secure.winred.com Open in urlscan Pro
104.19.211.89 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://gopway1.com/5654WY
Effective URL:
https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&...
Submission: On February 26 via manual (February 26th 2024, 3:43:10 pm UTC) from CA — Scanned from CA

Summary HTTP 162 Redirects Links 9 Behaviour Indicators

Summary

This website contacted 32 IPs in 3 countries across 23 domains to perform 162 HTTP transactions. The main IP is 104.19.211.89, located in and belongs to CLOUDFLARENET, US. The main domain is secure.winred.com. The Cisco Umbrella rank of the primary domain is 78308.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on January 22nd 2024. Valid for: a year.

This is the only time secure.winred.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2 2	99.83.253.106 99.83.253.106	16509 (AMAZON-02) (AMAZON-02)
1 14	104.19.211.89 104.19.211.89	13335 (CLOUDFLAR...) (CLOUDFLARENET)
45	151.101.0.176 151.101.0.176	54113 (FASTLY) (FASTLY)
4	172.253.63.95 172.253.63.95	15169 (GOOGLE) (GOOGLE)
4	13.249.85.64 13.249.85.64	16509 (AMAZON-02) (AMAZON-02)
3	172.253.62.132 172.253.62.132	15169 (GOOGLE) (GOOGLE)
6	142.250.31.97 142.250.31.97	15169 (GOOGLE) (GOOGLE)
1	104.16.57.101 104.16.57.101	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.19.212.89 104.19.212.89	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	172.253.115.92 172.253.115.92	15169 (GOOGLE) (GOOGLE)
1 2	172.253.63.148 172.253.63.148	15169 (GOOGLE) (GOOGLE)
5	172.253.122.113 172.253.122.113	15169 (GOOGLE) (GOOGLE)
1	146.75.36.157 146.75.36.157	54113 (FASTLY) (FASTLY)
2	31.13.66.19 31.13.66.19	32934 (FACEBOOK) (FACEBOOK)
1	38.70.189.71 38.70.189.71	399647 (RUMBLE) (RUMBLE)
1	172.253.122.155 172.253.122.155	15169 (GOOGLE) (GOOGLE)
4	142.250.31.156 142.250.31.156	15169 (GOOGLE) (GOOGLE)
2	172.253.62.154 172.253.62.154	15169 (GOOGLE) (GOOGLE)
1	104.244.42.69 104.244.42.69	13414 (TWITTER) (TWITTER)
1	104.244.42.195 104.244.42.195	13414 (TWITTER) (TWITTER)
2	198.202.176.141 198.202.176.141	16509 (AMAZON-02) (AMAZON-02)
3	104.16.250.69 104.16.250.69	13335 (CLOUDFLAR...) (CLOUDFLARENET)
15	54.187.159.182 54.187.159.182	16509 (AMAZON-02) (AMAZON-02)
4	172.253.122.106 172.253.122.106	15169 (GOOGLE) (GOOGLE)
8	142.250.31.94 142.250.31.94	15169 (GOOGLE) (GOOGLE)
4	172.253.122.94 172.253.122.94	15169 (GOOGLE) (GOOGLE)
3	44.236.167.79 44.236.167.79	16509 (AMAZON-02) (AMAZON-02)
1	31.13.66.35 31.13.66.35	32934 (FACEBOOK) (FACEBOOK)
2	216.239.38.181 216.239.38.181	15169 (GOOGLE) (GOOGLE)
3	52.84.125.40 52.84.125.40	16509 (AMAZON-02) (AMAZON-02)
12	172.253.63.101 172.253.63.101	15169 (GOOGLE) (GOOGLE)
4	104.19.219.90 104.19.219.90	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	104.19.218.90 104.19.218.90	13335 (CLOUDFLAR...) (CLOUDFLARENET)
162	32

2 99.83.253.106 (United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ab309889489bfc98b.awsglobalaccelerator.com

gopway1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 104.19.211.89 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

secure.winred.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

45 151.101.0.176 (United States)

ASN54113 (FASTLY, US)

js.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
m.stripe.network	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.253.63.95 (United States)

ASN15169 (GOOGLE, US)
PTR: bi-in-f95.1e100.net

maps.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 13.249.85.64 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-249-85-64.ord52.r.cloudfront.net

d35ligi1n5bgzc.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.253.62.132 (United States)

ASN15169 (GOOGLE, US)
PTR: bc-in-f132.1e100.net

lh7-us.googleusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.250.31.97 (United States)

ASN15169 (GOOGLE, US)
PTR: bj-in-f97.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.57.101 (None, )

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.19.212.89 (None, )

ASN13335 (CLOUDFLARENET, US)

app.revv.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.253.115.92 (United States)

ASN15169 (GOOGLE, US)
PTR: bg-in-f92.1e100.net

pay.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.253.63.148 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: bi-in-f148.1e100.net

9381094.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 172.253.122.113 (United States)

ASN15169 (GOOGLE, US)
PTR: bh-in-f113.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.75.36.157 (Reston, United States)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 31.13.66.19 (Ashburn, United States)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-01-iad3.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 38.70.189.71 (Toronto, Canada)

ASN399647 (RUMBLE, CA)

a.ads.rmbl.ws	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.253.122.155 (United States)

ASN15169 (GOOGLE, US)
PTR: bh-in-f155.1e100.net

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.31.156 (United States)

ASN15169 (GOOGLE, US)
PTR: bj-in-f156.1e100.net

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.253.62.154 (United States)

ASN15169 (GOOGLE, US)
PTR: bc-in-f154.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.69 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.195 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 198.202.176.141 (United States)

ASN16509 (AMAZON-02, US)

merchant-ui-api.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.16.250.69 (None, )

ASN13335 (CLOUDFLARENET, US)

gtm.winred.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 54.187.159.182 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ip-54-187-159-182.stripe.com

r.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.253.122.106 (United States)

ASN15169 (GOOGLE, US)
PTR: bh-in-f106.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 142.250.31.94 (United States)

ASN15169 (GOOGLE, US)
PTR: bj-in-f94.1e100.net

www.google.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.253.122.94 (United States)

ASN15169 (GOOGLE, US)
PTR: bh-in-f94.1e100.net

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 44.236.167.79 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-44-236-167-79.us-west-2.compute.amazonaws.com

m.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 31.13.66.35 (Ashburn, United States)

ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-01-iad3.facebook.com

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.239.38.181 (United States)

ASN15169 (GOOGLE, US)

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.84.125.40 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-84-125-40.ord53.r.cloudfront.net

b.stripecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 172.253.63.101 (United States)

ASN15169 (GOOGLE, US)
PTR: bi-in-f101.1e100.net

play.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.19.219.90 (None, )

ASN13335 (CLOUDFLARENET, US)

hcaptcha.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
newassets.hcaptcha.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
api.hcaptcha.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.19.218.90 (None, )

ASN13335 (CLOUDFLARENET, US)

newassets.hcaptcha.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
api.hcaptcha.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
63	stripe.com js.stripe.com — Cisco Umbrella Rank: 1204 merchant-ui-api.stripe.com — Cisco Umbrella Rank: 5270 r.stripe.com — Cisco Umbrella Rank: 3338 m.stripe.com — Cisco Umbrella Rank: 1173	2 MB
22	google.com pay.google.com — Cisco Umbrella Rank: 2911 adservice.google.com — Cisco Umbrella Rank: 99 www.google.com — Cisco Umbrella Rank: 2 analytics.google.com — Cisco Umbrella Rank: 159 play.google.com — Cisco Umbrella Rank: 37	423 KB
17	winred.com 1 redirects secure.winred.com — Cisco Umbrella Rank: 78308 gtm.winred.com — Cisco Umbrella Rank: 128599	218 KB
8	google.ca www.google.ca — Cisco Umbrella Rank: 9971	1 KB
8	doubleclick.net 1 redirects 9381094.fls.doubleclick.net — Cisco Umbrella Rank: 242866 stats.g.doubleclick.net — Cisco Umbrella Rank: 85 googleads.g.doubleclick.net — Cisco Umbrella Rank: 35	5 KB
6	hcaptcha.com hcaptcha.com — Cisco Umbrella Rank: 5575 newassets.hcaptcha.com — Cisco Umbrella Rank: 6816 api.hcaptcha.com — Cisco Umbrella Rank: 6979	441 KB
6	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 40	569 KB
5	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 31	21 KB
4	gstatic.com www.gstatic.com	102 KB
4	cloudfront.net d35ligi1n5bgzc.cloudfront.net	391 KB
4	googleapis.com maps.googleapis.com — Cisco Umbrella Rank: 369	186 KB
3	stripecdn.com b.stripecdn.com — Cisco Umbrella Rank: 11932	43 KB
3	googleusercontent.com lh7-us.googleusercontent.com — Cisco Umbrella Rank: 639	556 KB
2	stripe.network m.stripe.network — Cisco Umbrella Rank: 1277	16 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 176	71 KB
2	gopway1.com 2 redirects gopway1.com	384 B
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 102	185 B
1	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 802	726 B
1	t.co t.co — Cisco Umbrella Rank: 660	377 B
1	rmbl.ws a.ads.rmbl.ws — Cisco Umbrella Rank: 57280	2 KB
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 783	15 KB
1	revv.co app.revv.co — Cisco Umbrella Rank: 284639	1 KB
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 787	7 KB
162	23

	Domain	Requested by
43	js.stripe.com	secure.winred.com js.stripe.com
15	r.stripe.com	js.stripe.com
14	secure.winred.com	1 redirects secure.winred.com static.cloudflareinsights.com
12	play.google.com	www.gstatic.com
8	www.google.ca	secure.winred.com
6	www.googletagmanager.com	secure.winred.com www.googletagmanager.com www.google-analytics.com
5	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com secure.winred.com
4	www.gstatic.com	pay.google.com www.gstatic.com
4	www.google.com	secure.winred.com
4	stats.g.doubleclick.net	www.google-analytics.com www.googletagmanager.com
4	d35ligi1n5bgzc.cloudfront.net	secure.winred.com
4	maps.googleapis.com	secure.winred.com maps.googleapis.com
3	newassets.hcaptcha.com	hcaptcha.com newassets.hcaptcha.com
3	b.stripecdn.com	js.stripe.com b.stripecdn.com
3	m.stripe.com	m.stripe.network
3	gtm.winred.com	www.googletagmanager.com
3	pay.google.com	js.stripe.com pay.google.com www.gstatic.com
3	lh7-us.googleusercontent.com	secure.winred.com
2	api.hcaptcha.com	newassets.hcaptcha.com
2	analytics.google.com	www.googletagmanager.com
2	merchant-ui-api.stripe.com	js.stripe.com
2	googleads.g.doubleclick.net	www.googletagmanager.com
2	m.stripe.network	js.stripe.com m.stripe.network
2	connect.facebook.net	secure.winred.com connect.facebook.net
2	9381094.fls.doubleclick.net	1 redirects www.googletagmanager.com
2	gopway1.com	2 redirects
1	hcaptcha.com	b.stripecdn.com
1	www.facebook.com	secure.winred.com
1	analytics.twitter.com	secure.winred.com
1	t.co	secure.winred.com
1	adservice.google.com	9381094.fls.doubleclick.net
1	a.ads.rmbl.ws	www.googletagmanager.com
1	static.ads-twitter.com	www.googletagmanager.com
1	app.revv.co	secure.winred.com
1	static.cloudflareinsights.com	secure.winred.com
162	35

This site contains links to these domains. Also see Links.

Domain
txtterms.co
winred.com
www.donaldjtrump.com
cdn.donaldjtrump.com
donaldjtrump.com

Subject Issuer	Validity	Valid
secure.winred.com Cloudflare Inc ECC CA-3	`2024-01-22` - `2024-12-31`	a year	crt.sh
a.stripecdn.com DigiCert SHA2 Extended Validation Server CA	`2024-02-07` - `2024-05-09`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2023-10-10` - `2024-09-19`	a year	crt.sh
*.googleusercontent.com GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-04-10` - `2024-04-09`	a year	crt.sh
*.google.com GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
ads-twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-21` - `2024-07-19`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-12-05` - `2024-03-04`	3 months	crt.sh
a.ads.rmbl.ws R3	`2024-02-14` - `2024-05-14`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
t.co DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-01-04` - `2025-01-02`	a year	crt.sh
*.twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-11-07` - `2024-11-05`	a year	crt.sh
*.stripe.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-12-20` - `2024-03-21`	3 months	crt.sh
www.google.com GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
*.google.ca GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
m.stripe.com DigiCert TLS RSA SHA256 2020 CA1	`2023-12-22` - `2024-03-21`	3 months	crt.sh

This page contains 16 frames:

Primary Page: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&
Frame ID: 24B79E1CFFFDEFD6B879FB308CE7DB04
Requests: 68 HTTP requests in this frame

Frame: https://js.stripe.com/v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html
Frame ID: D84B7C9963447A963E1730AB166CA5BB
Requests: 2 HTTP requests in this frame

Frame: https://js.stripe.com/v3/controller-f3aaf0a4588c11fbdf4221277351eb39.html
Frame ID: 66096D8E3DDDA4EA88A4215E203A83E7
Requests: 13 HTTP requests in this frame

Frame: https://js.stripe.com/v3/elements-inner-card-a0cdf3329d4008ecf745f5bd6d7ff8c4.html
Frame ID: B5ECBCE6962BCB96AB69F3FE19774E20
Requests: 10 HTTP requests in this frame

Frame: https://js.stripe.com/v3/controller-f3aaf0a4588c11fbdf4221277351eb39.html
Frame ID: 2F41CA50EBE86123B037B10A9158D373
Requests: 13 HTTP requests in this frame

Frame: https://js.stripe.com/v3/payment-request-inner-google-pay-424bc64fb2c99dc102ae3d10262ced03.html
Frame ID: FB8B973B59592A3E543C337ECE3B1430
Requests: 4 HTTP requests in this frame

Frame: https://js.stripe.com/v3/payment-request-inner-browser-d4b352cf093e84a8e703102ce4376ef7.html
Frame ID: 995FE0CEC5995A33E791EF17D487C799
Requests: 3 HTTP requests in this frame

Frame: https://secure.winred.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/0f752fefe334/main.js
Frame ID: 011143751233B370227D6E29E811ADD1
Requests: 2 HTTP requests in this frame

Frame: https://9381094.fls.doubleclick.net/activityi;dc_pre=CJjF956syYQDFe0X-QAdL68HuA;src=9381094;type=pagev0;cat=djt_p0;ord=5214896282127;npa=0;auiddc=306036401.1708962183;pscdl=noapi;gtm=45He42l0v72350723za220;gcd=13l3l3l3l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-sms-trump-poll-v16-db%3Futm_term%3Ddb-sajfc-cr50sms-014%26source_code%3Ddb-sajfc-cr50sms-014%26
Frame ID: 6D1D54486CB8A93F9B7DDF021DFEA69B
Requests: 2 HTTP requests in this frame

Frame: https://m.stripe.network/inner.html
Frame ID: E63CFD43BAB1CA58C1BE1E0A1BA64B4D
Requests: 5 HTTP requests in this frame

Frame: https://pay.google.com/gp/p/ui/payframe?origin=https%3A%2F%2Fjs.stripe.com&mid=
Frame ID: 62512824001EE1730FCB289CFBEB0926
Requests: 12 HTTP requests in this frame

Frame: https://js.stripe.com/v3/hcaptcha-invisible-8f0fe4e84ddf0420df4a1a67d99fe1fb.html
Frame ID: 3B01B26F3129FBE0D5AD9674B698FA56
Requests: 2 HTTP requests in this frame

Frame: https://js.stripe.com/v3/elements-inner-link-button-for-card-a601a35b67a22542634fc1b3c0af285a.html
Frame ID: 37F4EADE1A180E6B4E7854360893C375
Requests: 4 HTTP requests in this frame

Frame: https://b.stripecdn.com/stripethirdparty-srv/assets/v20.17/HCaptchaInvisible.html?id=ab50c790-b01b-45a6-badb-5ed7c85803d5&origin=https%3A%2F%2Fjs.stripe.com
Frame ID: B9110F7FE3D44EDE971DF115A2AAC8DB
Requests: 4 HTTP requests in this frame

Frame: https://js.stripe.com/v3/elements-inner-payment-request-15dc8c13cab25b81f13ec54034fd41db.html
Frame ID: 81EDAA54710C86892DDF58A19C9DD572
Requests: 7 HTTP requests in this frame

Frame: https://newassets.hcaptcha.com/captcha/v1/fadb9c6/static/hcaptcha.html?_v=149jvnx8tug
Frame ID: AD010C03C2FE5106ABA95296B039D9CE
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

MAGA

Page URL History Show full URLs

http://gopway1.com/5654WY HTTP 302
https://gopway1.com/5654WY HTTP 307
https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=d... Page URL

Detected technologies

Google Maps (Maps) Expand

Overall confidence: 100%
Detected patterns

//maps\.google(?:apis)?\.com/maps/api/js

Google Pay (Payment processors) Expand

Overall confidence: 100%
Detected patterns

pay\.google\.com/([a-z/]+)/pay\.js

Stripe (Payment Processors) Expand

Overall confidence: 100%
Detected patterns

js\.stripe\.com

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/ns\.html[^>]+></iframe>
googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

hCaptcha (Security) Expand

Overall confidence: 100%
Detected patterns

https://hcaptcha.com/([\d]+?)/api.js

Page Statistics

162
Requests

99 %
HTTPS

0 %
IPv6

23
Domains

35
Subdomains

32
IPs

3
Countries

4967 kB
Transfer

15151 kB
Size

34
Cookies

9 Outgoing links

These are links going to different origins than the main page.

URL: https://txtterms.co/88022-2/
Title: txtterms.co/88022

Search URL Search Domain Scan URL

URL: https://winred.com/terms/donor-terms/
Title: terms of use

Search URL Search Domain Scan URL

URL: https://winred.com/privacy
Title: privacy policy

Search URL Search Domain Scan URL

URL: https://www.donaldjtrump.com/join
Title: Interested in volunteering? Click here to sign up today.

Search URL Search Domain Scan URL

URL: https://cdn.donaldjtrump.com/djtweb24/general/TSA_JFC_Contributor_Form_230217.pdf
Title: Want to donate by mail? Click here to print out a donation form that you can send to our address.

Search URL Search Domain Scan URL

URL: http://donaldjtrump.com/
Title: donaldjtrump.com

Search URL Search Domain Scan URL

URL: https://winred.com/
Title: Powered by

Search URL Search Domain Scan URL

URL: https://winred.com/about-our-ads/
Title: About Our Ads

Search URL Search Domain Scan URL

URL: https://winred.com/support/
Title: Questions about your charge? Go to our Support Center

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://gopway1.com/5654WY HTTP 302
https://gopway1.com/5654WY HTTP 307
https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 28

https://secure.winred.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
https://secure.winred.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/0f752fefe334/main.js

Request Chain 46

https://9381094.fls.doubleclick.net/activityi;src=9381094;type=pagev0;cat=djt_p0;ord=5214896282127;npa=0;auiddc=306036401.1708962183;pscdl=noapi;gtm=45He42l0v72350723za220;gcd=13l3l3l3l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-sms-trump-poll-v16-db%3Futm_term%3Ddb-sajfc-cr50sms-014%26source_code%3Ddb-sajfc-cr50sms-014%26 HTTP 302
https://9381094.fls.doubleclick.net/activityi;dc_pre=CJjF956syYQDFe0X-QAdL68HuA;src=9381094;type=pagev0;cat=djt_p0;ord=5214896282127;npa=0;auiddc=306036401.1708962183;pscdl=noapi;gtm=45He42l0v72350723za220;gcd=13l3l3l3l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-sms-trump-poll-v16-db%3Futm_term%3Ddb-sajfc-cr50sms-014%26source_code%3Ddb-sajfc-cr50sms-014%26

162 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request lp-sms-trump-poll-v16-db Show response
secure.winred.com/save-america-joint-fundraising-committee/
Redirect Chain

http://gopway1.com/5654WY
https://gopway1.com/5654WY
https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&

84 KB
19 KB

248ms
137ms

Document
text/html

104.19.211.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.211.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2e150f497f241fb9d3b2178dbca78ad16d7a2039ca8d6563b62f1da34993dacc

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache, no-store
cf-cache-status: DYNAMIC
cf-ray: 85b94d28091c36eb-YYZ
content-encoding: br
content-type: text/html; charset=utf-8
date: Mon, 26 Feb 2024 15:43:02 GMT
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
strict-transport-security: max-age=0; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-rack-cors: miss; no-origin
x-request-id: 0fded74c-8fd2-4b60-93bc-235550a38123
x-revv-cache: Hit from Revv
x-runtime: 0.049835
x-xss-protection: 1; mode=block

Redirect headers

content-length: 0
content-type: application/octet-stream
date: Mon, 26 Feb 2024 15:43:02 GMT
location: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&
server: awselb/2.0

GET
H2 200 / Show response
js.stripe.com/v3/ 600 KB
167 KB 53ms
16ms Script
text/javascript 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

9edb2179b3a4de19f2bd050f807bf098dc9820ac1301e7cda0916d1cf75316b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Mon, 26 Feb 2024 15:43:02 GMT
via: 1.1 varnish
age: 5
x-cache: HIT
content-length: 170259
x-request-id: b67f8542-5f94-4554-ac54-87206438664d
x-served-by: cache-yul1970023-YUL
last-modified: Fri, 23 Feb 2024 21:40:09 GMT
server: Fastly
etag: "f51da0bba6ffbda45dab8baf8465073f"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 2

GET
H2 200 landing_page-b5085350195c50801834c19cd56b1cabc8b9ea2b81e3a74f8486f6b3e2ae2898.css
secure.winred.com/assets/ 219 KB
34 KB 47ms
45ms Stylesheet
text/css 104.19.211.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/assets/landing_page-b5085350195c50801834c19cd56b1cabc8b9ea2b81e3a74f8486f6b3e2ae2898.css

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.211.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

961951e588ed2cbd0dadda321becf5c4d27451bb0896262f86e7d922da5794ca

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Mon, 26 Feb 2024 15:43:02 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
x-amz-version-id: 4RBMbG_c3G5laVKEwPaykYWu8oOdV56f
cf-cache-status: HIT
x-amz-request-id: DDMQVQGGNFGNG5XJ
age: 4367
cf-polished: origSize=227667
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-amz-id-2: k6N5K878OsGFrKoNRtPSGWmqDbeO9qVc9Qj8yo2WJpb194sQUAabaMYdrQXbK48tJzsHALgmOX0=
cf-bgj: minify
last-modified: Tue, 28 Nov 2023 01:42:36 GMT
server: cloudflare
etag: W/"57df3b6cebff9962c43c29347b45123f"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
cf-ray: 85b94d28faea36eb-YYZ
expires: Mon, 26 Feb 2024 19:43:02 GMT

GET
H2 200 1708359714.css
secure.winred.com/stylesheets/rv_page_01hq12r84vpxbfx9qas8v315cq/ 8 KB
2 KB 126ms
124ms Stylesheet
text/css 104.19.211.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/stylesheets/rv_page_01hq12r84vpxbfx9qas8v315cq/1708359714.css

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.211.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

60c5b6c14e2a63b65d65e67810664a5ee09348e5783033fd294bd9703da8ec95

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-rack-cors: miss; no-origin
date: Mon, 26 Feb 2024 15:43:02 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: MISS
content-encoding: br
x-permitted-cross-domain-policies: none
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
x-request-id: 7479a473-80ff-4d68-af85-cfdc9e8b907e
x-runtime: 0.038382
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 26 Feb 2024 15:43:02 GMT
server: cloudflare
x-download-options: noopen
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
cache-control: public, max-age=31556952
cf-ray: 85b94d28faec36eb-YYZ
expires: Tue, 25 Feb 2025 21:32:14 GMT

GET
H2 200 js Show response
maps.googleapis.com/maps/api/ 223 KB
74 KB 123ms
60ms Script
text/javascript 172.253.63.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f95.1e100.net

Software

scaffolding on HTTPServer2 /

Resource Hash

b5b60d72aeacf013c48d4302e8b6564c7a3307ece32a40fad2857c4238af2265

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Mon, 26 Feb 2024 15:43:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Accept-Language, Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 75651
x-xss-protection: 0

GET
H2 200 application-landing-page-02af777e5ee180a830e80ded51b5415c5574565418fa1c9107f075f6dc9fd6e5.js Show response
secure.winred.com/assets/ 488 KB
137 KB 61ms
60ms Script
application/javascript 104.19.211.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/assets/application-landing-page-02af777e5ee180a830e80ded51b5415c5574565418fa1c9107f075f6dc9fd6e5.js

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.211.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

969e82bade7f2133977ae76c952503b1c7d8185b31a0a084c45f5c9aae1ce138

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Mon, 26 Feb 2024 15:43:02 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
x-amz-version-id: 95BRgS7VdqaT8uLLM2He9ktkhRtARyWQ
cf-cache-status: HIT
x-amz-request-id: W6T188VSSMTMRYAT
age: 4367
cf-polished: origSize=499577
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-amz-id-2: QfevOnWnY3OGzTw4YRAUcAb5vtUV5tGuajOHVsHINlDtfJZe+ZHrNEjpxbKXyUzGjwl0Az2w3rM=
cf-bgj: minify
last-modified: Fri, 23 Feb 2024 02:52:49 GMT
server: cloudflare
etag: W/"988ca7229e9f5da8ee1d54cc48b9d293"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 85b94d28faef36eb-YYZ
expires: Mon, 26 Feb 2024 19:43:02 GMT

GET
H2 200 TRUMP_LOGO_-_WHITE_BOX_%281%29.png
d35ligi1n5bgzc.cloudfront.net/logos/logo_assets/000/826/035/large/ 165 KB
165 KB 146ms
50ms Image
image/png 13.249.85.64
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d35ligi1n5bgzc.cloudfront.net/logos/logo_assets/000/826/035/large/TRUMP_LOGO_-_WHITE_BOX_%281%29.png
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.85.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-249-85-64.ord52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c3c2125ebaeb07268bbc110c5f11486686b0d1b756115142dfbfc855cf82ba43

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-amz-version-id: yfwN.ggIOaUC6AxHonrapfZVYuxzZd13
date: Mon, 26 Feb 2024 11:26:54 GMT
via: 1.1 d1caea62fb8c2cc700e57b182183da64.cloudfront.net (CloudFront)
x-amz-cf-pop: ORD52-C1
age: 15402
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 168824
last-modified: Wed, 10 Jan 2024 18:25:23 GMT
server: AmazonS3
etag: "75ce68862b7b84a971e6026ca747a8ba"
vary: Accept-Encoding
content-type: image/png
accept-ranges: bytes
x-amz-cf-id: R3pAHXVPprKOFAQcc_-CuTlO8CbtK92m_Qb8HLx2xzUQdqDrfWsQDw==

GET
H2 200 UET0mw6k3__Rtq12V5J8yk29aoWfmYD666VeUqZpUq5Hw8GxxE_fxutD6th36uPFWftBOShCUyNs2CGq5RuVSIZJC5TyWhTxr5iqgj7LaAwZHC7QGh2fQAEa6dKIQp7adPGtD_fAs2xhobjctPacrlE
lh7-us.googleusercontent.com/ 354 KB
355 KB 107ms
41ms Image
image/png 172.253.62.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh7-us.googleusercontent.com/UET0mw6k3__Rtq12V5J8yk29aoWfmYD666VeUqZpUq5Hw8GxxE_fxutD6th36uPFWftBOShCUyNs2CGq5RuVSIZJC5TyWhTxr5iqgj7LaAwZHC7QGh2fQAEa6dKIQp7adPGtD_fAs2xhobjctPacrlE

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f132.1e100.net

Software

fife /

Resource Hash

ec21f3a88e2b4fba18a074541bef001d87c50e667cf5d52437961c1b5a3c953b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Mon, 26 Feb 2024 12:17:19 GMT
x-content-type-options: nosniff
age: 12343
content-disposition: inline;filename="DJT-TRUMPPOLL.png"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 362818
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Tue, 27 Feb 2024 12:17:19 GMT

GET
H2 200 bEVmiBAlrMNHqy8pYp6es3R_SGCX0rOh-5MJKw3B6i_L2qlob_wNs8XJaFAhpwwow-ZcPq_qlxb3kEhHRc7wAE1HvyVsoEbb_cj0vm5_mmxCKnsijw0yeSIk30aoo1k6PLKAXCZRaO4oYjE4luuo8qE
lh7-us.googleusercontent.com/ 5 KB
5 KB 34ms
30ms Image
image/png 172.253.62.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh7-us.googleusercontent.com/bEVmiBAlrMNHqy8pYp6es3R_SGCX0rOh-5MJKw3B6i_L2qlob_wNs8XJaFAhpwwow-ZcPq_qlxb3kEhHRc7wAE1HvyVsoEbb_cj0vm5_mmxCKnsijw0yeSIk30aoo1k6PLKAXCZRaO4oYjE4luuo8qE

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f132.1e100.net

Software

fife /

Resource Hash

ce483bd57a7d0576c16db84df9cf92b4d94a2c8472f3254dbd2a759704d0fbfd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Mon, 26 Feb 2024 12:16:31 GMT
x-content-type-options: nosniff
age: 12391
content-disposition: inline;filename="_QW1zW-kTCSjbaqIOpuRy5VMvh61fpZv212Q1YCWeOexOYKps9CRhiAxX9Kvvq-lIdKhd_eQcyu6vBuNlCq3u2RFxweb4FxaKIYDq3EaTHdLU2IPQQ2fCV-KVJygrIgkrOcUZ9htsl6GD76yV3Xaut4.png"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5209
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Tue, 27 Feb 2024 12:16:31 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 457 KB
101 KB 170ms
105ms Script
application/javascript 142.250.31.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.31.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

faeb9f5dcf58e12891d944bca3c47552abdff5146ce9e313aeb2a3cc9cf9929e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Mon, 26 Feb 2024 15:43:02 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 103241
x-xss-protection: 0
last-modified: Mon, 26 Feb 2024 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 26 Feb 2024 15:43:02 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 315 KB
105 KB 122ms
58ms Script
application/javascript 142.250.31.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.31.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

9f4e1162f14929daf66b14bc0395af8064813a0e21780d214c88a7f99e955d4e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Mon, 26 Feb 2024 15:43:02 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 107528
x-xss-protection: 0
last-modified: Mon, 26 Feb 2024 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 26 Feb 2024 15:43:02 GMT

GET
H2 200 XNEQX8J3Hn1Tc1Cekdz69bCfdrh2IUfxO-n_jmYRPw8m0XbfQ8U6r2gs40xCYHpHYIOjHO8UXt1tM0880iBH-lhkpJf_WnI6GRQGSpgV6uggayE25ukLzK4C9WilKq3YZYdrC00FjrewTGXWDIAtoEo
lh7-us.googleusercontent.com/ 195 KB
195 KB 34ms
30ms Image
image/png 172.253.62.132
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh7-us.googleusercontent.com/XNEQX8J3Hn1Tc1Cekdz69bCfdrh2IUfxO-n_jmYRPw8m0XbfQ8U6r2gs40xCYHpHYIOjHO8UXt1tM0880iBH-lhkpJf_WnI6GRQGSpgV6uggayE25ukLzK4C9WilKq3YZYdrC00FjrewTGXWDIAtoEo

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f132.1e100.net

Software

fife /

Resource Hash

b94b05ccc912f4deadb7dffd20326ce301931340c02efcb1e2a80fb55c59c6c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Mon, 26 Feb 2024 12:52:57 GMT
x-content-type-options: nosniff
age: 10205
content-disposition: inline;filename="DJT_YourRetribution_MMS.png"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 199926
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Tue, 27 Feb 2024 12:52:57 GMT

GET
H2 200 potus_headshot.png
d35ligi1n5bgzc.cloudfront.net/profiles/images/000/068/512/square/ 22 KB
22 KB 41ms
37ms Image
image/png 13.249.85.64
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d35ligi1n5bgzc.cloudfront.net/profiles/images/000/068/512/square/potus_headshot.png
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.85.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-249-85-64.ord52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4ec0827f796bdadb833f52dd7ea841e12158d9f488554ecb73479cc2ea6f6d8e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Sun, 25 Feb 2024 19:15:33 GMT
x-amz-version-id: 6HYtNhcBxi6F_uJ2AY87Rc_xOq3TeHoz
via: 1.1 d1caea62fb8c2cc700e57b182183da64.cloudfront.net (CloudFront)
last-modified: Sat, 17 Jul 2021 20:11:51 GMT
server: AmazonS3
x-amz-cf-pop: ORD52-C1
age: 73650
etag: "e595f679c10699fedef3c779e864cdd9"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 22449
x-amz-cf-id: GktuJH8LEbM2fxdPXglIfQmKM78fU6y_Y3GGbEkw2kxi_G8yG3SOpQ==

GET
H3 200 win-red-mark-small-24c5e97a925e2a929cae4a87ecdfcdf27f56974fd8172bdd34af91145aebca91.png
secure.winred.com/assets/ 9 KB
9 KB 57ms
55ms Image
image/webp 104.19.211.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.winred.com/assets/win-red-mark-small-24c5e97a925e2a929cae4a87ecdfcdf27f56974fd8172bdd34af91145aebca91.png

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.211.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

36f0bf882a876b13aeb20cf7a495421a43f336da5422072a58f58ce303fb6284

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Mon, 26 Feb 2024 15:43:02 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
x-amz-version-id: QT7TNO_2UJLGiuYsxQKB5.rqIfPdLgYd
cf-cache-status: HIT
x-amz-request-id: FESKQKNG6WNY9F64
age: 5141
cf-polished: origFmt=png, origSize=11635
content-disposition: inline; filename="win-red-mark-small-24c5e97a925e2a929cae4a87ecdfcdf27f56974fd8172bdd34af91145aebca91.webp"
alt-svc: h3=":443"; ma=86400
content-length: 8708
x-amz-id-2: 07z0lIp4XYJu9RUCMMtxYyL7jKwPShtKhmWOTI5LCSsHfO1GNV92qZ6djOguhtodtu97hP98pk0=
cf-bgj: imgq:85,h2pri
last-modified: Wed, 07 Feb 2024 01:15:18 GMT
server: cloudflare
etag: "972c0cca8d1e490484e89513f902e847"
vary: Accept
content-type: image/webp
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 85b94d2a39f33a0a-YYZ
expires: Mon, 26 Feb 2024 19:43:02 GMT

GET
H3 200 win-red-full-red-5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848.svg
secure.winred.com/assets/ 19 KB
8 KB 53ms
51ms Image
image/svg+xml 104.19.211.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.winred.com/assets/win-red-full-red-5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848.svg

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.211.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Mon, 26 Feb 2024 15:43:02 GMT
x-amz-version-id: f1JFLNaL.a2v3vTaKefRH3mKI0iL1aS2
x-content-type-options: nosniff
strict-transport-security: max-age=0; includeSubDomains
cf-cache-status: HIT
x-amz-request-id: DR221M7BV09V5M4K
age: 6607
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-amz-id-2: o3mwkPmqaNRV7lmkKby0loB41Op/Qye+l92VE5ENqVVaInfkxBejRsvNGOTW7eq4u/uhUH6RRT8=
last-modified: Tue, 28 Nov 2023 01:42:37 GMT
server: cloudflare
etag: W/"d31530d4186af669daf4f47099614593"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=14400
cf-ray: 85b94d2a39f43a0a-YYZ
expires: Mon, 26 Feb 2024 19:43:02 GMT

GET
H2 200 v84a3a4012de94ce1a686ba8c167c359c1696973893317 Show response
static.cloudflareinsights.com/beacon.min.js/ 20 KB
7 KB 138ms
83ms Script
text/javascript 104.16.57.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/v84a3a4012de94ce1a686ba8c167c359c1696973893317
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.57.101 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101

Request headers

Referer: https://secure.winred.com/
Origin: https://secure.winred.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Mon, 26 Feb 2024 15:43:02 GMT
content-encoding: gzip
last-modified: Tue, 10 Oct 2023 21:38:13 GMT
server: cloudflare
etag: W/"2023.10.0"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 85b94d2a8a89398d-YYZ

GET
H2 200 20210604_save-america_winred-backgrounds_winred-desktop_v2.jpg
d35ligi1n5bgzc.cloudfront.net/backgrounds/images/000/092/966/large/ 197 KB
198 KB 38ms
38ms Image
image/jpeg 13.249.85.64
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d35ligi1n5bgzc.cloudfront.net/backgrounds/images/000/092/966/large/20210604_save-america_winred-backgrounds_winred-desktop_v2.jpg
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/stylesheets/rv_page_01hq12r84vpxbfx9qas8v315cq/1708359714.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.85.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-249-85-64.ord52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 81a6832550bd52d1c44e1e63c2d9137a441dd53d31302c3070000403d032b012

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-amz-version-id: NXb6H3gY_kurDwSBNPY4Z260kpd_Eays
date: Sun, 25 Feb 2024 18:55:43 GMT
via: 1.1 d1caea62fb8c2cc700e57b182183da64.cloudfront.net (CloudFront)
x-amz-cf-pop: ORD52-C1
age: 74840
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 202127
last-modified: Sun, 18 Jul 2021 21:49:32 GMT
server: AmazonS3
etag: "4652598428898ad578aa5424f8463865"
vary: Accept-Encoding
content-type: image/jpeg
accept-ranges: bytes
x-amz-cf-id: oTLSWJE_dTwyf5u6TnmfYjXdKRSbNFGHYUh37nPqUbbI7kFvcLRZlw==

GET
H3 200 icon-dropdown-background-52b35865280d33e30f9708871085b8db6862e75bc159d6e8e3cd77af6c36bdde.png
secure.winred.com/assets/ 290 B
821 B 63ms
62ms Image
image/webp 104.19.211.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.winred.com/assets/icon-dropdown-background-52b35865280d33e30f9708871085b8db6862e75bc159d6e8e3cd77af6c36bdde.png

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/assets/landing_page-b5085350195c50801834c19cd56b1cabc8b9ea2b81e3a74f8486f6b3e2ae2898.css

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.211.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

96b04ef160f8b50520a48707a452fecdd6e6771c643706d5949020a2dea15962

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/assets/landing_page-b5085350195c50801834c19cd56b1cabc8b9ea2b81e3a74f8486f6b3e2ae2898.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Mon, 26 Feb 2024 15:43:02 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
x-amz-version-id: rSYL4SLa9xxo8c4gAkGBErgQ41XGHCr2
cf-cache-status: HIT
x-amz-request-id: VR57GZE73R2QH9D4
age: 6607
cf-polished: origFmt=png, origSize=560
content-disposition: inline; filename="icon-dropdown-background-52b35865280d33e30f9708871085b8db6862e75bc159d6e8e3cd77af6c36bdde.webp"
alt-svc: h3=":443"; ma=86400
content-length: 290
x-amz-id-2: oEz8nvUpTJ8Q4XyFGBQOSPbq75XdzSdR3ILkTzPEjzL86Cn+EXZRmwEoBOxZHYgg9m/Nqrl0j7c=
cf-bgj: imgq:85,h2pri
last-modified: Wed, 07 Feb 2024 01:15:16 GMT
server: cloudflare
etag: "571ee659b7ee9af9291e7dd8176721d5"
vary: Accept
content-type: image/webp
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 85b94d2a6a3c3a0a-YYZ
expires: Mon, 26 Feb 2024 19:43:02 GMT

GET
H2 200 m-outer-3437aaddcdf6922d623e172c2d6f9278.html Show response
js.stripe.com/v3/ Frame D84B 200 B
848 B 17ms
16ms Document
text/html 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

35dcc382eb69d00369d708708cdc545f3968b68fa5bbe3e728d11fedd04f93bb

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 1503344
cache-control: max-age=31536000
content-encoding: br
content-length: 154
content-security-policy: base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-security-policy-report-only: base-uri 'none'; connect-src 'self' https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src https://m.stripe.network; img-src https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Mon, 26 Feb 2024 15:43:02 GMT
etag: "3437aaddcdf6922d623e172c2d6f9278"
last-modified: Thu, 08 Feb 2024 22:46:21 GMT
server: Fastly
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 135644
x-content-type-options: nosniff
x-request-id: 488c1cb3-f749-4259-889e-9d637c6f6ad3
x-served-by: cache-yul1970023-YUL

GET
H2 200 controller-f3aaf0a4588c11fbdf4221277351eb39.html Show response
js.stripe.com/v3/ Frame 6609 325 B
735 B 17ms
17ms Document
text/html 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/controller-f3aaf0a4588c11fbdf4221277351eb39.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

113016669803e5472a495a27d0257cb180b3beb92a817841465d6ef0c7a8e564

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://api.stripe.com https://merchant-ui-api.stripe.com https://stripe.com/cookie-settings/enforcement-mode https://errors.stripe.com https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src 'self'; img-src 'self' https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'sha256-0hAheEzaMe6uXIKV4EehS9pu1am1lj/KnnzrOYqckXk='; worker-src 'none'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 14
cache-control: max-age=60, stale-while-revalidate=900
content-encoding: br
content-length: 189
content-security-policy: base-uri 'none'; connect-src 'self' https://api.stripe.com https://merchant-ui-api.stripe.com https://stripe.com/cookie-settings/enforcement-mode https://errors.stripe.com https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src 'self'; img-src 'self' https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'sha256-0hAheEzaMe6uXIKV4EehS9pu1am1lj/KnnzrOYqckXk='; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Mon, 26 Feb 2024 15:43:02 GMT
etag: "f3aaf0a4588c11fbdf4221277351eb39"
last-modified: Fri, 23 Feb 2024 21:02:27 GMT
server: Fastly
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 7
x-content-type-options: nosniff
x-request-id: b932682a-bb08-4b58-97d6-2c825ca2a9c3
x-served-by: cache-yul1970023-YUL

GET
H2 200 elements-inner-card-a0cdf3329d4008ecf745f5bd6d7ff8c4.html Show response
js.stripe.com/v3/ Frame B5EC 798 B
1 KB 16ms
15ms Document
text/html 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/elements-inner-card-a0cdf3329d4008ecf745f5bd6d7ff8c4.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

af55868699d57b9d2a50aac14791e93f70004703817fc3179f2243d36734dd96

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://ppm.stripe.com; default-src 'self'; font-src data: https:; form-action 'none'; frame-src 'self' https://www.affirm.com https://checkout.link.com https://b.stripecdn.com; img-src 'self' https://q.stripe.com https://b.stripecdn.com https://js.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 239922
cache-control: max-age=31536000
content-encoding: br
content-length: 362
content-security-policy: base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://ppm.stripe.com; default-src 'self'; font-src data: https:; form-action 'none'; frame-src 'self' https://www.affirm.com https://checkout.link.com https://b.stripecdn.com; img-src 'self' https://q.stripe.com https://b.stripecdn.com https://js.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-security-policy-report-only: base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://ppm.stripe.com; default-src 'self'; font-src data: https:; form-action 'none'; frame-src 'self' https://www.affirm.com https://checkout.link.com https://b.stripecdn.com; img-src 'self' https://q.stripe.com https://b.stripecdn.com https://js.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Mon, 26 Feb 2024 15:43:02 GMT
etag: "a0cdf3329d4008ecf745f5bd6d7ff8c4"
last-modified: Fri, 23 Feb 2024 21:02:27 GMT
server: Fastly
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 9410
x-content-type-options: nosniff
x-request-id: 414042a4-fa80-4aea-a27b-2b2c1268ca26
x-served-by: cache-yul1970023-YUL

GET
H2 200 current_with_info Show response
app.revv.co/api/v3/users/ 162 B
1 KB 173ms
112ms XHR
application/vnd.api+json 104.19.212.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.revv.co/api/v3/users/current_with_info?organization_token=rv_org_6KNvU36Z2qWJ2gfUBWqGZGoc&redirect=https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/assets/application-landing-page-02af777e5ee180a830e80ded51b5415c5574565418fa1c9107f075f6dc9fd6e5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.212.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

511599fb3ac1f39744ca04710b5b8396127a4aa96e93e849ba3aea89a1c4d739

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://secure.winred.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-rack-cors-original-access-control-allow-origin: https://secure.winred.com
x-rack-cors: hit
date: Mon, 26 Feb 2024 15:43:03 GMT
x-rack-cors-original-access-control-max-age: 0
x-rack-cors-original-access-control-allow-credentials: true
strict-transport-security: max-age=0; includeSubDomains
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
content-encoding: br
x-rack-cors-original-access-control-allow-methods: GET, POST, OPTIONS
x-rack-cors-original-access-control-expose-headers
alt-svc: h3=":443"; ma=86400
x-request-id: fd81fe13-b958-4735-8350-c9651dccc407
x-runtime: 0.012044
server: cloudflare
etag: W/"511599fb3ac1f39744ca04710b5b8396"
access-control-max-age: 0
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/vnd.api+json
access-control-allow-origin: https://secure.winred.com
access-control-expose-headers
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
vary: Origin
cf-ray: 85b94d2c29dfa234-YYZ

GET
H3 200 rv_page_01hq12r84vpxbfx9qas8v315cq-d4520876f858961990dd7e0e705c5a85e58a85d4 Show response
secure.winred.com/api/v3/donations/live/ 461 B
542 B 116ms
116ms XHR
application/json 104.19.211.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/api/v3/donations/live/rv_page_01hq12r84vpxbfx9qas8v315cq-d4520876f858961990dd7e0e705c5a85e58a85d4?stream_id=99d8e8df84060e08992e8cffd6ae32d1593139d0&_=1708962182707

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/assets/application-landing-page-02af777e5ee180a830e80ded51b5415c5574565418fa1c9107f075f6dc9fd6e5.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.211.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9e597d8c9a4da491394c388d66a4dc948d16cc327f8e9548d574e09429b4b437

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&
X-CSRF-Token: jcO+p/OCjzHLhYQYINEoHh2JZlf7i/vK9dM6NpWt44oYCKBc9yLEN5zFjtW0ORF2627F3xDEjhzsgFKfgGdQGQ==
X-Requested-With: XMLHttpRequest
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-rack-cors: miss; no-origin
date: Mon, 26 Feb 2024 15:43:03 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: EXPIRED
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-request-id: 5f1b0df2-f718-48fc-85e7-a0eeb0fda1fd
x-runtime: 0.008569
server: cloudflare
etag: W/"9e597d8c9a4da491394c388d66a4dc94"
vary: Origin, Accept-Encoding
content-type: application/json
cache-control: public, max-age=60
cf-ray: 85b94d2bccef3a0a-YYZ
expires: Mon, 26 Feb 2024 15:44:03 GMT

GET
H3 200 rv_page_01hq12r84vpxbfx9qas8v315cq-0a6e4fc061989ed329a079c8e5847a922acbefb1 Show response
secure.winred.com/api/v3/donations/live/ 451 B
525 B 128ms
127ms XHR
application/json 104.19.211.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/api/v3/donations/live/rv_page_01hq12r84vpxbfx9qas8v315cq-0a6e4fc061989ed329a079c8e5847a922acbefb1?stream_id=d8e55b78dfdb1407b754acd3d074071a0cd930fe&_=1708962182708

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/assets/application-landing-page-02af777e5ee180a830e80ded51b5415c5574565418fa1c9107f075f6dc9fd6e5.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.211.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a76848114ac3aa6c9a127156124b0f8c7efbc68cf71d2a03df51ae73dda2e6f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&
X-CSRF-Token: jcO+p/OCjzHLhYQYINEoHh2JZlf7i/vK9dM6NpWt44oYCKBc9yLEN5zFjtW0ORF2627F3xDEjhzsgFKfgGdQGQ==
X-Requested-With: XMLHttpRequest
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-rack-cors: miss; no-origin
date: Mon, 26 Feb 2024 15:43:03 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: EXPIRED
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-request-id: 486a43a6-d017-4e03-a2f6-7e2435214696
x-runtime: 0.009056
server: cloudflare
etag: W/"a76848114ac3aa6c9a127156124b0f8c"
vary: Origin, Accept-Encoding
content-type: application/json
cache-control: public, max-age=60
cf-ray: 85b94d2bccf13a0a-YYZ
expires: Mon, 26 Feb 2024 15:44:03 GMT

GET
H2 200 controller-f3aaf0a4588c11fbdf4221277351eb39.html Show response
js.stripe.com/v3/ Frame 2F41 325 B
288 B 16ms
16ms Document
text/html 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/controller-f3aaf0a4588c11fbdf4221277351eb39.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

113016669803e5472a495a27d0257cb180b3beb92a817841465d6ef0c7a8e564

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://api.stripe.com https://merchant-ui-api.stripe.com https://stripe.com/cookie-settings/enforcement-mode https://errors.stripe.com https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src 'self'; img-src 'self' https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'sha256-0hAheEzaMe6uXIKV4EehS9pu1am1lj/KnnzrOYqckXk='; worker-src 'none'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 14
cache-control: max-age=60, stale-while-revalidate=900
content-encoding: br
content-length: 189
content-security-policy: base-uri 'none'; connect-src 'self' https://api.stripe.com https://merchant-ui-api.stripe.com https://stripe.com/cookie-settings/enforcement-mode https://errors.stripe.com https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src 'self'; img-src 'self' https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'sha256-0hAheEzaMe6uXIKV4EehS9pu1am1lj/KnnzrOYqckXk='; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Mon, 26 Feb 2024 15:43:03 GMT
etag: "f3aaf0a4588c11fbdf4221277351eb39"
last-modified: Fri, 23 Feb 2024 21:02:27 GMT
server: Fastly
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 8
x-content-type-options: nosniff
x-request-id: 3c6b9189-9580-4e48-bb67-1e602ef6d1d9
x-served-by: cache-yul1970023-YUL

GET
H2 200 payment-request-inner-google-pay-424bc64fb2c99dc102ae3d10262ced03.html Show response
js.stripe.com/v3/ Frame FB8B 408 B
944 B 16ms
15ms Document
text/html 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/payment-request-inner-google-pay-424bc64fb2c99dc102ae3d10262ced03.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

726678783bf6d9de6e7df279d14f14901b68d0358d8812da8274665348dc71a2

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://r.stripe.com https://google.com/pay https://www.google.com/pay https://pay.google.com; default-src 'none'; form-action 'none'; frame-src https://pay.google.com; img-src https://q.stripe.com https://www.gstatic.com; script-src 'self' https://pay.google.com; style-src 'self'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 239860
cache-control: max-age=31536000
content-encoding: br
content-length: 222
content-security-policy: base-uri 'none'; connect-src 'self' https://r.stripe.com https://google.com/pay https://www.google.com/pay https://pay.google.com; default-src 'none'; form-action 'none'; frame-src https://pay.google.com; img-src https://q.stripe.com https://www.gstatic.com; script-src 'self' https://pay.google.com; style-src 'self'; report-uri https://q.stripe.com/csp-report
content-security-policy-report-only: base-uri 'none'; connect-src 'self' https://r.stripe.com https://google.com/pay https://www.google.com/pay https://pay.google.com; default-src 'none'; form-action 'none'; frame-src https://pay.google.com; img-src https://q.stripe.com https://www.gstatic.com; script-src 'self' https://pay.google.com; style-src 'self'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Mon, 26 Feb 2024 15:43:03 GMT
etag: "424bc64fb2c99dc102ae3d10262ced03"
last-modified: Fri, 23 Feb 2024 21:02:42 GMT
server: Fastly
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 1997
x-content-type-options: nosniff
x-request-id: 10f19a72-135f-4f4e-9e2e-6559890b0021
x-served-by: cache-yul1970023-YUL

GET
H2 200 payment-request-inner-browser-d4b352cf093e84a8e703102ce4376ef7.html Show response
js.stripe.com/v3/ Frame 995F 344 B
1 KB 16ms
16ms Document
text/html 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/payment-request-inner-browser-d4b352cf093e84a8e703102ce4376ef7.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

793f203a71fd5bb0d2d52113acad0d9ccc51cf6e5a461e93e8bf8f24e318c42c

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://google.com/pay https://www.google.com/pay https://pay.google.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src 'self'; img-src 'self' https://q.stripe.com https://www.gstatic.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 28
cache-control: max-age=60, stale-while-revalidate=900
content-encoding: br
content-length: 202
content-security-policy: base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://google.com/pay https://www.google.com/pay https://pay.google.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src 'self'; img-src 'self' https://q.stripe.com https://www.gstatic.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-security-policy-report-only: base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://google.com/pay https://www.google.com/pay https://pay.google.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src 'self'; img-src 'self' https://q.stripe.com https://www.gstatic.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Mon, 26 Feb 2024 15:43:03 GMT
etag: "d4b352cf093e84a8e703102ce4376ef7"
last-modified: Fri, 23 Feb 2024 21:02:42 GMT
server: Fastly
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 3
x-content-type-options: nosniff
x-request-id: 6677055b-b677-45d6-91e4-3519ddb77e1d
x-served-by: cache-yul1970023-YUL

GET
H3 200 DJT-USFLAG.png
d35ligi1n5bgzc.cloudfront.net/widget_images/images/000/853/672/small_square/ 5 KB
5 KB 40ms
40ms Image
image/png 13.249.85.64
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d35ligi1n5bgzc.cloudfront.net/widget_images/images/000/853/672/small_square/DJT-USFLAG.png
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 13.249.85.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-249-85-64.ord52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 03ff26aeebf7456b7511420741d9058e4966ab8525a27bb212aa10604f1b550e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-amz-version-id: i7c0KUoS2JwTP679YgHcOaA9X3_2yeiC
date: Mon, 26 Feb 2024 12:06:04 GMT
via: 1.1 9f7f2f577670c83ff7f5bb7e8d89ae32.cloudfront.net (CloudFront)
last-modified: Fri, 09 Feb 2024 15:03:38 GMT
server: AmazonS3
age: 13020
x-amz-cf-pop: ORD52-C1
x-amz-server-side-encryption: AES256
etag: "cdd07b6117b5bead9e9206e276f82805"
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 4622
x-amz-cf-id: oPx4SPkqh4T_Us0d5IMfbTGTjjsam4y4Way_GO7bSRhmHysmXAiAyg==

GET
H3 200 statistics Show response
secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db/forms/ 1 KB
1 KB 134ms
134ms XHR
text/html 104.19.211.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db/forms/statistics

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.211.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5f36f8d6819cb2f5698eee5682dd520de565034b8510510f827244579b51b437

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&
X-CSRF-Token: jcO+p/OCjzHLhYQYINEoHh2JZlf7i/vK9dM6NpWt44oYCKBc9yLEN5zFjtW0ORF2627F3xDEjhzsgFKfgGdQGQ==
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-rack-cors: miss; no-origin
date: Mon, 26 Feb 2024 15:43:03 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-permitted-cross-domain-policies: none
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
x-request-id: e5277b77-41fb-40fd-818c-ee296d975e5f
x-runtime: 0.046072
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
x-download-options: noopen
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/html; charset=utf-8
cache-control: max-age=0, private, must-revalidate
cf-ray: 85b94d2bfd683a0a-YYZ

GET
H3

200

main.js Show response
secure.winred.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/0f752fefe334/ Frame 0111
Redirect Chain

https://secure.winred.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://secure.winred.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/0f752fefe334/main.js

8 KB
4 KB

40ms
39ms

Script
application/javascript

104.19.211.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/0f752fefe334/main.js

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&

Protocol

Server

104.19.211.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

04179400a816aa5b0442231584899bfd58ab7a4c8d56de2fe06c6cd331b2a102

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Mon, 26 Feb 2024 15:43:03 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
content-encoding: br
server: cloudflare
vary: accept-encoding
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
cf-ray: 85b94d2ccebe3a0a-YYZ
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Mon, 26 Feb 2024 15:43:03 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
server: cloudflare
vary: accept-encoding
location: /cdn-cgi/challenge-platform/h/b/scripts/jsd/0f752fefe334/main.js
access-control-allow-origin: *
cache-control: max-age=300, public
cf-ray: 85b94d2c1d823a0a-YYZ
alt-svc: h3=":443"; ma=86400

GET
H2 200 m-outer-15a2b40a058ddff1cffdb63779fe3de1.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame D84B 526 B
619 B 17ms
16ms Script
text/javascript 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/m-outer-15a2b40a058ddff1cffdb63779fe3de1.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

ba2338aa6670580269c762f51c4291daef913201aa8f4d4fd166c1a878262652

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/m-outer-3437aaddcdf6922d623e172c2d6f9278.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Mon, 26 Feb 2024 15:43:03 GMT
via: 1.1 varnish
age: 1503344
x-cache: HIT
content-length: 315
x-request-id: 02cc0ddb-9673-40ad-b2e0-62894e6e8c90
x-served-by: cache-yul1970023-YUL
last-modified: Thu, 08 Feb 2024 22:46:19 GMT
server: Fastly
etag: "d96c709017743c0759cf3853d1806ba5"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 127733

GET
H3 200 gen_204 Show response
maps.googleapis.com/maps/api/mapsjs/ 3 B
45 B 111ms
45ms XHR
application/json 172.253.63.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f95.1e100.net

Software

scaffolding on HTTPServer2 /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Mon, 26 Feb 2024 15:43:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://secure.winred.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23
x-xss-protection: 0

GET
H2 200 shared-dfc36c72938e02dbf0b948f02dc01c05.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 6609 535 KB
130 KB 19ms
19ms Script
text/javascript 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-dfc36c72938e02dbf0b948f02dc01c05.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/controller-f3aaf0a4588c11fbdf4221277351eb39.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

9a53a378b0bf8737dd5384da05ca56af9af8e7a218eb8a2d22a96eca1ac5141b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/controller-f3aaf0a4588c11fbdf4221277351eb39.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Mon, 26 Feb 2024 15:43:03 GMT
via: 1.1 varnish
age: 239928
x-cache: HIT
content-length: 133281
x-request-id: 9cebce5f-bf0f-4d86-b6c7-e3e7e8c42b88
x-served-by: cache-yul1970023-YUL
last-modified: Fri, 23 Feb 2024 21:02:41 GMT
server: Fastly
etag: "ee779d877b789585dcd76914b08ab7f0"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 4465

GET
H2 200 controller-c5e9d80808364fba673096e3a8aa9195.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 6609 696 KB
182 KB 18ms
18ms Script
text/javascript 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/controller-c5e9d80808364fba673096e3a8aa9195.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/controller-f3aaf0a4588c11fbdf4221277351eb39.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

d7ab36bda2c2cd614f2273a36ad7318d78fac4580fc027603e82801fd539a499

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/controller-f3aaf0a4588c11fbdf4221277351eb39.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Mon, 26 Feb 2024 15:43:03 GMT
via: 1.1 varnish
age: 239929
x-cache: HIT
content-length: 185904
x-request-id: 41672a57-47a3-4c38-9449-8be3339df8df
x-served-by: cache-yul1970023-YUL
last-modified: Fri, 23 Feb 2024 21:02:39 GMT
server: Fastly
etag: "d08b421b5096714447361f320e2f6b0e"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 4551

GET
H2 200 shared-dfc36c72938e02dbf0b948f02dc01c05.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame B5EC 535 KB
130 KB 45ms
44ms Script
text/javascript 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-dfc36c72938e02dbf0b948f02dc01c05.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-card-a0cdf3329d4008ecf745f5bd6d7ff8c4.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

9a53a378b0bf8737dd5384da05ca56af9af8e7a218eb8a2d22a96eca1ac5141b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-card-a0cdf3329d4008ecf745f5bd6d7ff8c4.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Mon, 26 Feb 2024 15:43:03 GMT
via: 1.1 varnish
age: 239928
x-cache: HIT
content-length: 133281
x-request-id: 4b305f1f-ab49-475f-ba79-290f1d75f513
x-served-by: cache-yul1970023-YUL
last-modified: Fri, 23 Feb 2024 21:02:41 GMT
server: Fastly
etag: "ee779d877b789585dcd76914b08ab7f0"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 4466

GET
H2 200 ui-shared-681f96a7339ecfdb817fb408845ee657.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame B5EC 418 KB
118 KB 45ms
45ms Script
text/javascript 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/ui-shared-681f96a7339ecfdb817fb408845ee657.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-card-a0cdf3329d4008ecf745f5bd6d7ff8c4.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

58a0c074a2d68c4b2f319c228e092bbe83d0bc9edfcc904f897aad1f39d99520

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-card-a0cdf3329d4008ecf745f5bd6d7ff8c4.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Mon, 26 Feb 2024 15:43:03 GMT
via: 1.1 varnish
age: 239921
x-cache: HIT
content-length: 120223
x-request-id: fe7b0e5d-9f6b-4347-a9cc-0a27fa3f21f0
x-served-by: cache-yul1970023-YUL
last-modified: Fri, 23 Feb 2024 21:02:42 GMT
server: Fastly
etag: "afe1a1383429b48e2629d0b5546b6839"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 9639

GET
H2 200 elements-inner-card-9cf6bbbe92d0f8131858c663e02506aa.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame B5EC 55 KB
15 KB 21ms
18ms Script
text/javascript 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/elements-inner-card-9cf6bbbe92d0f8131858c663e02506aa.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-card-a0cdf3329d4008ecf745f5bd6d7ff8c4.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

d79e4b240cdc0e74e6066051005bb4701deaa28c5d5c20eefd6823dc1b5f4626

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-card-a0cdf3329d4008ecf745f5bd6d7ff8c4.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Mon, 26 Feb 2024 15:43:03 GMT
via: 1.1 varnish
age: 332041
x-cache: HIT
content-length: 15632
x-request-id: e3513b45-82f1-406a-95ba-13a83f037e9f
x-served-by: cache-yul1970023-YUL
last-modified: Thu, 22 Feb 2024 19:26:30 GMT
server: Fastly
etag: "656bbf034bcf173c819d93cad81e403e"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 9969

GET
H2 200 ui-shared-1d27f4e2b314637ba4bb9d7ff79c23c7.css
js.stripe.com/v3/fingerprinted/css/ Frame B5EC 20 KB
3 KB 43ms
43ms Stylesheet
text/css 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/css/ui-shared-1d27f4e2b314637ba4bb9d7ff79c23c7.css

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-card-a0cdf3329d4008ecf745f5bd6d7ff8c4.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

394724ca0118829643c12fb5a033cb66680e51327ba157677d18dec209278a3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-card-a0cdf3329d4008ecf745f5bd6d7ff8c4.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Mon, 26 Feb 2024 15:43:03 GMT
via: 1.1 varnish
age: 1503062
x-cache: HIT
content-length: 3304
x-request-id: f3fafd29-e808-4ead-bc8d-1c0e9270111e
x-served-by: cache-yul1970023-YUL
last-modified: Thu, 08 Feb 2024 22:46:07 GMT
server: Fastly
etag: "b361d7109e9925ca18e32c9da528520f"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 13098

GET
H2 200 elements-inner-card-53aa57bec7f6d40d72327654fd43a92e.css
js.stripe.com/v3/fingerprinted/css/ Frame B5EC 14 KB
2 KB 46ms
45ms Stylesheet
text/css 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/css/elements-inner-card-53aa57bec7f6d40d72327654fd43a92e.css

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-card-a0cdf3329d4008ecf745f5bd6d7ff8c4.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

eac1bb2890c6ae6d2cc8653765f594f1209eda9eb0036eef9fde51299e883a5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-card-a0cdf3329d4008ecf745f5bd6d7ff8c4.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Mon, 26 Feb 2024 15:43:03 GMT
via: 1.1 varnish
age: 1459608
x-cache: HIT
content-length: 2260
x-request-id: d442abde-f4c6-4a9b-80a8-3df6f89b40eb
x-served-by: cache-yul1970023-YUL
last-modified: Fri, 09 Feb 2024 18:11:43 GMT
server: Fastly
etag: "87bf0041cf7ae5e77d770c423e25828a"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 10499

GET
H2 200 shared-dfc36c72938e02dbf0b948f02dc01c05.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 2F41 535 KB
130 KB 54ms
53ms Script
text/javascript 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-dfc36c72938e02dbf0b948f02dc01c05.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/controller-f3aaf0a4588c11fbdf4221277351eb39.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

9a53a378b0bf8737dd5384da05ca56af9af8e7a218eb8a2d22a96eca1ac5141b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/controller-f3aaf0a4588c11fbdf4221277351eb39.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Mon, 26 Feb 2024 15:43:03 GMT
via: 1.1 varnish
age: 239928
x-cache: HIT
content-length: 133281
x-request-id: de7b76e0-f93a-4d4c-8044-bc14c1c03477
x-served-by: cache-yul1970023-YUL
last-modified: Fri, 23 Feb 2024 21:02:41 GMT
server: Fastly
etag: "ee779d877b789585dcd76914b08ab7f0"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 4467

GET
H2 200 controller-c5e9d80808364fba673096e3a8aa9195.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 2F41 696 KB
182 KB 54ms
54ms Script
text/javascript 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/controller-c5e9d80808364fba673096e3a8aa9195.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/controller-f3aaf0a4588c11fbdf4221277351eb39.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

d7ab36bda2c2cd614f2273a36ad7318d78fac4580fc027603e82801fd539a499

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/controller-f3aaf0a4588c11fbdf4221277351eb39.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Mon, 26 Feb 2024 15:43:03 GMT
via: 1.1 varnish
age: 239929
x-cache: HIT
content-length: 185904
x-request-id: e243be5f-6fc2-475c-a5ab-878bec61bedc
x-served-by: cache-yul1970023-YUL
last-modified: Fri, 23 Feb 2024 21:02:39 GMT
server: Fastly
etag: "d08b421b5096714447361f320e2f6b0e"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 4552

GET
H2 200 pay.js Show response
pay.google.com/gp/p/js/ Frame FB8B 117 KB
36 KB 130ms
58ms Script
application/javascript 172.253.115.92
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pay.google.com/gp/p/js/pay.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/payment-request-inner-google-pay-424bc64fb2c99dc102ae3d10262ced03.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.92 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f92.1e100.net

Software

ESF /

Resource Hash

d14d3528790f5f18fa352072175d550eb7a21c2dd1f5fadb1d33ca25ab8cbff5

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-fC1bY7eTi5jVzThKkrWuyQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendHttp/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Mon, 26 Feb 2024 15:43:03 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-fC1bY7eTi5jVzThKkrWuyQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendHttp/cspreport
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/gp/p/_/InstantbuyFrontendHttp/web-reports?context=eJzjKtHikmII1JBiWF4qxVBRK8WwZKYUg2fNTabOPTeZ1nU9YlrY_pRJk-sZU33UM6aZvM-Z4k48ZxJ885zp3b8XTO--vGTi-PqSSQKI1YB4h48Hi5jPdFa-ddNZVYBYc_101kAgdkqfwRoAxD71M1ijgFiIm6P98ad1bAINjTtjAPp9M8c"
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: private, max-age=600
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 26 Feb 2024 15:43:03 GMT

GET
H2 200 shared-dfc36c72938e02dbf0b948f02dc01c05.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame FB8B 535 KB
130 KB 56ms
56ms Script
text/javascript 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-dfc36c72938e02dbf0b948f02dc01c05.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/payment-request-inner-google-pay-424bc64fb2c99dc102ae3d10262ced03.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

9a53a378b0bf8737dd5384da05ca56af9af8e7a218eb8a2d22a96eca1ac5141b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/payment-request-inner-google-pay-424bc64fb2c99dc102ae3d10262ced03.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Mon, 26 Feb 2024 15:43:03 GMT
via: 1.1 varnish
age: 239928
x-cache: HIT
content-length: 133281
x-request-id: 221a3e18-23b4-44ff-9b1d-48709879b1f4
x-served-by: cache-yul1970023-YUL
last-modified: Fri, 23 Feb 2024 21:02:41 GMT
server: Fastly
etag: "ee779d877b789585dcd76914b08ab7f0"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 4468

GET
H2 200 payment-request-inner-google-pay-55926d87f8538450887ab383061d3425.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame FB8B 12 KB
5 KB 20ms
19ms Script
text/javascript 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/payment-request-inner-google-pay-55926d87f8538450887ab383061d3425.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/payment-request-inner-google-pay-424bc64fb2c99dc102ae3d10262ced03.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

f8e37527996d0530694a2a8ddf6afdcf28cc8a05e50ce3ce9d3f2f743b04659f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/payment-request-inner-google-pay-424bc64fb2c99dc102ae3d10262ced03.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Mon, 26 Feb 2024 15:43:03 GMT
via: 1.1 varnish
age: 1459686
x-cache: HIT
content-length: 5079
x-request-id: fb42931a-2745-4a87-8377-2aabc72bc63e
x-served-by: cache-yul1970023-YUL
last-modified: Fri, 09 Feb 2024 18:11:55 GMT
server: Fastly
etag: "c9c83657cf777673149a15b5cf68258f"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 2157

GET
H2 200 shared-dfc36c72938e02dbf0b948f02dc01c05.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 995F 535 KB
130 KB 60ms
60ms Script
text/javascript 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-dfc36c72938e02dbf0b948f02dc01c05.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/payment-request-inner-browser-d4b352cf093e84a8e703102ce4376ef7.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

9a53a378b0bf8737dd5384da05ca56af9af8e7a218eb8a2d22a96eca1ac5141b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/payment-request-inner-browser-d4b352cf093e84a8e703102ce4376ef7.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Mon, 26 Feb 2024 15:43:03 GMT
via: 1.1 varnish
age: 239928
x-cache: HIT
content-length: 133281
x-request-id: d4e8c948-eeaf-4436-8e49-7b14fb903e72
x-served-by: cache-yul1970023-YUL
last-modified: Fri, 23 Feb 2024 21:02:41 GMT
server: Fastly
etag: "ee779d877b789585dcd76914b08ab7f0"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 4469

GET
H2 200 payment-request-inner-browser-792795e2c4e2210721d96228540c4e06.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 995F 13 KB
6 KB 67ms
67ms Script
text/javascript 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/payment-request-inner-browser-792795e2c4e2210721d96228540c4e06.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/payment-request-inner-browser-d4b352cf093e84a8e703102ce4376ef7.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

fedfc64728beee4dcdf576abb2dd3c44b462afc3b5db8c53704629a1ee6dd14c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/payment-request-inner-browser-d4b352cf093e84a8e703102ce4376ef7.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Mon, 26 Feb 2024 15:43:03 GMT
via: 1.1 varnish
age: 1459688
x-cache: HIT
content-length: 5631
x-request-id: fc931dfa-0ab3-43a1-a244-3a8e4c5ddc2e
x-served-by: cache-yul1970023-YUL
last-modified: Fri, 09 Feb 2024 18:11:55 GMT
server: Fastly
etag: "32dba56f50e599b5cc53a055305f8c45"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 5099

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 316 KB
104 KB 49ms
48ms Script
application/javascript 142.250.31.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-0YWKLMCX4D&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.31.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

9c0a837b1dcc7a86d7630681eb73c0c4d1243adf483b269789b06f608348c6d6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Mon, 26 Feb 2024 15:43:03 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 106675
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 26 Feb 2024 15:43:03 GMT

GET
H2

200

activityi;dc_pre=CJjF956syYQDFe0X-QAdL68HuA;src=9381094;type=pagev0;cat=djt_p0;ord=5214896282127;npa=0;auiddc=306036401.1708962183;pscdl=noapi;gtm=45He42l0v72350723za220;gcd=13l3l3l3l1;dma=0;uaa=;u... Show response
9381094.fls.doubleclick.net/ Frame 6D1D
Redirect Chain

https://9381094.fls.doubleclick.net/activityi;src=9381094;type=pagev0;cat=djt_p0;ord=5214896282127;npa=0;auiddc=306036401.1708962183;pscdl=noapi;gtm=45He42l0v72350723za220;gcd=13l3l3l3l1;dma=0;uaa=...
https://9381094.fls.doubleclick.net/activityi;dc_pre=CJjF956syYQDFe0X-QAdL68HuA;src=9381094;type=pagev0;cat=djt_p0;ord=5214896282127;npa=0;auiddc=306036401.1708962183;pscdl=noapi;gtm=45He42l0v72350...

643 B
689 B

90ms
89ms

Document
text/html

172.253.63.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://9381094.fls.doubleclick.net/activityi;dc_pre=CJjF956syYQDFe0X-QAdL68HuA;src=9381094;type=pagev0;cat=djt_p0;ord=5214896282127;npa=0;auiddc=306036401.1708962183;pscdl=noapi;gtm=45He42l0v72350723za220;gcd=13l3l3l3l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-sms-trump-poll-v16-db%3Futm_term%3Ddb-sajfc-cr50sms-014%26source_code%3Ddb-sajfc-cr50sms-014%26?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f148.1e100.net

Software

cafe /

Resource Hash

3eecec5f13d9cb118886b731100620c80543b4f60edfc4e39833391f5786c797

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 384
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 26 Feb 2024 15:43:03 GMT
expires: Mon, 26 Feb 2024 15:43:03 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 26 Feb 2024 15:43:03 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://9381094.fls.doubleclick.net/activityi;dc_pre=CJjF956syYQDFe0X-QAdL68HuA;src=9381094;type=pagev0;cat=djt_p0;ord=5214896282127;npa=0;auiddc=306036401.1708962183;pscdl=noapi;gtm=45He42l0v72350723za220;gcd=13l3l3l3l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-sms-trump-poll-v16-db%3Futm_term%3Ddb-sajfc-cr50sms-014%26source_code%3Ddb-sajfc-cr50sms-014%26?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 98ms
31ms Script
text/javascript 172.253.122.113
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f113.1e100.net

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 26 Feb 2024 14:36:23 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 4000
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Mon, 26 Feb 2024 16:36:23 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 105ms
32ms Script
application/javascript 146.75.36.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.75.36.157 Reston, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Mon, 26 Feb 2024 15:43:03 GMT
content-encoding: gzip
last-modified: Thu, 27 Oct 2022 15:55:14 GMT
etag: "32ad004436155ec972bc50e6238b5b67+gzip"
vary: Accept-Encoding,Host
x-cache: HIT
content-type: application/javascript; charset=utf-8
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn: FT
cache-control: no-cache
accept-ranges: bytes
content-length: 15375
x-served-by: cache-iad-kcgs7200159-IAD

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 214 KB
58 KB 96ms
30ms Script
application/x-javascript 31.13.66.19
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

31.13.66.19 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-iad3.fbcdn.net

Software

Resource Hash

0e04153b5f73bfa7866948f2a9870593d69bfde14e77a1a06af5f567096e5a09

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

permissions-policy-report-only: clipboard-read=(), clipboard-write=(), picture-in-picture=();report-to="permissions_policy"
content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Mon, 26 Feb 2024 15:43:03 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 57257
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
pragma: public
x-fb-debug: 5USgOMeciVaVBoFc6YtmprzGPUfj3eAKoJw90L7ufrt8aEZ6nuGVyNlSFgIjLLr4/1RLVZZdC2f8zOWqKzbO1g==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 ratag Show response
a.ads.rmbl.ws/ 3 KB
2 KB 209ms
62ms Script
application/javascript 38.70.189.71
RUMBLE

General

Check archive.org

Show headers Download Go to

Full URL: https://a.ads.rmbl.ws/ratag?id=AV-6622
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 38.70.189.71 Toronto, Canada, ASN399647 (RUMBLE, CA),
Reverse DNS
Software: nginx /
Resource Hash: 6037734d0ad3dd7b2f31955aeeb4b34e2316f726e1bd884d7dbc979649570049

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Mon, 26 Feb 2024 15:43:03 GMT
content-encoding: gzip
server: nginx
etag: W/"788ed2f782eb45b57dff78c742214a69"
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=900
access-control-allow-credentials: true

GET
H2 200 inner.html Show response
m.stripe.network/ Frame E63C 930 B
1 KB 16ms
15ms Document
text/html 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.network/inner.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/m-outer-15a2b40a058ddff1cffdb63779fe3de1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

947ac0903521f5eceefc90637c066306a8ca67466ccc188bb0107fb7cfb532d1

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src https://m.stripe.network https://m.stripe.com; default-src 'none'; font-src https://m.stripe.network https://fonts.gstatic.com; form-action 'none'; frame-src https://m.stripe.network https://js.stripe.com; img-src https://m.stripe.network https://m.stripe.com https://b.stripecdn.com; script-src https://m.stripe.network 'sha256-/5Guo2nzv5n/w6ukZpOBZOtTJBJPSkJ6mhHpnBgm3Ls='; style-src https://m.stripe.network; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 245
cache-control: max-age=300, public
content-encoding: br
content-length: 540
content-security-policy: base-uri 'none'; connect-src https://m.stripe.network https://m.stripe.com; default-src 'none'; font-src https://m.stripe.network https://fonts.gstatic.com; form-action 'none'; frame-src https://m.stripe.network https://js.stripe.com; img-src https://m.stripe.network https://m.stripe.com https://b.stripecdn.com; script-src https://m.stripe.network 'sha256-/5Guo2nzv5n/w6ukZpOBZOtTJBJPSkJ6mhHpnBgm3Ls='; style-src https://m.stripe.network; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Mon, 26 Feb 2024 15:43:03 GMT
server: Fastly
strict-transport-security: max-age=31556926; includeSubDomains; preload
vary: Accept-Encoding, Origin
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 382
x-content-type-options: nosniff
x-request-id: 51e3a96a-f952-41dc-b0db-d93a30a284ea
x-served-by: cache-yul1970023-YUL
x-timer: S1708962183.177216,VS0,VE0

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 265 KB
90 KB 49ms
49ms Script
application/javascript 142.250.31.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

5949577882598f6beecd577b649b81b4fa4ab687638c979a4182cad88c02d3b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Mon, 26 Feb 2024 15:43:03 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 91801
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 26 Feb 2024 15:43:03 GMT

GET
H2 200 .deploy_status_henson.json Show response
js.stripe.com/v3/ Frame 6609 474 B
609 B 65ms
17ms Fetch
application/json 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/.deploy_status_henson.json

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-dfc36c72938e02dbf0b948f02dc01c05.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

b0f2842cf2fe230f30d403634d26de441e415c437b4d81fe2626ea0e95426c78

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/v3/controller-f3aaf0a4588c11fbdf4221277351eb39.html
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 26 Feb 2024 15:43:03 GMT
content-encoding: br
via: 1.1 varnish
strict-transport-security: max-age=31556926; includeSubDomains; preload
age: 4
x-cache: HIT
content-length: 298
x-request-id: b7b8a036-e3cc-47a5-845b-283dd24fc08c
x-served-by: cache-yul1970043-YUL
last-modified: Fri, 23 Feb 2024 21:40:09 GMT
server: Fastly
etag: "f2dfc898e40eddf6e7e8133dd4803280"
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=60
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 5

GET
H2 200 .deploy_status_henson.json Show response
js.stripe.com/v3/ Frame 6609 474 B
372 B 49ms
17ms Fetch
application/json 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/.deploy_status_henson.json

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-dfc36c72938e02dbf0b948f02dc01c05.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

b0f2842cf2fe230f30d403634d26de441e415c437b4d81fe2626ea0e95426c78

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/v3/controller-f3aaf0a4588c11fbdf4221277351eb39.html
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 26 Feb 2024 15:43:03 GMT
content-encoding: br
via: 1.1 varnish
strict-transport-security: max-age=31556926; includeSubDomains; preload
age: 4
x-cache: HIT
content-length: 298
x-request-id: 3e81f44f-ab93-4653-8a85-3f408005719d
x-served-by: cache-yul1970043-YUL
last-modified: Fri, 23 Feb 2024 21:40:09 GMT
server: Fastly
etag: "f2dfc898e40eddf6e7e8133dd4803280"
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=60
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 8

GET
H2 200 .deploy_status_henson.json Show response
js.stripe.com/v3/ Frame 2F41 474 B
369 B 37ms
18ms Fetch
application/json 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/.deploy_status_henson.json

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-dfc36c72938e02dbf0b948f02dc01c05.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

b0f2842cf2fe230f30d403634d26de441e415c437b4d81fe2626ea0e95426c78

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/v3/controller-f3aaf0a4588c11fbdf4221277351eb39.html
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 26 Feb 2024 15:43:03 GMT
content-encoding: br
via: 1.1 varnish
strict-transport-security: max-age=31556926; includeSubDomains; preload
age: 4
x-cache: HIT
content-length: 298
x-request-id: 3fc9e81b-0df6-4cc5-80df-0552bd78df32
x-served-by: cache-yul1970043-YUL
last-modified: Fri, 23 Feb 2024 21:40:09 GMT
server: Fastly
etag: "f2dfc898e40eddf6e7e8133dd4803280"
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=60
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 8

GET
H2 200 .deploy_status_henson.json Show response
js.stripe.com/v3/ Frame 2F41 474 B
371 B 32ms
18ms Fetch
application/json 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/.deploy_status_henson.json

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-dfc36c72938e02dbf0b948f02dc01c05.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

b0f2842cf2fe230f30d403634d26de441e415c437b4d81fe2626ea0e95426c78

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/v3/controller-f3aaf0a4588c11fbdf4221277351eb39.html
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 26 Feb 2024 15:43:03 GMT
content-encoding: br
via: 1.1 varnish
strict-transport-security: max-age=31556926; includeSubDomains; preload
age: 4
x-cache: HIT
content-length: 298
x-request-id: 92f096c9-99d3-4535-ac1f-b8a1508eac96
x-served-by: cache-yul1970043-YUL
last-modified: Fri, 23 Feb 2024 21:40:09 GMT
server: Fastly
etag: "f2dfc898e40eddf6e7e8133dd4803280"
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=60
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 7

GET
H2 200 out-4.5.43.js Show response
m.stripe.network/ Frame E63C 87 KB
15 KB 16ms
16ms Script
text/javascript 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.network/out-4.5.43.js

Requested by

Host: m.stripe.network
URL: https://m.stripe.network/inner.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

e039e607c78306c7e029a7fd0ecdb14f86456f16e1a5ce65aa26b4fdf1d38a3c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://m.stripe.network/inner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
date: Mon, 26 Feb 2024 15:43:03 GMT
x-content-type-options: nosniff
content-encoding: br
via: 1.1 varnish
age: 168
x-cache: HIT
content-length: 15509
x-request-id: c8451beb-0f66-4acb-8c46-3b39b63b7b75
x-served-by: cache-yul1970023-YUL
server: Fastly
x-timer: S1708962183.402512,VS0,VE0
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=utf-8
cache-control: max-age=300, public
accept-ranges: bytes
x-cache-hits: 282

GET
H2 200 .deploy_status_henson.json Show response
js.stripe.com/v3/ Frame B5EC 474 B
372 B 22ms
21ms Fetch
application/json 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/.deploy_status_henson.json

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-dfc36c72938e02dbf0b948f02dc01c05.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

b0f2842cf2fe230f30d403634d26de441e415c437b4d81fe2626ea0e95426c78

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/v3/elements-inner-card-a0cdf3329d4008ecf745f5bd6d7ff8c4.html
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 26 Feb 2024 15:43:03 GMT
content-encoding: br
via: 1.1 varnish
strict-transport-security: max-age=31556926; includeSubDomains; preload
age: 4
x-cache: HIT
content-length: 298
x-request-id: 321f3516-1814-4754-9a43-37dbf3ad94a8
x-served-by: cache-yul1970043-YUL
last-modified: Fri, 23 Feb 2024 21:40:09 GMT
server: Fastly
etag: "f2dfc898e40eddf6e7e8133dd4803280"
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=60
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 9

GET
H2 200 countryRanges-9ffc15b92962ca316164b9a5ff4c1917.json Show response
js.stripe.com/v3/fingerprinted/data/ Frame B5EC 145 KB
39 KB 27ms
27ms Fetch
application/json 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/data/countryRanges-9ffc15b92962ca316164b9a5ff4c1917.json

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-dfc36c72938e02dbf0b948f02dc01c05.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

007b4be1404b0f21a158fa83a2ae9375393b2d932a17e9745aa392fcadc7cf2f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://js.stripe.com/v3/elements-inner-card-a0cdf3329d4008ecf745f5bd6d7ff8c4.html
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Mon, 26 Feb 2024 15:43:03 GMT
via: 1.1 varnish
age: 1502190
x-cache: HIT
content-length: 39981
x-request-id: 42895338-1eff-4ea8-8e7f-c622ec50074c
x-served-by: cache-yul1970043-YUL
last-modified: Thu, 08 Feb 2024 22:46:07 GMT
server: Fastly
etag: "9ffc15b92962ca316164b9a5ff4c1917"
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 3100

GET
H2 200 dc_pre=CJjF956syYQDFe0X-QAdL68HuA;src=9381094;type=pagev0;cat=djt_p0;ord=5214896282127;npa=0;auiddc=*;pscdl=noapi;gtm=45He42l0v72350723za220;gcd=13l3l3l3l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;u...
adservice.google.com/ddm/fls/z/ Frame 6D1D 42 B
401 B 198ms
135ms Image
image/gif 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CJjF956syYQDFe0X-QAdL68HuA;src=9381094;type=pagev0;cat=djt_p0;ord=5214896282127;npa=0;auiddc=*;pscdl=noapi;gtm=45He42l0v72350723za220;gcd=13l3l3l3l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-sms-trump-poll-v16-db%3Futm_term%3Ddb-sajfc-cr50sms-014%26source_code%3Ddb-sajfc-cr50sms-014%26

Requested by

Host: 9381094.fls.doubleclick.net
URL: https://9381094.fls.doubleclick.net/activityi;dc_pre=CJjF956syYQDFe0X-QAdL68HuA;src=9381094;type=pagev0;cat=djt_p0;ord=5214896282127;npa=0;auiddc=306036401.1708962183;pscdl=noapi;gtm=45He42l0v72350723za220;gcd=13l3l3l3l1;dma=0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-sms-trump-poll-v16-db%3Futm_term%3Ddb-sajfc-cr50sms-014%26source_code%3Ddb-sajfc-cr50sms-014%26?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f155.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://9381094.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Feb 2024 15:43:03 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 85b94d28091c36eb Show response
secure.winred.com/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame 0111 0
340 B 56ms
55ms XHR
text/plain 104.19.211.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/cdn-cgi/challenge-platform/h/b/jsd/r/85b94d28091c36eb

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/cdn-cgi/challenge-platform/scripts/jsd/main.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.211.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 26 Feb 2024 15:43:03 GMT
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
content-encoding: br
server: cloudflare
content-type: text/plain; charset=UTF-8
cf-ray: 85b94d305e583a0a-YYZ
alt-svc: h3=":443"; ma=86400

POST
H2 200 collect Show response
www.google-analytics.com/j/ 16 B
223 B 40ms
39ms XHR
text/plain 172.253.122.113
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1179897253&t=pageview&_s=1&dl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-sms-trump-poll-v16-db%3Futm_term%3Ddb-sajfc-cr50sms-014%26source_code%3Ddb-sajfc-cr50sms-014%26&ul=en-us&de=UTF-8&dt=MAGA&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGBACEABBAAAACAAI~&jid=1157386572&gjid=308702753&cid=818782480.1708962184&tid=UA-60901920-1&_gid=605259594.1708962184&_r=1&_slc=1&gtm=45He42l0n71M27JCGv72350723za220&gcd=13l3l3l3l1&dma=0&z=1414412551

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f113.1e100.net

Software

Golfe2 /

Resource Hash

641defe78e044cbd72e13110f131016fc26c1e8b00ef29ad142e177a0e54bfe1

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 26 Feb 2024 15:43:03 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 3 B
70 B 39ms
38ms XHR
text/plain 172.253.122.113
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1179897253&t=pageview&_s=1&dl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-sms-trump-poll-v16-db%3Futm_term%3Ddb-sajfc-cr50sms-014%26source_code%3Ddb-sajfc-cr50sms-014%26&ul=en-us&de=UTF-8&dt=MAGA&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGDAiEABBAAAACAEK~&jid=1677590561&gjid=1226853871&cid=818782480.1708962184&tid=UA-73658561-7&_gid=605259594.1708962184&_slc=1&gtm=45He42l0n71NTQZ9Nv72410129za220&gcd=13l3l3l3l1&dma=0&cd61=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-sms-trump-poll-v16-db%3Futm_term%3Ddb-sajfc-cr50sms-014%26source_code%3Ddb-sajfc-cr50sms-014%26&z=888739808

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f113.1e100.net

Software

Golfe2 /

Resource Hash

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 26 Feb 2024 15:43:03 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
350 B 98ms
37ms XHR
text/plain 142.250.31.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-73658561-7&cid=818782480.1708962184&jid=1677590561&gjid=1226853871&_gid=605259594.1708962184&_u=YGDAiEABBAAAAGAEK~&z=1228303303

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.31.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f156.1e100.net

Software

Golfe2 /

Resource Hash

8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Mon, 26 Feb 2024 15:43:03 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
132 B 31ms
30ms Image
image/gif 172.253.122.113
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1179897253&t=event&ni=0&_s=1&dl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-sms-trump-poll-v16-db%3Futm_term%3Ddb-sajfc-cr50sms-014%26source_code%3Ddb-sajfc-cr50sms-014%26&ul=en-us&de=UTF-8&dt=MAGA&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=donation%20landing%20page&ea=user%20session%20start&el=landing%20page%20settings&_u=YGDAiEABBAAAAGAEK~&jid=&gjid=&cid=818782480.1708962184&tid=UA-73658561-7&_gid=605259594.1708962184&gtm=45He42l0n71NTQZ9Nv72410129za220&gcd=13l3l3l3l1&dma=0&cd41=anonymous&cd58=t&cd61=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-sms-trump-poll-v16-db%3Futm_term%3Ddb-sajfc-cr50sms-014%26source_code%3Ddb-sajfc-cr50sms-014%26&z=392640524

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.113 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f113.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 25 Feb 2024 16:02:54 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 85209
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
www.google-analytics.com/g/ 0
56 B 39ms
39ms Ping
text/plain 172.253.122.113
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-0YWKLMCX4D&gtm=45je42l0v9102512289z872350723za200&_p=1708962182562&gcd=13l3l3l3l1&npa=0&dma=0&cid=818782480.1708962184&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_s=1&sid=1708962183&sct=1&seg=0&dl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-sms-trump-poll-v16-db%3Futm_term%3Ddb-sajfc-cr50sms-014%26source_code%3Ddb-sajfc-cr50sms-014%26&dt=MAGA&en=page_view&_fv=1&_ss=1&ep.cookieDomain=auto&tfd=2043
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-0YWKLMCX4D&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.253.122.113 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bh-in-f113.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Feb 2024 15:43:03 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/11091438865/ 3 KB
2 KB 104ms
42ms Script
text/javascript 172.253.62.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11091438865/?random=1708962183793&cv=11&fst=1708962183793&bg=ffffff&guid=ON&async=1&gtm=45je42l0v9102512289z872350723za200&gcd=13l3l3l3l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-sms-trump-poll-v16-db%3Futm_term%3Ddb-sajfc-cr50sms-014%26source_code%3Ddb-sajfc-cr50sms-014%26&hn=www.googleadservices.com&frm=0&tiba=MAGA&npa=0&pscdl=noapi&auid=306036401.1708962183&uamb=0&uaw=0&data=event%3Dgtag.config%3BcookieDomain%3Dauto&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-0YWKLMCX4D&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f154.1e100.net

Software

cafe /

Resource Hash

2e5ebcc7a99345cc40f3095a81f85b2d2a05f55a11763e87bfa51317395f1762

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Feb 2024 15:43:03 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1394
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adsct
t.co/1/i/ 43 B
377 B 285ms
154ms Image
image/gif 104.244.42.69
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=cccbc223-e40a-480e-bb62-f51e71ba61a2&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=1bee8402-617d-452a-a156-3d2e4e0c5183&tw_document_href=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-sms-trump-poll-v16-db%3Futm_term%3Ddb-sajfc-cr50sms-014%26source_code%3Ddb-sajfc-cr50sms-014%26&tw_iframe_status=0&txn_id=of93e&type=javascript&version=2.3.29

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.69 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-response-time: 94
date: Mon, 26 Feb 2024 15:43:03 GMT
strict-transport-security: max-age=0
server: tsa_b
content-type: image/gif;charset=utf-8
x-transaction-id: 76cbb9249107911e
cache-control: no-cache, no-store, max-age=0
perf: 7469935968
x-connection-hash: 2a60e5543e8191204060d681f182b382855e50c1bff538da38a90ba1e6f9bbd4
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/1/i/ 43 B
726 B 191ms
67ms Image
image/gif 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=cccbc223-e40a-480e-bb62-f51e71ba61a2&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=1bee8402-617d-452a-a156-3d2e4e0c5183&tw_document_href=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-sms-trump-poll-v16-db%3Futm_term%3Ddb-sajfc-cr50sms-014%26source_code%3Ddb-sajfc-cr50sms-014%26&tw_iframe_status=0&txn_id=of93e&type=javascript&version=2.3.29

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_b /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

x-response-time: 7
date: Mon, 26 Feb 2024 15:43:03 GMT
strict-transport-security: max-age=631138519
server: tsa_b
content-type: image/gif;charset=utf-8
x-transaction-id: 5d7c5ccb92f3ee66
cache-control: no-cache, no-store, max-age=0
perf: 7469935968
x-connection-hash: 4f88374d5cb595b19bc09a0a483fff39c386226b12febdab89e23e7c7e1b8d1f
content-length: 43

POST
H2 200 wallet-config Show response
merchant-ui-api.stripe.com/elements/ Frame 2F41 2 KB
3 KB 243ms
164ms Fetch
application/json 198.202.176.141
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://merchant-ui-api.stripe.com/elements/wallet-config

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-dfc36c72938e02dbf0b948f02dc01c05.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

198.202.176.141 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

a1fd3ffbda7f9a22b6cf420f3672f608040b22ae27bc98dd175c6ae1efa6aea5

Security Headers

Name	Value
Content-Security-Policy	report-uri https://q.stripe.com/csp-report?p=elements%2Fwallet-config; block-all-mixed-content; default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; img-src 'self'; script-src 'self' 'report-sample'; style-src 'self'
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 26 Feb 2024 15:43:04 GMT
content-security-policy: report-uri https://q.stripe.com/csp-report?p=elements%2Fwallet-config; block-all-mixed-content; default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; img-src 'self'; script-src 'self' 'report-sample'; style-src 'self'
strict-transport-security: max-age=63072000; includeSubDomains; preload
cross-origin-resource-policy: same-site
content-length: 2502
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
access-control-max-age: 300
access-control-allow-methods: GET, POST
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://js.stripe.com
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
vary: Origin
access-control-allow-headers: x-stripe-csrf-token
cross-origin-opener-policy-report-only: same-origin; report-to=https://q.stripe.com/coop-report
expires: 0

GET
H2 200 1599889267195467 Show response
connect.facebook.net/signals/config/ 61 KB
13 KB 31ms
31ms Script
application/x-javascript 31.13.66.19
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1599889267195467?v=2.9.147&r=stable&domain=secure.winred.com&hme=20c913bdcd4be51a752120153aa5caaecb3ee86c7f26cf737846e40b202aba68&ex_m=62%2C106%2C94%2C98%2C53%2C3%2C88%2C61%2C14%2C86%2C79%2C44%2C46%2C150%2C153%2C164%2C160%2C161%2C163%2C25%2C89%2C45%2C68%2C162%2C145%2C148%2C157%2C158%2C165%2C115%2C13%2C43%2C169%2C168%2C117%2C16%2C29%2C32%2C1%2C36%2C57%2C58%2C59%2C63%2C83%2C15%2C12%2C85%2C82%2C81%2C95%2C97%2C31%2C96%2C26%2C22%2C146%2C149%2C124%2C24%2C9%2C10%2C11%2C5%2C6%2C21%2C19%2C20%2C49%2C54%2C56%2C66%2C90%2C23%2C67%2C8%2C7%2C71%2C41%2C18%2C92%2C91%2C17%2C4%2C73%2C80%2C72%2C78%2C40%2C39%2C77%2C33%2C35%2C76%2C48%2C74%2C28%2C37%2C65%2C0%2C84%2C75%2C2%2C30%2C55%2C34%2C93%2C38%2C70%2C60%2C99%2C52%2C51%2C27%2C87%2C50%2C47%2C42%2C69%2C64%2C100

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

31.13.66.19 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-iad3.fbcdn.net

Software

Resource Hash

7aa3e069e8b82688828c1d83cfd3d1a715bf1dfdccdb94438120cf79ec9274e4

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

permissions-policy-report-only: clipboard-read=(), clipboard-write=(), picture-in-picture=();report-to="permissions_policy"
content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Mon, 26 Feb 2024 15:43:03 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 12810
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
pragma: public
x-fb-debug: 4zZW5euUZLH5I/3eTi7ABVKog5d7g+DGKPMki4WLmjR+dG8ZfJZckN5FhVn1CqCTNaefjkVui5tOgeL7rDF56Q==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 payframe Show response
pay.google.com/gp/p/ui/ Frame 6251 19 KB
8 KB 61ms
60ms Document
text/html 172.253.115.92
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pay.google.com/gp/p/ui/payframe?origin=https%3A%2F%2Fjs.stripe.com&mid=

Requested by

Host: pay.google.com
URL: https://pay.google.com/gp/p/js/pay.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.92 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f92.1e100.net

Software

ESF /

Resource Hash

88c6aad586b488b6440cad6d6e82ff0cb00e17ade437d2aa07add8994d57982c

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-zy99Ku4Jt2GE6KIkoKY5Lg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport;worker-src 'self' script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport/allowlist require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://js.stripe.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=3600
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-zy99Ku4Jt2GE6KIkoKY5Lg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport;worker-src 'self' script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport/allowlist require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport
content-type: text/html; charset=utf-8
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-site
date: Mon, 26 Feb 2024 15:43:03 GMT
expires: Mon, 26 Feb 2024 15:43:03 GMT
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
reporting-endpoints: default="/gp/p/_/InstantbuyFrontendBuyflowPayframeUi/web-reports?context=eJzjKtHikmII1JBiWF4qxVBRK8WwZKYUg2fNTabOPTeZ1nU9YlrY_pRJk-sZU33UM6aZvM-Z4k48ZxJ885zp3b8XTO--vGTi-PqSSQKI1YB4h48Hi5jPdFa-ddNZVYBYc_101kAgdkqfwRoAxD71M1ijgFiIh6P98ad1bAIfru7fyAwAMp806g"
server: ESF
strict-transport-security: max-age=31536000
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-content-type-options: nosniff
x-ua-compatible: IE=edge
x-xss-protection: 0

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
70 B 39ms
38ms XHR
text/plain 142.250.31.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-60901920-1&cid=818782480.1708962184&jid=1157386572&gjid=308702753&_gid=605259594.1708962184&_u=YGBACEAABAAAACAAI~&z=51966123

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.31.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f156.1e100.net

Software

Golfe2 /

Resource Hash

8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Mon, 26 Feb 2024 15:43:03 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 255 KB
86 KB 49ms
49ms Script
application/javascript 142.250.31.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-HNR33QTX08&cx=c&_slc=1

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

d71837085a430ef3fc2ba4901eb669568469df3dbee23e68690125f6a287b01f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Mon, 26 Feb 2024 15:43:03 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 88366
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 26 Feb 2024 15:43:03 GMT

GET
H2 200 collect Show response
gtm.winred.com/g/ 739 B
985 B 220ms
159ms XHR
text/plain 104.16.250.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gtm.winred.com/g/collect?v=2&tid=G-X6H0114PDF&gtm=45je42l0v867905447z872410129za220&_p=1708962182562&gcd=13l3l3l3l1&npa=0&dma=0&cid=818782480.1708962184&ul=en-us&sr=1600x1200&_fplc=0&ur=CA-QC&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&sst.uc=CA&sst.gse=1&sst.etld=google.ca&sst.gcd=13l3l3l3l1&sst.tft=1708962182562&_s=1&sid=1708962183&sct=1&seg=0&dl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-sms-trump-poll-v16-db%3Futm_term%3Ddb-sajfc-cr50sms-014%26source_code%3Ddb-sajfc-cr50sms-014%26&dt=MAGA&en=page_view&_fv=1&_ss=1&ep.pagepath=%2Fsave-america-joint-fundraising-committee%2Flp-sms-trump-poll-v16-db&ep.pagehostname=secure.winred.com&ep.parsedurl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-sms-trump-poll-v16-db&epn.load_time_sec=-1708962181.7&epn.event_fire_time=1708962183236&ep.event_uuid=79591d8d-4b80-4d15-b8af-9396d0905176&ep.isVideoPage=f&ep.referrer=&tfd=2156&richsstsse

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.250.69 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bb6daad8bfcebeda56cb73bc7dfe8e5d2cd6333710ec83cf933ad109b7ab728a

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Mon, 26 Feb 2024 15:43:04 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
server: cloudflare
strict-transport-security: max-age=0; includeSubDomains
vary: Accept-Encoding
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 85b94d31ddf236eb-YYZ
alt-svc: h3=":443"; ma=86400

POST
H2 200 b Show response
r.stripe.com/ Frame 6609 0
274 B 327ms
122ms Fetch
text/plain 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-dfc36c72938e02dbf0b948f02dc01c05.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-159-182.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Mon, 26 Feb 2024 15:43:04 GMT
x-stripe-server-envoy-start-time-us: 1708962184206803
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 4
x-stripe-client-envoy-start-time-us: 1708962184206459
access-control-allow-credentials: true
content-length: 0

POST
H2 200 b Show response
r.stripe.com/ Frame 2F41 0
273 B 415ms
212ms Fetch
text/plain 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-dfc36c72938e02dbf0b948f02dc01c05.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-159-182.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Mon, 26 Feb 2024 15:43:04 GMT
x-stripe-server-envoy-start-time-us: 1708962184295721
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 5
x-stripe-client-envoy-start-time-us: 1708962184295264
access-control-allow-credentials: true
content-length: 0

POST
H2 200 b Show response
r.stripe.com/ Frame 2F41 0
273 B 404ms
205ms Fetch
text/plain 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-dfc36c72938e02dbf0b948f02dc01c05.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-159-182.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Mon, 26 Feb 2024 15:43:04 GMT
x-stripe-server-envoy-start-time-us: 1708962184289542
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 4
x-stripe-client-envoy-start-time-us: 1708962184289293
access-control-allow-credentials: true
content-length: 0

POST
H2 200 wallet-config Show response
merchant-ui-api.stripe.com/elements/ Frame 6609 2 KB
3 KB 170ms
169ms Fetch
application/json 198.202.176.141
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://merchant-ui-api.stripe.com/elements/wallet-config

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-dfc36c72938e02dbf0b948f02dc01c05.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

198.202.176.141 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

6b5c5665f31951a78369562f709f561506f92fa24c69469e42fc013963e9fb50

Security Headers

Name	Value
Content-Security-Policy	report-uri https://q.stripe.com/csp-report?p=elements%2Fwallet-config; block-all-mixed-content; default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; img-src 'self'; script-src 'self' 'report-sample'; style-src 'self'
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 26 Feb 2024 15:43:04 GMT
content-security-policy: report-uri https://q.stripe.com/csp-report?p=elements%2Fwallet-config; block-all-mixed-content; default-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'; img-src 'self'; script-src 'self' 'report-sample'; style-src 'self'
strict-transport-security: max-age=63072000; includeSubDomains; preload
cross-origin-resource-policy: same-site
content-length: 2502
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
access-control-max-age: 300
access-control-allow-methods: GET, POST
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://js.stripe.com
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
vary: Origin
access-control-allow-headers: x-stripe-csrf-token
cross-origin-opener-policy-report-only: same-origin; report-to=https://q.stripe.com/coop-report
expires: 0

POST
H2 200 b Show response
r.stripe.com/ Frame 6609 0
273 B 351ms
195ms Fetch
text/plain 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-dfc36c72938e02dbf0b948f02dc01c05.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-159-182.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Mon, 26 Feb 2024 15:43:04 GMT
x-stripe-server-envoy-start-time-us: 1708962184278075
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 6
x-stripe-client-envoy-start-time-us: 1708962184277409
access-control-allow-credentials: true
content-length: 0

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
408 B 113ms
51ms Image
image/gif 172.253.122.106
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-73658561-7&cid=818782480.1708962184&jid=1677590561&_u=YGDAiEABBAAAAGAEK~&z=1014883192

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f106.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Feb 2024 15:43:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.ca/ads/ 42 B
107 B 115ms
51ms Image
image/gif 142.250.31.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-73658561-7&cid=818782480.1708962184&jid=1677590561&_u=YGDAiEABBAAAAGAEK~&z=1014883192

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.31.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f94.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Feb 2024 15:43:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 m=_b,_tp Show response
www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.vFUoTPM3-pM.es5.O/am=gEEa/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/ujg=1/rs=AMi... Frame 6251 158 KB
56 KB 93ms
31ms Script
text/javascript 172.253.122.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.vFUoTPM3-pM.es5.O/am=gEEa/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/ujg=1/rs=AMitfriLce_A0UuawDkp9p8u6DMpJq-xWA/m=_b,_tp

Requested by

Host: pay.google.com
URL: https://pay.google.com/gp/p/ui/payframe?origin=https%3A%2F%2Fjs.stripe.com&mid=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f94.1e100.net

Software

sffe /

Resource Hash

b1322c7a9be782f0436fb0ece75829d265964462c36f2e5530c3ff78e0b5ac55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Fri, 23 Feb 2024 17:20:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 253351
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/payments-consumer-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57137
x-xss-protection: 0
last-modified: Fri, 23 Feb 2024 07:01:27 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="boq-infra/payments-consumer-boq-js-css-signers"
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/payments-consumer-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/payments-consumer-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Sat, 22 Feb 2025 17:20:33 GMT

GET
H2 200 .deploy_status_henson.json Show response
js.stripe.com/v3/ Frame B5EC 474 B
398 B 16ms
16ms Fetch
application/json 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/.deploy_status_henson.json

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-dfc36c72938e02dbf0b948f02dc01c05.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

b0f2842cf2fe230f30d403634d26de441e415c437b4d81fe2626ea0e95426c78

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/v3/elements-inner-card-a0cdf3329d4008ecf745f5bd6d7ff8c4.html
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 26 Feb 2024 15:43:04 GMT
content-encoding: br
via: 1.1 varnish
strict-transport-security: max-age=31556926; includeSubDomains; preload
age: 5
x-cache: HIT
content-length: 298
x-request-id: 6fbba789-6ce1-423d-99f7-26865a5e5980
x-served-by: cache-yul1970043-YUL
last-modified: Fri, 23 Feb 2024 21:40:09 GMT
server: Fastly
etag: "f2dfc898e40eddf6e7e8133dd4803280"
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=60
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 10

POST
H2 200 6 Show response
m.stripe.com/ Frame E63C 156 B
670 B 334ms
109ms XHR
application/json 44.236.167.79
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.com/6

Requested by

Host: m.stripe.network
URL: https://m.stripe.network/out-4.5.43.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.236.167.79 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-44-236-167-79.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

3a812fdbca60bfc0852ea2bb36f1aaf2672020a5b741ea90ee5d3e8ee4db3a42

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://m.stripe.network/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-stripe-bg-intended-route-color: green
date: Mon, 26 Feb 2024 15:43:04 GMT
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1708962184293471
server: nginx
content-type: application/json;charset=utf-8
x-stripe-server-envoy-upstream-service-time-ms: 3
access-control-allow-origin: https://m.stripe.network
x-stripe-client-envoy-start-time-us: 1708962184293262
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 156

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 97ms
64ms Image
image/gif 172.253.122.106
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-60901920-1&cid=818782480.1708962184&jid=1157386572&_u=YGBACEAABAAAACAAI~&z=580678248

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f106.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Feb 2024 15:43:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.ca/ads/ 42 B
107 B 131ms
96ms Image
image/gif 142.250.31.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-60901920-1&cid=818782480.1708962184&jid=1157386572&_u=YGBACEAABAAAACAAI~&z=580678248

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.31.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f94.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Feb 2024 15:43:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 b Show response
r.stripe.com/ Frame 2F41 0
273 B 333ms
223ms Fetch
text/plain 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-dfc36c72938e02dbf0b948f02dc01c05.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-159-182.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Mon, 26 Feb 2024 15:43:04 GMT
x-stripe-server-envoy-start-time-us: 1708962184307568
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 4
x-stripe-client-envoy-start-time-us: 1708962184307185
access-control-allow-credentials: true
content-length: 0

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 123ms
32ms Image
text/plain 31.13.66.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1599889267195467&ev=PageView&dl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-sms-trump-poll-v16-db%3Futm_term%3Ddb-sajfc-cr50sms-014%26source_code%3Ddb-sajfc-cr50sms-014%26&rl=&if=false&ts=1708962184032&sw=1600&sh=1200&v=2.9.147&r=stable&ec=0&o=4126&fbp=fb.1.1708962184030.1829367487&cs_est=true&ler=empty&cdl=API_unavailable&it=1708962183856&coo=false&exp=e1&rqm=GET

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

31.13.66.35 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-iad3.facebook.com

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Mon, 26 Feb 2024 15:43:04 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.google.com/pagead/1p-user-list/11091438865/ 42 B
154 B 86ms
75ms Image
image/gif 172.253.122.106
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/11091438865/?random=1708962183793&cv=11&fst=1708959600000&bg=ffffff&guid=ON&async=1&gtm=45je42l0v9102512289z872350723za200&gcd=13l3l3l3l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-sms-trump-poll-v16-db%3Futm_term%3Ddb-sajfc-cr50sms-014%26source_code%3Ddb-sajfc-cr50sms-014%26&frm=0&tiba=MAGA&npa=0&data=event%3Dgtag.config%3BcookieDomain%3Dauto&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_jeGkvMDcVHAhJ8PYCRAtk7IYH5JyfTXEIAnsvBsvNMA-lDIo&random=3499712675&rmt_tld=0&ipr=y

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f106.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Feb 2024 15:43:04 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.ca/pagead/1p-user-list/11091438865/ 42 B
455 B 56ms
43ms Image
image/gif 142.250.31.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-user-list/11091438865/?random=1708962183793&cv=11&fst=1708959600000&bg=ffffff&guid=ON&async=1&gtm=45je42l0v9102512289z872350723za200&gcd=13l3l3l3l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-sms-trump-poll-v16-db%3Futm_term%3Ddb-sajfc-cr50sms-014%26source_code%3Ddb-sajfc-cr50sms-014%26&frm=0&tiba=MAGA&npa=0&data=event%3Dgtag.config%3BcookieDomain%3Dauto&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_jeGkvMDcVHAhJ8PYCRAtk7IYH5JyfTXEIAnsvBsvNMA-lDIo&random=3499712675&rmt_tld=1&ipr=y

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.31.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f94.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Feb 2024 15:43:04 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
analytics.google.com/g/ 0
255 B 86ms
38ms Ping
text/plain 216.239.38.181
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-HNR33QTX08&_ono=1&gtm=45je42l0v9164375506za200&_p=1708962182562&_gaz=1&gcd=13l3l3l3l2&npa=0&dma=0&ul=en-us&sr=1600x1200&cid=818782480.1708962184&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_eu=EBAI&_s=1&dl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-sms-trump-poll-v16-db%3Futm_term%3Ddb-sajfc-cr50sms-014%26source_code%3Ddb-sajfc-cr50sms-014%26&dt=MAGA&sid=1708962184&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1&tfd=2331
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-HNR33QTX08&cx=c&_slc=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.239.38.181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Feb 2024 15:43:04 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 collect
stats.g.doubleclick.net/g/ 0
17 B 38ms
37ms Ping
text/plain 142.250.31.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&_ono=1&tid=G-HNR33QTX08&cid=818782480.1708962184&gtm=45je42l0v9164375506za200&aip=1&dma=0&gcd=13l3l3l3l2&npa=0
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-HNR33QTX08&cx=c&_slc=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.31.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bj-in-f156.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Feb 2024 15:43:04 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.ca/ads/ 42 B
107 B 98ms
98ms Image
image/gif 142.250.31.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&_ono=1&tid=G-HNR33QTX08&cid=818782480.1708962184&gtm=45je42l0v9164375506za200&aip=1&dma=0&gcd=13l3l3l3l2&npa=0&z=788128071

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.31.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f94.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Feb 2024 15:43:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 b Show response
r.stripe.com/ Frame 6609 0
273 B 283ms
236ms Fetch
text/plain 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-dfc36c72938e02dbf0b948f02dc01c05.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-159-182.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Mon, 26 Feb 2024 15:43:04 GMT
x-stripe-server-envoy-start-time-us: 1708962184319756
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 6
x-stripe-client-envoy-start-time-us: 1708962184319192
access-control-allow-credentials: true
content-length: 0

POST
H2 204 collect
analytics.google.com/g/s/ 0
45 B 48ms
47ms Ping
text/plain 216.239.38.181
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/s/collect?dma=0&gtm=45j91e42k1v867905447z872410129z9867900975za220&_gsid=X6H0114PDFlO26BDbBJIB_m8ZeOEfutg
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.239.38.181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Feb 2024 15:43:04 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 collect
stats.g.doubleclick.net/g/ 0
17 B 41ms
40ms Ping
text/plain 142.250.31.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&dma=0&tid=G-X6H0114PDF&cid=J%2FlZ%2FGwYbIXAqo5ybynvbFlYZO2bDFSi8n7RVHVxqVo%3D.1708962184&gtm=45j91e42k1v867905447z872410129z9867900975za220&aip=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.31.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bj-in-f156.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Feb 2024 15:43:04 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.ca/ads/ 42 B
107 B 48ms
47ms Image
image/gif 142.250.31.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&dma=0&tid=G-X6H0114PDF&cid=J%2FlZ%2FGwYbIXAqo5ybynvbFlYZO2bDFSi8n7RVHVxqVo%3D.1708962184&gtm=45j91e42k1v867905447z872410129z9867900975za220&aip=1&z=988779772

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.31.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f94.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Feb 2024 15:43:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 m=Das5Le Show response
www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.vFUoTPM3-pM.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.s9r... Frame 6251 75 KB
27 KB 31ms
31ms Script
text/javascript 172.253.122.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.vFUoTPM3-pM.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.s9rFdXq63so.L.B1.O/am=gEEa/d=1/exm=_b,_tp/excm=_b,_tp,payframeview/ed=1/wt=2/ujg=1/rs=AMitfrhQ9Ym_uTRximaaYs9B7_Z6YA_r4A/ee=EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SNUn3:ZwDk9d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;oGtAuc:sOXFj;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;wR5FRb:siKnQd;yEQyxe:p8L0ob;yxTchf:KUM7Z/m=Das5Le

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.vFUoTPM3-pM.es5.O/am=gEEa/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/ujg=1/rs=AMitfriLce_A0UuawDkp9p8u6DMpJq-xWA/m=_b,_tp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f94.1e100.net

Software

sffe /

Resource Hash

2cc1053348763e5da32a090789cc66f55c22c6a56b9aa2e312aac1ab8d207591

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Fri, 23 Feb 2024 17:20:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 253327
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/payments-consumer-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27704
x-xss-protection: 0
last-modified: Wed, 21 Feb 2024 06:09:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="boq-infra/payments-consumer-boq-js-css-signers"
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/payments-consumer-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/payments-consumer-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Sat, 22 Feb 2025 17:20:57 GMT

GET
H2 200 hcaptcha-invisible-8f0fe4e84ddf0420df4a1a67d99fe1fb.html Show response
js.stripe.com/v3/ Frame 3B01 71 KB
25 KB 16ms
16ms Document
text/html 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/hcaptcha-invisible-8f0fe4e84ddf0420df4a1a67d99fe1fb.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

ed0a155ad49d65503a2bfb7f8cae86f1a80eb6fd34c2cc5e309b2c4057b3187c

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://errors.stripe.com https://r.stripe.com; default-src 'self'; form-action 'none'; frame-src 'self' https://b.stripecdn.com; img-src 'self' https://q.stripe.com; object-src 'none'; script-src 'self' 'sha256-Acg/8ybJgL3Cdyg920NvxmHYlzvKfKmoYvhZOxK7Cm8='; style-src 'self'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 239921
cache-control: max-age=31536000
content-encoding: br
content-length: 25122
content-security-policy: base-uri 'none'; connect-src 'self' https://errors.stripe.com https://r.stripe.com; default-src 'self'; form-action 'none'; frame-src 'self' https://b.stripecdn.com; img-src 'self' https://q.stripe.com; object-src 'none'; script-src 'self' 'sha256-Acg/8ybJgL3Cdyg920NvxmHYlzvKfKmoYvhZOxK7Cm8='; style-src 'self'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Mon, 26 Feb 2024 15:43:04 GMT
etag: "8f0fe4e84ddf0420df4a1a67d99fe1fb"
last-modified: Fri, 23 Feb 2024 21:02:42 GMT
server: Fastly
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 8327
x-content-type-options: nosniff
x-request-id: 8072e619-cd65-41c6-8c70-00d39ea5dff5
x-served-by: cache-yul1970023-YUL

POST
H2 200 b Show response
r.stripe.com/ Frame 6609 0
273 B 220ms
220ms Fetch
text/plain 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-dfc36c72938e02dbf0b948f02dc01c05.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-159-182.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Mon, 26 Feb 2024 15:43:04 GMT
x-stripe-server-envoy-start-time-us: 1708962184331273
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 4
x-stripe-client-envoy-start-time-us: 1708962184331051
access-control-allow-credentials: true
content-length: 0

GET
H2 200 phone-numbers-lib-5113174565c377315fd5b8d695d8b541.js Show response
js.stripe.com/v3/fingerprinted/js/ 148 KB
40 KB 16ms
16ms Script
text/javascript 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/phone-numbers-lib-5113174565c377315fd5b8d695d8b541.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

621661fe1c7a59420c624f7a421c566ebfb38cfbc7edd98ee0462c44d15971f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Mon, 26 Feb 2024 15:43:04 GMT
via: 1.1 varnish
age: 1503281
x-cache: HIT
content-length: 40295
x-request-id: a51f17c2-f65f-4eea-94fa-b438e3eebfc5
x-served-by: cache-yul1970023-YUL
last-modified: Thu, 08 Feb 2024 22:46:19 GMT
server: Fastly
etag: "f7a3e754fa2fa9117506f69f618b5778"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 6535

GET
H2 200 elements-inner-link-button-for-card-a601a35b67a22542634fc1b3c0af285a.html Show response
js.stripe.com/v3/ Frame 37F4 78 KB
17 KB 16ms
15ms Document
text/html 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/elements-inner-link-button-for-card-a601a35b67a22542634fc1b3c0af285a.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

78ab2b963e7ba74ef400ed721024f39a48b230800debc2432066be7a8695cff6

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://ppm.stripe.com; default-src 'self'; font-src data: https:; form-action 'none'; frame-src 'self' https://www.affirm.com https://checkout.link.com https://b.stripecdn.com; img-src 'self' https://q.stripe.com https://b.stripecdn.com https://js.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 239921
cache-control: max-age=31536000
content-encoding: br
content-length: 16209
content-security-policy: base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://ppm.stripe.com; default-src 'self'; font-src data: https:; form-action 'none'; frame-src 'self' https://www.affirm.com https://checkout.link.com https://b.stripecdn.com; img-src 'self' https://q.stripe.com https://b.stripecdn.com https://js.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-security-policy-report-only: base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://ppm.stripe.com; default-src 'self'; font-src data: https:; form-action 'none'; frame-src 'self' https://www.affirm.com https://checkout.link.com https://b.stripecdn.com; img-src 'self' https://q.stripe.com https://b.stripecdn.com https://js.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Mon, 26 Feb 2024 15:43:04 GMT
etag: "a601a35b67a22542634fc1b3c0af285a"
last-modified: Fri, 23 Feb 2024 21:02:27 GMT
server: Fastly
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 3643
x-content-type-options: nosniff
x-request-id: fb0a319e-e888-4a27-a12a-6f4eef60a38c
x-served-by: cache-yul1970023-YUL

GET
H2 200 shared-dfc36c72938e02dbf0b948f02dc01c05.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 37F4 535 KB
130 KB 18ms
17ms Script
text/javascript 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-dfc36c72938e02dbf0b948f02dc01c05.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-link-button-for-card-a601a35b67a22542634fc1b3c0af285a.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

9a53a378b0bf8737dd5384da05ca56af9af8e7a218eb8a2d22a96eca1ac5141b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-link-button-for-card-a601a35b67a22542634fc1b3c0af285a.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Mon, 26 Feb 2024 15:43:04 GMT
via: 1.1 varnish
age: 239929
x-cache: HIT
content-length: 133281
x-request-id: e0b222e6-69ce-407c-99f1-c375abf1fcb8
x-served-by: cache-yul1970023-YUL
last-modified: Fri, 23 Feb 2024 21:02:41 GMT
server: Fastly
etag: "ee779d877b789585dcd76914b08ab7f0"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 4470

GET
H2 200 elements-inner-link-button-for-card-3e3c6751186392e3859c5f4470b4d0df.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 37F4 25 KB
10 KB 18ms
17ms Script
text/javascript 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/elements-inner-link-button-for-card-3e3c6751186392e3859c5f4470b4d0df.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-link-button-for-card-a601a35b67a22542634fc1b3c0af285a.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

c67fd705b4a52a62066cd60979c65edfa8b0d6c3da9a8d88d21afd56c11042e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-link-button-for-card-a601a35b67a22542634fc1b3c0af285a.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Mon, 26 Feb 2024 15:43:04 GMT
via: 1.1 varnish
age: 1028161
x-cache: HIT
content-length: 9702
x-request-id: fa1b6ee5-ada4-4937-b280-1b4d505ed5dd
x-served-by: cache-yul1970023-YUL
last-modified: Wed, 14 Feb 2024 18:03:44 GMT
server: Fastly
etag: "12873bf8979ee1f4c70fe3749e63d8a2"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 4997

GET
H2 200 elements-inner-link-button-for-card-e0892059cc36c5a207d4915b8be6a4f3.css
js.stripe.com/v3/fingerprinted/css/ Frame 37F4 25 KB
4 KB 16ms
16ms Stylesheet
text/css 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/css/elements-inner-link-button-for-card-e0892059cc36c5a207d4915b8be6a4f3.css

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-link-button-for-card-a601a35b67a22542634fc1b3c0af285a.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

d9b7faa0259f5b0961455f53b4a507fba4bd0ed70dffac0bdaf2f94298c74b40

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-link-button-for-card-a601a35b67a22542634fc1b3c0af285a.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Mon, 26 Feb 2024 15:43:04 GMT
via: 1.1 varnish
age: 1502246
x-cache: HIT
content-length: 4362
x-request-id: ee44722b-2555-42cf-af26-31369149e122
x-served-by: cache-yul1970023-YUL
last-modified: Thu, 08 Feb 2024 22:46:07 GMT
server: Fastly
etag: "ec65bfd4737d216032b538eb56aec1bd"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 4894

GET
H2 200 .deploy_status_henson.json Show response
js.stripe.com/v3/ Frame 3B01 474 B
567 B 16ms
15ms Fetch
application/json 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/.deploy_status_henson.json

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/hcaptcha-invisible-8f0fe4e84ddf0420df4a1a67d99fe1fb.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

b0f2842cf2fe230f30d403634d26de441e415c437b4d81fe2626ea0e95426c78

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/v3/hcaptcha-invisible-8f0fe4e84ddf0420df4a1a67d99fe1fb.html
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 26 Feb 2024 15:43:04 GMT
content-encoding: br
via: 1.1 varnish
strict-transport-security: max-age=31556926; includeSubDomains; preload
age: 5
x-cache: HIT
content-length: 298
x-request-id: bbdfdbd6-c4b0-4914-89a5-2b36e9667223
x-served-by: cache-yul1970043-YUL
last-modified: Fri, 23 Feb 2024 21:40:09 GMT
server: Fastly
etag: "f2dfc898e40eddf6e7e8133dd4803280"
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=60
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 11

GET
H2 200 HCaptchaInvisible.html Show response
b.stripecdn.com/stripethirdparty-srv/assets/v20.17/ Frame B911 419 B
1 KB 178ms
39ms Document
text/html 52.84.125.40
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://b.stripecdn.com/stripethirdparty-srv/assets/v20.17/HCaptchaInvisible.html?id=ab50c790-b01b-45a6-badb-5ed7c85803d5&origin=https%3A%2F%2Fjs.stripe.com

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/hcaptcha-invisible-8f0fe4e84ddf0420df4a1a67d99fe1fb.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.84.125.40 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-84-125-40.ord53.r.cloudfront.net

Software

Cloudfront /

Resource Hash

c64a6e5cd18f4259ba04815cf49fc93b4a6e7d9eb5d27e003246cd19ed1cfa22

Security Headers

Name	Value
Content-Security-Policy	base-uri 'self'; connect-src 'self' https://hcaptcha.com https://.hcaptcha.com https://errors.stripe.com; default-src 'self'; form-action 'none'; frame-src https://hcaptcha.com https://.hcaptcha.com; img-src 'self'; object-src 'none'; script-src 'self' https://hcaptcha.com https://.hcaptcha.com; style-src 'self' https://hcaptcha.com https://.hcaptcha.com; worker-src 'none'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.stripe.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 50
cache-control: max-age=60, stale-while-revalidate=900
content-length: 419
content-security-policy: base-uri 'self'; connect-src 'self' https://hcaptcha.com https://*.hcaptcha.com https://errors.stripe.com; default-src 'self'; form-action 'none'; frame-src https://hcaptcha.com https://*.hcaptcha.com; img-src 'self'; object-src 'none'; script-src 'self' https://hcaptcha.com https://*.hcaptcha.com; style-src 'self' https://hcaptcha.com https://*.hcaptcha.com; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Mon, 26 Feb 2024 15:42:15 GMT
etag: "732c33dbd0eb337f5891ab03521f3395"
last-modified: Thu, 15 Feb 2024 18:31:17 GMT
server: Cloudfront
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding,Origin
via: 1.1 3b8efcb1738e7807d88ed1cff31b3f3a.cloudfront.net (CloudFront)
x-amz-cf-id: DWmATZSR1-Qth_LLjtAPWoDKGzVIO0Z02u2hckbCtyj5TWYXTCPJcQ==
x-amz-cf-pop: ORD53-C1
x-cache: Hit from cloudfront
x-content-type-options: nosniff

GET
H3 200 pay Show response
pay.google.com/gp/p/ui/ Frame 6251 1 MB
376 KB 60ms
60ms XHR
text/html 172.253.115.92
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pay.google.com/gp/p/ui/pay

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.92 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f92.1e100.net

Software

ESF /

Resource Hash

310550e8d18b7d5910f060761bc8ff62539b09e6298d1c3430fb81f67058fec4

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-5pPJGJSi8YKuhJ6tYEwGbw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com https://sandbox.google.com https://payments.google.com https://payments.sandbox.google.com https://pay.google.com https://pay.sandbox.google.com;report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Mon, 26 Feb 2024 15:43:04 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-5pPJGJSi8YKuhJ6tYEwGbw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com https://sandbox.google.com https://payments.google.com https://payments.sandbox.google.com https://pay.google.com https://pay.sandbox.google.com;report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport
x-content-type-options: nosniff
cross-origin-resource-policy: same-site
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
reporting-endpoints: default="/gp/p/_/InstantbuyFrontendBuyflowPayUi/web-reports?context=eJzjKtHikmII1JBiWF4qxVBRK8WwZKYUg2fNTabOPTeZ1nU9YlrY_pRJk-sZU33UM6aZvM-Z4k48ZxJ885zp3b8XTO--vGTi-PqSSQKI1YB4h48Hi5jPdFa-ddNZVYBYc_101kAgdkqfwRoAxD71M1ijgFiIh6Pj8ad1bAI3PmxsYgQAMhQ0rw"
x-ua-compatible: IE=edge
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: unsafe-none
server: ESF
x-frame-options: DENY
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
cache-control: private, max-age=3600
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 26 Feb 2024 15:43:04 GMT

GET
H3 200 m=Wt6vjf,hhhU8,FCpbqb,WhJNk Show response
www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.vFUoTPM3-pM.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.s9r... Frame 6251 10 KB
4 KB 34ms
33ms Script
text/javascript 172.253.122.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.vFUoTPM3-pM.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.s9rFdXq63so.L.B1.O/am=gEEa/d=1/exm=Das5Le,_b,_tp/excm=_b,_tp,payframeview/ed=1/wt=2/ujg=1/rs=AMitfrhQ9Ym_uTRximaaYs9B7_Z6YA_r4A/ee=EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SNUn3:ZwDk9d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;oGtAuc:sOXFj;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;wR5FRb:siKnQd;yEQyxe:p8L0ob;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f94.1e100.net

Software

sffe /

Resource Hash

4158adb5a7663a1c27ca5da162a32fbb2a0df8cb57072d28815feef493c5534d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Fri, 23 Feb 2024 17:20:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 253327
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/payments-consumer-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4142
x-xss-protection: 0
last-modified: Wed, 21 Feb 2024 06:09:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="boq-infra/payments-consumer-boq-js-css-signers"
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/payments-consumer-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/payments-consumer-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Sat, 22 Feb 2025 17:20:57 GMT

GET
H3 200 m=byfTOb,lsjVmc,LEikZe,lwddkf,EFQ78c Show response
www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.vFUoTPM3-pM.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.s9r... Frame 6251 37 KB
14 KB 31ms
31ms Script
text/javascript 172.253.122.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.vFUoTPM3-pM.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.s9rFdXq63so.L.B1.O/am=gEEa/d=1/exm=Das5Le,FCpbqb,WhJNk,Wt6vjf,_b,_tp,hhhU8/excm=_b,_tp,payframeview/ed=1/wt=2/ujg=1/rs=AMitfrhQ9Ym_uTRximaaYs9B7_Z6YA_r4A/ee=EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SNUn3:ZwDk9d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;oGtAuc:sOXFj;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;wR5FRb:siKnQd;yEQyxe:p8L0ob;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe,lwddkf,EFQ78c

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f94.1e100.net

Software

sffe /

Resource Hash

706a1fcf9dc4f3efb060b17963f5b1d4cf07bb39161340adea90b81caf428f1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Fri, 23 Feb 2024 17:20:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 253327
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/payments-consumer-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14351
x-xss-protection: 0
last-modified: Wed, 21 Feb 2024 06:09:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="boq-infra/payments-consumer-boq-js-css-signers"
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/payments-consumer-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/payments-consumer-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Sat, 22 Feb 2025 17:20:57 GMT

POST
H3 200 log Show response
play.google.com/ Frame 6251 131 B
155 B 126ms
64ms XHR
text/plain 172.253.63.101
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.101 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f101.1e100.net

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://pay.google.com/
X-Goog-AuthUser: 0
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Mon, 26 Feb 2024 15:43:04 GMT
content-encoding: gzip
server: Playlog
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: X-Playlog-Web
content-length: 131
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 26 Feb 2024 15:43:04 GMT

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 105ms
41ms Preflight
text/plain 172.253.63.101
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.101 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f101.1e100.net

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: x-goog-authuser
Access-Control-Request-Method: POST
Origin: https://pay.google.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://pay.google.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/plain; charset=UTF-8
date: Mon, 26 Feb 2024 15:43:04 GMT
server: Playlog
x-frame-options: SAMEORIGIN
x-xss-protection: 0

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 106ms
43ms Preflight
text/plain 172.253.63.101
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.101 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f101.1e100.net

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: x-goog-authuser
Access-Control-Request-Method: POST
Origin: https://pay.google.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://pay.google.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/plain; charset=UTF-8
date: Mon, 26 Feb 2024 15:43:04 GMT
server: Playlog
x-frame-options: SAMEORIGIN
x-xss-protection: 0

POST
H3 200 log Show response
play.google.com/ Frame 6251 131 B
155 B 121ms
63ms XHR
text/plain 172.253.63.101
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.101 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f101.1e100.net

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://pay.google.com/
X-Goog-AuthUser: 0
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Mon, 26 Feb 2024 15:43:04 GMT
content-encoding: gzip
server: Playlog
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: X-Playlog-Web
content-length: 131
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 26 Feb 2024 15:43:04 GMT

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 105ms
43ms Preflight
text/plain 172.253.63.101
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.101 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f101.1e100.net

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: x-goog-authuser
Access-Control-Request-Method: POST
Origin: https://pay.google.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://pay.google.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/plain; charset=UTF-8
date: Mon, 26 Feb 2024 15:43:04 GMT
server: Playlog
x-frame-options: SAMEORIGIN
x-xss-protection: 0

POST
H3 200 log Show response
play.google.com/ Frame 6251 131 B
155 B 132ms
74ms XHR
text/plain 172.253.63.101
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.101 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f101.1e100.net

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://pay.google.com/
X-Goog-AuthUser: 0
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Mon, 26 Feb 2024 15:43:04 GMT
content-encoding: gzip
server: Playlog
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: X-Playlog-Web
content-length: 131
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 26 Feb 2024 15:43:04 GMT

POST
H3 200 log Show response
play.google.com/ Frame 6251 131 B
155 B 134ms
75ms XHR
text/plain 172.253.63.101
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.101 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f101.1e100.net

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://pay.google.com/
X-Goog-AuthUser: 0
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Mon, 26 Feb 2024 15:43:04 GMT
content-encoding: gzip
server: Playlog
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: X-Playlog-Web
content-length: 131
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 26 Feb 2024 15:43:04 GMT

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 103ms
43ms Preflight
text/plain 172.253.63.101
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.101 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f101.1e100.net

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: x-goog-authuser
Access-Control-Request-Method: POST
Origin: https://pay.google.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://pay.google.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/plain; charset=UTF-8
date: Mon, 26 Feb 2024 15:43:04 GMT
server: Playlog
x-frame-options: SAMEORIGIN
x-xss-protection: 0

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 102ms
42ms Preflight
text/plain 172.253.63.101
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.101 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f101.1e100.net

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: x-goog-authuser
Access-Control-Request-Method: POST
Origin: https://pay.google.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://pay.google.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/plain; charset=UTF-8
date: Mon, 26 Feb 2024 15:43:04 GMT
server: Playlog
x-frame-options: SAMEORIGIN
x-xss-protection: 0

POST
H3 200 log Show response
play.google.com/ Frame 6251 131 B
155 B 122ms
63ms XHR
text/plain 172.253.63.101
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.101 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f101.1e100.net

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://pay.google.com/
X-Goog-AuthUser: 0
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Mon, 26 Feb 2024 15:43:04 GMT
content-encoding: gzip
server: Playlog
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: X-Playlog-Web
content-length: 131
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 26 Feb 2024 15:43:04 GMT

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 91ms
43ms Preflight
text/plain 172.253.63.101
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.101 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f101.1e100.net

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: x-goog-authuser
Access-Control-Request-Method: POST
Origin: https://pay.google.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://pay.google.com
access-control-max-age: 86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/plain; charset=UTF-8
date: Mon, 26 Feb 2024 15:43:04 GMT
server: Playlog
x-frame-options: SAMEORIGIN
x-xss-protection: 0

POST
H3 200 log Show response
play.google.com/ Frame 6251 131 B
155 B 121ms
63ms XHR
text/plain 172.253.63.101
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.101 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f101.1e100.net

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://pay.google.com/
X-Goog-AuthUser: 0
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Mon, 26 Feb 2024 15:43:04 GMT
content-encoding: gzip
server: Playlog
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pay.google.com
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: X-Playlog-Web
content-length: 131
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 26 Feb 2024 15:43:04 GMT

POST
H2 200 b Show response
r.stripe.com/ Frame 2F41 0
273 B 125ms
125ms Fetch
text/plain 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-dfc36c72938e02dbf0b948f02dc01c05.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-159-182.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Mon, 26 Feb 2024 15:43:04 GMT
x-stripe-server-envoy-start-time-us: 1708962184367872
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 5
x-stripe-client-envoy-start-time-us: 1708962184367229
access-control-allow-credentials: true
content-length: 0

GET
H2 200 elements-inner-payment-request-15dc8c13cab25b81f13ec54034fd41db.html Show response
js.stripe.com/v3/ Frame 81ED 820 B
1 KB 16ms
15ms Document
text/html 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/elements-inner-payment-request-15dc8c13cab25b81f13ec54034fd41db.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

2db4e6b6bbc30142c619315b4f0ba2cac06a578ef3bac414cc68c3891ba9a45f

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://ppm.stripe.com; default-src 'self'; font-src data: https:; form-action 'none'; frame-src 'self' https://www.affirm.com https://checkout.link.com https://b.stripecdn.com; img-src 'self' https://q.stripe.com https://b.stripecdn.com https://js.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 239831
cache-control: max-age=31536000
content-encoding: br
content-length: 371
content-security-policy: base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://ppm.stripe.com; default-src 'self'; font-src data: https:; form-action 'none'; frame-src 'self' https://www.affirm.com https://checkout.link.com https://b.stripecdn.com; img-src 'self' https://q.stripe.com https://b.stripecdn.com https://js.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-security-policy-report-only: base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com https://ppm.stripe.com; default-src 'self'; font-src data: https:; form-action 'none'; frame-src 'self' https://www.affirm.com https://checkout.link.com https://b.stripecdn.com; img-src 'self' https://q.stripe.com https://b.stripecdn.com https://js.stripe.com; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-type: text/html; charset=utf-8
date: Mon, 26 Feb 2024 15:43:04 GMT
etag: "15dc8c13cab25b81f13ec54034fd41db"
last-modified: Fri, 23 Feb 2024 21:02:27 GMT
server: Fastly
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
vary: Accept-Encoding
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 2518
x-content-type-options: nosniff
x-request-id: cc8a6bf0-77ac-4400-9386-94a21b44f9e9
x-served-by: cache-yul1970023-YUL

POST
H2 200 b Show response
r.stripe.com/ Frame 2F41 0
274 B 130ms
129ms Fetch
text/plain 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-dfc36c72938e02dbf0b948f02dc01c05.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-159-182.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Mon, 26 Feb 2024 15:43:04 GMT
x-stripe-server-envoy-start-time-us: 1708962184378500
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 12
x-stripe-client-envoy-start-time-us: 1708962184378024
access-control-allow-credentials: true
content-length: 0

GET
H2 200 shared-dfc36c72938e02dbf0b948f02dc01c05.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 81ED 535 KB
130 KB 19ms
17ms Script
text/javascript 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-dfc36c72938e02dbf0b948f02dc01c05.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-payment-request-15dc8c13cab25b81f13ec54034fd41db.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

9a53a378b0bf8737dd5384da05ca56af9af8e7a218eb8a2d22a96eca1ac5141b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-payment-request-15dc8c13cab25b81f13ec54034fd41db.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Mon, 26 Feb 2024 15:43:04 GMT
via: 1.1 varnish
age: 239929
x-cache: HIT
content-length: 133281
x-request-id: 75015a9b-e83b-49a1-b819-89759cbc48f5
x-served-by: cache-yul1970023-YUL
last-modified: Fri, 23 Feb 2024 21:02:41 GMT
server: Fastly
etag: "ee779d877b789585dcd76914b08ab7f0"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 4471

GET
H2 200 ui-shared-681f96a7339ecfdb817fb408845ee657.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 81ED 418 KB
118 KB 18ms
17ms Script
text/javascript 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/ui-shared-681f96a7339ecfdb817fb408845ee657.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-payment-request-15dc8c13cab25b81f13ec54034fd41db.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

58a0c074a2d68c4b2f319c228e092bbe83d0bc9edfcc904f897aad1f39d99520

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-payment-request-15dc8c13cab25b81f13ec54034fd41db.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Mon, 26 Feb 2024 15:43:04 GMT
via: 1.1 varnish
age: 239922
x-cache: HIT
content-length: 120223
x-request-id: 49acab09-f413-400a-994b-7924883236cb
x-served-by: cache-yul1970023-YUL
last-modified: Fri, 23 Feb 2024 21:02:42 GMT
server: Fastly
etag: "afe1a1383429b48e2629d0b5546b6839"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 9640

GET
H2 200 elements-inner-payment-request-3ff85947b771e886842fda1094f7a761.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 81ED 73 KB
26 KB 21ms
20ms Script
text/javascript 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/elements-inner-payment-request-3ff85947b771e886842fda1094f7a761.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-payment-request-15dc8c13cab25b81f13ec54034fd41db.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

77263b1165469fdbabd1d353ecc07faa82baa23047e18ecb5520f74c2f6eb948

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-payment-request-15dc8c13cab25b81f13ec54034fd41db.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Mon, 26 Feb 2024 15:43:04 GMT
via: 1.1 varnish
age: 1028158
x-cache: HIT
content-length: 26076
x-request-id: dd416a40-b634-4175-947a-3386d3105a74
x-served-by: cache-yul1970023-YUL
last-modified: Wed, 14 Feb 2024 18:03:44 GMT
server: Fastly
etag: "bd35d245590fc31902f0b60d8c4331b2"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 2836

GET
H2 200 ui-shared-1d27f4e2b314637ba4bb9d7ff79c23c7.css
js.stripe.com/v3/fingerprinted/css/ Frame 81ED 20 KB
3 KB 17ms
16ms Stylesheet
text/css 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/css/ui-shared-1d27f4e2b314637ba4bb9d7ff79c23c7.css

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-payment-request-15dc8c13cab25b81f13ec54034fd41db.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

394724ca0118829643c12fb5a033cb66680e51327ba157677d18dec209278a3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-payment-request-15dc8c13cab25b81f13ec54034fd41db.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Mon, 26 Feb 2024 15:43:04 GMT
via: 1.1 varnish
age: 1503063
x-cache: HIT
content-length: 3304
x-request-id: 3fd2843f-85ad-4f2f-bbee-7849d7d31041
x-served-by: cache-yul1970023-YUL
last-modified: Thu, 08 Feb 2024 22:46:07 GMT
server: Fastly
etag: "b361d7109e9925ca18e32c9da528520f"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 13099

GET
H2 200 elements-inner-payment-request-cfe32df79f375ff09e642bdb265216a4.css
js.stripe.com/v3/fingerprinted/css/ Frame 81ED 12 KB
3 KB 18ms
18ms Stylesheet
text/css 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/css/elements-inner-payment-request-cfe32df79f375ff09e642bdb265216a4.css

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-payment-request-15dc8c13cab25b81f13ec54034fd41db.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

6e42ec45fee8ebb7248427c36f69b71450834c83dad5d9ffcc7740828cf6046b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-payment-request-15dc8c13cab25b81f13ec54034fd41db.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Mon, 26 Feb 2024 15:43:04 GMT
via: 1.1 varnish
age: 1013367
x-cache: HIT
content-length: 2794
x-request-id: 965c3c19-d1cc-44fc-be72-aa1da1296a74
x-served-by: cache-yul1970023-YUL
last-modified: Wed, 14 Feb 2024 22:10:41 GMT
server: Fastly
etag: "a4845cb93b01a6c0277388c7bfe6c9e9"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 3668

POST
H2 200 6 Show response
m.stripe.com/ Frame E63C 156 B
669 B 114ms
110ms XHR
application/json 44.236.167.79
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.com/6

Requested by

Host: m.stripe.network
URL: https://m.stripe.network/out-4.5.43.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.236.167.79 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-44-236-167-79.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

3a812fdbca60bfc0852ea2bb36f1aaf2672020a5b741ea90ee5d3e8ee4db3a42

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://m.stripe.network/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-stripe-bg-intended-route-color: green
date: Mon, 26 Feb 2024 15:43:04 GMT
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1708962184447476
server: nginx
content-type: application/json;charset=utf-8
x-stripe-server-envoy-upstream-service-time-ms: 3
access-control-allow-origin: https://m.stripe.network
x-stripe-client-envoy-start-time-us: 1708962184447201
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 156

POST
H2 200 6 Show response
m.stripe.com/ Frame E63C 156 B
669 B 160ms
158ms XHR
application/json 44.236.167.79
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.com/6

Requested by

Host: m.stripe.network
URL: https://m.stripe.network/out-4.5.43.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.236.167.79 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-44-236-167-79.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

3a812fdbca60bfc0852ea2bb36f1aaf2672020a5b741ea90ee5d3e8ee4db3a42

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://m.stripe.network/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-stripe-bg-intended-route-color: green
date: Mon, 26 Feb 2024 15:43:04 GMT
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
x-stripe-server-envoy-start-time-us: 1708962184494359
server: nginx
content-type: application/json;charset=utf-8
x-stripe-server-envoy-upstream-service-time-ms: 3
access-control-allow-origin: https://m.stripe.network
x-stripe-client-envoy-start-time-us: 1708962184494045
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 156

GET
H2 200 .deploy_status_henson.json Show response
js.stripe.com/v3/ Frame 81ED 474 B
373 B 17ms
16ms Fetch
application/json 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/.deploy_status_henson.json

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-dfc36c72938e02dbf0b948f02dc01c05.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

b0f2842cf2fe230f30d403634d26de441e415c437b4d81fe2626ea0e95426c78

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/v3/elements-inner-payment-request-15dc8c13cab25b81f13ec54034fd41db.html
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 26 Feb 2024 15:43:04 GMT
content-encoding: br
via: 1.1 varnish
strict-transport-security: max-age=31556926; includeSubDomains; preload
age: 5
x-cache: HIT
content-length: 298
x-request-id: cee6a7eb-e648-4cd5-b363-510e9314823a
x-served-by: cache-yul1970043-YUL
last-modified: Fri, 23 Feb 2024 21:40:09 GMT
server: Fastly
etag: "f2dfc898e40eddf6e7e8133dd4803280"
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=60
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 12

GET
H2 200 api.js Show response
hcaptcha.com/1/ Frame B911 376 KB
107 KB 96ms
41ms Script
application/javascript 104.19.219.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hcaptcha.com/1/api.js?onload=captchaLoad&render=explicit

Requested by

Host: b.stripecdn.com
URL: https://b.stripecdn.com/stripethirdparty-srv/assets/v20.17/HCaptchaInvisible.html?id=ab50c790-b01b-45a6-badb-5ed7c85803d5&origin=https%3A%2F%2Fjs.stripe.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.219.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f8372e4920304819a1afe1cb4a33def279a032e5d0154b53df47d05abdfc8077

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b.stripecdn.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Mon, 26 Feb 2024 15:43:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 0cf68108b8820db4a096a661da0108ba.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-content-type-options: nosniff
x-amz-version-id: Y83AnVQfVaYtiCkhua7rz_C8xbCj9kI1
age: 0
x-amz-cf-pop: YUL62-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 26 Feb 2024 13:10:44 GMT
server: cloudflare
etag: W/"cf161ae1463888e6b05f1ecd1d11305b"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=300
cf-ray: 85b94d34fc0439ea-YYZ
x-amz-cf-id: igQdYMcJ7csmfpTp_fflRRkGYv1RY9D5NQ9tRhM5psHUnnMVdNrTmQ==

GET
H2 200 vendors~AddressAutocomplete~AffirmInContext~AmazonPayButton~AuthMap~DemoPayButton~DynamicMap~GoogleA~35711e2c.2a2d58b91c6acfc1f9d8.bundle.js Show response
b.stripecdn.com/stripethirdparty-srv/assets/v20.17/ Frame B911 114 KB
35 KB 49ms
47ms Script
text/javascript 52.84.125.40
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://b.stripecdn.com/stripethirdparty-srv/assets/v20.17/vendors~AddressAutocomplete~AffirmInContext~AmazonPayButton~AuthMap~DemoPayButton~DynamicMap~GoogleA~35711e2c.2a2d58b91c6acfc1f9d8.bundle.js

Requested by

Host: b.stripecdn.com
URL: https://b.stripecdn.com/stripethirdparty-srv/assets/v20.17/HCaptchaInvisible.html?id=ab50c790-b01b-45a6-badb-5ed7c85803d5&origin=https%3A%2F%2Fjs.stripe.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.84.125.40 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-84-125-40.ord53.r.cloudfront.net

Software

Cloudfront /

Resource Hash

39253e0583d87f1e4da4c9028eb3112b1218fe79ee1a9df1d86560a43887615f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b.stripecdn.com/stripethirdparty-srv/assets/v20.17/HCaptchaInvisible.html?id=ab50c790-b01b-45a6-badb-5ed7c85803d5&origin=https%3A%2F%2Fjs.stripe.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Mon, 26 Feb 2024 15:10:41 GMT
via: 1.1 3b8efcb1738e7807d88ed1cff31b3f3a.cloudfront.net (CloudFront)
age: 1944
x-amz-cf-pop: ORD53-C1
x-cache: Hit from cloudfront
last-modified: Thu, 15 Feb 2024 18:31:18 GMT
server: Cloudfront
etag: W/"c0b2851b03eedaa4c74c6fb16a7223dc"
vary: Accept-Encoding,Origin
content-type: text/javascript; charset=utf-8
cache-control: max-age=31536000, public
timing-allow-origin: *
x-amz-cf-id: ZBDkDlhmpDx3OR7vcxGNavsPLn7exVGXsVe0eVQem0oqSMCsu66nwQ==

GET
H2 200 HCaptchaInvisible.f76df6e906382568d06d.bundle.js Show response
b.stripecdn.com/stripethirdparty-srv/assets/v20.17/ Frame B911 17 KB
7 KB 67ms
65ms Script
text/javascript 52.84.125.40
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://b.stripecdn.com/stripethirdparty-srv/assets/v20.17/HCaptchaInvisible.f76df6e906382568d06d.bundle.js

Requested by

Host: b.stripecdn.com
URL: https://b.stripecdn.com/stripethirdparty-srv/assets/v20.17/HCaptchaInvisible.html?id=ab50c790-b01b-45a6-badb-5ed7c85803d5&origin=https%3A%2F%2Fjs.stripe.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.84.125.40 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-84-125-40.ord53.r.cloudfront.net

Software

Cloudfront /

Resource Hash

5875aa9b6e08289882f785ca5b8faf742835cae993da615fdda385ba5e270077

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://b.stripecdn.com/stripethirdparty-srv/assets/v20.17/HCaptchaInvisible.html?id=ab50c790-b01b-45a6-badb-5ed7c85803d5&origin=https%3A%2F%2Fjs.stripe.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Mon, 26 Feb 2024 15:30:28 GMT
via: 1.1 3b8efcb1738e7807d88ed1cff31b3f3a.cloudfront.net (CloudFront)
age: 757
x-amz-cf-pop: ORD53-C1
x-cache: Hit from cloudfront
last-modified: Thu, 15 Feb 2024 18:31:17 GMT
server: Cloudfront
etag: W/"0a7c763d1eb46a040661b9704dc9d1bf"
vary: Accept-Encoding,Origin
content-type: text/javascript; charset=utf-8
cache-control: max-age=31536000, public
timing-allow-origin: *
x-amz-cf-id: cLpf9bOlkYHcof9Qh4LCg9P03Fub86e8ulVob7MGRBipGDG6e7ef7g==

GET
H2 200 collect Show response
gtm.winred.com/g/ 329 B
479 B 167ms
165ms XHR
text/plain 104.16.250.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gtm.winred.com/g/collect?v=2&tid=G-X6H0114PDF&gtm=45je42l0v867905447z872410129za220&_p=1708962182562&gcd=13l3l3l3l1&npa=0&dma=0&cid=818782480.1708962184&ul=en-us&sr=1600x1200&_fplc=0&ur=CA-QC&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&sst.uc=CA&sst.gse=1&sst.etld=google.ca&sst.gcd=13l3l3l3l1&sst.tft=1708962182562&_s=2&sid=1708962183&sct=1&seg=0&dl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-sms-trump-poll-v16-db%3Futm_term%3Ddb-sajfc-cr50sms-014%26source_code%3Ddb-sajfc-cr50sms-014%26&dt=MAGA&en=user%20session%20start&ep.pagepath=%2Fsave-america-joint-fundraising-committee%2Flp-sms-trump-poll-v16-db&ep.pagehostname=secure.winred.com&ep.parsedurl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-sms-trump-poll-v16-db&epn.load_time_sec=-1708962181.7&epn.event_fire_time=1708962183262&ep.event_uuid=25913e53-fa37-4972-a865-4295f5a3d316&ep.isVideoPage=f&ep.referrer=&ep.category=donation%20landing%20page&ep.action=user%20session%20start&ep.label=landing%20page%20settings&ep.customCSS=t&ep.usercategory=anonymous&_et=4&tfd=2711&richsstsse

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.250.69 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c8602934f8b2d2a89793ece40e427f78925555cfebb32dc315b1a5d573fcf68d

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Mon, 26 Feb 2024 15:43:04 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
server: cloudflare
strict-transport-security: max-age=0; includeSubDomains
vary: Accept-Encoding
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 85b94d34fd0636eb-YYZ
alt-svc: h3=":443"; ma=86400

POST
H3 204 rum Show response
secure.winred.com/cdn-cgi/ 0
142 B 46ms
39ms XHR
text/plain 104.19.211.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/v84a3a4012de94ce1a686ba8c167c359c1696973893317

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.211.89 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
content-type: application/json

Response headers

date: Mon, 26 Feb 2024 15:43:04 GMT
x-content-type-options: nosniff
server: cloudflare
vary: Origin
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://secure.winred.com
x-frame-options: DENY
access-control-allow-credentials: true
cf-ray: 85b94d35b9ec3a0a-YYZ

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 239 KB
82 KB 51ms
51ms Script
application/javascript 142.250.31.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-11094181768

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M27JCG

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

52a1de7724643745b966624de81900181e5e376195e841a6666db41fb1a37240

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Mon, 26 Feb 2024 15:43:04 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 84349
x-xss-protection: 0
last-modified: Mon, 26 Feb 2024 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 26 Feb 2024 15:43:04 GMT

GET
H2 200 hcaptcha.html Show response
newassets.hcaptcha.com/captcha/v1/fadb9c6/static/ Frame AD01 2 KB
1 KB 34ms
33ms Document
text/html 104.19.219.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newassets.hcaptcha.com/captcha/v1/fadb9c6/static/hcaptcha.html?_v=149jvnx8tug

Requested by

Host: hcaptcha.com
URL: https://hcaptcha.com/1/api.js?onload=captchaLoad&render=explicit

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.219.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

18bcb8b5e89175abcc7d5ca74b66e102ab8593c39fbd6733cda394e8430fba45

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://b.stripecdn.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

access-control-allow-origin: *
age: 5
alt-svc: h3=":443"; ma=86400
cache-control: max-age=1209600
cf-cache-status: HIT
cf-ray: 85b94d35dd6d39ea-YYZ
content-encoding: br
content-type: text/html
cross-origin-embedder-policy: credentialless
cross-origin-resource-policy: cross-origin
date: Mon, 26 Feb 2024 15:43:04 GMT
last-modified: Mon, 26 Feb 2024 13:10:44 GMT
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
via: 1.1 37504d411c7d230cb5e53aaf2809b804.cloudfront.net (CloudFront)
x-amz-cf-id: GX9nL7bJBsJQbqsnKcpWfhscdcnWiV6cibwqJD5B8Z9axVY-HRbRHg==
x-amz-cf-pop: YUL62-C2
x-amz-server-side-encryption: AES256
x-amz-version-id: w380JAJSDRpHmjdLNet.Oei.HbAumRcl
x-cache: Hit from cloudfront
x-content-type-options: nosniff

GET
H3 200 ga-audiences
www.google.ca/ads/ 42 B
63 B 48ms
47ms Image
image/gif 142.250.31.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&dma=0&tid=G-X6H0114PDF&cid=J%2FlZ%2FGwYbIXAqo5ybynvbFlYZO2bDFSi8n7RVHVxqVo%3D.1708962184&gtm=45j91e42k1h1v867905447z872410129z9867900975za220&aip=1&z=1874463728

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f94.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Feb 2024 15:43:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 hcaptcha.js Show response
newassets.hcaptcha.com/captcha/v1/fadb9c6/ Frame AD01 376 KB
106 KB 34ms
33ms Script
application/javascript 104.19.219.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newassets.hcaptcha.com/captcha/v1/fadb9c6/hcaptcha.js

Requested by

Host: newassets.hcaptcha.com
URL: https://newassets.hcaptcha.com/captcha/v1/fadb9c6/static/hcaptcha.html?_v=149jvnx8tug

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.219.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f8372e4920304819a1afe1cb4a33def279a032e5d0154b53df47d05abdfc8077

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://newassets.hcaptcha.com/captcha/v1/fadb9c6/static/hcaptcha.html?_v=149jvnx8tug
Origin: https://newassets.hcaptcha.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Mon, 26 Feb 2024 15:43:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 0cf68108b8820db4a096a661da0108ba.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-content-type-options: nosniff
x-amz-version-id: Y83AnVQfVaYtiCkhua7rz_C8xbCj9kI1
age: 5
x-amz-cf-pop: YUL62-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 26 Feb 2024 13:10:44 GMT
server: cloudflare
etag: W/"cf161ae1463888e6b05f1ecd1d11305b"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=1209600
cf-ray: 85b94d362de639ea-YYZ
x-amz-cf-id: igQdYMcJ7csmfpTp_fflRRkGYv1RY9D5NQ9tRhM5psHUnnMVdNrTmQ==

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/11094181768/ 3 KB
1 KB 46ms
45ms Script
text/javascript 172.253.62.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11094181768/?random=1708962184682&cv=11&fst=1708962184682&bg=ffffff&guid=ON&async=1&gtm=45be42l0v9102692410za220&gcd=13l3l3l3l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-sms-trump-poll-v16-db%3Futm_term%3Ddb-sajfc-cr50sms-014%26source_code%3Ddb-sajfc-cr50sms-014%26&hn=www.googleadservices.com&frm=0&tiba=MAGA&npa=0&pscdl=noapi&auid=306036401.1708962183&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-11094181768

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f154.1e100.net

Software

cafe /

Resource Hash

11ba8949524c96cc859f75843a92bec4f1954a019910e471ae3ac40d471226d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Feb 2024 15:43:04 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1372
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 checksiteconfig Show response
api.hcaptcha.com/ Frame AD01 719 B
898 B 76ms
75ms XHR
application/json 104.19.219.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.hcaptcha.com/checksiteconfig?v=fadb9c6&host=b.stripecdn.com&sitekey=463b917e-e264-403f-ad34-34af0ee10294&sc=1&swa=1&spst=1

Requested by

Host: newassets.hcaptcha.com
URL: https://newassets.hcaptcha.com/captcha/v1/fadb9c6/hcaptcha.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.219.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5e3450f2655679fe68f715f02d804dd0062df0ed824a009eae7e7224984cf9eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://newassets.hcaptcha.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: text/plain

Response headers

date: Mon, 26 Feb 2024 15:43:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
content-encoding: br
server: cloudflare
vary: Origin, Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://newassets.hcaptcha.com
access-control-allow-credentials: true
cf-ray: 85b94d36ff7e39ea-YYZ
access-control-allow-headers: Cache-Control, Content-Type, DNT, Referer, User-Agent, challenge-bypass-token, cf-chl-bypass, challenge-bypass-token, challenge-bypass-host, challenge-bypass-path
alt-svc: h3=":443"; ma=86400

GET
H2 200 /
www.google.com/pagead/1p-user-list/11094181768/ 42 B
108 B 54ms
53ms Image
image/gif 172.253.122.106
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/11094181768/?random=1708962184682&cv=11&fst=1708959600000&bg=ffffff&guid=ON&async=1&gtm=45be42l0v9102692410za220&gcd=13l3l3l3l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-sms-trump-poll-v16-db%3Futm_term%3Ddb-sajfc-cr50sms-014%26source_code%3Ddb-sajfc-cr50sms-014%26&frm=0&tiba=MAGA&npa=0&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_Nu5qmLkEHrTorJ7lKqkEPkLMUDO4Z-EeQ0tPvtowHHPGD1r9&random=466500437&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f106.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Feb 2024 15:43:04 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.ca/pagead/1p-user-list/11094181768/ 42 B
64 B 41ms
41ms Image
image/gif 142.250.31.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-user-list/11094181768/?random=1708962184682&cv=11&fst=1708959600000&bg=ffffff&guid=ON&async=1&gtm=45be42l0v9102692410za220&gcd=13l3l3l3l1&dma=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-sms-trump-poll-v16-db%3Futm_term%3Ddb-sajfc-cr50sms-014%26source_code%3Ddb-sajfc-cr50sms-014%26&frm=0&tiba=MAGA&npa=0&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_Nu5qmLkEHrTorJ7lKqkEPkLMUDO4Z-EeQ0tPvtowHHPGD1r9&random=466500437&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f94.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Feb 2024 15:43:04 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 hsw.js Show response
newassets.hcaptcha.com/c/0fb9fb5/ Frame AD01 508 KB
222 KB 37ms
37ms Script
application/javascript 104.19.218.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newassets.hcaptcha.com/c/0fb9fb5/hsw.js

Requested by

Host: newassets.hcaptcha.com
URL: https://newassets.hcaptcha.com/captcha/v1/fadb9c6/hcaptcha.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.218.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a6aeb0f05d454e29935dc8708f1dbdbe27176d849880fdbf1d30d4d5bc6c3c18

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://newassets.hcaptcha.com/captcha/v1/fadb9c6/static/hcaptcha.html?_v=149jvnx8tug
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Mon, 26 Feb 2024 15:43:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 b7321b4add4495066f8401239ad07f94.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-content-type-options: nosniff
x-amz-version-id: hX4Z6AbOk3MuIrAL1fopQL_PyMUYVvWN
age: 17565
x-amz-cf-pop: YUL62-C2
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 12 Feb 2024 22:29:35 GMT
server: cloudflare
etag: W/"380f869a8304c28e89d70dc536bdc54c"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3024000
cf-ray: 85b94d377d1836c0-YYZ
x-amz-cf-id: _p282NTG7YUIQbiF7H8aMkdFHMMXshZSimzb90mFZl66kaTxyrVKvA==

POST
H2 200 b Show response
r.stripe.com/ Frame 6609 0
273 B 107ms
107ms Fetch
text/plain 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-dfc36c72938e02dbf0b948f02dc01c05.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-159-182.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Mon, 26 Feb 2024 15:43:05 GMT
x-stripe-server-envoy-start-time-us: 1708962185046901
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 4
x-stripe-client-envoy-start-time-us: 1708962185046188
access-control-allow-credentials: true
content-length: 0

POST
H2 200 b Show response
r.stripe.com/ Frame 2F41 0
273 B 107ms
107ms Fetch
text/plain 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-dfc36c72938e02dbf0b948f02dc01c05.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-159-182.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Mon, 26 Feb 2024 15:43:05 GMT
x-stripe-server-envoy-start-time-us: 1708962185048099
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 3
x-stripe-client-envoy-start-time-us: 1708962185047869
access-control-allow-credentials: true
content-length: 0

POST
H2 200 b Show response
r.stripe.com/ Frame B5EC 0
273 B 108ms
108ms Fetch
text/plain 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-dfc36c72938e02dbf0b948f02dc01c05.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-159-182.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Mon, 26 Feb 2024 15:43:05 GMT
x-stripe-server-envoy-start-time-us: 1708962185167972
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 5
x-stripe-client-envoy-start-time-us: 1708962185167579
access-control-allow-credentials: true
content-length: 0

POST
H2 200 b Show response
r.stripe.com/ Frame 6609 0
273 B 114ms
113ms Fetch
text/plain 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-dfc36c72938e02dbf0b948f02dc01c05.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-159-182.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Mon, 26 Feb 2024 15:43:05 GMT
x-stripe-server-envoy-start-time-us: 1708962185415609
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 5
x-stripe-client-envoy-start-time-us: 1708962185414979
access-control-allow-credentials: true
content-length: 0

POST
H2 200 b Show response
r.stripe.com/ Frame 2F41 0
273 B 122ms
121ms Fetch
text/plain 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-dfc36c72938e02dbf0b948f02dc01c05.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-159-182.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Mon, 26 Feb 2024 15:43:05 GMT
x-stripe-server-envoy-start-time-us: 1708962185425477
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 5
x-stripe-client-envoy-start-time-us: 1708962185424989
access-control-allow-credentials: true
content-length: 0

POST
H3 200 463b917e-e264-403f-ad34-34af0ee10294 Show response
api.hcaptcha.com/getcaptcha/ Frame AD01 3 KB
4 KB 233ms
232ms XHR
application/octet-stream 104.19.218.90
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.hcaptcha.com/getcaptcha/463b917e-e264-403f-ad34-34af0ee10294

Requested by

Host: newassets.hcaptcha.com
URL: https://newassets.hcaptcha.com/captcha/v1/fadb9c6/hcaptcha.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.19.218.90 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

283c0c9035a71b9c7a4cf362bed2d808dec78b37d2e02be025009acbf4ae3ea7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept: application/json, application/octet-stream
Referer: https://newassets.hcaptcha.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
content-type: application/x-www-form-urlencoded

Response headers

date: Mon, 26 Feb 2024 15:43:05 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin, Accept-Encoding
content-type: application/octet-stream
access-control-allow-origin: https://newassets.hcaptcha.com
access-control-allow-credentials: true
cf-ray: 85b94d3a9cde36c0-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 3193

POST
H2 200 b Show response
r.stripe.com/ Frame 6609 0
273 B 109ms
108ms Fetch
text/plain 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://r.stripe.com/b
Requested by: Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-dfc36c72938e02dbf0b948f02dc01c05.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-159-182.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json
Referer: https://js.stripe.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

x-stripe-bg-intended-route-color: blue
date: Mon, 26 Feb 2024 15:43:06 GMT
x-stripe-server-envoy-start-time-us: 1708962186664348
server: nginx
content-type: text/plain
access-control-allow-origin: https://js.stripe.com
x-stripe-server-envoy-upstream-service-time-ms: 6
x-stripe-client-envoy-start-time-us: 1708962186663070
access-control-allow-credentials: true
content-length: 0

GET
H2 200 common.js Show response
maps.googleapis.com/maps-api-v3/api/js/56/1/ 255 KB
56 KB 31ms
30ms Script
text/javascript 172.253.63.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps-api-v3/api/js/56/1/common.js

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f95.1e100.net

Software

sffe /

Resource Hash

9ea16efa9e53039fffb7ccf6bee49de744e04402da82e1070d45733ef4a36711

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Mon, 26 Feb 2024 15:42:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 22
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56751
x-xss-protection: 0
last-modified: Tue, 20 Feb 2024 19:28:53 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="maps-api-js"
vary: Accept-Encoding, Origin
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 25 Feb 2025 15:42:46 GMT

GET
H2 200 util.js Show response
maps.googleapis.com/maps-api-v3/api/js/56/1/ 180 KB
56 KB 40ms
40ms Script
text/javascript 172.253.63.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps-api-v3/api/js/56/1/util.js

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f95.1e100.net

Software

sffe /

Resource Hash

c6dc2d05669b7d0b896bb7185ed18035463aa200da0022364d446579365a8350

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Mon, 26 Feb 2024 15:42:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56881
x-xss-protection: 0
last-modified: Tue, 20 Feb 2024 19:28:53 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="maps-api-js"
vary: Accept-Encoding, Origin
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 25 Feb 2025 15:42:49 GMT

GET
H2 200 trusted-types-checker-efd8cf45ce422659c098993bfc62531b.js Show response
js.stripe.com/v3/fingerprinted/js/ 176 B
321 B 19ms
19ms Script
text/javascript 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/trusted-types-checker-efd8cf45ce422659c098993bfc62531b.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

07b6b3d899dd69c0e9eb463e23e10e30e82588eddf95d15d45bb505c6703a813

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Mon, 26 Feb 2024 15:43:09 GMT
via: 1.1 varnish
age: 1503345
x-cache: HIT
content-length: 127
x-request-id: 430bc31d-1f8d-4920-8a52-45751264df8b
x-served-by: cache-yul1970023-YUL
last-modified: Thu, 08 Feb 2024 22:46:20 GMT
server: Fastly
etag: "96f5b26d366f47393b3ff36fe7471474"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 23594

GET
H3 200 collect Show response
gtm.winred.com/g/ 328 B
590 B 193ms
193ms XHR
text/plain 104.16.250.69
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gtm.winred.com/g/collect?v=2&tid=G-X6H0114PDF&gtm=45je42l0v867905447z872410129za220&_p=1708962182562&gcd=13l3l3l3l1&npa=0&dma=0&cid=818782480.1708962184&ul=en-us&sr=1600x1200&ur=CA-QC&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&sst.uc=CA&sst.gse=1&sst.etld=google.ca&sst.gcd=13l3l3l3l1&sst.tft=1708962182562&_s=3&sid=1708962183&sct=1&seg=0&dl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-sms-trump-poll-v16-db%3Futm_term%3Ddb-sajfc-cr50sms-014%26source_code%3Ddb-sajfc-cr50sms-014%26&dt=MAGA&en=page_load_time_event&ep.pagepath=%2Fsave-america-joint-fundraising-committee%2Flp-sms-trump-poll-v16-db&ep.pagehostname=secure.winred.com&ep.parsedurl=https%3A%2F%2Fsecure.winred.com%2Fsave-america-joint-fundraising-committee%2Flp-sms-trump-poll-v16-db&epn.load_time_sec=2.8&epn.event_fire_time=1708962184590&ep.event_uuid=a0ea5244-2469-4277-a5f8-7cb132783dbd&ep.isVideoPage=f&ep.referrer=&ep.category=donation%20landing%20page&ep.action=user%20session%20start&ep.label=landing%20page%20settings&ep.customCSS=t&ep.usercategory=anonymous&epn.loading_time_sec_on_window_load=2.83&_et=682&tfd=7853&richsstsse

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-X6H0114PDF&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.250.69 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c13c78967ff2ef425f0ed8408f64af4745ce11c72c5087cda6e273aed3b581b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

date: Mon, 26 Feb 2024 15:43:09 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
server: cloudflare
strict-transport-security: max-age=0; includeSubDomains
vary: Accept-Encoding
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 85b94d551e173739-YYZ
alt-svc: h3=":443"; ma=86400

GET
H3 200 ga-audiences
www.google.ca/ads/ 42 B
63 B 55ms
55ms Image
image/gif 142.250.31.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&dma=0&tid=G-X6H0114PDF&cid=J%2FlZ%2FGwYbIXAqo5ybynvbFlYZO2bDFSi8n7RVHVxqVo%3D.1708962184&gtm=45j91e42k1h1v867905447z872410129z9867900975za220&aip=1&z=148824137

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f94.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 26 Feb 2024 15:43:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

59 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

34 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
app.revv.co/api/v3/users	1970-01-21 04:18:42	Name: rvid Value: 1a64fb45-60a0-441e-9c65-dd6f1cbd9bd8
.secure.winred.com/	1970-01-20 18:42:43	Name: __cf_bm Value: e.94Wwzr.xkfk.VSmsoGegLmVFCb1PqloWB9TGEWPW8-1708962182-1.0-AXWL74vq6yf7OJYZE021N3WIsuxvnF2KWW0QDqRijmeXc9qyi+5i9v6p6FT8afTMr9DPWq7pqPwx/3+kxIDdWhg=
secure.winred.com/	1969-12-31 23:59:59	Name: origin_url Value: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014&
.winred.com/	1970-01-20 20:52:18	Name: _gcl_au Value: 1.1.306036401.1708962183
.winred.com/	1969-12-31 23:59:59	Name: _revv_v3_session Value: bnNXM3UweVJ6aWVMNU1HRGdjd0ZUZXJQRjhickpGZnFKL1I1ZS8yUVBhdjEwWnZTVFR2bjN2N0hUZTNraVkrSXJhR3Q0R3VIamRPNDVOSFBZeDk0NWsvSjA4ZzQ5am1YalBuYnNoTGMxMGxlQVlIc3lSak9qVWlJa1hwZFJGTVY3WGVTTTVDS1JFZENmQ01YL1FlV3lNdjdQQUJxKzVpeVF2eTBHa254YytpUkdSa0FsdVR4blppWUZZaW1iUXoxVXJjS0JqMzBja1AzN2RrMFVCMGJCdVFzR3hTZk9hbG01RHJWNVkxMTFJY1QzSDJKQWx4Nmhsa1NMcTdtYjJMS1dBWlkrd2l2bkNwWkFqamtnN1RvOFdaWUtLMGgxalIrclIzVVdGQlh4TkVJcG9kV09mMFphR0hoenBiQVJRVC9uWmoyK3dWVi9UdHEyREp6MUNmZmIvRDZ3VzVBTUc1YW9NckI5cTJtMnZVPS0tZ2U4eG5HRTlvVTdka3dQWmFiam1YUT09--fbdbdf683a14bbcad4fcc7e99e9cf5f2c971ada2
.revv.co/	1969-12-31 23:59:59	Name: _revv_v3_session Value: KzFJZ21DaXd3SitqdXNuWjBZb1V5ZXJ1ZG5DK3J3TG44UWVwaFN0N3BVVkt2cGwxeXFoYm8walFBK2tKeTRHQnBxK1JXcXorMFcrUVpJbXNoT2htVFE9PS0tUUU0TTVaN25iaW1Mc2dub0tjdkgxQT09--bbc706e27fddf3c4da5f5d2a2b685136e889fb14
.revv.co/	1970-01-20 18:42:43	Name: __cf_bm Value: XBaTB.iGmcQXd_nf_kmW_kpwMT.Pl3p8dYV4og7Ho4Q-1708962183-1.0-AfqveeoaNuSOtvwuFgjJ8yz0K1VxZugplkhlsQLEfj/hJ9J/o1Cg9BavIfrDYUbAgC8pqqSsvM48zBAMVA8pte4=
secure.winred.com/	1969-12-31 23:59:59	Name: sso_tries Value: 1
secure.winred.com/	1970-01-21 04:18:42	Name: rvid Value: 1a64fb45-60a0-441e-9c65-dd6f1cbd9bd8
.doubleclick.net/	1970-01-20 23:01:54	Name: receive-cookie-deprecation Value: 1
.winred.com/	1970-01-20 18:44:08	Name: _gid Value: GA1.2.605259594.1708962184
.winred.com/	1970-01-20 18:42:42	Name: _gat_UA-60901920-1 Value: 1
.winred.com/	1970-01-20 18:42:42	Name: _dc_gtm_UA-73658561-7 Value: 1
.secure.winred.com/	1970-01-21 03:28:18	Name: cf_clearance Value: .LHWe0VY0pEfR627.RaF5jBu8uFy8k5TZrfg6zDxK3Y-1708962183-1.0-AXjz4eZfrJkAFSuMWOHFjEkSJ3/AiiaJniYFjJN3s6C40vUeDA16sEEX/sqZ6HN5umAjM42CepCY9n/KY7W0Og8=
.winred.com/	1970-01-21 04:18:42	Name: _ga_0YWKLMCX4D Value: GS1.1.1708962183.1.0.1708962183.0.0.0
.winred.com/	1970-01-21 04:18:42	Name: _ga Value: GA1.1.818782480.1708962184
.doubleclick.net/	1970-01-21 04:18:42	Name: IDE Value: AHWqTUlHI4xbbIg4w0p5pDBh2CWOg3U-RrdwYRwAVqFIa3zrip_lkp0sFUVlbhs9
secure.winred.com/	1970-01-20 21:06:38	Name: _cids Value: W10=
.twitter.com/	1970-01-21 04:18:42	Name: guest_id_marketing Value: v1%3A170896218397683151
.twitter.com/	1970-01-21 04:18:42	Name: guest_id_ads Value: v1%3A170896218397683151
.twitter.com/	1970-01-21 04:18:42	Name: personalization_id Value: "v1_oAe+SQN//VO1IPHMgGiDGA=="
.twitter.com/	1970-01-21 04:18:42	Name: guest_id Value: v1%3A170896218397683151
.winred.com/	1970-01-20 20:52:18	Name: _fbp Value: fb.1.1708962184030.1829367487
.winred.com/	1970-01-21 04:18:42	Name: _ga_HNR33QTX08 Value: GS1.2.1708962184.1.0.1708962184.60.0.0
.t.co/	1970-01-21 04:18:42	Name: muc_ads Value: 28452290-13df-4edf-8180-8b64589287a3
.winred.com/	1970-01-21 04:18:42	Name: FPID Value: FPID2.2.J%2FlZ%2FGwYbIXAqo5ybynvbFlYZO2bDFSi8n7RVHVxqVo%3D.1708962184
.winred.com/	1970-01-20 18:42:43	Name: FPGSID Value: 1.1708962184.1708962184.G-X6H0114PDF.lO26BDbBJIB_m8ZeOEfutg
m.stripe.com/	1970-01-21 04:18:42	Name: m Value: 273a41ef-d147-4969-ad72-a40a88d36169f32fa6
.secure.winred.com/	1970-01-21 03:28:18	Name: __stripe_mid Value: 25fedb8f-0146-4b98-b091-e4ed1d3cd793185680
.secure.winred.com/	1970-01-20 18:42:43	Name: __stripe_sid Value: c169e9b1-b690-4d71-aa52-00b1942085ba14da8c
.google.com/	1970-01-20 23:06:13	Name: NID Value: 512=WUIZL_T3J8lupYSoPJKborpwcAAIut81w2A9S866Z7UjYTz8DNbxvxMFA7lg2n5bZ0dfykGFYjT76aE3L9EYOj7jzhxUCwrxoYfUr6JrYiR7GWtBeFkVBhekflR973OylIaCrrYwNlvYi-e7eXsxIqgnEXdY2qiRBjTF_lkRq2g
.winred.com/	1970-01-21 04:18:42	Name: _ga_X6H0114PDF Value: GS1.1.1708962183.1.0.1708962184.0.0.0
.winred.com/	1970-01-20 18:43:54	Name: FPLC Value: PdeR6vaN8fXuKEsDlgwOdiE%2BT4GYtDvVyF3Fm244RRcEtcq8hvmQadA1E5NLYJgQuudAcCLSDvCIZxdssBgQ9xf23kFq47ik4g4R7NOHIPwxzmk3ZLyb%2FvBCi%2F9KHw%3D%3D
api.hcaptcha.com/	1970-01-20 19:25:54	Name: hmt_id Value: c9323514-6cc3-4217-944e-9b6526a1fd3a

46 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://connect.facebook.net/signals/config/1599889267195467?v=2.9.147&r=stable&domain=secure.winred.com&hme=20c913bdcd4be51a752120153aa5caaecb3ee86c7f26cf737846e40b202aba68&ex_m=62%2C106%2C94%2C98%2C53%2C3%2C88%2C61%2C14%2C86%2C79%2C44%2C46%2C150%2C153%2C164%2C160%2C161%2C163%2C25%2C89%2C45%2C68%2C162%2C145%2C148%2C157%2C158%2C165%2C115%2C13%2C43%2C169%2C168%2C117%2C16%2C29%2C32%2C1%2C36%2C57%2C58%2C59%2C63%2C83%2C15%2C12%2C85%2C82%2C81%2C95%2C97%2C31%2C96%2C26%2C22%2C146%2C149%2C124%2C24%2C9%2C10%2C11%2C5%2C6%2C21%2C19%2C20%2C49%2C54%2C56%2C66%2C90%2C23%2C67%2C8%2C7%2C71%2C41%2C18%2C92%2C91%2C17%2C4%2C73%2C80%2C72%2C78%2C40%2C39%2C77%2C33%2C35%2C76%2C48%2C74%2C28%2C37%2C65%2C0%2C84%2C75%2C2%2C30%2C55%2C34%2C93%2C38%2C70%2C60%2C99%2C52%2C51%2C27%2C87%2C50%2C47%2C42%2C69%2C64%2C100(Line 105) Message: Unrecognized feature: 'attribution-reporting'.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://secure.winred.com/save-america-joint-fundraising-committee/lp-sms-trump-poll-v16-db?utm_term=db-sajfc-cr50sms-014&source_code=db-sajfc-cr50sms-014& Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

9381094.fls.doubleclick.net
a.ads.rmbl.ws
adservice.google.com
analytics.google.com
analytics.twitter.com
api.hcaptcha.com
app.revv.co
b.stripecdn.com
connect.facebook.net
d35ligi1n5bgzc.cloudfront.net
googleads.g.doubleclick.net
gopway1.com
gtm.winred.com
hcaptcha.com
js.stripe.com
lh7-us.googleusercontent.com
m.stripe.com
m.stripe.network
maps.googleapis.com
merchant-ui-api.stripe.com
newassets.hcaptcha.com
pay.google.com
play.google.com
r.stripe.com
secure.winred.com
static.ads-twitter.com
static.cloudflareinsights.com
stats.g.doubleclick.net
t.co
www.facebook.com
www.google-analytics.com
www.google.ca
www.google.com
www.googletagmanager.com
www.gstatic.com
104.16.250.69
104.16.57.101
104.19.211.89
104.19.212.89
104.19.218.90
104.19.219.90
104.244.42.195
104.244.42.69
13.249.85.64
142.250.31.156
142.250.31.94
142.250.31.97
146.75.36.157
151.101.0.176
172.253.115.92
172.253.122.106
172.253.122.113
172.253.122.155
172.253.122.94
172.253.62.132
172.253.62.154
172.253.63.101
172.253.63.148
172.253.63.95
198.202.176.141
216.239.38.181
31.13.66.19
31.13.66.35
38.70.189.71
44.236.167.79
52.84.125.40
54.187.159.182
99.83.253.106
007b4be1404b0f21a158fa83a2ae9375393b2d932a17e9745aa392fcadc7cf2f
03ff26aeebf7456b7511420741d9058e4966ab8525a27bb212aa10604f1b550e
04179400a816aa5b0442231584899bfd58ab7a4c8d56de2fe06c6cd331b2a102
07b6b3d899dd69c0e9eb463e23e10e30e82588eddf95d15d45bb505c6703a813
0e04153b5f73bfa7866948f2a9870593d69bfde14e77a1a06af5f567096e5a09
113016669803e5472a495a27d0257cb180b3beb92a817841465d6ef0c7a8e564
11ba8949524c96cc859f75843a92bec4f1954a019910e471ae3ac40d471226d4
18bcb8b5e89175abcc7d5ca74b66e102ab8593c39fbd6733cda394e8430fba45
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
283c0c9035a71b9c7a4cf362bed2d808dec78b37d2e02be025009acbf4ae3ea7
2cc1053348763e5da32a090789cc66f55c22c6a56b9aa2e312aac1ab8d207591
2db4e6b6bbc30142c619315b4f0ba2cac06a578ef3bac414cc68c3891ba9a45f
2e150f497f241fb9d3b2178dbca78ad16d7a2039ca8d6563b62f1da34993dacc
2e5ebcc7a99345cc40f3095a81f85b2d2a05f55a11763e87bfa51317395f1762
310550e8d18b7d5910f060761bc8ff62539b09e6298d1c3430fb81f67058fec4
35dcc382eb69d00369d708708cdc545f3968b68fa5bbe3e728d11fedd04f93bb
36f0bf882a876b13aeb20cf7a495421a43f336da5422072a58f58ce303fb6284
39253e0583d87f1e4da4c9028eb3112b1218fe79ee1a9df1d86560a43887615f
394724ca0118829643c12fb5a033cb66680e51327ba157677d18dec209278a3d
3a812fdbca60bfc0852ea2bb36f1aaf2672020a5b741ea90ee5d3e8ee4db3a42
3eecec5f13d9cb118886b731100620c80543b4f60edfc4e39833391f5786c797
4158adb5a7663a1c27ca5da162a32fbb2a0df8cb57072d28815feef493c5534d
4ec0827f796bdadb833f52dd7ea841e12158d9f488554ecb73479cc2ea6f6d8e
502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358
511599fb3ac1f39744ca04710b5b8396127a4aa96e93e849ba3aea89a1c4d739
52a1de7724643745b966624de81900181e5e376195e841a6666db41fb1a37240
5875aa9b6e08289882f785ca5b8faf742835cae993da615fdda385ba5e270077
58a0c074a2d68c4b2f319c228e092bbe83d0bc9edfcc904f897aad1f39d99520
5949577882598f6beecd577b649b81b4fa4ab687638c979a4182cad88c02d3b1
5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848
5e3450f2655679fe68f715f02d804dd0062df0ed824a009eae7e7224984cf9eb
5f36f8d6819cb2f5698eee5682dd520de565034b8510510f827244579b51b437
6037734d0ad3dd7b2f31955aeeb4b34e2316f726e1bd884d7dbc979649570049
60c5b6c14e2a63b65d65e67810664a5ee09348e5783033fd294bd9703da8ec95
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101
621661fe1c7a59420c624f7a421c566ebfb38cfbc7edd98ee0462c44d15971f9
641defe78e044cbd72e13110f131016fc26c1e8b00ef29ad142e177a0e54bfe1
6b5c5665f31951a78369562f709f561506f92fa24c69469e42fc013963e9fb50
6e42ec45fee8ebb7248427c36f69b71450834c83dad5d9ffcc7740828cf6046b
706a1fcf9dc4f3efb060b17963f5b1d4cf07bb39161340adea90b81caf428f1b
726678783bf6d9de6e7df279d14f14901b68d0358d8812da8274665348dc71a2
77263b1165469fdbabd1d353ecc07faa82baa23047e18ecb5520f74c2f6eb948
78ab2b963e7ba74ef400ed721024f39a48b230800debc2432066be7a8695cff6
793f203a71fd5bb0d2d52113acad0d9ccc51cf6e5a461e93e8bf8f24e318c42c
7aa3e069e8b82688828c1d83cfd3d1a715bf1dfdccdb94438120cf79ec9274e4
81a6832550bd52d1c44e1e63c2d9137a441dd53d31302c3070000403d032b012
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50
88c6aad586b488b6440cad6d6e82ff0cb00e17ade437d2aa07add8994d57982c
947ac0903521f5eceefc90637c066306a8ca67466ccc188bb0107fb7cfb532d1
961951e588ed2cbd0dadda321becf5c4d27451bb0896262f86e7d922da5794ca
969e82bade7f2133977ae76c952503b1c7d8185b31a0a084c45f5c9aae1ce138
96b04ef160f8b50520a48707a452fecdd6e6771c643706d5949020a2dea15962
9a53a378b0bf8737dd5384da05ca56af9af8e7a218eb8a2d22a96eca1ac5141b
9c0a837b1dcc7a86d7630681eb73c0c4d1243adf483b269789b06f608348c6d6
9e597d8c9a4da491394c388d66a4dc948d16cc327f8e9548d574e09429b4b437
9ea16efa9e53039fffb7ccf6bee49de744e04402da82e1070d45733ef4a36711
9edb2179b3a4de19f2bd050f807bf098dc9820ac1301e7cda0916d1cf75316b3
9f4e1162f14929daf66b14bc0395af8064813a0e21780d214c88a7f99e955d4e
a1fd3ffbda7f9a22b6cf420f3672f608040b22ae27bc98dd175c6ae1efa6aea5
a6aeb0f05d454e29935dc8708f1dbdbe27176d849880fdbf1d30d4d5bc6c3c18
a76848114ac3aa6c9a127156124b0f8c7efbc68cf71d2a03df51ae73dda2e6f0
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
af55868699d57b9d2a50aac14791e93f70004703817fc3179f2243d36734dd96
b0f2842cf2fe230f30d403634d26de441e415c437b4d81fe2626ea0e95426c78
b1322c7a9be782f0436fb0ece75829d265964462c36f2e5530c3ff78e0b5ac55
b5b60d72aeacf013c48d4302e8b6564c7a3307ece32a40fad2857c4238af2265
b94b05ccc912f4deadb7dffd20326ce301931340c02efcb1e2a80fb55c59c6c2
ba2338aa6670580269c762f51c4291daef913201aa8f4d4fd166c1a878262652
bb6daad8bfcebeda56cb73bc7dfe8e5d2cd6333710ec83cf933ad109b7ab728a
c13c78967ff2ef425f0ed8408f64af4745ce11c72c5087cda6e273aed3b581b6
c3c2125ebaeb07268bbc110c5f11486686b0d1b756115142dfbfc855cf82ba43
c64a6e5cd18f4259ba04815cf49fc93b4a6e7d9eb5d27e003246cd19ed1cfa22
c67fd705b4a52a62066cd60979c65edfa8b0d6c3da9a8d88d21afd56c11042e9
c6dc2d05669b7d0b896bb7185ed18035463aa200da0022364d446579365a8350
c8602934f8b2d2a89793ece40e427f78925555cfebb32dc315b1a5d573fcf68d
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
ce483bd57a7d0576c16db84df9cf92b4d94a2c8472f3254dbd2a759704d0fbfd
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee
d14d3528790f5f18fa352072175d550eb7a21c2dd1f5fadb1d33ca25ab8cbff5
d71837085a430ef3fc2ba4901eb669568469df3dbee23e68690125f6a287b01f
d79e4b240cdc0e74e6066051005bb4701deaa28c5d5c20eefd6823dc1b5f4626
d7ab36bda2c2cd614f2273a36ad7318d78fac4580fc027603e82801fd539a499
d9b7faa0259f5b0961455f53b4a507fba4bd0ed70dffac0bdaf2f94298c74b40
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e039e607c78306c7e029a7fd0ecdb14f86456f16e1a5ce65aa26b4fdf1d38a3c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eac1bb2890c6ae6d2cc8653765f594f1209eda9eb0036eef9fde51299e883a5b
ec21f3a88e2b4fba18a074541bef001d87c50e667cf5d52437961c1b5a3c953b
ed0a155ad49d65503a2bfb7f8cae86f1a80eb6fd34c2cc5e309b2c4057b3187c
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f8372e4920304819a1afe1cb4a33def279a032e5d0154b53df47d05abdfc8077
f8e37527996d0530694a2a8ddf6afdcf28cc8a05e50ce3ce9d3f2f743b04659f
faeb9f5dcf58e12891d944bca3c47552abdff5146ce9e313aeb2a3cc9cf9929e
fedfc64728beee4dcdf576abb2dd3c44b462afc3b5db8c53704629a1ee6dd14c

secure.winred.com Open in urlscan Pro 104.19.211.89 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

162 Requests

99 %HTTPS

0 %IPv6

23 Domains

35 Subdomains

32 IPs

3 Countries

4967 kBTransfer

15151 kBSize

34 Cookies

9 Outgoing links

Page URL History

Redirected requests

162 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

secure.winred.com Open in urlscan Pro
104.19.211.89 Public Scan

Screenshot
Live screenshot

Full Image

162
Requests

99 %
HTTPS

0 %
IPv6

23
Domains

35
Subdomains

32
IPs

3
Countries

4967 kB
Transfer

15151 kB
Size

34
Cookies

162 HTTP transactions
0 data transactions