT
server: cloudflare
etag: "8e6fb1359a3d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6MLUCOPH7IkW%2B4wYO7uZZXPXQS%2Fhw6AZ6FL%2B%2FkxKLTH1mK8vsfYeQOjI96pNVcsabHm164CKO80OvM5DIMse39TXu6eEShmspXASxKtduCzmoKz97fnSDDXwaczviEb%2FYqFG3D71THoaYswPVbzE4A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *, *
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 6dd1a0dded374bc5-YUL

GET
H2 200 scholarships-white-90x90.png
www.nextstepu.com/Portals/_default/Skins/NextStep/images/ 4 KB
4 KB 33ms
30ms Image
image/png 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.nextstepu.com/Portals/_default/Skins/NextStep/images/scholarships-white-90x90.png
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/winfreetuition/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 587597d1685a0cad61e48cc52d837e72aa8b67d6e7bf27bef7634f646e2989a0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/winfreetuition/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:39 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 452830
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4248
last-modified: Thu, 14 Jun 2018 04:44:33 GMT
server: cloudflare
etag: "fdd9d9639a3d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6ZdOEfNsN1M9bPlqiziyTDiCdG3ys6mQxXKfBA1w35AssH%2FDBd7aL8cxnrZNQ64t6pidwZ%2BbHmCV1rUhWCZqo80bOVEdj7s0VkBxe4MEUVTUVMNb4xxViy4N%2FFgAnfWkPWEd7EvKeRWPdlcoMWFdsQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *, *
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 6dd1a0dded384bc5-YUL

GET
H2 200 colleges-white-90x90.png
www.nextstepu.com/Portals/_default/Skins/NextStep/images/ 4 KB
4 KB 31ms
30ms Image
image/png 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.nextstepu.com/Portals/_default/Skins/NextStep/images/colleges-white-90x90.png
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/winfreetuition/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 63ab17adc6f1b9673a3b8333cbeecd0ce4d67e7f8acb84c8946f3d95387d3d37

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/winfreetuition/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:39 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 523406
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 3885
last-modified: Thu, 14 Jun 2018 04:43:35 GMT
server: cloudflare
etag: "95e963419a3d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zaCdnijcXzUqMGBr0df%2FFbaCHJ3TyxybBOPRpimMfNkYkuEPD3kaiYSPVdXeLH35DvY3kFnI3TAK2EChiW98dLjppVwcrtxAbnc2ZxCzRJ%2Fjtt%2FbE8PS3T6f21xVLAqAg8X1R%2FbpXAcoWHGDTsmwig%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *, *
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 6dd1a0dded394bc5-YUL

GET
H2 200 wft-icon-white.png
www.nextstepu.com/Portals/_default/Skins/NextStep/images/ 3 KB
4 KB 57ms
56ms Image
image/png 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.nextstepu.com/Portals/_default/Skins/NextStep/images/wft-icon-white.png
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/winfreetuition/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 5af7bf1d8151cde51974546ccfc225efd36218dfc03f35a2c3b9732f942c5285

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/winfreetuition/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:40 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 3558
last-modified: Thu, 14 Jun 2018 04:44:48 GMT
server: cloudflare
etag: "67b5d66c9a3d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YYEebqSAcuUtTk9R79B%2BFN%2FSVZirAzlSlLImweogvsA6uPJcPUm%2FfFh5EDa7btt3iLsUr2%2FkOfWj8uChjzKmoeZopzQA8hwtyJlvIuDKnHY62%2B9%2FUOG2Mugw5BPxataje%2BO7a1%2B6mzsoMFi2CidhOA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *, *
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 6dd1a0dded3a4bc5-YUL

GET
H3

500

404.aspx
www.nextstepu.com/
Redirect Chain

https://www.nextstepu.com/portals/0/Images/wft-2015.png
https://www.nextstepu.com/404.aspx?aspxerrorpath=/404.aspx

2 KB
2 KB

61ms
61ms

Image
text/html

2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.nextstepu.com/404.aspx?aspxerrorpath=/404.aspx
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/winfreetuition/
Protocol: H3
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 5c914242a7dfef52441c666a95421161f09fc95330af23aaf886acc83ff10695

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/winfreetuition/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:40 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ee0OPT6xRQd1yDU5xtUwWqfdru5sJNHOv8eeXWBIKYmepQImZ4NuWaThkLaigV4N82AbK4jqtXlGrj6aqGEDfsxv3hN%2FTTPprM%2BzLaQ%2BqsFxlnrOpRi6RTabVqnW7cMU7aidhae59TStTCRMdga1DA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=utf-8
cache-control: private
cf-ray: 6dd1a0de78eb7145-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

Redirect headers

date: Sun, 13 Feb 2022 22:52:40 GMT
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
location: https://www.nextstepu.com/404.aspx?aspxerrorpath=/404.aspx
x-powered-by: ASP.NET
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=URR%2B9CP0DjYhJjIxU6934JY7U7c6g2hdNe1FSMHPQZQBJ8XFqGfT7QkP3%2BKm5CO78TdySu%2BjsL3tioMLIqlowERaCRxZqj3IFoh%2FBYSVaS%2BfgyyPVD2kKy4t%2BPNdteAI1v5UIRsLV4uF6JUnfn%2FpJg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=utf-8
access-control-allow-origin: *, *
cf-ray: 6dd1a0de28707145-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 ScholarshipOwl-Logo.jpg
www.nextstepu.com/portals/0/NewFolder/ 5 KB
6 KB 32ms
26ms Image
image/jpeg 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.nextstepu.com/portals/0/NewFolder/ScholarshipOwl-Logo.jpg
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/winfreetuition/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 4c2e4583fe83cb89919678a9c866ceebf8e069afcf7dd9cac87dbb2cb50320a0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/winfreetuition/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:40 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 414092
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 5166
last-modified: Tue, 28 Jun 2016 07:31:36 GMT
server: cloudflare
etag: "475471afd1d11:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AaMil2QfZen3q9B2tZRP5M7mgIndI0WWtX8g2S2JImyNAFb%2BUqAeKNiOqXkvK0AAlDqhbcMvJaLkQn1C2XDa3dwd03jxyf%2F3Nqu6aRPYpIVy8v8Sjem7PMW4wQ0hIzPNx7CbjLXDIs7%2F6nGJSQwQRw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *, *
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 6dd1a0de287e7145-YUL

GET
H3 200 NextStepU-small.png
www.nextstepu.com/Portals/_default/Skins/NextStep/images/ 4 KB
4 KB 27ms
26ms Image
image/png 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.nextstepu.com/Portals/_default/Skins/NextStep/images/NextStepU-small.png
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/winfreetuition/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 9617b3e2e8abe6fcb2403f474a98fec166d3b85b518412fd9cd2a1293f1ddfcd

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/winfreetuition/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:40 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 297746
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 3626
last-modified: Thu, 14 Jun 2018 04:44:25 GMT
server: cloudflare
etag: "5376555f9a3d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6tDVbMlPNCeACgXknwKQM5OMlQs1BGyxAPip5uzPHbUmVUfkggo98MoPAI0%2FUw57Z5eMOnCL%2BxAIpVB%2FnnWHi7HCeVdBm8QayykYxY%2BM49Tm3CokIzIEGcrPSLcgxrSvNTNJcyrHwuZpOp3kXAMziw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *, *
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 6dd1a0de38867145-YUL

GET
H3 200 email-decode.min.js Show response
www.nextstepu.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
1 KB 14ms
14ms Script
application/javascript 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nextstepu.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: www.nextstepu.com
URL: https://www.nextstepu.com/winfreetuition/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/winfreetuition/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 11 Feb 2022 20:14:10 GMT
server: cloudflare
etag: W/"6206c392-4d7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Gkj%2BT%2FazgfHRXxDYn4l8xKzMdjv0WRgJMKayRQeidVl88sArYBGBlTTDj9m6zu%2BK9TOwEIPmd0A%2BmdlYGn91R2AUtKv6b5uLlIPildTw9O8Z%2FnY%2By5NTJ%2BdLIpRrsrYEzj7Pm8OID%2FstEKCeiQng2Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=172800, public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6dd1a0de38897145-YUL
vary: Accept-Encoding
expires: Tue, 15 Feb 2022 22:52:40 GMT

GET
H3 200 wft.css
www.nextstepu.com/DesktopModules/nsWFTMobile/Resources/ 1 KB
1 KB 31ms
30ms Stylesheet
text/css 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.nextstepu.com/DesktopModules/nsWFTMobile/Resources/wft.css
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/winfreetuition/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 6f9593c12df3a1fd234ee21f30b3e8bf2ff8b4847ac775c52a7b0a7ff3e0efc4

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/winfreetuition/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:40 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 414115
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 14 Jun 2018 05:19:55 GMT
server: cloudflare
etag: W/"3bacce549f3d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sI%2BRd96OPt1XkKoD56jl5Aqh2ySKQGugpOwmFd7CCOkctfKuEk5OQdWpU%2FxTjOM4sm8xzFbwQAyBLa%2FoYpfPcTt2G8NOktJtjMjZXLN8RyShTMNQS7muGzEo6A94o4R4%2BZyxurp9yrBdPs8NrsZUCg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *, *
cache-control: max-age=604800
cf-polished: origSize=2088
cf-ray: 6dd1a0de388b7145-YUL
cf-bgj: minify

GET
H3 200 wft-icon-white.png
www.nextstepu.com/DesktopModules/nsWFTMobile/Resources/ 3 KB
4 KB 23ms
21ms Image
image/png 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.nextstepu.com/DesktopModules/nsWFTMobile/Resources/wft-icon-white.png
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/winfreetuition/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 5af7bf1d8151cde51974546ccfc225efd36218dfc03f35a2c3b9732f942c5285

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/winfreetuition/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:40 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 523407
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 3558
last-modified: Thu, 14 Jun 2018 05:19:56 GMT
server: cloudflare
etag: "a6aaed549f3d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mq5uU9c0%2BlglE8CfhtzWkh9MrLEPvYNE%2FTlUpg0QGbSG4ZCPcKtaXCTWc8QuNPVMHGj2iOck4wHj%2BSy%2BJiBYrr8HfuL8lvcHFnjguF1HTTC07ChJUdCLJNEkl6CbSbpMu34RNZp0ULiR5U%2F2jrEJdw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *, *
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 6dd1a0de48a67145-YUL

GET
H3 200 rocket-loader.min.js Show response
www.nextstepu.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ 12 KB
4 KB 22ms
19ms Script
application/javascript 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nextstepu.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Requested by

Host: www.nextstepu.com
URL: https://www.nextstepu.com/winfreetuition/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/winfreetuition/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 11 Feb 2022 20:14:10 GMT
server: cloudflare
etag: W/"6206c392-302c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tj0wdyAXvGbJeMxe9QMozeTZQdI6kP09B7b3L%2FR7vgvbWCx1XoFGsbPIrqwwhUxhsAh2%2FF9chbwTfqd3U4X4h9h7fE7M5VH572Boj%2FiB%2F2a61x6y%2B9KdK0vp5BU2y%2BmqkZLJGYo1tR%2BVHPzCued6uQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=172800, public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6dd1a0de48aa7145-YUL
vary: Accept-Encoding
expires: Tue, 15 Feb 2022 22:52:40 GMT

GET
H2 200 v652eace1692a40cfa3763df669d7439c1639079717194 Show response
static.cloudflareinsights.com/beacon.min.js/ 14 KB
5 KB 108ms
59ms Script
text/javascript 2606:4700::6810:5f41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/v652eace1692a40cfa3763df669d7439c1639079717194
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/winfreetuition/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5f41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fd0a1ac929c11b08e819fe4b0a18c5574012c44f09de8987c6be99a0f055a505

Request headers

Referer: https://www.nextstepu.com/
Origin: https://www.nextstepu.com
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:40 GMT
content-encoding: gzip
last-modified: Thu, 09 Dec 2021 19:55:17 GMT
server: cloudflare
etag: W/2021.12.0
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 6dd1a0de9dc6ecf2-YUL

GET
H3 200 background-pattern.jpg
www.nextstepu.com/Portals/_default/Skins/NextStep/images/ 3 KB
3 KB 16ms
16ms Image
image/jpeg 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.nextstepu.com/Portals/_default/Skins/NextStep/images/background-pattern.jpg
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/Portals/_default/Skins/NextStep/css/app.css?v1.2
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 5cfba597c9f3d87e177f3af2d1ab4923a96dc597cab379c6e3ca71ffb384c8e4

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/Portals/_default/Skins/NextStep/css/app.css?v1.2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:40 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 414114
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 2605
last-modified: Wed, 12 Jan 2022 23:11:10 GMT
server: cloudflare
etag: "14fcbfaf98d81:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=i2phPx%2BU3%2BkFJLGPdhuL0JUfuB7Wq4TYT7aS%2Bh9Kzyg1uBfBaUjFkHLPhu4FfbUf420kyRwVKNDiVWBgk%2Bbs2P60zXvnnawuMpwZ%2BkyFqhFFa7o8SCJsPqfl0SEMbt8lVNgl%2Fu1azTAJdjw4vJj4AA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *, *
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 6dd1a0ded95b7145-YUL

GET
H3 200 dropdown-2.jpg
www.nextstepu.com/Portals/_default/Skins/NextStep/css/images/ 23 KB
23 KB 17ms
16ms Image
image/jpeg 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.nextstepu.com/Portals/_default/Skins/NextStep/css/images/dropdown-2.jpg
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/Portals/_default/Skins/NextStep/css/ui.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 1be0abf077cc0b1c88fe81f7fbee33e8d77d1943690637f0030507631a41edda

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/Portals/_default/Skins/NextStep/css/ui.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:40 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 523398
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 23488
last-modified: Thu, 14 Jun 2018 04:43:03 GMT
server: cloudflare
etag: "73dc4e2e9a3d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eA5513Zb%2BvrDM6qFDTm0s0K2l37FDDluxb0BRmu4wbPhvtbXYP0t6MGy2gApLE6C38MWJY6FR3nbkmiNLIVG3guKhKF7vIo1NnANAKVK7ROU1ElLNbBkTZ5Gen9JXibVwn4BpW9o76rGsZxQwUlDkQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *, *
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 6dd1a0ded95f7145-YUL

GET
H3 200 fontawesome-webfont.woff2
maxcdn.bootstrapcdn.com/font-awesome/4.4.0/fonts/ 63 KB
64 KB 38ms
21ms Font
font/woff2 2606:4700::6812:bcf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/font-awesome/4.4.0/fonts/fontawesome-webfont.woff2?v=4.4.0

Requested by

Host: maxcdn.bootstrapcdn.com
URL: https://maxcdn.bootstrapcdn.com/font-awesome/4.4.0/css/font-awesome.min.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3c4a1bb7ce3234407184f0d80cc4dec075e4ad616b44dcc5778e1cfb1bc24019

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://maxcdn.bootstrapcdn.com/font-awesome/4.4.0/css/font-awesome.min.css
Origin: https://www.nextstepu.com
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:40 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 569, 617, 617, 617
age: 6336
cdn-cachedat: 2021-06-08 12:35:36
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 64464
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:54 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: font/woff2
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: bd18a3662fa2bef870a7ad802c2afae5
accept-ranges: bytes
cf-ray: 6dd1a0def8dd7142-YUL
cdn-requestcountrycode: US
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 infolinks_main.js Show response
resources.infolinks.com/js/ 3 KB
2 KB 117ms
43ms Script
application/javascript 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/js/infolinks_main.js
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 483bc7d183e97ee75656a646640e2387bc579e657a4a92aa6b61ada0c95a5721

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

cf-ray: 6dd1a0e00957ca98-YYZ
date: Sun, 13 Feb 2022 22:52:40 GMT
via: 1.1 google
cf-cache-status: HIT
last-modified: Wed, 09 Feb 2022 08:26:37 GMT
server: cloudflare
age: 8728
etag: W/"d73-5d791979f01a2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=3600
content-encoding: gzip
expires: Sun, 13 Feb 2022 21:27:12 GMT

GET
H3 200 wft.js Show response
www.nextstepu.com/DesktopModules/nsWFTMobile/Resources/ 979 B
1 KB 18ms
18ms Script
application/x-javascript 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.nextstepu.com/DesktopModules/nsWFTMobile/Resources/wft.js
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 8fb2408e2587bda7b967f2786fc894940bce6d6ef33d33cec11e1a7f9aae317b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/winfreetuition/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:40 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 414114
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 14 Jun 2018 05:19:56 GMT
server: cloudflare
etag: W/"c825559f3d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gbdPClIEQ0goSK7z%2FIqs%2Fb3MTCJTix7IyXicoJd%2FuBwVU%2FQMXRgJqIO4t3EY2F48knsGeeJoDpAAyUqZ9SBjsrFeQ4fgDoVKh5QynfMWU9pzZ1d25VzMvuzEYUkaPqdMHCx5WiAmJMEXBAdNYJ%2BzKA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
access-control-allow-origin: *, *
cache-control: max-age=604800
cf-polished: origSize=2935
cf-ray: 6dd1a0df8a297145-YUL
cf-bgj: minify

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 152 KB
53 KB 128ms
77ms Script
text/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: www.nextstepu.com
URL: https://www.nextstepu.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c2ffdcbf86b0ae9ed953ba80c5baaf6155425225be3b519a63c7eb57a0768a30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 53575
x-xss-protection: 0
server: cafe
etag: 8127697519896636829
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sun, 13 Feb 2022 22:52:40 GMT

GET
H3 200 initWidgets.js Show response
www.nextstepu.com/Resources/Shared/scripts/ 1 KB
1 KB 16ms
16ms Script
application/x-javascript 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.nextstepu.com/Resources/Shared/scripts/initWidgets.js
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: a50a7a66ddae614225d39d3a1bc215feb43c6ac351178ea810a330b4a9ed5ed8

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/winfreetuition/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:40 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 341252
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Fri, 26 Jul 2013 18:12:00 GMT
server: cloudflare
etag: W/"0183b9f2b8ace1:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gIlbDuoK8O3fqe9eY0qf9Met%2FhJWTJSz0X0%2BfXfZ5nyHHA2TG%2BiR5lBJCyNdf3o9K5qPtXJrOXjJmUp2d0n%2B%2F2O5iXPXfc3X3ymQEM70c3p7aXbDcT3saKFWTlNEWHZZ%2BZWXMY%2Bki0MNHyjYfG3QvA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
access-control-allow-origin: *, *
cache-control: max-age=604800
cf-polished: origSize=1308
cf-ray: 6dd1a0df8a2a7145-YUL
cf-bgj: minify

GET
H3 200 scrolldepth.js Show response
www.nextstepu.com/Portals/_default/Skins/NextStep/js/analytics/ 2 KB
2 KB 18ms
18ms Script
application/x-javascript 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.nextstepu.com/Portals/_default/Skins/NextStep/js/analytics/scrolldepth.js
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: de560434583567587dba2f8a58f84f4b211730bed40f9fb54ea912ab24930c36

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/winfreetuition/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:40 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 414114
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 14 Jun 2018 04:44:51 GMT
server: cloudflare
etag: W/"911e606e9a3d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=l42kbzmENWBQ38xfw6NDwGnR986o%2BQjQLC03O7E0CbTZYtSlxSqAHWkrfAilFVnpwfNxu53xpikbIA4C4DysLjO912roZgM9Tt%2BDXl7ouWF07DQo5dDIuIfxmutgkoN3ykDCTuSpu52So%2FteEYeYDA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
access-control-allow-origin: *, *
cache-control: max-age=604800
cf-polished: origSize=2510
cf-ray: 6dd1a0df9a2d7145-YUL
cf-bgj: minify

GET
H3 200 riveted.js Show response
www.nextstepu.com/Portals/_default/Skins/NextStep/js/analytics/ 2 KB
1 KB 19ms
18ms Script
application/x-javascript 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.nextstepu.com/Portals/_default/Skins/NextStep/js/analytics/riveted.js
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: c7e6e8f290554488e0e6abdc2756e3112b7fcaeaddc6087e7e3220767e7681ed

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/winfreetuition/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:40 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 41261
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 14 Jun 2018 04:44:50 GMT
server: cloudflare
etag: W/"77f91a6e9a3d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=drVoLeKlWJtWYywlFyH4btxDpnk9lPcj9LOTr0mYfkySRMGxvtOx8D02dIsLohyuqMBcawhb1eArYe8tiusdaa8YO4Z%2BVvgSmH0e54cdL14G4A0I92KjodXoo0pqFNwO%2B6CnXZ579O9UMyOeix%2FUmg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
access-control-allow-origin: *, *
cache-control: max-age=604800
cf-polished: origSize=2065
cf-ray: 6dd1a0df9a2f7145-YUL
cf-bgj: minify

GET
H3 200 parsley.js Show response
www.nextstepu.com/Portals/_default/Skins/NextStep/js/ 22 KB
6 KB 18ms
17ms Script
application/x-javascript 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.nextstepu.com/Portals/_default/Skins/NextStep/js/parsley.js
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: b5050af3aea0eb4c0b276d4cb8fe7be460c9f98da48bc2f5b6c32b97dbb39047

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/winfreetuition/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:40 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 523407
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 14 Jun 2018 04:45:04 GMT
server: cloudflare
etag: W/"b38b6e769a3d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O9rZ9hKliy6vc%2Fu90FFJNojjMYzF0zPpXCRhjZGulceKwg48rEBERGnovQZ4Gg1M4SscGeGZsQ3e3UGXyA0nds9YI3jtC5HA4mifh1aGl8YdDXMKUmny05o%2BiaoM6RJ%2BKFiqgXO9KUzMuaxrEksCQw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
access-control-allow-origin: *, *
cache-control: max-age=604800
cf-polished: origSize=47099
cf-ray: 6dd1a0df9a317145-YUL
cf-bgj: minify

GET
H3 200 dnncore.js Show response
www.nextstepu.com/js/ 8 KB
3 KB 19ms
19ms Script
application/x-javascript 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.nextstepu.com/js/dnncore.js?cdv=23
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: d0148618ecdc44d01d6464ec4081f8865d947a60ea482ceff7476439fb8b95ff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/winfreetuition/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:40 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 523407
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Fri, 26 Jul 2013 18:02:00 GMT
server: cloudflare
etag: W/"05c9a392a8ace1:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9eVe6IQQakkcIWnQk75cztTkAq8SE5%2Bu54GC1lUuH54P9DldpYfON7JOe%2Fn9Csly8SpBXGi1WbgsH5bSD8z4Tky1bJxCAGOxuiYAO6zk8w3AwRWh5RTmuDLicGiwvR9lq4qjNUuvn6hU9X8HZk58ag%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
access-control-allow-origin: *, *
cache-control: max-age=604800
cf-polished: origSize=9650
cf-ray: 6dd1a0df9a327145-YUL
cf-bgj: minify

GET
H3 200 Telerik.Web.UI.WebResource.axd Show response
www.nextstepu.com/ 140 KB
36 KB 83ms
83ms Script
application/x-javascript 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.nextstepu.com/Telerik.Web.UI.WebResource.axd?_TSM_HiddenField_=ScriptManager_TSM&compress=1&_TSM_CombinedScripts_=%3b%3bSystem.Web.Extensions%2c+Version%3d4.0.0.0%2c+Culture%3dneutral%2c+PublicKeyToken%3d31bf3856ad364e35%3aen-US%3a22727c22-244c-4537-8243-3c42cc5b20e2%3aea597d4b%3ab25378d2
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: c0112ea735e02700c64d88d83f777f53d3033e4b98013b0756de5917affe067a

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/winfreetuition/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:40 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 05 Dec 2012 00:00:00 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QR8yu4i%2BiJ5ocmBgBEVeDOrbhHideClK9OwAa24PsYloDVqS0FAAUVG59F6x5HfNuxwI%2FXOfcWTClxfgxjpqCp2YNE%2BRTj1pdJd%2Fy4vDZ8JPmgxXyBtPoWk6Zj1zEWd9W1lUTt2EM%2F%2BKWlyeR%2FzfxA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
access-control-allow-origin: *, *
cache-control: public, max-age=31536000
cf-ray: 6dd1a0df9a337145-YUL
expires: Mon, 13 Feb 2023 22:52:40 GMT

GET
H3 200 WebResource.axd Show response
www.nextstepu.com/ 23 KB
5 KB 64ms
63ms Script
application/x-javascript 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.nextstepu.com/WebResource.axd?d=pIYOKY5GPb07OgwIC9LGYV00G8vkGNa2RcLZU5309KEAPy6y6Yi-3-S5nxDYXyRnxnsmAHy6IrYCJsew0&t=636995930740000000
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 40732e9dcfa704cf615e4691bb07aecfd1cc5e063220a46e4a7ff6560c77f5db

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/winfreetuition/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:40 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 24 Jul 2019 23:24:34 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MPyHOxZrD9EBSqVxNf8dQAJqremvmMNxcjVh8KWl%2Bwb1lZbItiMUR7lW2n4w%2B0IW7JNdj4ABzOfEh%2BsDFw4SkhGhH0rndGuLUMrTBx4aQqWG5QAVh%2BPT%2B9HDWTIp2BO9IxIg6KmvrOaJwPPNO5DC7Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
access-control-allow-origin: *,*
cache-control: public
cf-ray: 6dd1a0df9a347145-YUL
expires: Sun, 12 Feb 2023 18:32:09 GMT

GET
H3 200 jquery.min.js Show response
www.nextstepu.com/Resources/Shared/Scripts/jquery/ 54 B
639 B 19ms
18ms Script
application/x-javascript 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.nextstepu.com/Resources/Shared/Scripts/jquery/jquery.min.js?cdv=23
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: b31c2ade2395796e5fc4bc6f4f0e066fb0a2735f326290bd22d3593550c0c6f5

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/winfreetuition/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:40 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 523407
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Fri, 26 Jul 2013 18:12:00 GMT
server: cloudflare
etag: W/"0183b9f2b8ace1:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MrRMOBzyVsgT27BctFlri%2FF1db6MAyYMk%2F%2FuOCrhkotDyKi2nX1yGyoccHCHbAings1c73EjkQnHZBFoBpfovVNkw4Wd9sQN%2BftODBgg0GdYobGlAChOjzm24nUiu%2BPGKjGeR%2BQFysU8m96gsIbEHg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
access-control-allow-origin: *, *
cache-control: max-age=604800
cf-ray: 6dd1a0df9a367145-YUL

GET
H3 200 masked.input.plugin.js Show response
www.nextstepu.com/Portals/_default/Skins/NextStep/js/ 3 KB
2 KB 21ms
20ms Script
application/x-javascript 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.nextstepu.com/Portals/_default/Skins/NextStep/js/masked.input.plugin.js
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: f7f480e008e61f1d28d9c096d9cf3095d11b1fd5a5603db6e6c5a21898c07d4a

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/winfreetuition/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:40 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 523407
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 14 Jun 2018 04:45:04 GMT
server: cloudflare
etag: W/"632cf769a3d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WzjtHzpiHPYa0olfTKcWQUslt6FrjRCO71%2BYqb%2FLxMBVKO9WaiJDs41VBI4UcfuGw5SMV4%2BGB4heFClduNWHmJD1%2BvyA5%2B40zg1L7Hv%2Bq56CbCD1q1tqmsq5AvaOvFf0pJj8BP9muAh943%2BgiY6w%2BQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
access-control-allow-origin: *, *
cache-control: max-age=604800
cf-polished: origSize=3574
cf-ray: 6dd1a0df9a377145-YUL
cf-bgj: minify

GET
H3 200 app.js Show response
www.nextstepu.com/Portals/_default/Skins/NextStep/js/ 8 KB
3 KB 19ms
17ms Script
application/x-javascript 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.nextstepu.com/Portals/_default/Skins/NextStep/js/app.js
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: c5defaf0b5e7b4a86456455c43a93dcbd412370e4937222d33befc5c726b7f71

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/winfreetuition/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:40 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 523407
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 14 Jun 2018 04:44:50 GMT
server: cloudflare
etag: W/"89fcbd6d9a3d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dIXUPKRmvxuZGoYVTEgehajRx1UsQAmDTk7ijGO9ycimYEa28D66y0M%2F%2F2dYbM5LhKnaT4Dybexp3rXO1EBtL4plf3vPh%2FW7%2Bjb53dI5Di6xBbxXVaETTsVlmK%2FzM22hHhmP%2Bj3ZAEEFKW5EOjaZOQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
access-control-allow-origin: *, *
cache-control: max-age=604800
cf-polished: origSize=21695
cf-ray: 6dd1a0df9a3b7145-YUL
cf-bgj: minify

GET
H3 200 jquery.ziptastic.js Show response
www.nextstepu.com/Portals/_default/Skins/NextStep/js/ 565 B
937 B 25ms
19ms Script
application/x-javascript 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.nextstepu.com/Portals/_default/Skins/NextStep/js/jquery.ziptastic.js
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: dbc16ba132d287bee6c411381f94853b26604dd4ccfc2851af190979eb889491

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/winfreetuition/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:40 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 414114
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 14 Jun 2018 04:45:03 GMT
server: cloudflare
etag: W/"a7587b759a3d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JPpjIcr82OGQbKmK5wS%2B%2FQNrStYrKd7zNT4tpyFkDrkDrbMoWtyVGb1XUYC%2Be67lKxhsa%2FKDeUzzPAl5iafmA4twr5Yp9imeuqGqtUXaR79GXVFkx85ib8BcAyV1QiewieflUyWsv4ouIBbViee6rg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
access-control-allow-origin: *, *
cache-control: max-age=604800
cf-polished: origSize=928
cf-ray: 6dd1a0df9a477145-YUL
cf-bgj: minify

GET
H2 200 jquery-ui.min.js Show response
ajax.googleapis.com/ajax/libs/jqueryui/1.10.4/ 223 KB
61 KB 89ms
21ms Script
text/javascript 2607:f8b0:4006:816::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jqueryui/1.10.4/jquery-ui.min.js

Requested by

Host: www.nextstepu.com
URL: https://www.nextstepu.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::200a Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a13c96acd88fe907edbb8becda0d113c22abde0d5ae904e5213360a1e6f145ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 04:20:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 325925
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 61441
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 10 Feb 2023 04:20:35 GMT

GET
H3 200 jquery.cookie.js Show response
www.nextstepu.com/Portals/_default/Skins/NextStep/js/ 1 KB
1 KB 39ms
38ms Script
application/x-javascript 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.nextstepu.com/Portals/_default/Skins/NextStep/js/jquery.cookie.js
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: c3f05412b273a3c32bf550bf721db6302d8c8c8692d25b847f278ef67693195d

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/winfreetuition/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:40 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 341252
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 14 Jun 2018 04:44:58 GMT
server: cloudflare
etag: W/"bffa9c729a3d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0dtinTus9ETQrvcY2WDm%2F09SBVi0A8QZa2z0YiG7VPMMtfKOO1QKiIuIMI4AOOf4L3ST2B7N3OJyGWAYhDOvH1XTNcQMBguxJ%2FKJDFBT%2F%2BOzhSH%2BiNfSFr0agAql33KX%2BfAAgsvvrLlII9a91eb2OQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
access-control-allow-origin: *, *
cache-control: max-age=604800
cf-polished: origSize=1911
cf-ray: 6dd1a0df9a487145-YUL
cf-bgj: minify

GET
H3 200 foundation.min.js Show response
www.nextstepu.com/Portals/_default/Skins/NextStep/js/ 155 KB
52 KB 26ms
25ms Script
application/x-javascript 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.nextstepu.com/Portals/_default/Skins/NextStep/js/foundation.min.js
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: ad7aec48510d18ca75e4b8c9e92a8e66285d7a6088ba365dadf1ea6b64c0f578

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/winfreetuition/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:40 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 237755
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 14 Jun 2018 04:44:54 GMT
server: cloudflare
etag: W/"775b7d709a3d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ytlamOTYFZSlnge617lLmT047NUg1gUZ1BolIdPdNerEP92Z52nEO2SjUjcIrQ2tJtUZzbVvjOCF5SP2OCffK%2FLojdgC%2F7tM%2FFIGp%2FUuSBkO9guAsWq%2FyQrp2HgPDr%2B35SfEBFFma3lJDSIfnUb%2BpA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
access-control-allow-origin: *, *
cache-control: max-age=604800
cf-ray: 6dd1a0df9a497145-YUL

GET
H3 200 jquery.js Show response
www.nextstepu.com/Portals/_default/Skins/NextStep/js/ 141 KB
43 KB 21ms
20ms Script
application/x-javascript 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.nextstepu.com/Portals/_default/Skins/NextStep/js/jquery.js
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 9c44f587e53431ec3922782595c258a8742b405557360d384228db97b3b547ca

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/winfreetuition/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:40 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 414114
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 14 Jun 2018 04:45:09 GMT
server: cloudflare
etag: W/"1d7275799a3d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dsGSl6FvFeEpk2BrqizTuJ9RxyCqTIqeq3KpaDiO6HWvVzFXbU4gdWoEviMHsRQD1LMp1pEkE7Z1dSQ4uJHqkd8gTi8bKqHd0%2BH%2FaN%2BrdQYVHag6%2B2pFa%2FSknCdy4VMlX5o32IWo81MHp4gTtZ%2BTTA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
access-control-allow-origin: *, *
cache-control: max-age=604800
cf-polished: origSize=274658
cf-ray: 6dd1a0df9a4c7145-YUL
cf-bgj: minify

GET
H3 200 modernizr.foundation.js Show response
www.nextstepu.com/Portals/_default/Skins/NextStep/js/ 9 KB
4 KB 19ms
18ms Script
application/x-javascript 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.nextstepu.com/Portals/_default/Skins/NextStep/js/modernizr.foundation.js
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: b0279bd6ce9f08bf050f91947e12b108cb6671fb328514d7a49b83fe85515c26

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/winfreetuition/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:40 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 341252
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 14 Jun 2018 04:45:03 GMT
server: cloudflare
etag: W/"5598c759a3d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Kc4bkotOHdFSOfKHM1h1udyT2EKSSaMluabhYfd3rmDywDxznBteKW1SRaGbru7vpiJoqHZS8cKW2%2Frvuqs9JyT7UqQwRXy%2BgI%2Bx0fO2NTjXxNf7PfNhRtBY%2BGNoqYamrp%2F3NAdUzhN%2FYauzvt01iA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
access-control-allow-origin: *, *
cache-control: max-age=604800
cf-polished: origSize=9292
cf-ray: 6dd1a0df9a4d7145-YUL
cf-bgj: minify

GET
H2 200 css
fonts.googleapis.com/ 2 KB
940 B 90ms
36ms Stylesheet
text/css 2607:f8b0:4006:823::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Titillium+Web:300,400,600

Requested by

Host: www.nextstepu.com
URL: https://www.nextstepu.com/winfreetuition/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::200a Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8b09ec0a805bc5794f26d0dc217aae22057220d3631ff30b0caca99ae3067d7b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sun, 13 Feb 2022 22:52:40 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Sun, 13 Feb 2022 22:52:40 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 13 Feb 2022 22:52:40 GMT

GET
H3 200 show_ads_impl_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202202030101/ 289 KB
104 KB 97ms
66ms Script
text/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202202030101/show_ads_impl_fy2019.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2ad7073f84fbbd0ad2762cc2bbc4a2d4d91c3428071955399fd8c3bc7ba01d6f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 106373
x-xss-protection: 0
server: cafe
etag: 882054260762342820
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Sun, 13 Feb 2022 22:52:40 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220210/r20190131/ Frame 5F14 13 KB
6 KB 71ms
24ms Document
text/html 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220210/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7cfdef7cd1a0fab390d940b7b61ea3afc340838418bb94d460fe451d654331ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 5933
x-xss-protection: 0
date: Sun, 13 Feb 2022 15:12:36 GMT
expires: Sun, 27 Feb 2022 15:12:36 GMT
cache-control: public, max-age=1209600
age: 27604
etag: 17376176057921392695
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 152 KB
52 KB 73ms
58ms Script
text/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: www.nextstepu.com
URL: https://www.nextstepu.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

58c21ff181fdeaf28c8f18c84357ee05ec7eb89e31d0840f43a61633c7d79001

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 53574
x-xss-protection: 0
server: cafe
etag: 4552910375616373622
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sun, 13 Feb 2022 22:52:40 GMT

GET
H/1.1

200
OK

bounce Show response
secure.adnxs.com/
Redirect Chain

https://secure.adnxs.com/ttj?id=14248720
https://secure.adnxs.com/bounce?%2Fttj%3Fid%3D14248720

7 KB
4 KB

24ms
23ms

Script
application/javascript

68.67.179.91
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/bounce?%2Fttj%3Fid%3D14248720

Protocol

HTTP/1.1

Server

68.67.179.91 Secaucus, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

576.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

5ebaf047e26f0db01f71569cb801be6e627dd8f49f2e53c809d79791abed6896

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Sun, 13 Feb 2022 22:52:40 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 149.56.153.181; 149.56.153.181; 576.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 01dee4f4-10f0-45bb-8124-c756787652af
Server: nginx/1.17.9
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 22:52:40 GMT
X-Proxy-Origin: 149.56.153.181; 149.56.153.181; 576.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: d94f1a14-f308-4f38-b2f8-5410a5b83506
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://secure.adnxs.com/bounce?%2Fttj%3Fid%3D14248720
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 217 B
644 B 86ms
35ms Script
text/javascript 142.251.40.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.nextstepu.com&callback=_gfp_s_&client=ca-pub-3687838056419034

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202202030101/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s80-in-f2.1e100.net

Software

cafe /

Resource Hash

49ed2468e22ecae9eda37e93b53a584be75012f9155d5d7332f90f9176f4886b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 200
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.ca/adsid/ 107 B
792 B 134ms
39ms Script
application/javascript 2607:f8b0:4006:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.ca/adsid/integrator.js?domain=www.nextstepu.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202202030101/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 13 Feb 2022 22:52:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 87ms
39ms Script
application/javascript 2607:f8b0:4006:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.nextstepu.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202202030101/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 13 Feb 2022 22:52:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 403 ads Show response
googleads.g.doubleclick.net/pagead/ Frame DE39 603 B
67 B 96ms
67ms Document
text/html 2607:f8b0:4006:80d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3687838056419034&output=html&adk=2926845670&adf=1797764267&lmt=1644792760&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.nextstepu.com%2Fwinfreetuition%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644792760420&bpp=4&bdt=483&idt=163&shv=r20220210&mjsv=m202202030101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=8455416896218&frm=20&pv=2&ga_vid=1106375528.1644792761&ga_sid=1644792761&ga_hid=927442201&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44758229&oid=2&pvsid=878527974903673&pem=744&tmod=858405443&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=183

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202202030101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 13 Feb 2022 22:52:40 GMT
server: cafe
content-length: 46
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 sync Show response
gum.criteo.com/ 51 B
376 B 75ms
24ms Script
text/javascript 2620:100:a001::c
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sync?c=30&r=2&j=cr_handle_data_a

Requested by

Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?id=14248720

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Resource Hash

acb5d519051cc13618e992a7df4bce6a980036dfbe2e17a970ec716194329f6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:40 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=3600
server-processing-duration-in-ticks: 1541
strict-transport-security: max-age=31536000; preload;
content-length: 169
expires: 60

GET
H/1.1 200
OK ttj Show response
secure.adnxs.com/ 5 KB
3 KB 34ms
34ms Script
application/javascript 68.67.179.91
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/ttj?ttjb=1&bdc=1644792760&bdh=jJ4uXWTJEoKKpTGVpMwwKoao0RE.&&bdref=https%3A%2F%2Fwww.nextstepu.com%2Fwinfreetuition%2F&bdtop=true&bdifs=0&bstk=https%3A%2F%2Fwww.nextstepu.com%2Fwinfreetuition%2F&&id=14248720

Requested by

Host: www.nextstepu.com
URL: https://www.nextstepu.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.91 Secaucus, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

576.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

1907a3cfa460d2a58471769c16563d2d7319c140dcab03427fa7a1ae1f84f79a

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Sun, 13 Feb 2022 22:52:40 GMT
Content-Encoding: gzip
X-Creative-ID: 339074945
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 149.56.153.181; 149.56.153.181; 576.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: b1ee98bd-4e91-4cf2-83e8-8ce28d5a73b7
Server: nginx/1.17.9
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 2817 52 KB
17 KB 140ms
35ms Document
text/html 23.221.202.212
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=1568&pub_id=1374716
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.221.202.212 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-221-202-212.deploy.static.akamaitechnologies.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/

Response headers

Server: nginx/1.18.0 (Ubuntu)
Last-Modified: Wed, 02 Dec 2020 20:56:47 GMT
ETag: "5fc7ff8f-cf34"
Access-Control-Allow-Origin: *
Content-Type: text/html
Content-Encoding: gzip
Content-Length: 17053
Cache-Control: max-age=86402
Expires: Mon, 14 Feb 2022 22:52:42 GMT
Date: Sun, 13 Feb 2022 22:52:40 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1 200
OK trk.js Show response
cdn.adnxs.com/v/s/222/ 85 KB
29 KB 256ms
29ms Script
application/x-javascript 23.52.160.130
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adnxs.com/v/s/222/trk.js
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.52.160.130 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-52-160-130.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 7b6fc69a9da277bb118dbe07973e75598ff107f8d5c69aec6a3e0f5e6884603a

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Sun, 13 Feb 2022 22:52:40 GMT
Content-Encoding: gzip
Last-Modified: Tue, 14 Dec 2021 10:40:55 GMT
Server: AkamaiNetStorage
ETag: "27a82a9a755fe85e7882d2ba1e990a11:1639478455.565772"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *, *
Cache-Control: max-age=31536000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 29209
Expires: Mon, 13 Feb 2023 22:52:40 GMT

GET
H/1.1 200
OK ttj Show response
secure.adnxs.com/ 7 KB
4 KB 64ms
64ms Script
application/javascript 68.67.179.91
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/ttj?id=14247887

Requested by

Host: www.nextstepu.com
URL: https://www.nextstepu.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.91 Secaucus, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

576.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

e43f7f2f94dfce4d655223361aff4dc2dd084dc41eb67ac7cad27612682f9c79

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Sun, 13 Feb 2022 22:52:40 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 149.56.153.181; 149.56.153.181; 576.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 7a3710e2-06bf-41ed-9cd5-80eef5975ffb
Server: nginx/1.17.9
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK d4a757d2-8b68-48df-af38-751beb5d84a5.png
crcdn01.adnxs-simple.com/creative/p/1568/2022/1/31/31308380/ 30 KB
30 KB 156ms
22ms Image
image/png 23.52.160.130
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://crcdn01.adnxs-simple.com/creative/p/1568/2022/1/31/31308380/d4a757d2-8b68-48df-af38-751beb5d84a5.png
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.52.160.130 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-52-160-130.deploy.static.akamaitechnologies.com
Software: nginx/1.19.0 /
Resource Hash: 16b889d393b026e5f758e551c0c89bccf2548b74f75aa3ce4f6d3711fb8e9d7d

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Sun, 13 Feb 2022 22:52:40 GMT
Last-Modified: Mon, 31 Jan 2022 18:06:04 GMT
Server: nginx/1.19.0
x-amz-request-id: b7be2821-9d1a-4361-90d9-7a20e729619b
X-Clv-Request-Id: b7be2821-9d1a-4361-90d9-7a20e729619b
ETag: "fe9576fc94a28637bdf888c598df6804"
Content-Type: image/png
Access-Control-Allow-Origin: *
Cache-Control: max-age=3888000
X-Clv-S3-Version: 2.5
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 30504
Expires: Wed, 30 Mar 2022 22:52:40 GMT

GET
H/1.1 200
OK it
nym1-ib.adnxs.com/ 0
805 B 64ms
18ms Image
text/html 68.67.179.121
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://nym1-ib.adnxs.com/it?an_audit=0&referrer=https%3A%2F%2Fwww.nextstepu.com%2Fwinfreetuition%2F&e=wqT_3QLsCcDsBAAAAwDWAAUBCLiXppAGEJz7-aCa-ZepJxil4vaMj-ievBUqNgmamZmZmZm5PxGaAQgcmbk_GQAAAKABCQAhERsAKREJADERG6gwkNblBjigDECgDEgCUIG_16EBWPb-Z2AAaMbUCniWuwWAAQGKAQNVU0SSBQbwVZgB2AWgAVqoAQGwAQC4AQLAAQPIAQLQAQDYAQDgAQDwAQCKAjx1ZignYScsIDIyNTIyNDcsIDE2NDQ3OTI3NjApO3VmKCdyJywgMzM5MDc0OTQ1LCAxHR_wmpIC7QMhT0ZMSGxnamp2b2tNRUlHXzE2RUJHQUFnOXY1bk1BQTRBRUFFU0tBTVVKRFc1UVpZQUdERkFtZ0FjQUI0QUlBQkFJZ0JBSkFCQVpnQkFhQUJBYWdCQTdBQkFMa0JkYXNOYkpxWnVUX0JBWFdyRFd5YW1ia195UUZWenFPNWlaa0FRTmtCQUFBQUFBQUE4RF9nQVFEMUFRAQ8sQ1lBZ0NnQWdDMUFnBRAAOQkI8ElEQUFnRElBZ0RRQWdEWUFnRGdBZ0RvQWdENEFnQ0FBd0dZQXdHNkF3bE9XVTB5T2pRNU1UUGdBODR0aUFRQWtBUUFtQVFCd1FRQQFWBQEITWtFBQgFARhEWUJBRHhCBQwJARxpQVd4SnFrRgkOHEFBOEQteEJREQ4QQUF3UVUZDQBNGSgMQUFEUi4oAAAyLigA8EBPQUZrRTd3QmJHQ25RUDRCZGU3aVFHQ0JnTlZVMFNJQmdDUUJnR1lCZ0NoQnBxWm1abVptYmtfcUFZQnNnWWtDURlzAEUdjABHHQwASR0MOHVBWVWaApkBIWxSVE5WQTrxATBQYi1aeUFFS0FBeG1wBWtcWnVUODZDVTVaVFRJNk5Ea3hNMERPTFVrDXYMRHdQMT00AEYRGAxBQUFHHRgARx0YAEgdGBBIZ0FpUR0Q8LBBLi7YAqwE4AKM5QbqAilodHRwczovL3d3dy5uZXh0c3RlcHUuY29tL3dpbmZyZWV0dWl0aW9uL4ADAIgDAZADAJgDGaADAaoDAMADrALIAwDYAwDgAwDoAwD4AwGABACSBAQvdHRqmAQAogQOMTQ5LjU2LjE1My4xODGoBACyBAwIABAAGAAgADAAOAC4BADABADIBADSBA4xNTY4I05ZTTI6NDkxM9oEAggB4AQA8ARlvyCIBQGYBQCgBf8RARgBwAUAyQUABQEU8D_SBQkJBQt0AAAA2AUB4AUB8AUB-gUECAAQAJAGAJgGALgGAMEGAR8wAADwP9AGjQXaBhYKEAkRGQFcEAAYAOAGAfIGAggAgAcBiAcAoAcBugcPAUgEGAAFtCy0BEAAyAeWuwXSBw0VdAE4CNoHBgknROAHAOoHAggA8AfE_weKCAIQAA..&s=92f3c212697310e2c446ada84caacf36f5c379c0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.121 Secaucus, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

578.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 22:52:40 GMT
X-Proxy-Origin: 149.56.153.181; 149.56.153.181; 578.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: cd6ecd47-8144-4355-ad5c-98dacd531c2f
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK ttj Show response
secure.adnxs.com/ 4 KB
3 KB 37ms
37ms Script
application/javascript 68.67.179.91
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: www.nextstepu.com
URL: https://www.nextstepu.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.91 Secaucus, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

576.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

f5056f59f505a00e51e63e9f2574a321dc09b1251afae2421149291f69a32012

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Sun, 13 Feb 2022 22:52:40 GMT
Content-Encoding: gzip
X-Creative-ID: 120261906
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 149.56.153.181; 149.56.153.181; 576.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 30372af9-8d67-4ccf-834a-8ebe4be46cd3
Server: nginx/1.17.9
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame ABE9 52 KB
17 KB 71ms
40ms Document
text/html 23.221.202.212
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=1568&pub_id=1374716
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.221.202.212 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-221-202-212.deploy.static.akamaitechnologies.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/

Response headers

Server: nginx/1.18.0 (Ubuntu)
Last-Modified: Wed, 02 Dec 2020 20:56:47 GMT
ETag: "5fc7ff8f-cf34"
Access-Control-Allow-Origin: *
Content-Type: text/html
Content-Encoding: gzip
Content-Length: 17053
Cache-Control: max-age=86402
Expires: Mon, 14 Feb 2022 22:52:42 GMT
Date: Sun, 13 Feb 2022 22:52:40 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1 200
OK ad_5908abc28daba.js Show response
www.genmeo.com/widget/ 4 KB
1 KB 344ms
117ms Script
text/html 44.232.111.221
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.genmeo.com/widget/ad_5908abc28daba.js?ID=1
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 44.232.111.221 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-232-111-221.us-west-2.compute.amazonaws.com
Software: Apache/2.4.46 (Unix) OpenSSL/1.1.1d / PHP/7.4.10
Resource Hash: c17d72592686f260a196209efb58e3b07ffe95028f653626de44021b2be69cdc

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Sun, 13 Feb 2022 22:52:41 GMT
Content-Encoding: gzip
Server: Apache/2.4.46 (Unix) OpenSSL/1.1.1d
X-Powered-By: PHP/7.4.10
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Content-Length: 960

GET
H/1.1 200
OK it
nym1-ib.adnxs.com/ 0
805 B 20ms
19ms Image
text/html 68.67.179.121
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://nym1-ib.adnxs.com/it?an_audit=0&referrer=https%3A%2F%2Fwww.nextstepu.com%2Fwinfreetuition%2F&e=wqT_3QLmCcDmBAAAAwDWAAUBCLiXppAGEM3u8PyejZ7kKBil4vaMj-ievBUqNgmamZmZmZm5PxGaAQgcmbk_GQAAAKABCQAhERsAKREJADERG6gwz8_lBjigDECgDEgCUJKarDlY9v5nYABoxtQKeI-pBYABAYoBA1VTRJIBAQbwVZgB2AWgAVqoAQGwAQC4AQLAAQPIAQLQAQDYAQDgAQDwAQCKAjx1ZignYScsIDIyNTIyNDcsIDE2NDQ3OTI3NjApO3VmKCdyJywgMTIwMjYxOTA2LCAxHR_w_ZIC7QMhMDFIQXpnaldvWW9NRUpLYXJEa1lBQ0QyX21jd0FEZ0FRQVJJb0F4UXo4X2xCbGdBWU1VQ2FBQndBSGdBZ0FFQWlBRUFrQUVCbUFFQm9BRUJxQUVEc0FFQXVRRjFxdzFzbXBtNVA4RUJkYXNOYkpxWnVUX0pBVUV0dFNlZ3RQNF8yUUVBQUFBQUFBRHdQLUFCQVBVQkFBQUFBSmdDQUtBQ0FMVUNBQUFBQUwwQ0FBQUFBTUFDQU1nQ0FOQUNBTmdDQU9BQ0FPZ0NBUGdDQUlBREFaZ0RBYm9EQ1U1WlRUSTZORFEyTS1BRHppMklCQUNRQkFDWUJBSEJCBU0JAQh5UVEJCQEBFE5nRUFQRRGVLEFBQUNJQmU4aXFRVQENCagIN0VGAQoJAQhEQkIdPwB5FSgMQUFBTjIoAABaLigA8EA0QVdRVHZBRnNZS2RBX2dGMTd1SkFZSUdBMVZUUklnR0FKQUdBWmdHQUtFR21wbVptWm1adVQtb0JnR3lCaVFKQQFgCQEAUgkHBQEAWgUGCQEAaAkHAQE8QzRCaFEumgKVASF4Qk5CXzrxATA5djVuSUFRb0FER2FtBWtYbTVQem9KVGxsTk1qbzBORFl6UU00dFMR6QxQQV9VEQwMQUFBVx0MAFkdDABhHQwAYx0MEGVBQ0pBHRDw19gCrATgAozlBuoCKWh0dHBzOi8vd3d3Lm5leHRzdGVwdS5jb20vd2luZnJlZXR1aXRpb24vgAMAiAMBkAMAmAMZoAMBqgMAwAOsAsgDANgDAOADAOgDAPgDAYAEAJIEBC90dGqYBACiBA4xNDkuNTYuMTUzLjE4MagEALIEDAgAEAAYACAAMAA4ALgEAMAEAMgEANIEDjE1NjgjTllNMjo0NDYz2gQCCAHgBADwBJKarDmIBQGYBQCgBf___________wHABQDJBQAAAAAAAPA_0gUJCQAAAAUOLNgFAeAFAfAFAfoFBAFrKJAGAJgGALgGAMEGBSAsAPA_0AaNBdoGFgoQCREZAVwQABgA4AYB8gYCCACABwGIBwCgBwG6Bw8BSA2zMLQEQADIB4-pBdIHDQkROgE4CNoHBgknROAHAOoHAggA8AfE_weKCAIQAA..&s=67e99e7e3c5f8eb1b8c14ff3d7c4fe1dddf94072

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.121 Secaucus, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

578.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 22:52:40 GMT
X-Proxy-Origin: 149.56.153.181; 149.56.153.181; 578.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: 746326cd-003f-449d-8bc7-9ba24dbfa94b
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 2817 0
733 B 66ms
22ms Script
text/html 68.67.179.173
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=1568&pub_id=1374716&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=1568&pub_id=1374716

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.173 Secaucus, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

569.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 22:52:40 GMT
X-Proxy-Origin: 149.56.153.181; 149.56.153.181; 569.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: 5b230332-997d-49fd-8e10-478b0194b22d
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame ABE9 0
733 B 52ms
17ms Script
text/html 68.67.179.173
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=1568&pub_id=1374716&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=1568&pub_id=1374716

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.173 Secaucus, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

569.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 22:52:40 GMT
X-Proxy-Origin: 149.56.153.181; 149.56.153.181; 569.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: ec4cd437-ea19-40df-9f8a-f9090c6690e5
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK vevent
nym1-ib.adnxs.com/ 0
829 B 60ms
60ms Ping
text/html 68.67.179.121
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.nextstepu.com%2Fwinfreetuition%2F&e=wqT_3QLsCcDsBAAAAwDWAAUBCLiXppAGEJz7-aCa-ZepJxil4vaMj-ievBUqNgmamZmZmZm5PxGaAQgcmbk_GQAAAKABCQAhERsAKREJADERG6gwkNblBjigDECgDEgCUIG_16EBWPb-Z2AAaMbUCniWuwWAAQGKAQNVU0SSBQbwVZgB2AWgAVqoAQGwAQC4AQLAAQPIAQLQAQDYAQDgAQDwAQCKAjx1ZignYScsIDIyNTIyNDcsIDE2NDQ3OTI3NjApO3VmKCdyJywgMzM5MDc0OTQ1LCAxHR_wmpIC7QMhT0ZMSGxnamp2b2tNRUlHXzE2RUJHQUFnOXY1bk1BQTRBRUFFU0tBTVVKRFc1UVpZQUdERkFtZ0FjQUI0QUlBQkFJZ0JBSkFCQVpnQkFhQUJBYWdCQTdBQkFMa0JkYXNOYkpxWnVUX0JBWFdyRFd5YW1ia195UUZWenFPNWlaa0FRTmtCQUFBQUFBQUE4RF9nQVFEMUFRAQ8sQ1lBZ0NnQWdDMUFnBRAAOQkI8ElEQUFnRElBZ0RRQWdEWUFnRGdBZ0RvQWdENEFnQ0FBd0dZQXdHNkF3bE9XVTB5T2pRNU1UUGdBODR0aUFRQWtBUUFtQVFCd1FRQQFWBQEITWtFBQgFARhEWUJBRHhCBQwJARxpQVd4SnFrRgkOHEFBOEQteEJREQ4QQUF3UVUZDQBNGSgMQUFEUi4oAAAyLigA8EBPQUZrRTd3QmJHQ25RUDRCZGU3aVFHQ0JnTlZVMFNJQmdDUUJnR1lCZ0NoQnBxWm1abVptYmtfcUFZQnNnWWtDURlzAEUdjABHHQwASR0MOHVBWVWaApkBIWxSVE5WQTrxATBQYi1aeUFFS0FBeG1wBWtcWnVUODZDVTVaVFRJNk5Ea3hNMERPTFVrDXYMRHdQMT00AEYRGAxBQUFHHRgARx0YAEgdGBBIZ0FpUR0Q8LBBLi7YAqwE4AKM5QbqAilodHRwczovL3d3dy5uZXh0c3RlcHUuY29tL3dpbmZyZWV0dWl0aW9uL4ADAIgDAZADAJgDGaADAaoDAMADrALIAwDYAwDgAwDoAwD4AwGABACSBAQvdHRqmAQAogQOMTQ5LjU2LjE1My4xODGoBACyBAwIABAAGAAgADAAOAC4BADABADIBADSBA4xNTY4I05ZTTI6NDkxM9oEAggB4AQA8ARlvyCIBQGYBQCgBf8RARgBwAUAyQUABQEU8D_SBQkJBQt0AAAA2AUB4AUB8AUB-gUECAAQAJAGAJgGALgGAMEGAR8wAADwP9AGjQXaBhYKEAkRGQFcEAAYAOAGAfIGAggAgAcBiAcAoAcBugcPAUgEGAAFtCy0BEAAyAeWuwXSBw0VdAE4CNoHBgknROAHAOoHAggA8AfE_weKCAIQAA..&s=92f3c212697310e2c446ada84caacf36f5c379c0&type=nv&nvt=5&jm=1003&px=436&py=296&bw=728&bh=90&sid=4047424981803701549&vd=ct~0|rr~0&sv=222&tv=view7-1js&ua=chrome52&pl=win&x=v&tag_id=14248720&sw=1600&sh=1200&pw=1600&ph=1654&ww=1600&wh=1200&ft=0

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/222/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.121 Secaucus, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

578.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 22:52:40 GMT
X-Proxy-Origin: 149.56.153.181; 149.56.153.181; 578.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: af63ee6a-303e-4705-af9a-096362d5248a
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.nextstepu.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK script.css
www.genmeo.com/css/ 12 KB
3 KB 80ms
79ms Stylesheet
text/css 44.232.111.221
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.genmeo.com/css/script.css
Requested by: Host: www.genmeo.com
URL: https://www.genmeo.com/widget/ad_5908abc28daba.js?ID=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 44.232.111.221 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-232-111-221.us-west-2.compute.amazonaws.com
Software: Apache/2.4.46 (Unix) OpenSSL/1.1.1d /
Resource Hash: 1bc8836d0349190446c320987abd4dee0ea029a24f8e6d94386bd163fc220f57

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Sun, 13 Feb 2022 22:52:41 GMT
Content-Encoding: gzip
Last-Modified: Wed, 02 May 2018 18:37:12 GMT
Server: Apache/2.4.46 (Unix) OpenSSL/1.1.1d
ETag: "3066-56b3d600a0600-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 2575

GET
H/1.1 200
OK trk.js Show response
cdn.adnxs.com/v/s/222/ 85 KB
29 KB 29ms
28ms Script
application/x-javascript 23.52.160.130
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adnxs.com/v/s/222/trk.js
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.52.160.130 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-52-160-130.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 7b6fc69a9da277bb118dbe07973e75598ff107f8d5c69aec6a3e0f5e6884603a

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Sun, 13 Feb 2022 22:52:41 GMT
Content-Encoding: gzip
Last-Modified: Tue, 14 Dec 2021 10:40:55 GMT
Server: AkamaiNetStorage
ETag: "27a82a9a755fe85e7882d2ba1e990a11:1639478455.565772"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *, *
Cache-Control: max-age=31536000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 29209
Expires: Mon, 13 Feb 2023 22:52:41 GMT

GET
H3 200 parsley.js Show response
www.nextstepu.com/Portals/_default/Skins/NextStep/js/ 22 KB
6 KB 17ms
16ms Script
application/x-javascript 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.nextstepu.com/Portals/_default/Skins/NextStep/js/parsley.js
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: b5050af3aea0eb4c0b276d4cb8fe7be460c9f98da48bc2f5b6c32b97dbb39047

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/winfreetuition/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:41 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 523408
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 14 Jun 2018 04:45:04 GMT
server: cloudflare
etag: W/"b38b6e769a3d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wrbAGsg3TIchIEsmySSs3x2uwa2gsfBO6uS5o%2BWQBcD%2Fs5WGDPU%2BI3kPam2CU5tuPt6%2FIdefDI7fDbPqSSdbggXkND%2Bhaw%2FRCB8kX2UR%2BbLcL8QPHGuGmi9eI63d76QziVcibAdYG3XIQKkPaQXURw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
access-control-allow-origin: *, *
cache-control: max-age=604800
cf-polished: origSize=47099
cf-ray: 6dd1a0e4fa267145-YUL
cf-bgj: minify

GET
H/1.1 200
OK timthumb.php
www.genmeo.com/ 2 KB
3 KB 158ms
80ms Image
image/jpeg 44.232.111.221
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.genmeo.com/timthumb.php?src=files/ads/1493429473.jpg&q=80&a=c&zc=0&ct=1&w=90&h=90
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 44.232.111.221 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-232-111-221.us-west-2.compute.amazonaws.com
Software: Apache/2.4.46 (Unix) OpenSSL/1.1.1d / PHP/7.4.10
Resource Hash: 45a7e93d9ca98232d925287f7142f85630ea732ef6bbb6fa656aec3932b55d13

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Sun, 13 Feb 2022 22:52:41 GMT
Last-Modified: Sun, 13 Feb 2022 22:52:41 GMT
Server: Apache/2.4.46 (Unix) OpenSSL/1.1.1d
X-Powered-By: PHP/7.4.10
Content-Type: image/jpeg
Cache-Control: max-age=864000, must-revalidate
Connection: Keep-Alive
Accept-Ranges: none
Keep-Alive: timeout=5, max=98
Content-Length: 2393
Expires: Wed, 23 Feb 2022 22:52:41 GMT

GET
H/1.1 200
OK timthumb.php
www.genmeo.com/ 2 KB
3 KB 228ms
77ms Image
image/jpeg 44.232.111.221
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.genmeo.com/timthumb.php?src=files/ads/1493429700.jpg&q=80&a=c&zc=0&ct=1&w=90&h=90
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 44.232.111.221 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-232-111-221.us-west-2.compute.amazonaws.com
Software: Apache/2.4.46 (Unix) OpenSSL/1.1.1d / PHP/7.4.10
Resource Hash: 6b76b29b98d2ec706d630f15033c3480e16e88d6b056c896cd5c03001f0128c9

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Sun, 13 Feb 2022 22:52:41 GMT
Last-Modified: Sun, 13 Feb 2022 22:52:41 GMT
Server: Apache/2.4.46 (Unix) OpenSSL/1.1.1d
X-Powered-By: PHP/7.4.10
Content-Type: image/jpeg
Cache-Control: max-age=864000, must-revalidate
Connection: Keep-Alive
Accept-Ranges: none
Keep-Alive: timeout=5, max=100
Content-Length: 2544
Expires: Wed, 23 Feb 2022 22:52:41 GMT

GET
H/1.1 200
OK timthumb.php
www.genmeo.com/ 3 KB
4 KB 235ms
79ms Image
image/jpeg 44.232.111.221
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.genmeo.com/timthumb.php?src=files/ads/1493738050.jpg&q=80&a=c&zc=0&ct=1&w=90&h=90
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 44.232.111.221 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-232-111-221.us-west-2.compute.amazonaws.com
Software: Apache/2.4.46 (Unix) OpenSSL/1.1.1d / PHP/7.4.10
Resource Hash: d6288a931fba3da7d84a383b3682d7c4a329d87b54efe001787a0175fd1f9be6

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Sun, 13 Feb 2022 22:52:41 GMT
Last-Modified: Sun, 13 Feb 2022 22:52:41 GMT
Server: Apache/2.4.46 (Unix) OpenSSL/1.1.1d
X-Powered-By: PHP/7.4.10
Content-Type: image/jpeg
Cache-Control: max-age=864000, must-revalidate
Connection: Keep-Alive
Accept-Ranges: none
Keep-Alive: timeout=5, max=100
Content-Length: 3311
Expires: Wed, 23 Feb 2022 22:52:41 GMT

GET
H/1.1 200
OK timthumb.php
www.genmeo.com/ 3 KB
3 KB 237ms
79ms Image
image/jpeg 44.232.111.221
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.genmeo.com/timthumb.php?src=files/ads/1493738301.jpg&q=80&a=c&zc=0&ct=1&w=90&h=90
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 44.232.111.221 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-232-111-221.us-west-2.compute.amazonaws.com
Software: Apache/2.4.46 (Unix) OpenSSL/1.1.1d / PHP/7.4.10
Resource Hash: 0966015e6837ef75cd4d71f72a737e11879f5dd5d5edad7506548f7b3e136d49

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Sun, 13 Feb 2022 22:52:41 GMT
Last-Modified: Sun, 13 Feb 2022 22:52:41 GMT
Server: Apache/2.4.46 (Unix) OpenSSL/1.1.1d
X-Powered-By: PHP/7.4.10
Content-Type: image/jpeg
Cache-Control: max-age=864000, must-revalidate
Connection: Keep-Alive
Accept-Ranges: none
Keep-Alive: timeout=5, max=100
Content-Length: 3190
Expires: Wed, 23 Feb 2022 22:52:41 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 67ms
19ms Script
text/javascript 2607:f8b0:4006:80d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.nextstepu.com
URL: https://www.nextstepu.com/winfreetuition/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::200e Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 1705
date: Sun, 13 Feb 2022 22:24:16 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Mon, 14 Feb 2022 00:24:16 GMT

GET
H2 200 DotNetNukeAjaxShared.js Show response
static.cloudflareinsights.com/beacon.min.js/v652eace1692a40cfa3763df669d7439c1639079717194/Resources/Shared/scripts/ 14 KB
5 KB 72ms
50ms Script
text/javascript 2606:4700::6810:5f41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/v652eace1692a40cfa3763df669d7439c1639079717194/Resources/Shared/scripts/DotNetNukeAjaxShared.js?_=1644792761134
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/Portals/_default/Skins/NextStep/js/foundation.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5f41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fd0a1ac929c11b08e819fe4b0a18c5574012c44f09de8987c6be99a0f055a505

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:41 GMT
content-encoding: gzip
last-modified: Thu, 09 Dec 2021 19:55:17 GMT
server: cloudflare
etag: W/2021.12.0
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 6dd1a0e549ececfe-YUL

GET
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 152 KB
52 KB 64ms
64ms Script
text/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: www.nextstepu.com
URL: https://www.nextstepu.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1efeff8ba4a900e35e453402932e19fd575d76396cb3044e0463c593a340043a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 53574
x-xss-protection: 0
server: cafe
etag: 8202758649444687459
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sun, 13 Feb 2022 22:52:41 GMT

GET
H2 200 ice.js Show response
resources.infolinks.com/js/1786.003-3.025/ 178 KB
55 KB 38ms
37ms Script
application/javascript 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/js/1786.003-3.025/ice.js
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/winfreetuition/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d51fc32f16709946cd68db3ca2ab3a88d7e8bf7dad9a28834a51e19aed8c3a8d

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

cf-ray: 6dd1a0e528c1ca98-YYZ
date: Sun, 13 Feb 2022 22:52:41 GMT
via: 1.1 google
cf-cache-status: HIT
last-modified: Wed, 26 Jan 2022 08:38:27 GMT
server: cloudflare
age: 7277
etag: W/"2c618-5d6782026a911"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
content-encoding: gzip
expires: Tue, 15 Mar 2022 20:51:24 GMT

GET
H/1.1 200
OK tt Show response
secure.adnxs.com/ Frame BCCE 7 KB
4 KB 23ms
23ms Document
text/html 68.67.179.91
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/tt?id=14248747

Requested by

Host: www.nextstepu.com
URL: https://www.nextstepu.com/winfreetuition/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.91 Secaucus, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

576.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

1b67fe90dbb58507badc8a182cee401c08afa046fd759217a8d16fb7002d3d98

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/

Response headers

Server: nginx/1.17.9
Date: Sun, 13 Feb 2022 22:52:41 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
AN-X-Request-Uuid: a8147a41-1693-4b8a-91e4-a344da69663e
X-Proxy-Origin: 149.56.153.181; 149.56.153.181; 576.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
Content-Encoding: gzip

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 12 KB
9 KB 71ms
45ms XHR
application/json 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20220210&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202202030101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

035697d637512dec2d5d01db643b4e5ac3cdd2b2dc5426b65ed17a8b3f62fa4c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 13 Feb 2022 22:52:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9687
x-xss-protection: 0

GET
H2 200 update.js Show response
browser-update.org/ 9 KB
5 KB 77ms
21ms Script
application/javascript 2606:4700:20::681a:7b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://browser-update.org/update.js
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/winfreetuition/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:7b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c66e34dd2ad59f3f746cbd1ece385ca7c290e0a17cd2e57a2616db742aa60f53

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:41 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 277010
cf-polished: origSize=13724
content-disposition: inline; filename=update.js
cf-bgj: minify
last-modified: Thu, 10 Feb 2022 17:55:10 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=onSQvc8df%2FZ5NzLcqbqi4oAlrkhO%2BgO9CRCsEqhZlKERGLEAAfhdH2s00MxX6OcH1iRQdMVori5herqnipsBFYH6nc9y8gowD633DWinxjNKmuBXwOAUT%2BOkVTeW6C9qG%2BV%2BMq7LzpZtf6Ycjb3Gsw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: max-age=86400
cf-ray: 6dd1a0e5ce3eca53-YUL
expires: Fri, 11 Feb 2022 17:55:50 GMT

GET
H3 200 win-free.jpg
www.nextstepu.com/Portals/_default/skins/NextStep/images/ 71 KB
71 KB 25ms
24ms Image
image/jpeg 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.nextstepu.com/Portals/_default/skins/NextStep/images/win-free.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 90d1fe713957cd37019a419006a252bb16bddaf162295d1853ec28be1843a652

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/winfreetuition/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:41 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 341252
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 72516
last-modified: Thu, 14 Jun 2018 04:44:52 GMT
server: cloudflare
etag: "db7cde6e9a3d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=665cA90LMbAzfuTJlC1h9W1saJWhglR5IACysKfk3BaaRGl6znXnDCmokiELQeHnkIsHEfptuGBUBfqwSyr%2FBmKjpuem1BgHhVaQOMONgWsRriF173Ccgtvp1tfiMGmaQAvCQK62Fp7mFL9yGTvoBg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *, *
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 6dd1a0e57aae7145-YUL

GET tag.png
beeker.io/images/posts/2/ 0
0

GET
H3 200 input2.jpg
www.nextstepu.com/Portals/_default/Skins/NextStep/css/images/ 21 KB
21 KB 16ms
15ms Image
image/jpeg 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.nextstepu.com/Portals/_default/Skins/NextStep/css/images/input2.jpg
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/Portals/_default/Skins/NextStep/css/registration.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: abfad7f2d52d1a1d9417390df50ae3f187db4d2cb0981fb19b7a7975e383e765

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/Portals/_default/Skins/NextStep/css/registration.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:41 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 414092
x-powered-by: ASP.NET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 21163
last-modified: Thu, 14 Jun 2018 04:43:08 GMT
server: cloudflare
etag: "4240e3309a3d41:0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GodPMfnkMdElMWhW1url%2BGNsk2RdtbFC8lAzyp3GPL7vAznbcue0cwzltem11KMyD2pVtjWda8yEPDe5iIoLIlvirvllVALjM8LdZrpjdQjZqDycvViMBogkKDpzpFpfH0dEAnXrp7rDOBZh1iI34Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *, *
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 6dd1a0e57ab67145-YUL

POST
H3 200 rum Show response
www.nextstepu.com/cdn-cgi/ 0
168 B 16ms
16ms XHR
text/plain 2606:4700:3108::ac42:2b6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nextstepu.com/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/v652eace1692a40cfa3763df669d7439c1639079717194

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3108::ac42:2b6e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.nextstepu.com/winfreetuition/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
content-type: application/json

Response headers

date: Sun, 13 Feb 2022 22:52:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cloudflare
x-frame-options: DENY
access-control-allow-methods: POST,OPTIONS
content-type: text/plain
access-control-allow-origin: https://www.nextstepu.com
access-control-max-age: 86400
access-control-allow-credentials: true
cf-ray: 6dd1a0e58ac37145-YUL
vary: Origin

GET
H2 200 manage Show response
router.infolinks.com/usync/ Frame 16F1 9 KB
2 KB 62ms
59ms Document
text/html 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://router.infolinks.com/usync/manage?pid=3303138&wsid=0&pdom=www.nextstepu.com&purl=https%3A%2F%2Fwww.nextstepu.com%2Fwinfreetuition%2F
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1786.003-3.025/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cb136b453d4ce6808ac49bacc3432761f340e04d21d1524c9887ec011e6c0c5d

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/

Response headers

date: Sun, 13 Feb 2022 22:52:41 GMT
content-type: text/html;charset=UTF-8
cache-control: no-store
p3p: CP="NON DSP NID OUR COR"
via: 1.1 google
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6dd1a0e63a75ca98-YYZ
content-encoding: gzip

GET
H2 200 lcmanage Show response
router.infolinks.com/usync/ 263 B
300 B 57ms
57ms Script
application/javascript 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://router.infolinks.com/usync/lcmanage?pid=3303138&wsid=0&pdom=www.nextstepu.com&purl=https%3A%2F%2Fwww.nextstepu.com%2Fwinfreetuition%2F
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1786.003-3.025/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: af9650a440fa2c7fae008b7c4e8786654b5dc4822df0c385ae868062dc2893ff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:41 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 6dd1a0e63a7bca98-YYZ
p3p: CP="NON DSP NID OUR COR"
content-encoding: gzip
cache-control: no-store
content-type: application/javascript;charset=ISO-8859-1

GET
H2 200 gsd Show response
router.infolinks.com/ 313 B
484 B 59ms
58ms Script
text/javascript 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://router.infolinks.com/gsd?evt=afterGSD&pid=3303138&wsid=0&pdom=www.nextstepu.com&purl=https%3A%2F%2Fwww.nextstepu.com%2Fwinfreetuition%2F&jsv=1786.003-3.025&_cb=16447927613090
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1786.003-3.025/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 88dcf91c1359c701f4c11b594ea0762a9982cf2c14c0f465d6a9cb3fa99e014b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 22:52:41 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NON DSP NID OUR COR"
content-type: text/javascript;charset=UTF-8
content-encoding: gzip
cache-control: max-age=0
cf-ray: 6dd1a0e64a92ca98-YYZ
expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H/1.1 200
OK vevent
nym1-ib.adnxs.com/ 0
829 B 25ms
24ms Ping
text/html 68.67.179.121
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.nextstepu.com%2Fwinfreetuition%2F&e=wqT_3QLmCcDmBAAAAwDWAAUBCLiXppAGEM3u8PyejZ7kKBil4vaMj-ievBUqNgmamZmZmZm5PxGaAQgcmbk_GQAAAKABCQAhERsAKREJADERG6gwz8_lBjigDECgDEgCUJKarDlY9v5nYABoxtQKeI-pBYABAYoBA1VTRJIBAQbwVZgB2AWgAVqoAQGwAQC4AQLAAQPIAQLQAQDYAQDgAQDwAQCKAjx1ZignYScsIDIyNTIyNDcsIDE2NDQ3OTI3NjApO3VmKCdyJywgMTIwMjYxOTA2LCAxHR_w_ZIC7QMhMDFIQXpnaldvWW9NRUpLYXJEa1lBQ0QyX21jd0FEZ0FRQVJJb0F4UXo4X2xCbGdBWU1VQ2FBQndBSGdBZ0FFQWlBRUFrQUVCbUFFQm9BRUJxQUVEc0FFQXVRRjFxdzFzbXBtNVA4RUJkYXNOYkpxWnVUX0pBVUV0dFNlZ3RQNF8yUUVBQUFBQUFBRHdQLUFCQVBVQkFBQUFBSmdDQUtBQ0FMVUNBQUFBQUwwQ0FBQUFBTUFDQU1nQ0FOQUNBTmdDQU9BQ0FPZ0NBUGdDQUlBREFaZ0RBYm9EQ1U1WlRUSTZORFEyTS1BRHppMklCQUNRQkFDWUJBSEJCBU0JAQh5UVEJCQEBFE5nRUFQRRGVLEFBQUNJQmU4aXFRVQENCagIN0VGAQoJAQhEQkIdPwB5FSgMQUFBTjIoAABaLigA8EA0QVdRVHZBRnNZS2RBX2dGMTd1SkFZSUdBMVZUUklnR0FKQUdBWmdHQUtFR21wbVptWm1adVQtb0JnR3lCaVFKQQFgCQEAUgkHBQEAWgUGCQEAaAkHAQE8QzRCaFEumgKVASF4Qk5CXzrxATA5djVuSUFRb0FER2FtBWtYbTVQem9KVGxsTk1qbzBORFl6UU00dFMR6QxQQV9VEQwMQUFBVx0MAFkdDABhHQwAYx0MEGVBQ0pBHRDw19gCrATgAozlBuoCKWh0dHBzOi8vd3d3Lm5leHRzdGVwdS5jb20vd2luZnJlZXR1aXRpb24vgAMAiAMBkAMAmAMZoAMBqgMAwAOsAsgDANgDAOADAOgDAPgDAYAEAJIEBC90dGqYBACiBA4xNDkuNTYuMTUzLjE4MagEALIEDAgAEAAYACAAMAA4ALgEAMAEAMgEANIEDjE1NjgjTllNMjo0NDYz2gQCCAHgBADwBJKarDmIBQGYBQCgBf___________wHABQDJBQAAAAAAAPA_0gUJCQAAAAUOLNgFAeAFAfAFAfoFBAFrKJAGAJgGALgGAMEGBSAsAPA_0AaNBdoGFgoQCREZAVwQABgA4AYB8gYCCACABwGIBwCgBwG6Bw8BSA2zMLQEQADIB4-pBdIHDQkROgE4CNoHBgknROAHAOoHAggA8AfE_weKCAIQAA..&s=67e99e7e3c5f8eb1b8c14ff3d7c4fe1dddf94072&type=nv&nvt=5&jm=1003|1030&sid=4047424981803701549&vd=ct~0|rr~0&sv=222&tv=view7-1js&ua=chrome52&pl=win&x=v&tag_id=14247887&sw=1600&sh=1200&pw=1600&ph=1742&ww=1600&wh=1200&ft=0

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/222/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.121 Secaucus, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

578.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 22:52:41 GMT
X-Proxy-Origin: 149.56.153.181; 149.56.153.181; 578.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: 2c3f5840-f9a7-4a16-8e0a-1e678220f1fc
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.nextstepu.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 115ms
61ms Script
text/javascript 2607:f8b0:4006:80c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202202030101/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 13 Feb 2022 22:52:41 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 62ms
33ms XHR
text/plain 2607:f8b0:4006:80d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=927442201&t=pageview&_s=1&dl=https%3A%2F%2Fwww.nextstepu.com%2Fwinfreetuition%2F&ul=en-us&de=UTF-8&dt=NextStepU%20%3E%20Win%20Free%20Tuition&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IAhAAAABAAAAAC~&jid=976387110&gjid=933287192&cid=1106375528.1644792761&tid=UA-930506-1&_gid=187575091.1644792761&_r=1&_slc=1&z=1084765297

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::200e Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.nextstepu.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 22:52:41 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.nextstepu.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 47ms
19ms Image
image/gif 2607:f8b0:4006:80d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=927442201&t=event&ni=1&_s=2&dl=https%3A%2F%2Fwww.nextstepu.com%2Fwinfreetuition%2F&ul=en-us&de=UTF-8&dt=NextStepU%20%3E%20Win%20Free%20Tuition&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scroll%20Depth&ea=Percentage&el=Baseline&ev=1&_u=IAhAAAABAAAAAC~&jid=&gjid=&cid=1106375528.1644792761&tid=UA-930506-1&_gid=187575091.1644792761&z=411477060

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80d::200e Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 09:04:18 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 49703
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 widgets.js Show response
static.cloudflareinsights.com/beacon.min.js/v652eace1692a40cfa3763df669d7439c1639079717194/Resources/Shared/scripts/ 14 KB
5 KB 48ms
47ms Script
text/javascript 2606:4700::6810:5f41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/v652eace1692a40cfa3763df669d7439c1639079717194/Resources/Shared/scripts/widgets.js?_=1644792761370
Requested by: Host: www.nextstepu.com
URL: https://www.nextstepu.com/Portals/_default/Skins/NextStep/js/foundation.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5f41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fd0a1ac929c11b08e819fe4b0a18c5574012c44f09de8987c6be99a0f055a505

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:41 GMT
content-encoding: gzip
last-modified: Thu, 09 Dec 2021 19:55:17 GMT
server: cloudflare
etag: W/2021.12.0
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 6dd1a0e69bafecfe-YUL

GET
H2 200 sync Show response
gum.criteo.com/ Frame BCCE 51 B
376 B 25ms
24ms Script
text/javascript 2620:100:a001::c
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sync?c=30&r=2&j=cr_handle_data_a

Requested by

Host: secure.adnxs.com
URL: https://secure.adnxs.com/tt?id=14248747

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Resource Hash

acb5d519051cc13618e992a7df4bce6a980036dfbe2e17a970ec716194329f6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:41 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=3600
server-processing-duration-in-ticks: 1613
strict-transport-security: max-age=31536000; preload;
content-length: 169
expires: 60

GET
H/1.1 200
OK ttj Show response
secure.adnxs.com/ Frame BCCE 5 KB
4 KB 150ms
150ms Script
application/javascript 68.67.179.91
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/ttj?ttjb=1&bdc=1644792761&bdh=z5jFmWd12og4NnoEv2gHTd_kmng.&&bdref=https%3A%2F%2Fwww.nextstepu.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwww.nextstepu.com%2F,https%3A%2F%2Fsecure.adnxs.com%2Ftt%3Fid%3D14248747&&id=14248747

Requested by

Host: secure.adnxs.com
URL: https://secure.adnxs.com/tt?id=14248747

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.91 Secaucus, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

576.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

a38fe103b5ad3edfe5c8e6e246254697c298c5e4c9756566c1b163c100380a42

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.adnxs.com/tt?id=14248747
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Sun, 13 Feb 2022 22:52:41 GMT
Content-Encoding: gzip
X-Creative-ID: 120189276
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 149.56.153.181; 149.56.153.181; 576.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 529d699e-0e35-4b05-a41b-e2b9ab0fd98e
Server: nginx/1.17.9
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 iqusync-1.14.min.js Show response
resources.infolinks.com/static/usync/ 3 KB
1 KB 33ms
33ms Script
application/javascript 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/static/usync/iqusync-1.14.min.js
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/lcmanage?pid=3303138&wsid=0&pdom=www.nextstepu.com&purl=https%3A%2F%2Fwww.nextstepu.com%2Fwinfreetuition%2F
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4672d29f833a7f7cc73b07fb9de14be1ebe2d293a913fe5196191e89ae5037b6

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

cf-ray: 6dd1a0e6db72ca98-YYZ
date: Sun, 13 Feb 2022 22:52:41 GMT
via: 1.1 google
cf-cache-status: HIT
last-modified: Sun, 09 Jan 2022 13:00:03 GMT
server: cloudflare
age: 10245
etag: W/"ab3-5d525cc6a0e71"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
content-encoding: gzip
expires: Tue, 15 Mar 2022 20:01:56 GMT

POST
H2 200 doq.htm Show response
rt3010.infolinks.com/action/ 0
322 B 195ms
122ms XHR
text/plain 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rt3010.infolinks.com/action/doq.htm?pcode=utf-8&r=16447927614151
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1786.003-3.025/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.nextstepu.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 22:52:41 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
content-type: text/plain;charset=UTF-8
access-control-allow-origin: https://www.nextstepu.com
cache-control: no-cache,no-store
access-control-allow-credentials: true
cf-ray: 6dd1a0e768d454bb-YYZ
content-length: 0
x-application-context: application:prod
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

/ Show response
hde.tynt.com/deb/ Frame 8049
Redirect Chain

https://de.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV
https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1

1 KB
2 KB

43ms
31ms

Document
text/html

67.202.105.33
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3303138&wsid=0&pdom=www.nextstepu.com&purl=https%3A%2F%2Fwww.nextstepu.com%2Fwinfreetuition%2F
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.33 , United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip33.67-202-105.static.steadfastdns.net
Software: /
Resource Hash: a1c5e9b3f4e6612be39235b826c902b5bc04f359135fda002f9ce92f4550aa01

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/

Response headers

cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
expires: Sat, 26 Jul 1997 05:00:00 GMT
referrer-policy: unsafe-url
content-type: text/html
content-length: 1333
date: Sun, 13 Feb 2022 22:52:40 GMT
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"

Redirect headers

location: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
expires: Sat, 26 Jul 1997 05:00:00 GMT
referrer-policy: unsafe-url
content-length: 0
date: Sun, 13 Feb 2022 22:52:40 GMT
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"

GET
H/1.1

200
OK

usermatch Show response
ssum-sec.casalemedia.com/ Frame C7AE
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?s=191306&cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1

2 KB
3 KB

50ms
50ms

Document
text/html

23.221.203.181
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3303138&wsid=0&pdom=www.nextstepu.com&purl=https%3A%2F%2Fwww.nextstepu.com%2Fwinfreetuition%2F
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.221.203.181 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-221-203-181.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1cb5dc690d49a8b998d9562ca39ac0e882a8d5c46af9cc74febbd11b51d4e08

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/

Response headers

Server: Apache
Content-Type: text/html
Dropped-Udsids: 45|230|39|241|65|3|218|111
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Vary: Is-Traffic-Usersync
Expires: Sun, 13 Feb 2022 22:52:41 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sun, 13 Feb 2022 22:52:41 GMT
Content-Length: 1672
Connection: keep-alive

Redirect headers

Server: Apache
Content-Length: 311
Content-Type: text/html; charset=iso-8859-1
Location: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Expires: Sun, 13 Feb 2022 22:52:41 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sun, 13 Feb 2022 22:52:41 GMT
Connection: keep-alive

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame C469 2 KB
814 B 47ms
15ms Document
text/html 51.222.239.230
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90

Requested by

Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3303138&wsid=0&pdom=www.nextstepu.com&purl=https%3A%2F%2Fwww.nextstepu.com%2Fwinfreetuition%2F

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.239.230 , Canada, ASN16276 (OVH, FR),

Reverse DNS

ip230.ip-51-222-239.net

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/

Response headers

content-type: text/html
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
strict-transport-security: max-age=15552000

GET
H2

200

pbm-usync
router.infolinks.com/dyn/ Frame 16F1
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=156872&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156872%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infoli...
https://image8.pubmatic.com/AdServer/ImgSync?p=156872&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156872%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infoli...
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=Q0Q0N0M3NkEtMjcwRi00MUNFLTgzN0EtQzkwQzk4QjU3NTk0&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?p=156872&pmc=1&pr=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fpbm-usync%3Fuid%3DCD47C76A-270F-41CE-837A-C90C98B57594
https://router.infolinks.com/dyn/pbm-usync?uid=CD47C76A-270F-41CE-837A-C90C98B57594

0
40 B

61ms
60ms

Image
text/html

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/pbm-usync?uid=CD47C76A-270F-41CE-837A-C90C98B57594
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3303138&wsid=0&pdom=www.nextstepu.com&purl=https%3A%2F%2Fwww.nextstepu.com%2Fwinfreetuition%2F
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 22:52:43 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NON DSP NID OUR COR"
content-type: text/html;charset=UTF-8
cache-control: no-store, no-cache, private
cf-ray: 6dd1a0f64a44ca98-YYZ
content-length: 0
expires: Sat, 13 Feb 2021 22:52:43 GMT

Redirect headers

location: https://router.infolinks.com/dyn/pbm-usync?uid=CD47C76A-270F-41CE-837A-C90C98B57594
date: Sun, 13 Feb 2022 22:52:43 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

apn-usync
router.infolinks.com/dyn/ Frame 16F1
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fapn-usync%3Fuser_id%3D%24UID
https://router.infolinks.com/dyn/apn-usync?user_id=1547121990863532325

35 B
242 B

53ms
53ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/apn-usync?user_id=1547121990863532325
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3303138&wsid=0&pdom=www.nextstepu.com&purl=https%3A%2F%2Fwww.nextstepu.com%2Fwinfreetuition%2F
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 22:52:41 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 6dd1a0e72be7ca98-YYZ
content-length: 35
expires: Sat, 13 Feb 2021 22:52:41 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 22:52:41 GMT
X-Proxy-Origin: 149.56.153.181; 149.56.153.181; 569.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: 72961506-9bc4-4042-ba30-a5e1245a1c15
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://router.infolinks.com/dyn/apn-usync?user_id=1547121990863532325
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

ox-usync
router.infolinks.com/dyn/ Frame 16F1
Redirect Chain

https://u.openx.net/w/1.0/cm?id=9b5994f2-035d-46de-8c12-bc0e9a4e66c2&r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fox-usync%3Fuid%3D
https://u.openx.net/w/1.0/cm?cc=1&id=9b5994f2-035d-46de-8c12-bc0e9a4e66c2&r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fox-usync%3Fuid%3D
https://router.infolinks.com/dyn/ox-usync?uid=3c523f8c-edfd-4519-858b-0ee0bf19f22f

35 B
199 B

54ms
54ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/ox-usync?uid=3c523f8c-edfd-4519-858b-0ee0bf19f22f
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3303138&wsid=0&pdom=www.nextstepu.com&purl=https%3A%2F%2Fwww.nextstepu.com%2Fwinfreetuition%2F
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 22:52:41 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 6dd1a0e7fd32ca98-YYZ
content-length: 35
expires: Sat, 13 Feb 2021 22:52:41 GMT

Redirect headers

date: Sun, 13 Feb 2022 22:52:41 GMT
content-encoding: gzip
server: OXGW/17.1.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://router.infolinks.com/dyn/ox-usync?uid=3c523f8c-edfd-4519-858b-0ee0bf19f22f
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
via: 1.1 google

GET
H2

200

VR-usync
router.infolinks.com/dyn/ Frame 16F1
Redirect Chain

https://ups.analytics.yahoo.com/ups/58422/occ
https://ups.analytics.yahoo.com/ups/58422/occ?verify=true
https://router.infolinks.com/dyn/VR-usync?uid=y-fNt3yHtE2uE52zVPiPg2JrNOIZdBnrmCoeTgz5U-~A

35 B
209 B

63ms
63ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/VR-usync?uid=y-fNt3yHtE2uE52zVPiPg2JrNOIZdBnrmCoeTgz5U-~A
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3303138&wsid=0&pdom=www.nextstepu.com&purl=https%3A%2F%2Fwww.nextstepu.com%2Fwinfreetuition%2F
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 22:52:41 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 6dd1a0e84daaca98-YYZ
content-length: 35
expires: Sat, 13 Feb 2021 22:52:41 GMT

Redirect headers

location: https://router.infolinks.com/dyn/VR-usync?uid=y-fNt3yHtE2uE52zVPiPg2JrNOIZdBnrmCoeTgz5U-~A
date: Sun, 13 Feb 2022 22:52:41 GMT
server: ATS/9.1.0.33
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

r1-usync
router.infolinks.com/dyn/ Frame 16F1
Redirect Chain

https://sync.1rx.io/usersync2/infolinks
https://sync.1rx.io/usersync2/infolinks?zcc=1&cb=1644792761552
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=1649246671
https://match.adsrvr.org/track/cmb/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=1649246671
https://sync.1rx.io/usersync/tradedesk/cb317987-537c-4a92-9217-723fac1e61b6
https://sync.targeting.unrulymedia.com/csync/RX-b82f4669-7c78-445d-b697-59f8e17403f8-005?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fr1-usync%3Fuid%3DRX-b82f4669-7c78-445d-b697-59f8e17403f8-005
https://router.infolinks.com/dyn/r1-usync?uid=RX-b82f4669-7c78-445d-b697-59f8e17403f8-005

35 B
283 B

56ms
55ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/r1-usync?uid=RX-b82f4669-7c78-445d-b697-59f8e17403f8-005
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3303138&wsid=0&pdom=www.nextstepu.com&purl=https%3A%2F%2Fwww.nextstepu.com%2Fwinfreetuition%2F
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 22:52:42 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 6dd1a0ea894dca98-YYZ
content-length: 35
expires: Sat, 13 Feb 2021 22:52:42 GMT

Redirect headers

Date: Sun, 13 Feb 2022 22:52:41 GMT
Server: Tengine
ETag: RXb82f46697c78445db69759f8e17403f8005
Transfer-Encoding: chunked
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Location: https://router.infolinks.com/dyn/r1-usync?uid=RX-b82f4669-7c78-445d-b697-59f8e17403f8-005
Connection: keep-alive
Content-Type: text/html

GET
H2

200

zmn-usync
router.infolinks.com/dyn/ Frame 16F1
Redirect Chain

https://b1sync.zemanta.com/usersync/infolinks/?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fzmn-usync%3Fuid%3D__ZUID__
https://stags.bluekai.com/site/23178?id=F1-PFmtqDImzyXRbJv5f&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64TPOV2GK4RONFXGM33MNFXGW4ZOMNXW2L3EPFXC66TN...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS64TPOV2GK4RONFXGM33MNFXGW4ZOMNXW2L3EPFXC66TNNYWXK43ZNZRT6ZLYMNUGC3THMU6WS3TGN5WGS3TLOMTHK2LEHVDDCLKQIZWXI4KEJFWXU6KYKJREU5RVMY
https://router.infolinks.com/dyn/zmn-usync?uid=F1-PFmtqDImzyXRbJv5f

35 B
214 B

53ms
52ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/zmn-usync?uid=F1-PFmtqDImzyXRbJv5f
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3303138&wsid=0&pdom=www.nextstepu.com&purl=https%3A%2F%2Fwww.nextstepu.com%2Fwinfreetuition%2F
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 22:52:41 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 6dd1a0e95f5cca98-YYZ
content-length: 35
expires: Sat, 13 Feb 2021 22:52:41 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 22:52:41 GMT
P3p: CP="We do not support P3P header."
Location: https://router.infolinks.com/dyn/zmn-usync?uid=F1-PFmtqDImzyXRbJv5f
Cache-Control: no-cache, no-store, must-revalidate
Content-Type: text/html; charset=utf-8
Content-Length: 90
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2

200

sonobi-usync
router.infolinks.com/dyn/ Frame 16F1
Redirect Chain

https://sync.go.sonobi.com/us?loc=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsonobi-usync%3Fuid%3D%5BUID%5D
https://router.infolinks.com/dyn/sonobi-usync?uid=116b46d0-8a62-4111-8744-962064a800f7

35 B
243 B

56ms
56ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/sonobi-usync?uid=116b46d0-8a62-4111-8744-962064a800f7
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3303138&wsid=0&pdom=www.nextstepu.com&purl=https%3A%2F%2Fwww.nextstepu.com%2Fwinfreetuition%2F
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 22:52:41 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 6dd1a0e98fa7ca98-YYZ
content-length: 35
expires: Sat, 13 Feb 2021 22:52:41 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 22:52:41 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-lax-1-5-9
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://router.infolinks.com/dyn/sonobi-usync?uid=116b46d0-8a62-4111-8744-962064a800f7
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Type: text/plain; charset=utf8
Content-Length: 0
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H/1.1

200
OK

ca.png
s.cpx.to/ Frame 16F1
Redirect Chain

https://ib.adnxs.com/getuid?https://s.cpx.to/ca.png?ref=https%253A%252F%252Fwww.nextstepu.com%252Fwinfreetuition%252F&pid=12306&adnxs_uid=$UID
https://s.cpx.to/ca.png?ref=https%3A%2F%2Fwww.nextstepu.com%2Fwinfreetuition%2F&pid=12306&adnxs_uid=1547121990863532325

95 B
944 B

503ms
96ms

Image
image/png

34.246.235.84
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.cpx.to/ca.png?ref=https%3A%2F%2Fwww.nextstepu.com%2Fwinfreetuition%2F&pid=12306&adnxs_uid=1547121990863532325

Requested by

Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3303138&wsid=0&pdom=www.nextstepu.com&purl=https%3A%2F%2Fwww.nextstepu.com%2Fwinfreetuition%2F

Protocol

HTTP/1.1

Server

34.246.235.84 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-246-235-84.eu-west-1.compute.amazonaws.com

Software

Resource Hash

bf27786b4381176350787d768bf5f7c5310ba640aa48ee98a3d2c310ddd971ab

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache, no-cache
Content-Security-Policy: default-src 'self'
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
Date: Sun, 13 Feb 2022 22:52:41 GMT
X-Frame-Options: sameorigin
Connection: keep-alive
P3P: CP="NOI DEV ADM"
Cache-Control: no-store, must-revalidate, private, max-age=0, no-store, must-revalidate, private, max-age=0
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: image/png
Content-Length: 95
Expires: Sun, 13 Feb 2022 22:52:41 UTC

Redirect headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 22:52:41 GMT
X-Proxy-Origin: 149.56.153.181; 149.56.153.181; 569.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: 2b7bcc73-7602-46c8-8cb0-77f579e36c91
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://s.cpx.to/ca.png?ref=https%3A%2F%2Fwww.nextstepu.com%2Fwinfreetuition%2F&pid=12306&adnxs_uid=1547121990863532325
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

earn-usync
router.infolinks.com/dyn/ Frame 16F1
Redirect Chain

https://dsp.adkernel.com/sync?exchange=202&r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fearn-usync%3Fuid%3D%7BUID%7D
https://router.infolinks.com/dyn/earn-usync?uid=A1863792558695749414

35 B
190 B

68ms
68ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/earn-usync?uid=A1863792558695749414
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3303138&wsid=0&pdom=www.nextstepu.com&purl=https%3A%2F%2Fwww.nextstepu.com%2Fwinfreetuition%2F
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 22:52:41 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 6dd1a0e7acafca98-YYZ
content-length: 35
expires: Sat, 13 Feb 2021 22:52:41 GMT

Redirect headers

Location: https://router.infolinks.com/dyn/earn-usync?uid=A1863792558695749414
Date: Sun, 13 Feb 2022 22:52:41 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

200

imd-usync
router.infolinks.com/dyn/ Frame 16F1
Redirect Chain

https://ad.360yield.com/server_match?r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fimd-usync%3Fuser_id%3D%7BPUB_USER_ID%7D%26partner_id%3D1531
https://ad.360yield.com/ul_cb/server_match?r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fimd-usync%3Fuser_id%3D%7BPUB_USER_ID%7D%26partner_id%3D1531
https://router.infolinks.com/dyn/imd-usync?user_id=4271937e-f8ec-4d53-b0ee-abf0ef4cf643&partner_id=1531

35 B
200 B

63ms
63ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/imd-usync?user_id=4271937e-f8ec-4d53-b0ee-abf0ef4cf643&partner_id=1531
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3303138&wsid=0&pdom=www.nextstepu.com&purl=https%3A%2F%2Fwww.nextstepu.com%2Fwinfreetuition%2F
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 22:52:41 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 6dd1a0e85dacca98-YYZ
content-length: 35
expires: Sat, 13 Feb 2021 22:52:41 GMT

Redirect headers

location: https://router.infolinks.com/dyn/imd-usync?user_id=4271937e-f8ec-4d53-b0ee-abf0ef4cf643&partner_id=1531
date: Sun, 13 Feb 2022 22:52:41 GMT
access-control-allow-origin: *
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H2

200

outh-usync
router.infolinks.com/dyn/ Frame 16F1
Redirect Chain

https://pixel.advertising.com/ups/58237/sync?&gdpr=&gdpr_consent=&redir=true
https://pixel.advertising.com/ups/58237/sync?&gdpr=&gdpr_consent=&redir=true&verify=true
https://ups.analytics.yahoo.com/ups/58237/sync?&gdpr=&gdpr_consent=&redir=true&apid=UPa65c447e-8d1f-11ec-a226-0ad2e9c1cf5b
https://router.infolinks.com/dyn/outh-usync?uid=y-9Y7AeYlE2uHhFZnSHyTJAK0rv8MGVgFW~A~UPa65c447e-8d1f-11ec-a226-0ad2e9c1cf5b

35 B
235 B

53ms
52ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/outh-usync?uid=y-9Y7AeYlE2uHhFZnSHyTJAK0rv8MGVgFW~A~UPa65c447e-8d1f-11ec-a226-0ad2e9c1cf5b
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3303138&wsid=0&pdom=www.nextstepu.com&purl=https%3A%2F%2Fwww.nextstepu.com%2Fwinfreetuition%2F
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 22:52:41 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 6dd1a0e8de8aca98-YYZ
content-length: 35
expires: Sat, 13 Feb 2021 22:52:41 GMT

Redirect headers

location: https://router.infolinks.com/dyn/outh-usync?uid=y-9Y7AeYlE2uHhFZnSHyTJAK0rv8MGVgFW~A~UPa65c447e-8d1f-11ec-a226-0ad2e9c1cf5b
date: Sun, 13 Feb 2022 22:52:41 GMT
server: ATS/9.1.0.33
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1

400
Bad Request

usersync
match.bnmla.com/ Frame 16F1
Redirect Chain

https://match.bnmla.com/usersync?sspid=1000361&redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fenbd-usync%3Fuid%3D%5BUUID%5D
https://bh.contextweb.com/bh/rtset?pid=558752&ev=1&us_privacy=${us_privacy}&rurl=https%3A%2F%2Fmatch.bnmla.com%2Fusersync%3Fdspid%3D1%26uuid%3D%25%25VGUID%25%25
https://match.bnmla.com/usersync?dspid=1&uuid=pEHL4HSY45Ej&ev=1&us_privacy=${us_privacy}&pid=558752

0
137 B

34ms
33ms

Image
text/plain

38.27.122.158
COGENT-174

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.bnmla.com/usersync?dspid=1&uuid=pEHL4HSY45Ej&ev=1&us_privacy=${us_privacy}&pid=558752
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3303138&wsid=0&pdom=www.nextstepu.com&purl=https%3A%2F%2Fwww.nextstepu.com%2Fwinfreetuition%2F
Protocol: HTTP/1.1
Server: 38.27.122.158 , United States, ASN174 (COGENT-174, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Sun, 13 Feb 2022 22:52:42 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked

Redirect headers

strict-transport-security: max-age=15768000
server: Jetty(9.4.14.v20181114)
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language: en-CA
location: https://match.bnmla.com/usersync?dspid=1&uuid=pEHL4HSY45Ej&ev=1&us_privacy=${us_privacy}&pid=558752
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-56659f45bd-76fjw
expires: -1

GET
H2

200

sovrn-usync
router.infolinks.com/dyn/ Frame 16F1
Redirect Chain

https://ap.lijit.com/pixel?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsovrn-usync%3Fuid%3D%24UID
https://ap.lijit.com/pixel?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsovrn-usync%3Fuid%3D%24UID&sovrn_retry=true
https://router.infolinks.com/dyn/sovrn-usync?uid=9edce594a4f3e8efd4d260d0

35 B
273 B

52ms
52ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/sovrn-usync?uid=9edce594a4f3e8efd4d260d0
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3303138&wsid=0&pdom=www.nextstepu.com&purl=https%3A%2F%2Fwww.nextstepu.com%2Fwinfreetuition%2F
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 22:52:41 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 6dd1a0e92f22ca98-YYZ
content-length: 35
expires: Sat, 13 Feb 2021 22:52:41 GMT

Redirect headers

Date: Sun, 13 Feb 2022 22:52:41 GMT
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://router.infolinks.com/dyn/sovrn-usync?uid=9edce594a4f3e8efd4d260d0
Access-Control-Allow-Credentials: true
Connection: close
X-Sovrn-Pod: ad_ap6ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type

GET
H2

200

pbm-usync
router.infolinks.com/dyn/ Frame 16F1
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=60809&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D60809%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infolink...
https://image8.pubmatic.com/AdServer/ImgSync?p=60809&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D60809%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infolink...
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=ODk5MkQ0QjgtRTA0Ny00MUU3LTgzQkYtN0UwN0VBQ0YwNzQz&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?p=156872&pmc=1&pr=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fpbm-usync%3Fuid%3DCD47C76A-270F-41CE-837A-C90C98B57594
https://router.infolinks.com/dyn/pbm-usync?uid=CD47C76A-270F-41CE-837A-C90C98B57594

0
40 B

65ms
64ms

Image
text/html

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/pbm-usync?uid=CD47C76A-270F-41CE-837A-C90C98B57594
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3303138&wsid=0&pdom=www.nextstepu.com&purl=https%3A%2F%2Fwww.nextstepu.com%2Fwinfreetuition%2F
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 22:52:43 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NON DSP NID OUR COR"
content-type: text/html;charset=UTF-8
cache-control: no-store, no-cache, private
cf-ray: 6dd1a0f64a3fca98-YYZ
content-length: 0
expires: Sat, 13 Feb 2021 22:52:43 GMT

Redirect headers

location: https://router.infolinks.com/dyn/pbm-usync?uid=CD47C76A-270F-41CE-837A-C90C98B57594
date: Sun, 13 Feb 2022 22:32:53 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

zeta-usync
router.infolinks.com/dyn/ Frame 16F1
Redirect Chain

https://p.rfihub.com/cm?pub=43153&in=1
https://router.infolinks.com/dyn/zeta-usync?uid=978758876949750219

35 B
195 B

60ms
60ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/zeta-usync?uid=978758876949750219
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3303138&wsid=0&pdom=www.nextstepu.com&purl=https%3A%2F%2Fwww.nextstepu.com%2Fwinfreetuition%2F
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 22:52:41 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 6dd1a0e94f49ca98-YYZ
content-length: 35
expires: Sat, 13 Feb 2021 22:52:41 GMT

Redirect headers

Location: https://router.infolinks.com/dyn/zeta-usync?uid=978758876949750219
Date: Sun, 13 Feb 2022 22:52:41 GMT
Server: Jetty(9.3.29.v20201019)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

33a-usync
router.infolinks.com/dyn/ Frame 16F1
Redirect Chain

https://ssc-cms.33across.com/ps/?ri=0010b00002CpYhEAAV&ru=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2F33a-usync%3Fuid%3D33XUSERID33X
https://router.infolinks.com/dyn/33a-usync?uid=1904621968638

35 B
184 B

69ms
67ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/33a-usync?uid=1904621968638
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3303138&wsid=0&pdom=www.nextstepu.com&purl=https%3A%2F%2Fwww.nextstepu.com%2Fwinfreetuition%2F
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 22:52:42 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 6dd1a0eb0a1eca98-YYZ
content-length: 35
expires: Sat, 13 Feb 2021 22:52:42 GMT

Redirect headers

pragma: no-cache
date: Sun, 13 Feb 2022 22:52:41 GMT
referrer-policy: unsafe-url
server: 33XP005
x-33x-status: 100000000008200000C
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://router.infolinks.com/dyn/33a-usync?uid=1904621968638
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

pbm-usync
router.infolinks.com/dyn/ Frame 16F1
Redirect Chain

https://router.infolinks.com/dyn/iq-usync
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=1509139146&pcid=33cbf679-c6a2-4a4f-b8ca-c0675fa1ad16&3rddpi=2023874098&3rdpcid=YgmLuamgwVw.TzHFDVXq8AAA%26542&3rddpi=...
https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=1509139146&pcid=33cbf679-c6a2-4a4f-b8ca-c0675fa1ad16&3rddpi=2023874098&3rdpcid=YgmLuamgwVw.TzHFDVXq8AAA%26542&3rddpi...
https://image8.pubmatic.com/AdServer/ImgSync?p=156872&pu=https%3A%2F%2Fsync1.intentiq.com%2Fprofiles_engine%2FProfilesEngineServlet%3Fat%3D20%26dpi%3D1402230080%26mi%3D10%26csh%3D1509139146%26rnd%3...
https://image8.pubmatic.com/AdServer/ImgSync?p=156872&pu=https%3A%2F%2Fsync1.intentiq.com%2Fprofiles_engine%2FProfilesEngineServlet%3Fat%3D20%26dpi%3D1402230080%26mi%3D10%26csh%3D1509139146%26rnd%3...
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=NjQyOUFFOUEtMUIwQy00NUI3LUI5OTYtNUZBOEU3MTY0QzM0&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?p=156872&pmc=1&pr=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fpbm-usync%3Fuid%3DCD47C76A-270F-41CE-837A-C90C98B57594
https://router.infolinks.com/dyn/pbm-usync?uid=CD47C76A-270F-41CE-837A-C90C98B57594

0
231 B

55ms
55ms

Image
text/html

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/pbm-usync?uid=CD47C76A-270F-41CE-837A-C90C98B57594
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3303138&wsid=0&pdom=www.nextstepu.com&purl=https%3A%2F%2Fwww.nextstepu.com%2Fwinfreetuition%2F
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 22:52:43 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NON DSP NID OUR COR"
content-type: text/html;charset=UTF-8
cache-control: no-store, no-cache, private
cf-ray: 6dd1a0f64a3eca98-YYZ
content-length: 0
expires: Sat, 13 Feb 2021 22:52:43 GMT

Redirect headers

location: https://router.infolinks.com/dyn/pbm-usync?uid=CD47C76A-270F-41CE-837A-C90C98B57594
date: Sun, 13 Feb 2022 22:52:42 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

ProfilesEngineServlet Show response
api.intentiq.com/profiles_engine/
Redirect Chain

https://api.intentiq.com/profiles_engine/ProfilesEngineServlet?at=39&mi=10&dpi=1509139146&pt=17&dpn=1&idtype=0&pcid=33cbf679-c6a2-4a4f-b8ca-c0675fa1ad16&iiqidtype=2&iiqpcid=a4d8c31a-7106-411d-be7a-...
https://api.intentiq.com/profiles_engine/ProfilesEngineServlet?at=39&mi=10&dpi=1509139146&pt=17&dpn=1&idtype=0&pcid=33cbf679-c6a2-4a4f-b8ca-c0675fa1ad16&iiqidtype=2&iiqpcid=a4d8c31a-7106-411d-be7a-...

15 B
826 B

42ms
41ms

XHR
text/html

13.226.31.74
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.intentiq.com/profiles_engine/ProfilesEngineServlet?at=39&mi=10&dpi=1509139146&pt=17&dpn=1&idtype=0&pcid=33cbf679-c6a2-4a4f-b8ca-c0675fa1ad16&iiqidtype=2&iiqpcid=a4d8c31a-7106-411d-be7a-0c233774f4d0&iiqpciddate=1644792761444&dbsaved=true&fbp=2503514549&ckls=true&ci=LYWiKC4NKI&nc=false&trid=573280304
Protocol: H2
Server: 13.226.31.74 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-31-74.ewr53.r.cloudfront.net
Software: Apache-Coyote/1.1 /
Resource Hash: 30adcceef958c38a02a02125fb5794f73e88cd388a62ac554c5d406cab2dd431

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:41 GMT
via: 1.1 a5bdbdd1958d4d023b03427095a0a97a.cloudfront.net (CloudFront)
vary: Origin
x-amz-cf-pop: EWR53-C2
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
patent: https://www.almondnet.com/ip
pragma: no-cache
server: Apache-Coyote/1.1
access-control-max-age: 3600
access-control-allow-methods: POST, GET
content-type: text/html
access-control-allow-origin: https://www.nextstepu.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Accept, X-Requested-With, remember-me
x-amz-cf-id: fQ8UgKNzAXjK-1t0xE4-YzZAK-LMuq5RtVp-yRFfT9LIoXaoZ6X00g==
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

date: Sun, 13 Feb 2022 22:52:41 GMT
via: 1.1 a5bdbdd1958d4d023b03427095a0a97a.cloudfront.net (CloudFront)
vary: Origin
x-amz-cf-pop: EWR53-C2
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
patent: https://www.almondnet.com/ip
content-length: 43
pragma: no-cache
access-control-allow-origin: https://www.nextstepu.com
server: Apache-Coyote/1.1
access-control-max-age: 3600
access-control-allow-methods: POST, GET
content-type: image/gif
location: https://api.intentiq.com/profiles_engine/ProfilesEngineServlet?at=39&mi=10&dpi=1509139146&pt=17&dpn=1&idtype=0&pcid=33cbf679-c6a2-4a4f-b8ca-c0675fa1ad16&iiqidtype=2&iiqpcid=a4d8c31a-7106-411d-be7a-0c233774f4d0&iiqpciddate=1644792761444&dbsaved=true&fbp=2503514549&ckls=true&ci=LYWiKC4NKI&nc=false&trid=573280304
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Accept, X-Requested-With, remember-me
x-amz-cf-id: 0PNMw13bBcfkfmkfpfCuG4IpRlM-NBMQSuj_Vu84Bke8rF-ex81YSg==
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 pwt.js Show response
ads.pubmatic.com/AdServer/js/pwt/156872/3103/ 196 KB
62 KB 612ms
18ms Script
text/javascript 23.52.161.180
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/pwt/156872/3103/pwt.js
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/static/usync/iqusync-1.14.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.52.161.180 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-52-161-180.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 84e18d9144b52818f5ce1d7458c677100251597dacdecba06225b9ff265670ad

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:42 GMT
content-encoding: gzip
last-modified: Wed, 01 Dec 2021 18:28:45 GMT
server: Apache/2.2.15 (CentOS)
etag: "1121326-3108a-5d219d81d0a54"
vary: Accept-Encoding
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: public, max-age=98391
accept-ranges: bytes
content-type: text/javascript
content-length: 62966
expires: Tue, 15 Feb 2022 02:12:33 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 150C 13 KB
5 KB 62ms
21ms Document
text/html 2607:f8b0:4006:80c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80c::2001 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5046
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sun, 13 Feb 2022 18:39:47 GMT
expires: Mon, 13 Feb 2023 18:39:47 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
content-type: text/html
age: 15174
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 20E1 783 B
1 KB 95ms
39ms Document
text/html 2607:f8b0:4006:823::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2004 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

ee35a2927a5427f36a1cb14ce0079aba5dce556010be174874dea1897b9a892a

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-h+s7Kl9SZfpIuSV7etPvwQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Sun, 13 Feb 2022 22:52:41 GMT
date: Sun, 13 Feb 2022 22:52:41 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-h+s7Kl9SZfpIuSV7etPvwQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 512
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 3EE5 52 KB
17 KB 41ms
40ms Document
text/html 23.221.202.212
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=1568&pub_id=1374716
Requested by: Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?ttjb=1&bdc=1644792761&bdh=z5jFmWd12og4NnoEv2gHTd_kmng.&&bdref=https%3A%2F%2Fwww.nextstepu.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwww.nextstepu.com%2F,https%3A%2F%2Fsecure.adnxs.com%2Ftt%3Fid%3D14248747&&id=14248747
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.221.202.212 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-221-202-212.deploy.static.akamaitechnologies.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://secure.adnxs.com/

Response headers

Server: nginx/1.18.0 (Ubuntu)
Last-Modified: Wed, 02 Dec 2020 20:56:47 GMT
ETag: "5fc7ff8f-cf34"
Access-Control-Allow-Origin: *
Content-Type: text/html
Content-Encoding: gzip
Content-Length: 17053
Cache-Control: max-age=86402
Expires: Mon, 14 Feb 2022 22:52:43 GMT
Date: Sun, 13 Feb 2022 22:52:41 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1 200
OK trk.js Show response
cdn.adnxs.com/v/s/222/ Frame BCCE 85 KB
29 KB 29ms
28ms Script
application/x-javascript 23.52.160.130
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adnxs.com/v/s/222/trk.js
Requested by: Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?ttjb=1&bdc=1644792761&bdh=z5jFmWd12og4NnoEv2gHTd_kmng.&&bdref=https%3A%2F%2Fwww.nextstepu.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwww.nextstepu.com%2F,https%3A%2F%2Fsecure.adnxs.com%2Ftt%3Fid%3D14248747&&id=14248747
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.52.160.130 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-52-160-130.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 7b6fc69a9da277bb118dbe07973e75598ff107f8d5c69aec6a3e0f5e6884603a

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Sun, 13 Feb 2022 22:52:41 GMT
Content-Encoding: gzip
Last-Modified: Tue, 14 Dec 2021 10:40:55 GMT
Server: AkamaiNetStorage
ETag: "27a82a9a755fe85e7882d2ba1e990a11:1639478455.565772"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *, *
Cache-Control: max-age=31536000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 29209
Expires: Mon, 13 Feb 2023 22:52:41 GMT

GET
H/1.1 200
OK it
nym1-ib.adnxs.com/ Frame BCCE 0
805 B 81ms
81ms Image
text/html 68.67.179.121
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://nym1-ib.adnxs.com/it?an_audit=0&referrer=https%3A%2F%2Fwww.nextstepu.com%2F&e=wqT_3QLXCcDXBAAAAwDWAAUBCLmXppAGEPGEqYe7k9iQPhil4vaMj-ievBUqNgmamZmZmZm5PxGaAQgcmbk_GQAAAKABCQAhERsAKREJADERG6gwq9blBjigDECgDEgCUNzipzlY9v5nYABoxtQKeLW7BYABAYoBA1VTRJIBAQbwVZgBggKgATKoAQGwAQC4AQLAAQPIAQLQAQDYAQDgAQDwAQCKAjx1ZignYScsIDIyNTIyNDcsIDE2NDQ3OTI3NjEpO3VmKCdyJywgMTIwMTg5Mjc2LCAxHR_w_ZIC7QMhNEZKRFFnanp2NGtNRU56aXB6a1lBQ0QyX21jd0FEZ0FRQVJJb0F4UXE5YmxCbGdBWU1VQ2FBQndBSGdBZ0FFRWlBRUFrQUVCbUFFQm9BRUJxQUVEc0FFQXVRRjFxdzFzbXBtNVA4RUJkYXNOYkpxWnVUX0pBWE94cTVVSHplb18yUUVBQUFBQUFBRHdQLUFCQVBVQkFBQUFBSmdDQUtBQ0FMVUNBQUFBQUwwQ0FBQUFBTUFDQU1nQ0FOQUNBTmdDQU9BQ0FPZ0NBUGdDQUlBREFaZ0RBYm9EQ1U1WlRUSTZORGt5Ti1BRHppMklCQUNRQkFDWUJBSEJCBU0JAQh5UVEJCQEBFE5nRUFQRRGVLEFBQUNJQmI4bXFRVQENCagIN0VGAQoJAQhEQkIdPwB5FSgMQUFBTjIoAABaLigA8EA0QVdRVHZBRnNZS2RBX2dGMTd1SkFZSUdBMVZUUklnR0FKQUdBWmdHQUtFR21wbVptWm1adVQtb0JnR3lCaVFKQQFgCQEAUgkHBQEAWgUGCQEAaAkHAQE8QzRCaFEumgKVASFrQlRfVDrxATA5djVuSUFRb0FER2FtBWtYbTVQem9KVGxsTk1qbzBPVEkzUU00dFMR6QxQQV9VEQwMQUFBVx0MAFkdDABhHQwAYx0MEGVBQ0pBHRDw_dgCrATgAozlBuoCGmh0dHBzOi8vd3d3Lm5leHRzdGVwdS5jb20vgAMAiAMBkAMAmAMZoAMBqgMAwAOsAsgDANgDAOADAOgDAPgDAYAEAJIEBC90dGqYBACiBA4xNDkuNTYuMTUzLjE4MagEALIEDAgAEAAYACAAMAA4ALgEAMAEAMgEANIEDjE1NjgjTllNMjo0OTI32gQCCAHgBADwBNzipzmIBQGYBQCgBf___________wHABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AUB-gUECAAQAJAGAJgGALgGAMEGAAAAAAAA8D_QBo0F2gYWChAAAAAAATQRAWAQABgA4AYB8gYCCACABwGIBwCgBwG6Bw8IBRpEIAAwADi0BEAAyAe1uwXSBw0JLjgACNoHBgknROAHAOoHAggA8AfE_weKCAIQAA..&s=3fe8d673bd9b8e70bdf78a46ea5ef4e0949e246e

Requested by

Host: secure.adnxs.com
URL: https://secure.adnxs.com/tt?id=14248747

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.121 Secaucus, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

578.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 22:52:41 GMT
X-Proxy-Origin: 149.56.153.181; 149.56.153.181; 578.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: f7ef73d8-b5a7-4e1b-b862-6a0f574f6c46
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 -KWncqjjGzUwfkE9Iz7kKrmGQUyasx7mQMa73T4tfiM.js Show response
pagead2.googlesyndication.com/bg/ Frame 150C 35 KB
13 KB 20ms
20ms Script
text/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/-KWncqjjGzUwfkE9Iz7kKrmGQUyasx7mQMa73T4tfiM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f8a5a772a8e31b35307e413d233ee42ab986414c9ab31ee640c6bbdd3e2d7e23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 12:46:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 36375
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13554
x-xss-protection: 0
last-modified: Tue, 08 Feb 2022 16:08:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 13 Feb 2023 12:46:26 GMT

POST
H/1.1 200
OK vevent
nym1-ib.adnxs.com/ Frame BCCE 0
828 B 87ms
87ms Ping
text/html 68.67.179.121
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.nextstepu.com%2F&e=wqT_3QLXCcDXBAAAAwDWAAUBCLmXppAGEPGEqYe7k9iQPhil4vaMj-ievBUqNgmamZmZmZm5PxGaAQgcmbk_GQAAAKABCQAhERsAKREJADERG6gwq9blBjigDECgDEgCUNzipzlY9v5nYABoxtQKeLW7BYABAYoBA1VTRJIBAQbwVZgBggKgATKoAQGwAQC4AQLAAQPIAQLQAQDYAQDgAQDwAQCKAjx1ZignYScsIDIyNTIyNDcsIDE2NDQ3OTI3NjEpO3VmKCdyJywgMTIwMTg5Mjc2LCAxHR_w_ZIC7QMhNEZKRFFnanp2NGtNRU56aXB6a1lBQ0QyX21jd0FEZ0FRQVJJb0F4UXE5YmxCbGdBWU1VQ2FBQndBSGdBZ0FFRWlBRUFrQUVCbUFFQm9BRUJxQUVEc0FFQXVRRjFxdzFzbXBtNVA4RUJkYXNOYkpxWnVUX0pBWE94cTVVSHplb18yUUVBQUFBQUFBRHdQLUFCQVBVQkFBQUFBSmdDQUtBQ0FMVUNBQUFBQUwwQ0FBQUFBTUFDQU1nQ0FOQUNBTmdDQU9BQ0FPZ0NBUGdDQUlBREFaZ0RBYm9EQ1U1WlRUSTZORGt5Ti1BRHppMklCQUNRQkFDWUJBSEJCBU0JAQh5UVEJCQEBFE5nRUFQRRGVLEFBQUNJQmI4bXFRVQENCagIN0VGAQoJAQhEQkIdPwB5FSgMQUFBTjIoAABaLigA8EA0QVdRVHZBRnNZS2RBX2dGMTd1SkFZSUdBMVZUUklnR0FKQUdBWmdHQUtFR21wbVptWm1adVQtb0JnR3lCaVFKQQFgCQEAUgkHBQEAWgUGCQEAaAkHAQE8QzRCaFEumgKVASFrQlRfVDrxATA5djVuSUFRb0FER2FtBWtYbTVQem9KVGxsTk1qbzBPVEkzUU00dFMR6QxQQV9VEQwMQUFBVx0MAFkdDABhHQwAYx0MEGVBQ0pBHRDw_dgCrATgAozlBuoCGmh0dHBzOi8vd3d3Lm5leHRzdGVwdS5jb20vgAMAiAMBkAMAmAMZoAMBqgMAwAOsAsgDANgDAOADAOgDAPgDAYAEAJIEBC90dGqYBACiBA4xNDkuNTYuMTUzLjE4MagEALIEDAgAEAAYACAAMAA4ALgEAMAEAMgEANIEDjE1NjgjTllNMjo0OTI32gQCCAHgBADwBNzipzmIBQGYBQCgBf___________wHABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AUB-gUECAAQAJAGAJgGALgGAMEGAAAAAAAA8D_QBo0F2gYWChAAAAAAATQRAWAQABgA4AYB8gYCCACABwGIBwCgBwG6Bw8IBRpEIAAwADi0BEAAyAe1uwXSBw0JLjgACNoHBgknROAHAOoHAggA8AfE_weKCAIQAA..&s=3fe8d673bd9b8e70bdf78a46ea5ef4e0949e246e&type=nv&nvt=5&jm=1003&sid=7921422631408396923&vd=ct~0|rr~0&sv=222&tv=view7-1js&ua=chrome52&pl=win&x=v&tag_id=14248747&sw=1600&sh=1200&pw=0&ph=0&ww=0&wh=0&ft=3

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/222/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.121 Secaucus, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

578.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://secure.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 22:52:41 GMT
X-Proxy-Origin: 149.56.153.181; 149.56.153.181; 578.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: 7f7b7567-22b4-47e4-ad3d-741152221906
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://secure.adnxs.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 20E1 0
0 49ms
48ms Image
text/html 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20220210&jk=878527974903673&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:816::2002 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 3EE5 0
733 B 54ms
54ms Script
text/html 68.67.179.173
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=1568&pub_id=1374716&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=1568&pub_id=1374716

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.173 Secaucus, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

569.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 22:52:41 GMT
X-Proxy-Origin: 149.56.153.181; 149.56.153.181; 569.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: 8de8fab5-5a7c-4280-a75c-881eb3f2d937
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 7BD9
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=33across&endpoint=us-east&us_privacy=
https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=

281 B
554 B

73ms
18ms

Document
text/html

23.57.136.222
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.57.136.222 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-57-136-222.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: about:blank

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
ETag: "402b2-119-5d32342a551c0"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Sun, 13 Feb 2022 22:52:41 GMT
Connection: keep-alive
Vary: Accept-Encoding

Redirect headers

server: AkamaiGHost
content-length: 0
location: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
date: Sun, 13 Feb 2022 22:52:41 GMT
access-control-allow-credentials: true
access-control-allow-origin: *

GET
H2

200

match
cms-xch-chicago.33across.com/ Frame 8049
Redirect Chain

https://x.bidswitch.net/sync?ssp=the33across&us_privacy=
https://x.bidswitch.net/ul_cb/sync?ssp=the33across&us_privacy=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=bidswitch&ttd_tpi=1&ttd_puid=the33across&gdpr=&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=93&user_id=cb317987-537c-4a92-9217-723fac1e61b6&expires=30&ssp=the33across&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT_21}
https://ssc-cms.33across.com/ps/?gdpr_consent=&ri=10&ru=https%3A%2F%2Fcms-xch.33across.com%2Fmatch%3Fgdpr_58%3D%24gdpr_58%26gdpr%3D%24%7Bgdpr%7D%26gdpr_consent%3D%24%7Bgdpr_consent%7D%26bidder_id%3...
https://cms-xch.33across.com/match?gdpr_58=&gdpr=0&gdpr_consent=&bidder_id=10&external_user_id=f43c2f25-d675-4781-a3cc-7d84422ea1e8
https://cms-xch-chicago.33across.com/match?gdpr_58=&gdpr=0&gdpr_consent=&bidder_id=10&external_user_id=f43c2f25-d675-4781-a3cc-7d84422ea1e8

68 B
127 B

50ms
50ms

Image
image/png

34.117.239.71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cms-xch-chicago.33across.com/match?gdpr_58=&gdpr=0&gdpr_consent=&bidder_id=10&external_user_id=f43c2f25-d675-4781-a3cc-7d84422ea1e8
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: nginx/1.20.1 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:42 GMT
via: 1.1 google, 1.1 google
server: nginx/1.20.1
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: clear
content-length: 68
content-type: image/png

Redirect headers

location: https://cms-xch-chicago.33across.com:443/match?gdpr_58=&gdpr=0&gdpr_consent=&bidder_id=10&external_user_id=f43c2f25-d675-4781-a3cc-7d84422ea1e8
date: Sun, 13 Feb 2022 22:52:42 GMT
server: awselb/2.0
content-length: 134
content-type: text/html

GET
H2

200

match
cms-xch-chicago.33across.com/ Frame 8049
Redirect Chain

https://ssc-cms.33across.com/ps/?us_privacy=&ts=1644792761564.3&ri=1&ru=https%3A%2F%2Fsync.mathtag.com%2Fsync%2Fimg%3Fus_privacy%3D%24%7BUS_PRIVACY%7D%26mt_exid%3D73%26redir%3Dhttps%253A%252F%252Fc...
https://sync.mathtag.com/sync/img?us_privacy=&mt_exid=73&redir=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D1%26external_user_id%3D%5BMM_UUID%5D
https://cms-xch-chicago.33across.com/match?liv=h&us_privacy=&bidder_id=1&external_user_id=48bc6209-8bba-4a00-9040-40694d9b9d4b

68 B
127 B

226ms
226ms

Image
image/png

34.117.239.71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cms-xch-chicago.33across.com/match?liv=h&us_privacy=&bidder_id=1&external_user_id=48bc6209-8bba-4a00-9040-40694d9b9d4b
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: nginx/1.20.1 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:42 GMT
via: 1.1 google, 1.1 google
server: nginx/1.20.1
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: clear
content-length: 68
content-type: image/png

Redirect headers

Date: Sun, 13 Feb 2022 22:52:42 GMT
Server: MT3 4133 baa842e master nrt-pixel-x8 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cms-xch-chicago.33across.com/match?liv=h&us_privacy=&bidder_id=1&external_user_id=48bc6209-8bba-4a00-9040-40694d9b9d4b
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Sun, 13 Feb 2022 22:52:41 GMT

GET
H2

200

match
cms-xch-chicago.33across.com/ Frame 8049
Redirect Chain

https://ups.analytics.yahoo.com/ups/58350/sync?redir=true
https://ssc-cms.33across.com/ps/?xi=99&us_privacy=&xu=y-_.5YbNxE2uHOQ1ueDW32TPx.n_wBR34s~A
https://cms-xch-chicago.33across.com/match?bidder_id=99&external_user_id=y-_.5YbNxE2uHOQ1ueDW32TPx.n_wBR34s%7EA&ts=1644792762&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
127 B

208ms
176ms

Image
image/png

34.117.239.71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cms-xch-chicago.33across.com/match?bidder_id=99&external_user_id=y-_.5YbNxE2uHOQ1ueDW32TPx.n_wBR34s%7EA&ts=1644792762&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: nginx/1.20.1 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:42 GMT
via: 1.1 google, 1.1 google
server: nginx/1.20.1
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: clear
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Sun, 13 Feb 2022 22:52:41 GMT
referrer-policy: unsafe-url
server: 33XP005
x-33x-status: 8000000008200000C
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://cms-xch-chicago.33across.com/match?bidder_id=99&external_user_id=y-_.5YbNxE2uHOQ1ueDW32TPx.n_wBR34s%7EA&ts=1644792762&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

match
cms-xch-chicago.33across.com/ Frame 8049
Redirect Chain

https://33across-match.dotomi.com/match/bounce/current?networkId=78390&version=1&us_privacy=
https://33across-match.dotomi.com/match/bounce/current?DotomiTest=6eaff6b087c11227&is_secure=true&networkId=78390&version=1&us_privacy=
https://ssc-cms.33across.com/ps?xi=64&xu=AAAGcp0MlcnbUwMxa5gMAAAAAAA&expiration=1644879161&is_secure=true&us_privacy=
https://cms-xch-chicago.33across.com/match?bidder_id=64&external_user_id=AAAGcp0MlcnbUwMxa5gMAAAAAAA&ts=1644792762&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
213 B

73ms
40ms

Image
image/png

34.117.239.71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cms-xch-chicago.33across.com/match?bidder_id=64&external_user_id=AAAGcp0MlcnbUwMxa5gMAAAAAAA&ts=1644792762&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: nginx/1.20.1 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:42 GMT
via: 1.1 google, 1.1 google
server: nginx/1.20.1
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: clear
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Sun, 13 Feb 2022 22:52:41 GMT
referrer-policy: unsafe-url
server: 33XP002
x-33x-status: 8000000008200000C
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://cms-xch-chicago.33across.com/match?bidder_id=64&external_user_id=AAAGcp0MlcnbUwMxa5gMAAAAAAA&ts=1644792762&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

match
cms-xch-chicago.33across.com/ Frame 8049
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=f0v35ew&ttd_tpi=1&us_privacy=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=f0v35ew&ttd_tpi=1&us_privacy=
https://ssc-cms.33across.com/ps/?ri=102&ru=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fbidder_id%3D102%26ttl%3D1647384761%26external_user_id%3Dcb317987-537c-4a92-9217-723fac1e61b6
https://cms-xch-chicago.33across.com/match?bidder_id=102&ttl=1647384761&external_user_id=cb317987-537c-4a92-9217-723fac1e61b6

68 B
127 B

192ms
160ms

Image
image/png

34.117.239.71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cms-xch-chicago.33across.com/match?bidder_id=102&ttl=1647384761&external_user_id=cb317987-537c-4a92-9217-723fac1e61b6
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: nginx/1.20.1 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:42 GMT
via: 1.1 google, 1.1 google
server: nginx/1.20.1
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: clear
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Sun, 13 Feb 2022 22:52:41 GMT
referrer-policy: unsafe-url
server: 33XP003
x-33x-status: 40000000008200000C
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://cms-xch-chicago.33across.com/match?bidder_id=102&ttl=1647384761&external_user_id=cb317987-537c-4a92-9217-723fac1e61b6
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame C7AE
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=YgmLuamgwVw.TzHFDVXq8AAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESECN8sQklmIGhAIJNM17QZYI&google_cver=1&google_hm=2

43 B
1 KB

45ms
45ms

Image
image/gif

23.221.203.181
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESECN8sQklmIGhAIJNM17QZYI&google_cver=1&google_hm=2
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol: HTTP/1.1
Server: 23.221.203.181 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-221-203-181.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 22:52:41 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 13 Feb 2022 22:52:41 GMT

Redirect headers

pragma: no-cache
date: Sun, 13 Feb 2022 22:52:41 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESECN8sQklmIGhAIJNM17QZYI&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 330
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

usermatchredir
ssum-sec.casalemedia.com/ Frame C7AE
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=YgmLuamgwVw-TzHFDVXq8AAAAh4AAAAB&gdpr_consent=&us_privacy=&gdpr=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESELRcfGDZU-K3SNWubd0QOFQ&google_cver=1

43 B
315 B

38ms
38ms

Image
image/gif

23.221.203.181
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESELRcfGDZU-K3SNWubd0QOFQ&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol: HTTP/1.1
Server: 23.221.203.181 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-221-203-181.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 22:52:41 GMT
Server: Apache
Vary: Is-Traffic-Usersync
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 43
Expires: Sun, 13 Feb 2022 22:52:41 GMT

Redirect headers

pragma: no-cache
date: Sun, 13 Feb 2022 22:52:41 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESELRcfGDZU-K3SNWubd0QOFQ&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 342
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame C7AE
Redirect Chain

https://match.adsrvr.org/track/cmf/casale
https://match.adsrvr.org/track/cmb/casale?
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=cb317987-537c-4a92-9217-723fac1e61b6&expiration=1647384761&gdpr=0&gdpr_consent=

43 B
1006 B

87ms
44ms

Image
image/gif

23.221.203.181
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=cb317987-537c-4a92-9217-723fac1e61b6&expiration=1647384761&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol: HTTP/1.1
Server: 23.221.203.181 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-221-203-181.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 22:52:41 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 13 Feb 2022 22:52:41 GMT

Redirect headers

pragma: no-cache
date: Sun, 13 Feb 2022 22:52:41 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=cb317987-537c-4a92-9217-723fac1e61b6&expiration=1647384761&gdpr=0&gdpr_consent=
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 323

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame C7AE
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=YgmLuamgwVw-TzHFDVXq8AAAAh4AAAAB
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=YgmLuamgwVw-TzHFDVXq8AAAAh4AAAAB&dcc=t

43 B
932 B

44ms
44ms

Image
image/gif

209.54.180.3
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=YgmLuamgwVw-TzHFDVXq8AAAAh4AAAAB&dcc=t

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1

Protocol

HTTP/1.1

Server

209.54.180.3 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 22:52:41 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: 0YEHWAJZB3F4VN49MQPS
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 22:52:41 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: BMBX8HJGS20KJSB218CD
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=YgmLuamgwVw-TzHFDVXq8AAAAh4AAAAB&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum.casalemedia.com/ Frame C7AE
Redirect Chain

https://casale-match.dotomi.com/match/bounce/current?networkId=19998&version=1
https://casale-match.dotomi.com/match/bounce/current?DotomiTest=1df38d08eb371227&is_secure=true&networkId=19998&version=1
https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=AAAGc1LytjWCpQM624D3AAAAAAA&expiration=1644879161&is_secure=true

43 B
997 B

150ms
42ms

Image
image/gif

23.221.203.181
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=AAAGc1LytjWCpQM624D3AAAAAAA&expiration=1644879161&is_secure=true
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol: HTTP/1.1
Server: 23.221.203.181 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-221-203-181.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 22:52:42 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 13 Feb 2022 22:52:42 GMT

Redirect headers

pragma: no-cache
date: Sun, 13 Feb 2022 22:52:41 GMT
server: nginx
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location: https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=AAAGc1LytjWCpQM624D3AAAAAAA&expiration=1644879161&is_secure=true
cache-control: no-cache, private, max-age=0, no-store
content-length: 0
expires: 0

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame C7AE
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=15&redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D3%26external_user_id%3D%5BMM_UUID%5D
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=3c6a6209-8bba-4900-a64c-754564e030f5

43 B
1 KB

41ms
41ms

Image
image/gif

23.221.203.181
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=3c6a6209-8bba-4900-a64c-754564e030f5
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol: HTTP/1.1
Server: 23.221.203.181 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-221-203-181.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 22:52:42 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 13 Feb 2022 22:52:42 GMT

Redirect headers

Date: Sun, 13 Feb 2022 22:52:42 GMT
Server: MT3 4133 baa842e master nrt-pixel-x17 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=3c6a6209-8bba-4900-a64c-754564e030f5
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Sun, 13 Feb 2022 22:52:41 GMT

GET
H/1.1

200
OK

demconf.jpg
dpm.demdex.net/ Frame C7AE
Redirect Chain

https://dpm.demdex.net/ibs:dpid=23728&dpuuid=YgmLuamgwVw.TzHFDVXq8AAA%26542?gdpr_consent=&us_privacy=&gdpr=
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=23728&dpuuid=YgmLuamgwVw.TzHFDVXq8AAA%26542

42 B
945 B

85ms
84ms

Image
image/gif

52.40.93.193
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=23728&dpuuid=YgmLuamgwVw.TzHFDVXq8AAA%26542

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1

Protocol

HTTP/1.1

Server

52.40.93.193 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-40-93-193.us-west-2.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

DCS: dcs-prod-usw2-2-v024-0e7d2749b.edge-usw2.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: FgJyUj6jT3I=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-usw2-1-v024-091bffe4a.edge-usw2.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: j6RgaDGaRdg=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=23728&dpuuid=YgmLuamgwVw.TzHFDVXq8AAA%26542
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame C7AE
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=29
https://c1.adform.net/serving/cookie/match?CC=1&party=29
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=111&external_user_id=5219957225041795101&expiration=1646002361

43 B
989 B

109ms
54ms

Image
image/gif

23.221.203.181
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=111&external_user_id=5219957225041795101&expiration=1646002361
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol: HTTP/1.1
Server: 23.221.203.181 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-221-203-181.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 22:52:41 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 13 Feb 2022 22:52:41 GMT

Redirect headers

pragma: no-cache
date: Sun, 13 Feb 2022 22:52:41 GMT
server: nginx
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=111&external_user_id=5219957225041795101&expiration=1646002361
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 200 ix-usync
router.infolinks.com/dyn/ Frame C7AE 35 B
197 B 58ms
57ms Image
image/gif 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/ix-usync?uid=YgmLuamgwVw.TzHFDVXq8AAA%26542
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 22:52:41 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 6dd1a0e89e34ca98-YYZ
content-length: 35
expires: Sat, 13 Feb 2021 22:52:41 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 150C 0
9 B 21ms
20ms Image
text/plain 2607:f8b0:4006:80c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?ERBqXg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:80c::2001 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:41 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 52ms
51ms Image
image/gif 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gda_r20220210&jk=878527974903673&bg=!u7iluPzNAAbAtJCDwLQ7ACkAdvg8WlG-PPodpi_Y8xkkLi0GWSE_6Vh050kbRux0OZiQzZ-1a9u3SwIAAACvUgAAAAJoAQeZAsOiyGbH4DbaKvb_L0h3VC7VppfyXzeGvVYbNeOEcmi_stO47CBsfFST2Iuv09wz4mMYktq2aF_WheQ_UPtiR9CdY7fJZHl_UoFfb4L5vJTWPXmL7lphLLXcXCGg2xMWKEKJXjtAA9dFAW_64wWpxhgLc662ZuPGIfuJMZvQwesgZWsVlE-l8AoiplbUShLDEoIoH5PxJD1Qg-I2c8qkwfLhxR2xtE5_PL0K0dU4jcEYCJoNI8Ugw4K-G26Ncz3a29z26BPsk5IVFYjXR7Wx5sxfAuxaVqdrW9d0AIXnLgJuPUfa8D5Oq5Gy6ucQtUvc-ArCO-BkcehSJdQzqsLRr5XhrX-SBEtXSZD20vs2Hg04nIgBmWqjR7La7mWbw6iJ3ypYg8z_i0ygtJx9eXDaDfbiEQTOqdV7vRnQDzzYKjKiukzK5U5Z2IhgWTfFCBEzw0GFboYkbXIynOfNvBAaEpWUlGZjDfAl4oMZByd2qtljJ_RTK1PoXJcXCYgZPtruSbUEoPNdXZ2YDGNCNaaZyxrDgMyxOAB54GogVHrCGMWYqDigjcjeeUjHEm7RPdS7p0DCIoQzFflZhwvlzfu4Jsnkz_Z_YC3YDesishQ-7gGbeggyrAQYnXiJXfxOu8VEtrSBkpd_xfL3SuKMjD0P-y4Meyqq7pYxHN59nXDG2Rc_b3N2clCZGtxtpZJkPeJOmQTwXp40IDomO55VXQa6Ao4A7of7KDljBqpQR2sbjjfYC_IS4Rjh2ENEi8O7DdFdVf1X0-S72dtsXe01wBp5pwHK68n5s7zHcM9MMrn6VXLqjkCntw4Lm4d-tLKmQbUDOl4-fQSSr_sipCYVHl3Af1NtkArkPLGIUablGr84C2acyeOrxNADpXtDT8q0XFjcYZhp_j7lblVwI8y4mY23ubw2kvJy2_5S3IqDW1Bj8S7sKPHykQ

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 22:52:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 2817 0
733 B 25ms
25ms Script
text/html 68.67.179.173
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=1568&pub_id=1374716&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=1568&pub_id=1374716

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.173 Secaucus, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

569.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 22:52:41 GMT
X-Proxy-Origin: 149.56.153.181; 149.56.153.181; 569.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: d167d68d-a1ba-4613-932f-d4f1d6494e4f
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame ABE9 0
733 B 83ms
79ms Script
text/html 68.67.179.173
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=1568&pub_id=1374716&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=1568&pub_id=1374716

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.173 Secaucus, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

569.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 22:52:41 GMT
X-Proxy-Origin: 149.56.153.181; 149.56.153.181; 569.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: ed9c347b-4c5c-4141-98ce-dd2aac45463f
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 7BD9 32 KB
10 KB 29ms
29ms Script
text/html 23.57.136.222
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.57.136.222 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-57-136-222.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 8a3e73818e0c4786c6403ce2551e2ab7becd01e87e84ea53e18e65f6e0c43f4a

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Sun, 13 Feb 2022 22:52:41 GMT
Content-Encoding: gzip
Last-Modified: Wed, 15 Dec 2021 23:04:16 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=23000
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9702
Expires: Mon, 14 Feb 2022 05:16:01 GMT

GET
H/1.1 200
OK khaos.jpg
token.rubiconproject.com/ Frame 7BD9 284 B
934 B 108ms
24ms Image
image/jpg 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/khaos.jpg?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 284
X-RPHost: e1bddfc34a927e97bda010c0d8a62b62
Content-Type: image/jpg

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 70ms
24ms Preflight
application/json 2620:100:a001::c
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.nextstepu.com%2F&domain=www.nextstepu.com&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Origin: https://www.nextstepu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
content-type: application/json; charset=utf-8
expires: 0
access-control-allow-origin: https://www.nextstepu.com
access-control-allow-headers: content-type
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 1380
date: Sun, 13 Feb 2022 22:52:41 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
vary: Accept-Encoding

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.nextstepu.com%2F&domain=www.nextstepu.com&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=Uxvxy3xzYnlVU0FBSTRvNWFnMm9Id09FSVJQcWZMb1hyUkVPNDUycEJ2MFJFUjlnSXgzYmpVK2owS2paSTF5cUdzV1FXSUtRa21iK1lodVluZ2NmY1JFTjgyTndldVA2dVZac1doV3ZMdVprSEpWcGJYNXQ1amZ3T1JjK1...

358 B
620 B

74ms
25ms

XHR
application/json

74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=Uxvxy3xzYnlVU0FBSTRvNWFnMm9Id09FSVJQcWZMb1hyUkVPNDUycEJ2MFJFUjlnSXgzYmpVK2owS2paSTF5cUdzV1FXSUtRa21iK1lodVluZ2NmY1JFTjgyTndldVA2dVZac1doV3ZMdVprSEpWcGJYNXQ1amZ3T1JjK1VUMnVaZVE2bVlDeGtCcjRNRWw2THF2OCtibXB0YTFHeTkvcDBBS2pNRmN4Tm5CcVBQUjVVWHFYOC9BWFAvbmdIZ2U3bTBwT3VJd09mWUw1N3Q5azRycWhrSnVqSGpuYXUzNGd4YU9vZUsrZVlmQ1NidGI4PXw&cppv=2

Protocol

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Resource Hash

dde3a2b19a39d29abbaf3ffad54c02b322031f62cdf4d1239c32231af89f1559

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 22:52:42 GMT
content-encoding: gzip
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 2825
strict-transport-security: max-age=31536000; preload;
expires: 0

Redirect headers

pragma: no-cache
date: Sun, 13 Feb 2022 22:52:41 GMT
location: https://mug.criteo.com/sid?cpp=Uxvxy3xzYnlVU0FBSTRvNWFnMm9Id09FSVJQcWZMb1hyUkVPNDUycEJ2MFJFUjlnSXgzYmpVK2owS2paSTF5cUdzV1FXSUtRa21iK1lodVluZ2NmY1JFTjgyTndldVA2dVZac1doV3ZMdVprSEpWcGJYNXQ1amZ3T1JjK1VUMnVaZVE2bVlDeGtCcjRNRWw2THF2OCtibXB0YTFHeTkvcDBBS2pNRmN4Tm5CcVBQUjVVWHFYOC9BWFAvbmdIZ2U3bTBwT3VJd09mWUw1N3Q5azRycWhrSnVqSGpuYXUzNGd4YU9vZUsrZVlmQ1NidGI4PXw&cppv=2
strict-transport-security: max-age=31536000; preload;
access-control-allow-methods: GET
content-type: text/html; charset=utf-8
access-control-allow-origin: https://www.nextstepu.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 2706
content-length: 482
expires: 0

GET
H2

200

match
cms-xch-chicago.33across.com/ Frame 7BD9
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=33across&us_privacy=&khaos=KZLV55NP-1M-DRWQ
https://ssc-cms.33across.com/ps/?xi=1&xu=KZLV55NP-1M-DRWQ
https://cms-xch-chicago.33across.com/match?bidder_id=30&external_user_id=KZLV55NP-1M-DRWQ&ts=1644792762&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
127 B

27ms
27ms

Image
image/png

34.117.239.71
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cms-xch-chicago.33across.com/match?bidder_id=30&external_user_id=KZLV55NP-1M-DRWQ&ts=1644792762&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: nginx/1.20.1 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:42 GMT
via: 1.1 google, 1.1 google
server: nginx/1.20.1
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: clear
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Sun, 13 Feb 2022 22:52:41 GMT
referrer-policy: unsafe-url
server: 33XP003
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://cms-xch-chicago.33across.com/match?bidder_id=30&external_user_id=KZLV55NP-1M-DRWQ&ts=1644792762&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 166ms
25ms Preflight
application/json 74.119.119.139
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Origin: null
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
content-type: application/json; charset=utf-8
expires: 0
access-control-allow-origin: null
access-control-allow-headers: content-type
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 1209
date: Sun, 13 Feb 2022 22:52:42 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
vary: Accept-Encoding

GET
H2 200 709414.gif
id.rlcdn.com/ Frame 7BD9 42 B
449 B 77ms
43ms Image
image/gif 35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/709414.gif
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 13 Feb 2022 22:52:42 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 7BD9
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=cb317987-537c-4a92-9217-723fac1e61b6&gdpr=0&gdpr_consent=&expires=30

42 B
691 B

85ms
23ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=cb317987-537c-4a92-9217-723fac1e61b6&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 42
X-RPHost: 9a0c641c0479142b55591fdf2031b15f
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Sun, 13 Feb 2022 22:52:42 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=cb317987-537c-4a92-9217-723fac1e61b6&gdpr=0&gdpr_consent=&expires=30
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 289

GET
H2

204

v1
ads.yahoo.com/cms/ Frame 7BD9
Redirect Chain

https://token.rubiconproject.com/token?pid=26594
https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KZLV55NP-1M-DRWQ&sigv=1&esig=2~74000f1ed1c914bc0fc9e2b622d8361540ec677d

0
194 B

81ms
23ms

Image
text/plain

2001:4998:1c:800::1001
YAHOO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KZLV55NP-1M-DRWQ&sigv=1&esig=2~74000f1ed1c914bc0fc9e2b622d8361540ec677d

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=

Protocol

Server

2001:4998:1c:800::1001 , United States, ASN14779 (YAHOO, US),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 22:52:42 GMT
cache-control: no-store
x-content-type-options: nosniff
server: ATS
strict-transport-security: max-age=15552000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block

Redirect headers

Location: https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=KZLV55NP-1M-DRWQ&sigv=1&esig=2~74000f1ed1c914bc0fc9e2b622d8361540ec677d
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: f72efbd84733ea5ba734e4e8fe0395a3
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 7BD9
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/ZdePO7YkSHdRmR3A7qrZJsn5EUdSAgOZEtemQ7w0kco?csrc=
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=6850550879117786175

42 B
691 B

29ms
28ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=6850550879117786175
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 42
X-RPHost: c3b5432477546c086cd062707f625a76
Content-Type: image/gif

Redirect headers

date: Sun, 13 Feb 2022 22:52:42 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=6850550879117786175
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 7BD9
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=9&redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D4222%26nid%3D1512%26put%3D%5BMM_UUID%5D
https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=4e156209-8bba-4f00-84b5-aaa985d9130a

42 B
691 B

26ms
25ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=4e156209-8bba-4f00-84b5-aaa985d9130a
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 42
X-RPHost: 9a0c641c0479142b55591fdf2031b15f
Content-Type: image/gif

Redirect headers

Date: Sun, 13 Feb 2022 22:52:42 GMT
Server: MT3 4133 baa842e master nrt-pixel-x17 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://pixel.rubiconproject.com/tap.php?v=4222&nid=1512&put=4e156209-8bba-4f00-84b5-aaa985d9130a
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Sun, 13 Feb 2022 22:52:41 GMT

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 7BD9
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D191940%26nid%3D3778%26put%3D%24%7BUSER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D191940%26nid%3D3778%26put%3D%24%7BUSER_ID%7D&_test=YgmLugAGAtqkaQBB
https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=YgmLugAGAtqkaQBB&_test=YgmLugAGAtqkaQBB

42 B
691 B

52ms
25ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=YgmLugAGAtqkaQBB&_test=YgmLugAGAtqkaQBB
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 42
X-RPHost: d5a7ef20801cf5cb1ee516b6110e672f
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Sun, 13 Feb 2022 22:52:42 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1644792762.307335,VS0,VE0
x-served-by: cache-yul12822-YUL
x-cache: HIT
location: https://pixel.rubiconproject.com/tap.php?v=191940&nid=3778&put=YgmLugAGAtqkaQBB&_test=YgmLugAGAtqkaQBB
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7BD9
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MmUyMzU0ZDJlZDlkMjBjMzg3ZDc0NTQ5OWFmNzkxN2U5MWJmYTI4OQ

170 B
188 B

44ms
44ms

Image
image/png

142.251.35.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MmUyMzU0ZDJlZDlkMjBjMzg3ZDc0NTQ5OWFmNzkxN2U5MWJmYTI4OQ

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=

Protocol

Server

142.251.35.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s78-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 22:52:42 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MmUyMzU0ZDJlZDlkMjBjMzg3ZDc0NTQ5OWFmNzkxN2U5MWJmYTI4OQ
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: b5ba23d75d0dcd35432b720d73e3149b
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 7BD9
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=a9us
https://s.amazon-adsystem.com/ecm3?id=KZLV55NP-1M-DRWQ&ex=d-rubiconproject.com&status=ok

43 B
556 B

30ms
29ms

Image
image/gif

209.54.180.3
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=KZLV55NP-1M-DRWQ&ex=d-rubiconproject.com&status=ok

Requested by

Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=

Protocol

HTTP/1.1

Server

209.54.180.3 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 22:52:42 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: 1KHEYN6H57JXJSE2FY2R
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://s.amazon-adsystem.com/ecm3?id=KZLV55NP-1M-DRWQ&ex=d-rubiconproject.com&status=ok
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 0190a17a18f2299b1b85aeb1793e601c
Expires: 0

POST
H/1.1 200
OK vevent
nym1-ib.adnxs.com/ 0
829 B 19ms
19ms Ping
text/html 68.67.179.121
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.nextstepu.com%2Fwinfreetuition%2F&e=wqT_3QLsCcDsBAAAAwDWAAUBCLiXppAGEJz7-aCa-ZepJxil4vaMj-ievBUqNgmamZmZmZm5PxGaAQgcmbk_GQAAAKABCQAhERsAKREJADERG6gwkNblBjigDECgDEgCUIG_16EBWPb-Z2AAaMbUCniWuwWAAQGKAQNVU0SSBQbwVZgB2AWgAVqoAQGwAQC4AQLAAQPIAQLQAQDYAQDgAQDwAQCKAjx1ZignYScsIDIyNTIyNDcsIDE2NDQ3OTI3NjApO3VmKCdyJywgMzM5MDc0OTQ1LCAxHR_wmpIC7QMhT0ZMSGxnamp2b2tNRUlHXzE2RUJHQUFnOXY1bk1BQTRBRUFFU0tBTVVKRFc1UVpZQUdERkFtZ0FjQUI0QUlBQkFJZ0JBSkFCQVpnQkFhQUJBYWdCQTdBQkFMa0JkYXNOYkpxWnVUX0JBWFdyRFd5YW1ia195UUZWenFPNWlaa0FRTmtCQUFBQUFBQUE4RF9nQVFEMUFRAQ8sQ1lBZ0NnQWdDMUFnBRAAOQkI8ElEQUFnRElBZ0RRQWdEWUFnRGdBZ0RvQWdENEFnQ0FBd0dZQXdHNkF3bE9XVTB5T2pRNU1UUGdBODR0aUFRQWtBUUFtQVFCd1FRQQFWBQEITWtFBQgFARhEWUJBRHhCBQwJARxpQVd4SnFrRgkOHEFBOEQteEJREQ4QQUF3UVUZDQBNGSgMQUFEUi4oAAAyLigA8EBPQUZrRTd3QmJHQ25RUDRCZGU3aVFHQ0JnTlZVMFNJQmdDUUJnR1lCZ0NoQnBxWm1abVptYmtfcUFZQnNnWWtDURlzAEUdjABHHQwASR0MOHVBWVWaApkBIWxSVE5WQTrxATBQYi1aeUFFS0FBeG1wBWtcWnVUODZDVTVaVFRJNk5Ea3hNMERPTFVrDXYMRHdQMT00AEYRGAxBQUFHHRgARx0YAEgdGBBIZ0FpUR0Q8LBBLi7YAqwE4AKM5QbqAilodHRwczovL3d3dy5uZXh0c3RlcHUuY29tL3dpbmZyZWV0dWl0aW9uL4ADAIgDAZADAJgDGaADAaoDAMADrALIAwDYAwDgAwDoAwD4AwGABACSBAQvdHRqmAQAogQOMTQ5LjU2LjE1My4xODGoBACyBAwIABAAGAAgADAAOAC4BADABADIBADSBA4xNTY4I05ZTTI6NDkxM9oEAggB4AQA8ARlvyCIBQGYBQCgBf8RARgBwAUAyQUABQEU8D_SBQkJBQt0AAAA2AUB4AUB8AUB-gUECAAQAJAGAJgGALgGAMEGAR8wAADwP9AGjQXaBhYKEAkRGQFcEAAYAOAGAfIGAggAgAcBiAcAoAcBugcPAUgEGAAFtCy0BEAAyAeWuwXSBw0VdAE4CNoHBgknROAHAOoHAggA8AfE_weKCAIQAA..&s=92f3c212697310e2c446ada84caacf36f5c379c0&type=pv&jm=1003|1030&px=436&py=296&bw=728&bh=90&sf=1&sid=4047424981803701549&vd=ct~0|rr~5&sv=222&tv=view7-1js&ua=chrome52&pl=win&x=v&tag_id=14248720&ft=0

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/222/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.121 Secaucus, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

578.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.nextstepu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 22:52:42 GMT
X-Proxy-Origin: 149.56.153.181; 149.56.153.181; 578.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: 38ba5735-2df4-4ddc-938e-1205d2e76933
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.nextstepu.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 3EE5 0
733 B 36ms
35ms Script
text/html 68.67.179.173
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=1568&pub_id=1374716&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=1568&pub_id=1374716

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.173 Secaucus, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

569.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 22:52:42 GMT
X-Proxy-Origin: 149.56.153.181; 149.56.153.181; 569.bm-nginx-loadbalancer.mgmt.nym2; adnxs.com
AN-X-Request-Uuid: c50b2331-c593-4cc2-832a-f9f3477775d6
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200 535.json Show response
id5-sync.com/g/v2/ 2 KB
2 KB 392ms
96ms XHR
application/json 54.36.109.183
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/535.json

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/156872/3103/pwt.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.36.109.183 , France, ASN16276 (OVH, FR),

Reverse DNS

p08.id5-sync.com

Software

Resource Hash

ca0ef206c756e7865598545c5a8251f3f763cefb996a4251f6a3f6652c233b81

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.nextstepu.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: text/plain

Response headers

Date: Sun, 13 Feb 2022 22:52:43 GMT
Vary: Origin
P3P: CP="CAO PSA OUR"
Access-Control-Allow-Origin: https://www.nextstepu.com
Access-Control-Allow-Credentials: true
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Content-Type: application/json;charset=UTF-8
Transfer-Encoding: chunked

GET
H2 451 envelope Show response
api.rlcdn.com/api/identity/ 0
255 B 83ms
42ms XHR
text/plain 34.120.155.137
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.rlcdn.com/api/identity/envelope?pid=1258
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/156872/3103/pwt.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.155.137 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 137.155.120.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.nextstepu.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: text/plain

Response headers

date: Sun, 13 Feb 2022 22:52:44 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: https://www.nextstepu.com
access-control-allow-credentials: true
access-control-allow-headers: Accept, Authorization, Content-Type, Cookie, Origin, X-Requested-With
content-length: 0

GET
H2 200 id Show response
id.crwdcntrl.net/ 154 B
906 B 111ms
42ms XHR
application/json 18.233.240.143
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://id.crwdcntrl.net/id
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/156872/3103/pwt.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.233.240.143 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-233-240-143.compute-1.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 8844311e9bc5499bcd8ab70679bfe3146168a25b728c7ca80fd0688c14bade4b

Request headers

Referer: https://www.nextstepu.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 22:52:44 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://www.nextstepu.com
cache-control: no-cache
x-server: 10.40.8.252
access-control-allow-credentials: true
content-type: application/json;charset=utf-8
content-length: 154
expires: 0

GET
H2 200 rid Show response
match.adsrvr.org/track/ 108 B
744 B 37ms
36ms XHR
application/json 35.71.131.137
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=pubmatic&fmt=json
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/156872/3103/pwt.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: 7b3e9fa1a76e14f168cdce88a2db100e0a2008deafcfd6f18e7fb8404ad7c4ec

Request headers

Referer: https://www.nextstepu.com/
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: text/plain

Response headers

date: Sun, 13 Feb 2022 22:52:44 GMT
x-aspnet-version: 4.0.30319
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.nextstepu.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 108
expires: Tue, 15 Mar 2022 22:52:44 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: beeker.io
URL: https://beeker.io/images/posts/2/tag.png

Verdicts & Comments Add Verdict or Comment

176 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

108 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.nextstepu.com/winfreetuition	1969-12-31 23:59:59	Name: logglytrackingsession Value: 57eac5b7-f3fa-42b5-9dbf-243e285f20f5
www.nextstepu.com/	1970-01-20 02:33:12	Name: .ASPXANONYMOUS Value: deihPb5X2AEkAAAAY2M3NjExYTctOTJjMy00M2M0LWI3ZjYtMDBkOWRhMjhjMzdm0
www.nextstepu.com/	1969-12-31 23:59:59	Name: ASP.NET_SessionId Value: onseq3klk2uuttgveb4io4tp
www.nextstepu.com/	1969-12-31 23:59:59	Name: language Value: en-US
www.nextstepu.com/	1969-12-31 23:59:59	Name: refid Value:
.adnxs.com/	1970-01-20 03:02:48	Name: uuid2 Value: 1547121990863532325
.nextstepu.com/	1970-01-20 10:14:48	Name: __gads Value: ID=df029a8a1362d8a7-228fef56dccf0043:T=1644792760:RT=1644792760:S=ALNI_Manleg2W6D_S_oDtPrm41DQW_cweg
www.nextstepu.com/	1970-01-20 00:54:39	Name: winFreeRequest Value: requested
.nextstepu.com/	1970-01-20 18:24:24	Name: _ga Value: GA1.2.1106375528.1644792761
.nextstepu.com/	1970-01-20 00:54:39	Name: _gid Value: GA1.2.187575091.1644792761
.nextstepu.com/	1970-01-20 00:53:12	Name: _gat Value: 1
.infolinks.com/	1970-01-20 18:24:24	Name: cuid Value: 33cbf679-c6a2-4a4f-b8ca-c0675fa1ad16
.infolinks.com/	1970-01-20 03:02:48	Name: ANUSERCOOKIE Value: 1547121990863532325
.openx.net/	1970-01-20 09:38:48	Name: i Value: c4692244-57ae-4d62-9e92-f1fa23996447\|1644792761
.adnxs.com/	1970-01-20 03:02:48	Name: anj Value: dTM7k!M4/8D>6NRF']wIg2Il^m6jJ2!fsuh)<V)+PlZ[C[-kX-g3*4k
.adnxs.com/	1970-01-20 03:02:48	Name: icu Value: ChgI_PNTEAoYAyADKAMwuZemkAY4A0ADSAMQuZemkAYYAg..
.adkernel.com/	1970-01-20 01:36:24	Name: ADKUID Value: A1863792558695749414
.tynt.com/	1970-01-20 09:38:48	Name: uid Value: EO05xmIJi7l6+KHpWZiLrw==
.yahoo.com/	1970-01-20 09:39:10	Name: A3 Value: d=AQABBLmLCWICEB7DxsiLsfEeRVYLjC58VUwFEgEBAQHdCmITYgAAAAAA_eMAAA&S=AQAAAueixtZYAl-bPYlKWh3eNCo
.tynt.com/	1970-01-20 03:02:48	Name: pids Value: %5B%7B%22p%22%3A%227daaa56bb0%22%2C%22f%22%3A1%2C%22ts%22%3A1644792761564%7D%2C%7B%22p%22%3A%2224c05c7b76%22%2C%22f%22%3A1%2C%22ts%22%3A1644792761564%7D%2C%7B%22p%22%3A%22bac1bc34e2%22%2C%22f%22%3A1%2C%22ts%22%3A1644792761564%7D%2C%7B%22p%22%3A%22d26852f088%22%2C%22f%22%3A1%2C%22ts%22%3A1644792761564%7D%2C%7B%22p%22%3A%2222833ea406%22%2C%22f%22%3A1%2C%22ts%22%3A1644792761564%7D%2C%7B%22p%22%3A%22f9a4a8fd15%22%2C%22f%22%3A1%2C%22ts%22%3A1644792761564%7D%5D
.360yield.com/	1970-01-20 03:02:48	Name: tuuid Value: 4271937e-f8ec-4d53-b0ee-abf0ef4cf643
.360yield.com/	1970-01-20 03:02:48	Name: tuuid_lu Value: 1644792761
.zemanta.com/	1970-01-20 09:38:48	Name: zuid Value: F1-PFmtqDImzyXRbJv5f
.casalemedia.com/	1970-01-20 09:38:48	Name: CMID Value: YgmLuamgwVw.TzHFDVXq8AAA
.casalemedia.com/	1970-01-20 03:02:48	Name: CMPS Value: 463
.infolinks.com/	1970-01-20 00:54:39	Name: EARNUSERCOOKIE Value: A1863792558695749414
.advertising.com/	1970-01-20 09:40:15	Name: APID Value: UPa65c447e-8d1f-11ec-a226-0ad2e9c1cf5b
.casalemedia.com/	1970-01-20 03:02:48	Name: CMPRO Value: 542
.infolinks.com/	1970-01-20 00:54:39	Name: OXUSERCOOKIE Value: 3c523f8c-edfd-4519-858b-0ee0bf19f22f
.infolinks.com/	1970-01-20 00:54:39	Name: VRUSERCOOKIE Value: y-fNt3yHtE2uE52zVPiPg2JrNOIZdBnrmCoeTgz5U-~A
.infolinks.com/	1970-01-20 00:53:16	Name: IMDUSERCOOKIE Value: 4271937e-f8ec-4d53-b0ee-abf0ef4cf643
.lijit.com/	1970-01-20 09:38:48	Name: ljt_reader Value: 9edce594a4f3e8efd4d260d0
.analytics.yahoo.com/	1970-01-20 09:40:15	Name: IDSYNC Value: "192u~237y:18xp~237y"
.infolinks.com/	1970-01-20 00:54:39	Name: IXUSERCOOKIE Value: YgmLuamgwVw.TzHFDVXq8AAA&542
.adsrvr.org/	1970-01-20 09:38:48	Name: TDID Value: cb317987-537c-4a92-9217-723fac1e61b6
.infolinks.com/	1970-01-20 00:54:39	Name: OUTHUSERCOOKIE Value: y-9Y7AeYlE2uHhFZnSHyTJAK0rv8MGVgFW~A~UPa65c447e-8d1f-11ec-a226-0ad2e9c1cf5b
.adform.net/	1970-01-20 01:33:31	Name: C Value: 1
.rfihub.com/	1970-01-20 10:14:48	Name: rud Value: H4sIAAAAAAAAAOMSsjS3MDe1sDA3szSxNDc1MDK0FOIz1M1JC3Uvcs0piqjwdZHiNTQzMTG3NDI3MzQ3NwEAAHHxZzMAAAA
.rfihub.com/	1970-01-20 10:14:48	Name: eud Value: H4sIAAAAAAAAAFslzmtoZmJibmlkbmZobm4CADkpM-MQAAAA
.rfihub.com/	1969-12-31 23:59:59	Name: ruds Value: H4sIAAAAAAAAAOMSsjS3MDe1sDA3szSxNDc1MDK0FOIz1M1JC3Uvcs0piqjwdQEAiCWx6CQAAAA
.doubleclick.net/	1970-01-20 18:24:24	Name: IDE Value: AHWqTUmaa7lzXieRkQl_5db5PLm2AT7Seh0GiJMgZIA1FOah3PXvmDIIN9OL5mfyoFU
.bidswitch.net/	1970-01-20 09:38:48	Name: tuuid Value: f43c2f25-d675-4781-a3cc-7d84422ea1e8
.bidswitch.net/	1970-01-20 09:38:48	Name: c Value: 1644792761
.bidswitch.net/	1970-01-20 09:38:48	Name: tuuid_lu Value: 1644792761
.adform.net/	1970-01-20 02:19:36	Name: uid Value: 5219957225041795101
.amazon-adsystem.com/	1970-01-20 06:24:24	Name: ad-id Value: Ayd7SE1Q_E-ktFLA17Hyguo
.amazon-adsystem.com/	1970-01-21 21:50:19	Name: ad-privacy Value: 0
.1rx.io/	1970-01-20 09:38:48	Name: _rxuuid Value: %7B%22rx_uuid%22%3A%22RX-b82f4669-7c78-445d-b697-59f8e17403f8-005%22%2C%22nxtrdr%22%3Afalse%7D
.go.sonobi.com/	1970-01-20 01:36:24	Name: __uis Value: 116b46d0-8a62-4111-8744-962064a800f7
.infolinks.com/	1970-01-20 00:54:39	Name: SOVRNUSERCOOKIE Value: 9edce594a4f3e8efd4d260d0
.dotomi.com/	1970-01-20 00:53:12	Name: DotomiTest Value: 6eaff6b087c11227
.infolinks.com/	1970-01-20 00:54:39	Name: ZTUSERCOOKIE Value: 978758876949750219
.infolinks.com/	1970-01-20 03:02:48	Name: ZMNUSERCOOKIE Value: F1-PFmtqDImzyXRbJv5f
.infolinks.com/	1970-01-20 00:54:39	Name: SONOBIUSERCOOKIE Value: 116b46d0-8a62-4111-8744-962064a800f7
.intentiq.com/	1970-01-20 18:24:24	Name: IQver Value: 1.9
.intentiq.com/	1970-01-20 18:24:24	Name: intentIQ Value: fC6WM0SQKV
.cpx.to/	1970-01-20 09:38:48	Name: cpSess Value: f32f012327023ce
.cpx.to/	1970-01-20 09:38:48	Name: dsp_app_nexus Value: 1547121990863532325#1644792761934
.targeting.unrulymedia.com/	1970-01-20 09:38:48	Name: _rxuuid Value: %7B%22rx_uuid%22%3A%22RX-b82f4669-7c78-445d-b697-59f8e17403f8-005%22%7D
.bnmla.com/	1970-01-20 00:53:13	Name: rx_sspurl_1000361 Value: https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fenbd-usync%3Fuid%3Dc6baa6fa-2c33-4c59-b859-1f5be9705064
.bnmla.com/	1970-01-20 01:14:48	Name: rx_uuid Value: c6baa6fa-2c33-4c59-b859-1f5be9705064
.bnmla.com/	1970-01-20 01:14:48	Name: rx_maxage_1000361 Value: 1646088762
.bnmla.com/	1970-01-20 00:53:13	Name: rx_sspid_1000361 Value: 1_6_170_162_175_181_19_203_213
.intentiq.com/	1970-01-20 18:24:24	Name: intentIQCDate Value: 1644792762022
.intentiq.com/	1969-12-31 23:59:59	Name: IIQinfolinksCookieSync Value: 1644792762024
.intentiq.com/	1970-01-20 18:24:24	Name: CSDT Value: UEQ6MTUwMTlfMCZTeE1jbzhX
.intentiq.com/	1970-01-20 18:24:24	Name: ASDT Value: 0
.intentiq.com/	1970-01-20 18:24:24	Name: IQPData Value: 2503514549#1644792762017#0#1644792762017
.demdex.net/	1970-01-20 05:12:24	Name: demdex Value: 56192233063295420071649640680008275823
.infolinks.com/	1970-01-20 00:54:39	Name: R1USERCOOKIE Value: RX-b82f4669-7c78-445d-b697-59f8e17403f8-005
.33across.com/	1970-01-20 09:38:48	Name: 33x_ps Value: u%3D118961228460716%3As1%3D1644792762062%3Ats%3D1644792762062
.rubiconproject.com/	1970-01-20 09:38:48	Name: khaos Value: KZLV55NP-1M-DRWQ
www.nextstepu.com/	1970-01-20 01:36:24	Name: _pbjs_userid_consent_data Value: 3524755945110770
.contextweb.com/	1970-01-20 09:31:36	Name: V Value: pEHL4HSY45Ej
.contextweb.com/	1970-01-20 09:38:48	Name: pb_rtb_ev Value: 3-1c5t\|7hP.0.1
bh.contextweb.com/	1969-12-31 23:59:59	Name: INGRESSCOOKIE Value: 3176a148e3f2fa6c
.nextstepu.com/	1970-01-20 05:12:24	Name: _pubcid Value: a46a92eb-feaf-4e7b-b3b0-14d99df56d4c
.dpm.demdex.net/	1970-01-20 05:12:24	Name: dpm Value: 56192233063295420071649640680008275823
.infolinks.com/	1970-01-20 03:02:48	Name: 33AUSERCOOKIE Value: 1904621968638
.pubmatic.com/	1970-01-20 00:54:39	Name: KTPCACOOKIE Value: YES
.adsrvr.org/	1970-01-20 09:38:48	Name: TDCPM Value: CAESFQoGY2FzYWxlEgsIqK-Ur7LTtzoQBRIYCgliaWRzd2l0Y2gSCwj0hv-vstO3OhAFEhYKB3J1Ymljb24SCwiY8dWzstO3OhAFGAEgAigCMgsI9P6B3cjTtzoQBTgBWgliaWRzd2l0Y2hgAg..
.pubmatic.com/	1970-01-20 03:02:48	Name: SyncRTB3 Value: 1645920000%3A220
.pubmatic.com/	1970-01-20 03:02:48	Name: KADUSERCOOKIE Value: CD47C76A-270F-41CE-837A-C90C98B57594
.everesttech.net/	1970-01-20 09:38:48	Name: everest_g_v2 Value: g_surferid~YgmLugAGAtqkaQBB
.rlcdn.com/	1970-01-20 09:38:48	Name: rlas3 Value: u59ehI6LmRHfFx7FBpZ3QzvwzE7yFdUgnVOrINXthRY=
.rlcdn.com/	1970-01-20 02:19:36	Name: pxrc Value: CAA=
www.nextstepu.com/	1970-01-20 10:14:48	Name: cto_bidid Value: PAWSXV9xTWRweHRaN2tybUUlMkJzJTJCdmpJcE91aWF0UUZCMEtWMG9ZVFdrQVc4bldFMTdYNjklMkJVWmdZRFVmUDNYRmpxTyUyQlMyN3BOVGdPJTJCczRmOXZoWU5IdG9adkElM0QlM0Q
www.nextstepu.com/	1970-01-20 10:14:48	Name: cto_bundle Value: XhOUPV9WV1VYbUppTXRqJTJGc1AlMkZuaTFXdFRMWmhsZFFvNXA5MjlXQnFxejNtTlk4U1drMU4lMkZlb0dXTHMwYVQzZWhYc3hDNFpjelBjZ0M5V3o4ZmVub1ZGZ1RKbHJGSG55S1JHZ1VZbzBHJTJGSVV5MVdDYWszakdyZElvbXlaTiUyRkhKcXdlZ3A
.casalemedia.com/	1970-01-20 00:54:39	Name: CMST Value: YgmLuWIJi7oA
.casalemedia.com/	1970-01-20 09:38:48	Name: CMRUM3 Value: f162098bb905a0&4162098bb905a0AAAGc1LytjWCpQM624D3AAAAAAA&e662098bb92760&6f62098bb905a0&da62098bb92760&0362098bba27603c6a6209-8bba-4900-a64c-754564e030f5&2762098bb90b40&2d62098bb905a0
.mathtag.com/	1970-01-20 10:19:07	Name: uuid Value: 4e156209-8bba-4f00-84b5-aaa985d9130a
.rubiconproject.com/	1970-01-20 09:38:48	Name: audit Value: 1\|6gxV/sq9sR/6f/1hYcVBNYGbTSOqpMy0WUGYBBV3A+ceECEUBMheikaw2Mn3KIt7dLT6zXPAyA3qFTrNE4+z9kqVaHlG5SlgpmvllXEtYN4=
.pubmatic.com/	1970-01-20 03:02:48	Name: PUBMDCID Value: 2
.pubmatic.com/	1970-01-20 00:54:39	Name: pi Value: 156872:3
.pubmatic.com/	1970-01-20 03:02:48	Name: chkChromeAb67Sec Value: 2
.infolinks.com/	1970-01-20 00:54:39	Name: PUBMUSERCOOKIE Value: CD47C76A-270F-41CE-837A-C90C98B57594
www.nextstepu.com/	1970-01-20 00:53:16	Name: _lr_retry_request Value: true
www.nextstepu.com/	1970-01-20 01:36:24	Name: _lr_env_src_ats Value: false
www.nextstepu.com/	1970-01-20 02:19:36	Name: pbjs-unifiedid Value: %7B%22TDID%22%3A%22cb317987-537c-4a92-9217-723fac1e61b6%22%2C%22TDID_LOOKUP%22%3A%22TRUE%22%2C%22TDID_CREATED_AT%22%3A%222022-01-13T22%3A52%3A44%22%7D
.crwdcntrl.net/	1970-01-20 07:21:58	Name: _cc_dc Value: 0
.crwdcntrl.net/	1970-01-20 07:21:58	Name: _cc_id Value: d9e401d7c427c08cb7aa0bdf3c0cd26f
.crwdcntrl.net/	1970-01-20 07:22:00	Name: _cc_cc Value: "ACZ4XmNQSLFMNTEwTDFPNjEyTzawSE4yT0w0SEpJM042SE4xMktjAIIkzu49IBoKAGfWC0U%3D"
.crwdcntrl.net/	1970-01-20 07:22:00	Name: _cc_aud Value: "ABR4XmNgYGBI4uzeA6SgAAAUewGz"
.nextstepu.com/	1969-12-31 23:59:59	Name: panoramaId_expiry Value: 1645397564213
.nextstepu.com/	1970-01-20 07:22:00	Name: _cc_id Value: d9e401d7c427c08cb7aa0bdf3c0cd26f
.nextstepu.com/	1969-12-31 23:59:59	Name: panoramaId Value: 70a81f48cc4d7bd7ca72b0418a3d16d5393852a616b75bd6f903c518946b51a2
.id5-sync.com/	1970-01-20 03:02:48	Name: 3pi Value:
.id5-sync.com/	1970-01-20 03:02:48	Name: id5 Value: a3170fd8-c581-34b7-80d0-ea7bf95c3069#1644792764469#1

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.nextstepu.com/404.aspx?aspxerrorpath=/404.aspx Message: Failed to load resource: the server responded with a status of 500 ()
network	error	URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3687838056419034&output=html&adk=2926845670&adf=1797764267&lmt=1644792760&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.nextstepu.com%2Fwinfreetuition%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644792760420&bpp=4&bdt=483&idt=163&shv=r20220210&mjsv=m202202030101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=8455416896218&frm=20&pv=2&ga_vid=1106375528.1644792761&ga_sid=1644792761&ga_hid=927442201&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44758229&oid=2&pvsid=878527974903673&pem=744&tmod=858405443&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=183 Message: Failed to load resource: the server responded with a status of 403 ()
security	warning	URL: https://www.nextstepu.com/winfreetuition/ Message: Mixed Content: The page at 'https://www.nextstepu.com/winfreetuition/' was loaded over HTTPS, but requested an insecure element 'http://beeker.io/images/posts/2/tag.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
network	error	URL: https://beeker.io/images/posts/2/tag.png Message: Failed to load resource: net::ERR_CONNECTION_REFUSED
network	error	URL: https://match.bnmla.com/usersync?dspid=1&uuid=pEHL4HSY45Ej&ev=1&us_privacy=${us_privacy}&pid=558752 Message: Failed to load resource: the server responded with a status of 400 (Bad Request)
network	error	URL: https://api.rlcdn.com/api/identity/envelope?pid=1258 Message: Failed to load resource: the server responded with a status of 451 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

33across-match.dotomi.com
acdn.adnxs.com
ad.360yield.com
ads.pubmatic.com
ads.yahoo.com
adservice.google.ca
adservice.google.com
ajax.googleapis.com
ap.lijit.com
api.intentiq.com
api.rlcdn.com
b1sync.zemanta.com
beeker.io
bh.contextweb.com
browser-update.org
c1.adform.net
casale-match.dotomi.com
cdn.adnxs.com
cm.g.doubleclick.net
cms-xch-chicago.33across.com
cms-xch.33across.com
code.jquery.com
crcdn01.adnxs-simple.com
de.tynt.com
dpm.demdex.net
dsp.adkernel.com
dsum-sec.casalemedia.com
dsum.casalemedia.com
eus.rubiconproject.com
fonts.googleapis.com
googleads.g.doubleclick.net
gum.criteo.com
hde.tynt.com
ib.adnxs.com
id.crwdcntrl.net
id.rlcdn.com
id5-sync.com
image2.pubmatic.com
image4.pubmatic.com
image8.pubmatic.com
match.adsrvr.org
match.bnmla.com
maxcdn.bootstrapcdn.com
mug.criteo.com
nym1-ib.adnxs.com
onetag-sys.com
p.rfihub.com
pagead2.googlesyndication.com
partner.googleadservices.com
pixel-us-east.rubiconproject.com
pixel.advertising.com
pixel.rubiconproject.com
pr-bh.ybp.yahoo.com
resources.infolinks.com
router.infolinks.com
rt3010.infolinks.com
s.amazon-adsystem.com
s.cpx.to
secure-assets.rubiconproject.com
secure.adnxs.com
ssc-cms.33across.com
ssum-sec.casalemedia.com
stags.bluekai.com
static.cloudflareinsights.com
sync-tm.everesttech.net
sync.1rx.io
sync.go.sonobi.com
sync.intentiq.com
sync.mathtag.com
sync.targeting.unrulymedia.com
sync1.intentiq.com
token.rubiconproject.com
tpc.googlesyndication.com
u.openx.net
ups.analytics.yahoo.com
www.genmeo.com
www.google-analytics.com
www.google.com
www.nextstepu.com
x.bidswitch.net
beeker.io
103.229.205.242
104.36.113.24
104.36.115.109
13.226.31.35
13.226.31.74
142.251.35.162
142.251.40.130
151.101.194.49
172.66.41.9
172.66.42.247
173.223.56.123
174.137.133.49
18.233.240.143
185.167.164.42
198.148.27.139
199.127.204.142
199.38.167.129
2001:4998:1c:800::1001
2001:4de0:ac18::1:a:2b
209.54.180.3
23.221.202.212
23.221.203.181
23.50.66.244
23.52.160.130
23.52.161.180
23.57.136.222
2600:1f18:4e9:5a01:5d12:a26d:2c7b:2781
2606:4700:20::681a:7b4
2606:4700:3108::ac42:2b6e
2606:4700::6810:5f41
2606:4700::6812:bcf
2606:ae80:1451:22::760
2607:f8b0:4006:80c::2001
2607:f8b0:4006:80d::2002
2607:f8b0:4006:80d::200e
2607:f8b0:4006:80f::2002
2607:f8b0:4006:816::2002
2607:f8b0:4006:816::200a
2607:f8b0:4006:820::2002
2607:f8b0:4006:823::2004
2607:f8b0:4006:823::200a
2620:100:a001::c
3.227.228.140
34.117.239.71
34.120.155.137
34.246.235.84
34.98.64.218
35.190.60.146
35.211.178.172
35.71.131.137
38.27.122.158
44.232.111.221
51.222.239.230
52.204.139.121
52.40.93.193
54.175.87.114
54.36.109.183
54.84.98.244
63.251.114.137
64.74.236.95
67.202.105.22
67.202.105.33
68.67.179.121
68.67.179.173
68.67.179.91
69.173.151.100
72.34.250.75
74.119.119.139
8.28.7.82
8.43.72.97
00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce
035697d637512dec2d5d01db643b4e5ac3cdd2b2dc5426b65ed17a8b3f62fa4c
0966015e6837ef75cd4d71f72a737e11879f5dd5d5edad7506548f7b3e136d49
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
13f19abef22e15d47becccea1abbf814849afbea505423d18c108fc831e65e93
142b5cbc5c2d5839f95cf9c04f80986739d7354a69feb9cce4698a0aedc54616
16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d
16b889d393b026e5f758e551c0c89bccf2548b74f75aa3ce4f6d3711fb8e9d7d
1907a3cfa460d2a58471769c16563d2d7319c140dcab03427fa7a1ae1f84f79a
1b67fe90dbb58507badc8a182cee401c08afa046fd759217a8d16fb7002d3d98
1bc8836d0349190446c320987abd4dee0ea029a24f8e6d94386bd163fc220f57
1be0abf077cc0b1c88fe81f7fbee33e8d77d1943690637f0030507631a41edda
1efeff8ba4a900e35e453402932e19fd575d76396cb3044e0463c593a340043a
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11
2ad7073f84fbbd0ad2762cc2bbc4a2d4d91c3428071955399fd8c3bc7ba01d6f
30adcceef958c38a02a02125fb5794f73e88cd388a62ac554c5d406cab2dd431
37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0
3c4a1bb7ce3234407184f0d80cc4dec075e4ad616b44dcc5778e1cfb1bc24019
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390
40732e9dcfa704cf615e4691bb07aecfd1cc5e063220a46e4a7ff6560c77f5db
43a400cc4c30fc5e45147e54c0de460616b91a9b51714f249ca9af92e8585af9
45a7e93d9ca98232d925287f7142f85630ea732ef6bbb6fa656aec3932b55d13
4672d29f833a7f7cc73b07fb9de14be1ebe2d293a913fe5196191e89ae5037b6
483bc7d183e97ee75656a646640e2387bc579e657a4a92aa6b61ada0c95a5721
492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032
49ed2468e22ecae9eda37e93b53a584be75012f9155d5d7332f90f9176f4886b
4c2e4583fe83cb89919678a9c866ceebf8e069afcf7dd9cac87dbb2cb50320a0
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
587597d1685a0cad61e48cc52d837e72aa8b67d6e7bf27bef7634f646e2989a0
58c21ff181fdeaf28c8f18c84357ee05ec7eb89e31d0840f43a61633c7d79001
5af7bf1d8151cde51974546ccfc225efd36218dfc03f35a2c3b9732f942c5285
5c914242a7dfef52441c666a95421161f09fc95330af23aaf886acc83ff10695
5cfba597c9f3d87e177f3af2d1ab4923a96dc597cab379c6e3ca71ffb384c8e4
5ebaf047e26f0db01f71569cb801be6e627dd8f49f2e53c809d79791abed6896
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
63ab17adc6f1b9673a3b8333cbeecd0ce4d67e7f8acb84c8946f3d95387d3d37
69480f14e126a0ddbc6368a75aca2bc94477cdf7bfff525f31cf0b8ec761afa4
6b76b29b98d2ec706d630f15033c3480e16e88d6b056c896cd5c03001f0128c9
6f9593c12df3a1fd234ee21f30b3e8bf2ff8b4847ac775c52a7b0a7ff3e0efc4
7b3e9fa1a76e14f168cdce88a2db100e0a2008deafcfd6f18e7fb8404ad7c4ec
7b6fc69a9da277bb118dbe07973e75598ff107f8d5c69aec6a3e0f5e6884603a
7cfdef7cd1a0fab390d940b7b61ea3afc340838418bb94d460fe451d654331ac
80c364483d47c76870e1f9a274d0198330c56558eaf0dd829f079780d7a324f6
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e18d9144b52818f5ce1d7458c677100251597dacdecba06225b9ff265670ad
8844311e9bc5499bcd8ab70679bfe3146168a25b728c7ca80fd0688c14bade4b
88dcf91c1359c701f4c11b594ea0762a9982cf2c14c0f465d6a9cb3fa99e014b
89871b910c20b1510814279d9d6064e990c308e5f13f7af1ddef05c6a9f67078
8a3e73818e0c4786c6403ce2551e2ab7becd01e87e84ea53e18e65f6e0c43f4a
8b09ec0a805bc5794f26d0dc217aae22057220d3631ff30b0caca99ae3067d7b
8b324607f3277432aa256b0f49bf75ef6e9951d448d4795f42f8eca2d59d442e
8fb2408e2587bda7b967f2786fc894940bce6d6ef33d33cec11e1a7f9aae317b
90d1fe713957cd37019a419006a252bb16bddaf162295d1853ec28be1843a652
936ffccdc35bc55221e669d0e76034af76ba8c080c1b1149144dbbd3b5311829
9617b3e2e8abe6fcb2403f474a98fec166d3b85b518412fd9cd2a1293f1ddfcd
9c44f587e53431ec3922782595c258a8742b405557360d384228db97b3b547ca
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a13c96acd88fe907edbb8becda0d113c22abde0d5ae904e5213360a1e6f145ce
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a1c5e9b3f4e6612be39235b826c902b5bc04f359135fda002f9ce92f4550aa01
a3206bf77d72f3601d218fa7d75a2dc958d827efe22f441414b803d55b542427
a38fe103b5ad3edfe5c8e6e246254697c298c5e4c9756566c1b163c100380a42
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a50a7a66ddae614225d39d3a1bc215feb43c6ac351178ea810a330b4a9ed5ed8
abfad7f2d52d1a1d9417390df50ae3f187db4d2cb0981fb19b7a7975e383e765
acb5d519051cc13618e992a7df4bce6a980036dfbe2e17a970ec716194329f6a
ad7aec48510d18ca75e4b8c9e92a8e66285d7a6088ba365dadf1ea6b64c0f578
af9650a440fa2c7fae008b7c4e8786654b5dc4822df0c385ae868062dc2893ff
b0279bd6ce9f08bf050f91947e12b108cb6671fb328514d7a49b83fe85515c26
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b1cb5dc690d49a8b998d9562ca39ac0e882a8d5c46af9cc74febbd11b51d4e08
b31c2ade2395796e5fc4bc6f4f0e066fb0a2735f326290bd22d3593550c0c6f5
b5050af3aea0eb4c0b276d4cb8fe7be460c9f98da48bc2f5b6c32b97dbb39047
b6d4a694a00b024663439bcd8b46f31a8f07e4cf36661fcd74fef48295dd3665
bf27786b4381176350787d768bf5f7c5310ba640aa48ee98a3d2c310ddd971ab
c0112ea735e02700c64d88d83f777f53d3033e4b98013b0756de5917affe067a
c17d72592686f260a196209efb58e3b07ffe95028f653626de44021b2be69cdc
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c2ffdcbf86b0ae9ed953ba80c5baaf6155425225be3b519a63c7eb57a0768a30
c3f05412b273a3c32bf550bf721db6302d8c8c8692d25b847f278ef67693195d
c5defaf0b5e7b4a86456455c43a93dcbd412370e4937222d33befc5c726b7f71
c62551dd0ee07b06310c7ae17466e1b9509fffdc878026ca3ab4f464fe7ca616
c66e34dd2ad59f3f746cbd1ece385ca7c290e0a17cd2e57a2616db742aa60f53
c7e6e8f290554488e0e6abdc2756e3112b7fcaeaddc6087e7e3220767e7681ed
ca0ef206c756e7865598545c5a8251f3f763cefb996a4251f6a3f6652c233b81
cb136b453d4ce6808ac49bacc3432761f340e04d21d1524c9887ec011e6c0c5d
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
d0148618ecdc44d01d6464ec4081f8865d947a60ea482ceff7476439fb8b95ff
d51fc32f16709946cd68db3ca2ab3a88d7e8bf7dad9a28834a51e19aed8c3a8d
d6288a931fba3da7d84a383b3682d7c4a329d87b54efe001787a0175fd1f9be6
d6b3fe665c12f36f3dfc1f69d5dcf2683470df42cb2af5e8f0c0c28f6b3c4498
dbc16ba132d287bee6c411381f94853b26604dd4ccfc2851af190979eb889491
dde3a2b19a39d29abbaf3ffad54c02b322031f62cdf4d1239c32231af89f1559
de560434583567587dba2f8a58f84f4b211730bed40f9fb54ea912ab24930c36
e013fdf05469dd63dff29fb9b1a07235261572c621710397836449892904696f
e218337b64d8998ecca6944b7fedebc9c4bb83a18fc703a0f3504dafc4bc5eba
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e43f7f2f94dfce4d655223361aff4dc2dd084dc41eb67ac7cad27612682f9c79
ee35a2927a5427f36a1cb14ce0079aba5dce556010be174874dea1897b9a892a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f5056f59f505a00e51e63e9f2574a321dc09b1251afae2421149291f69a32012
f68a7330be05739601a1c7b4498d5fb0ada04ddbe4ee75d38fb8cb377403e7da
f7f480e008e61f1d28d9c096d9cf3095d11b1fd5a5603db6e6c5a21898c07d4a
f8a5a772a8e31b35307e413d233ee42ab986414c9ab31ee640c6bbdd3e2d7e23
fd0a1ac929c11b08e819fe4b0a18c5574012c44f09de8987c6be99a0f055a505

www.nextstepu.com Open in urlscan Pro 2606:4700:3108::ac42:2b6e Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

172 Requests

75 %HTTPS

26 %IPv6

51 Domains

80 Subdomains

45 IPs

7 Countries

1284 kBTransfer

3285 kBSize

108 Cookies

15 Outgoing links

Redirected requests

172 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.nextstepu.com Open in urlscan Pro
2606:4700:3108::ac42:2b6e Public Scan

Screenshot
Live screenshot

Full Image

172
Requests

75 %
HTTPS

26 %
IPv6

51
Domains

80
Subdomains

45
IPs

7
Countries

1284 kB
Transfer

3285 kB
Size

108
Cookies

172 HTTP transactions
0 data transactions