secure.winred.com Open in urlscan Pro
2606:4700:10::6814:543 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://click.campaigns.rnchq.com/?qs=6c5ef73527251a10d5411942ddaced13373c8b0f33c8b45630a077ff585505633044dbc4559e84bf570a4d788d8a...
Effective URL:
https://secure.winred.com/rnc/2021-sustaining-membership?utm_medium=email&utm_source=ET_16&utm_campaign=20210920_106163_20...
Submission: On September 20 via api (September 20th 2021, 8:02:07 pm UTC) from US — Scanned from DE

Summary HTTP 148 Redirects Links 7 Behaviour Indicators

Summary

This website contacted 30 IPs in 3 countries across 21 domains to perform 148 HTTP transactions. The main IP is 2606:4700:10::6814:543, located in United States and belongs to CLOUDFLARENET, US. The main domain is secure.winred.com.
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on September 15th 2020. Valid for: a year.

This is the only time secure.winred.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	13.111.145.38 13.111.145.38	22606 (EXACT-7) (EXACT-7)
9	2606:4700:10:... 2606:4700:10::6814:543	13335 (CLOUDFLAR...) (CLOUDFLARENET)
26	13.224.193.92 13.224.193.92	16509 (AMAZON-02) (AMAZON-02)
4	2a00:1450:400... 2a00:1450:4001:831::200a	15169 (GOOGLE) (GOOGLE)
4	13.224.193.4 13.224.193.4	16509 (AMAZON-02) (AMAZON-02)
4	2a00:1450:400... 2a00:1450:4001:808::2008	15169 (GOOGLE) (GOOGLE)
1	104.111.232.208 104.111.232.208	16625 (AKAMAI-AS) (AKAMAI-AS)
8	2a00:1450:400... 2a00:1450:4001:810::200e	15169 (GOOGLE) (GOOGLE)
6	184.30.24.194 184.30.24.194	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2606:4700:10:... 2606:4700:10::6814:443	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.111.240.115 104.111.240.115	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	142.250.185.134 142.250.185.134	15169 (GOOGLE) (GOOGLE)
2	3.224.144.253 3.224.144.253	14618 (AMAZON-AES) (AMAZON-AES)
4	2a03:2880:f02... 2a03:2880:f02d:100:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	2a00:1450:400... 2a00:1450:400c:c04::9c	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:400c:c00::5c	15169 (GOOGLE) (GOOGLE)
2	2600:9000:20e... 2600:9000:20eb:e000:19:7d10:bd80:93a1	16509 (AMAZON-02) (AMAZON-02)
32	54.186.23.98 54.186.23.98	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:80f::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80e::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:812::2002	15169 (GOOGLE) (GOOGLE)
1 1	142.250.185.98 142.250.185.98	15169 (GOOGLE) (GOOGLE)
3	35.157.44.192 35.157.44.192	16509 (AMAZON-02) (AMAZON-02)
1	35.165.21.246 35.165.21.246	16509 (AMAZON-02) (AMAZON-02)
1	3.124.235.44 3.124.235.44	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:80f::2002	15169 (GOOGLE) (GOOGLE)
5	2a03:2880:f12... 2a03:2880:f12d:181:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
5	2a00:1450:400... 2a00:1450:4001:810::2003	15169 (GOOGLE) (GOOGLE)
13	2a00:1450:400... 2a00:1450:4001:829::200e	15169 (GOOGLE) (GOOGLE)
1	142.250.186.162 142.250.186.162	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82b::2003	15169 (GOOGLE) (GOOGLE)
1	52.45.207.82 52.45.207.82	14618 (AMAZON-AES) (AMAZON-AES)
148	30

1 13.111.145.38 (United States) 1 redirects

ASN22606 (EXACT-7, US)
PTR: click.campaigns.rnchq.com

click.campaigns.rnchq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2606:4700:10::6814:543 (United States)

ASN13335 (CLOUDFLARENET, US)

secure.winred.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

26 13.224.193.92 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-193-92.fra2.r.cloudfront.net

js.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:831::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

maps.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 13.224.193.4 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-193-4.fra2.r.cloudfront.net

d35ligi1n5bgzc.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:808::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.232.208 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-232-208.deploy.static.akamaitechnologies.com

cdn-pci.optimizely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:810::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 184.30.24.194 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a184-30-24-194.deploy.static.akamaitechnologies.com

tags.tiqcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6814:443 (United States)

ASN13335 (CLOUDFLARENET, US)

app.revv.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.240.115 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-240-115.deploy.static.akamaitechnologies.com

a8416096648.cdn-pci.optimizely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.134 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f6.1e100.net

9323526.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.224.144.253 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-224-144-253.compute-1.amazonaws.com

10964169.collect.igodigital.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
nova.collect.igodigital.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f02d:100:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c04::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:400c:c00::5c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

pay.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:20eb:e000:19:7d10:bd80:93a1 (United States)

ASN16509 (AMAZON-02, US)

m.stripe.network	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

32 54.186.23.98 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ip-54-186-23-98.stripe.com

r.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
q.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80f::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:812::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.98 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.157.44.192 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-157-44-192.eu-central-1.compute.amazonaws.com

datacloud.tealiumiq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
collect.tealiumiq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.165.21.246 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-165-21-246.us-west-2.compute.amazonaws.com

m.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.124.235.44 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-124-235-44.eu-central-1.compute.amazonaws.com

visitor-service-eu-central-1.tealiumiq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.se	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a03:2880:f12d:181:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:810::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2a00:1450:4001:829::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

play.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.se	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.45.207.82 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-45-207-82.compute-1.amazonaws.com

logx.optimizely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
59	stripe.com js.stripe.com r.stripe.com q.stripe.com m.stripe.com	696 KB
20	google.com pay.google.com www.google.com adservice.google.com play.google.com	390 KB
9	winred.com secure.winred.com	245 KB
8	google-analytics.com www.google-analytics.com	85 KB
6	doubleclick.net 2 redirects 9323526.fls.doubleclick.net stats.g.doubleclick.net cm.g.doubleclick.net googleads.g.doubleclick.net	5 KB
6	tiqcdn.com tags.tiqcdn.com	22 KB
5	gstatic.com www.gstatic.com	102 KB
5	facebook.com www.facebook.com	654 B
4	tealiumiq.com datacloud.tealiumiq.com collect.tealiumiq.com visitor-service-eu-central-1.tealiumiq.com	3 KB
4	facebook.net connect.facebook.net	204 KB
4	googletagmanager.com www.googletagmanager.com	207 KB
4	cloudfront.net d35ligi1n5bgzc.cloudfront.net	327 KB
4	googleapis.com maps.googleapis.com	168 KB
3	optimizely.com cdn-pci.optimizely.com a8416096648.cdn-pci.optimizely.com logx.optimizely.com	110 KB
2	google.se adservice.google.se www.google.se	1 KB
2	stripe.network m.stripe.network	17 KB
2	igodigital.com 10964169.collect.igodigital.com nova.collect.igodigital.com	3 KB
1	googleadservices.com www.googleadservices.com	14 KB
1	google.de www.google.de	522 B
1	revv.co app.revv.co	1 KB
1	rnchq.com 1 redirects click.campaigns.rnchq.com	441 B
148	21

	Domain	Requested by
28	q.stripe.com	secure.winred.com
26	js.stripe.com	secure.winred.com js.stripe.com
13	play.google.com	www.gstatic.com
9	secure.winred.com	secure.winred.com
8	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com secure.winred.com www.gstatic.com
6	tags.tiqcdn.com	secure.winred.com tags.tiqcdn.com
5	www.gstatic.com	pay.google.com www.gstatic.com
5	www.facebook.com	secure.winred.com
4	r.stripe.com	js.stripe.com
4	pay.google.com	js.stripe.com pay.google.com secure.winred.com www.gstatic.com
4	connect.facebook.net	secure.winred.com connect.facebook.net
4	www.googletagmanager.com	secure.winred.com www.googletagmanager.com
4	d35ligi1n5bgzc.cloudfront.net	secure.winred.com
4	maps.googleapis.com	secure.winred.com maps.googleapis.com
2	collect.tealiumiq.com	tags.tiqcdn.com
2	www.google.com	secure.winred.com
2	m.stripe.network	js.stripe.com m.stripe.network
2	stats.g.doubleclick.net	www.google-analytics.com
2	9323526.fls.doubleclick.net	1 redirects www.googletagmanager.com
1	logx.optimizely.com	cdn-pci.optimizely.com
1	www.google.se
1	googleads.g.doubleclick.net	www.googleadservices.com
1	www.googleadservices.com	www.googletagmanager.com
1	adservice.google.se	adservice.google.com
1	visitor-service-eu-central-1.tealiumiq.com	tags.tiqcdn.com
1	m.stripe.com	m.stripe.network
1	datacloud.tealiumiq.com	secure.winred.com
1	cm.g.doubleclick.net	1 redirects
1	nova.collect.igodigital.com	secure.winred.com
1	adservice.google.com	9323526.fls.doubleclick.net
1	www.google.de	secure.winred.com
1	10964169.collect.igodigital.com	www.googletagmanager.com
1	a8416096648.cdn-pci.optimizely.com	cdn-pci.optimizely.com
1	app.revv.co	secure.winred.com
1	cdn-pci.optimizely.com	secure.winred.com
1	click.campaigns.rnchq.com	1 redirects
148	36

This site contains links to these domains. Also see Links.

Domain
winred.com
www.80810-info.com
www.gop.com

Subject Issuer	Validity	Valid
www.winred.com DigiCert SHA2 Extended Validation Server CA	`2020-09-15` - `2021-10-17`	a year	crt.sh
a.stripecdn.com DigiCert SHA2 Extended Validation Server CA	`2021-07-09` - `2021-11-03`	4 months	crt.sh
upload.video.google.com GTS CA 1C3	`2021-08-30` - `2021-11-22`	3 months	crt.sh
*.cloudfront.net Amazon	`2021-03-19` - `2022-03-17`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-08-30` - `2021-11-22`	3 months	crt.sh
cdn-pci.optimizely.com DigiCert SHA2 Secure Server CA	`2021-02-17` - `2022-02-21`	a year	crt.sh
*.tiqcdn.com DigiCert SHA2 Secure Server CA	`2021-04-19` - `2022-04-27`	a year	crt.sh
*.revv.co DigiCert SHA2 Secure Server CA	`2020-09-11` - `2021-10-13`	a year	crt.sh
*.cdn-pci.optimizely.com DigiCert SHA2 Secure Server CA	`2021-02-17` - `2022-02-21`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2021-08-30` - `2021-11-22`	3 months	crt.sh
*.collect.igodigital.com DigiCert TLS RSA SHA256 2020 CA1	`2021-01-25` - `2022-02-25`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-07-01` - `2021-09-29`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-08-30` - `2021-11-22`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-08-30` - `2021-11-22`	3 months	crt.sh
*.stripe.com DigiCert SHA2 Secure Server CA	`2021-09-08` - `2022-09-07`	a year	crt.sh
www.google.com GTS CA 1C3	`2021-08-30` - `2021-11-22`	3 months	crt.sh
www.google.de GTS CA 1C3	`2021-08-30` - `2021-11-22`	3 months	crt.sh
*.tealiumiq.com Amazon	`2020-10-23` - `2021-11-22`	a year	crt.sh
m.stripe.com DigiCert TLS RSA SHA256 2020 CA1	`2021-07-13` - `2021-11-03`	4 months	crt.sh
*.google.se GTS CA 1C3	`2021-08-30` - `2021-11-22`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-08-30` - `2021-11-22`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2021-08-30` - `2021-11-22`	3 months	crt.sh
logx.optimizely.com Amazon	`2021-08-23` - `2022-09-21`	a year	crt.sh

This page contains 16 frames:

Primary Page: https://secure.winred.com/rnc/2021-sustaining-membership?utm_medium=email&utm_source=ET_16&utm_campaign=20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc&utm_content=gop_direct-ask_text_contribute_bottom_other_all
Frame ID: 761BDB1E914D5EC6D71BDF2E8B3F5AE0
Requests: 59 HTTP requests in this frame

Frame: https://js.stripe.com/v3/m-outer-9475bd26486e6119b23924eebd3d561a.html
Frame ID: 30D68FF316F6CC6EC5BEEEAA6B5D2CB5
Requests: 2 HTTP requests in this frame

Frame: https://js.stripe.com/v3/controller-1e93944d1a9de5801e277dcad979f254.html
Frame ID: 434496140C48EB7AE4A37FB6A87892C5
Requests: 14 HTTP requests in this frame

Frame: https://js.stripe.com/v3/elements-inner-card-58e63ab408e3331b87172d32302f52e5.html
Frame ID: 99AA2849411F7F9D12482EE25CE66C90
Requests: 6 HTTP requests in this frame

Frame: https://js.stripe.com/v3/controller-1e93944d1a9de5801e277dcad979f254.html
Frame ID: D8E29DB933955250DCC71FCC9E1B7079
Requests: 23 HTTP requests in this frame

Frame: https://js.stripe.com/v3/payment-request-inner-google-pay-4ab654d9b723d75a0b2928ca5ebbf577.html
Frame ID: 7C5F04D5FDD38A70200D9486FF6DEDE6
Requests: 4 HTTP requests in this frame

Frame: https://js.stripe.com/v3/payment-request-inner-browser-56c245eb8dc4e99a2725ad66f94f0ebf.html
Frame ID: 728DDA494F34F1962E5D8B2F0F74AEB6
Requests: 3 HTTP requests in this frame

Frame: https://a8416096648.cdn-pci.optimizely.com/client_storage/a8416096648.html
Frame ID: 4DB6AEA896C8B08771F93705EF702C36
Requests: 1 HTTP requests in this frame

Frame: https://9323526.fls.doubleclick.net/activityi;dc_pre=CP_xiomsjvMCFQrrUQodEugMIQ;src=9323526;type=landi0;cat=gop_d0;ord=3757474134697;gtm=2wg9f0;auiddc=956306649.1632168122;~oref=https%3A%2F%2Fsecure.winred.com%2Frnc%2F2021-sustaining-membership%3Futm_medium%3Demail%26utm_source%3DET_16%26utm_campaign%3D20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc%26utm_content%3Dgop_direct-ask_text_contribute_bottom_other_all
Frame ID: C1CCE7CE3E941AF76C30AC7517FA8CC5
Requests: 1 HTTP requests in this frame

Frame: https://m.stripe.network/inner.html
Frame ID: 642856A85F94527AEBDE1D3041C66DDB
Requests: 4 HTTP requests in this frame

Frame: https://pay.google.com/gp/p/ui/payframe?origin=https%3A%2F%2Fjs.stripe.com&mid=
Frame ID: 8AF00EB79DA6064996EEA657E00141C2
Requests: 16 HTTP requests in this frame

Frame: https://adservice.google.com/ddm/fls/i/dc_pre=CP_xiomsjvMCFQrrUQodEugMIQ;src=9323526;type=landi0;cat=gop_d0;ord=3757474134697;gtm=2wg9f0;auiddc=956306649.1632168122;~oref=https%3A%2F%2Fsecure.winred.com%2Frnc%2F2021-sustaining-membership%3Futm_medium%3Demail%26utm_source%3DET_16%26utm_campaign%3D20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc%26utm_content%3Dgop_direct-ask_text_contribute_bottom_other_all
Frame ID: 38BF7C5F8F1E36A9E84BE02C8B9BD608
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.se/ddm/fls/i/dc_pre=CP_xiomsjvMCFQrrUQodEugMIQ;src=9323526;type=landi0;cat=gop_d0;ord=3757474134697;gtm=2wg9f0;auiddc=956306649.1632168122;~oref=https%3A%2F%2Fsecure.winred.com%2Frnc%2F2021-sustaining-membership%3Futm_medium%3Demail%26utm_source%3DET_16%26utm_campaign%3D20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc%26utm_content%3Dgop_direct-ask_text_contribute_bottom_other_all
Frame ID: B4B3A2E83599862925A0DC56E8A4BFB8
Requests: 1 HTTP requests in this frame

Frame: https://js.stripe.com/v3/elements-inner-payment-request-ba41c776bf8e1c724faebfdd96840d43.html
Frame ID: BF373185C0175F2302286EAE9630FC7E
Requests: 5 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 1ED265483E83556714839AE9154AD280
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: FB86158302589C9BF987B5691BBBAB4F
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Republican National Committee

Page URL History Show full URLs

https://click.campaigns.rnchq.com/?qs=6c5ef73527251a10d5411942ddaced13373c8b0f33c8b45630a077ff585505633044dbc4... HTTP 302
https://secure.winred.com/rnc/2021-sustaining-membership?utm_medium=email&utm_source=ET_16&utm_campaig... Page URL

Detected technologies

Google Maps (Maps) Expand

Overall confidence: 100%
Detected patterns

//maps\.google(?:apis)?\.com/maps/api/js

Google Pay (Payment processors) Expand

Overall confidence: 100%
Detected patterns

pay\.google\.com/([a-z/]+)/pay\.js

Stripe (Payment Processors) Expand

Overall confidence: 100%
Detected patterns

js\.stripe\.com

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/ns\.html[^>]+></iframe>
googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Optimizely (Analytics) Expand

Overall confidence: 100%
Detected patterns

optimizely\.com.*\.js

Tealium (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

^(?:https?:)?//tags\.tiqcdn\.com/

Page Statistics

148
Requests

100 %
HTTPS

53 %
IPv6

21
Domains

36
Subdomains

30
IPs

3
Countries

2601 kB
Transfer

8130 kB
Size

27
Cookies

7 Outgoing links

These are links going to different origins than the main page.

URL: https://winred.com/terms/donor-terms/
Title: terms of use

Search URL Search Domain Scan URL

URL: https://winred.com/privacy
Title: privacy policy

Search URL Search Domain Scan URL

URL: http://www.80810-info.com/
Title: www.80810-info.com

Search URL Search Domain Scan URL

URL: http://www.gop.com/
Title: www.gop.com

Search URL Search Domain Scan URL

URL: https://winred.com/
Title: Powered by

Search URL Search Domain Scan URL

URL: https://winred.com/about-our-ads/
Title: About Our Ads

Search URL Search Domain Scan URL

URL: https://winred.com/support/
Title: Questions about your charge? Go to our Support Center

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://click.campaigns.rnchq.com/?qs=6c5ef73527251a10d5411942ddaced13373c8b0f33c8b45630a077ff585505633044dbc4559e84bf570a4d788d8a28be38d577033fae8fb4 HTTP 302
https://secure.winred.com/rnc/2021-sustaining-membership?utm_medium=email&utm_source=ET_16&utm_campaign=20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc&utm_content=gop_direct-ask_text_contribute_bottom_other_all Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 26

https://9323526.fls.doubleclick.net/activityi;src=9323526;type=landi0;cat=gop_d0;ord=3757474134697;gtm=2wg9f0;auiddc=956306649.1632168122;~oref=https%3A%2F%2Fsecure.winred.com%2Frnc%2F2021-sustaining-membership%3Futm_medium%3Demail%26utm_source%3DET_16%26utm_campaign%3D20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc%26utm_content%3Dgop_direct-ask_text_contribute_bottom_other_all HTTP 302
https://9323526.fls.doubleclick.net/activityi;dc_pre=CP_xiomsjvMCFQrrUQodEugMIQ;src=9323526;type=landi0;cat=gop_d0;ord=3757474134697;gtm=2wg9f0;auiddc=956306649.1632168122;~oref=https%3A%2F%2Fsecure.winred.com%2Frnc%2F2021-sustaining-membership%3Futm_medium%3Demail%26utm_source%3DET_16%26utm_campaign%3D20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc%26utm_content%3Dgop_direct-ask_text_contribute_bottom_other_all

Request Chain 89

https://cm.g.doubleclick.net/pixel?tealium_cookie_sync=true&google_nid=tealium_dmp&google_cm&tealium_vid=017c04cd17b30095e3a5ae45502803072010a06a00b08&tealium_account=gop&tealium_profile=main HTTP 302
https://datacloud.tealiumiq.com/vdata/i.gif?tealium_cookie_sync=true&tealium_vid=017c04cd17b30095e3a5ae45502803072010a06a00b08&tealium_account=gop&tealium_profile=main&google_gid=CAESEPlM2X9HORL7UW2yHL6MJkE&google_cver=1

148 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request 2021-sustaining-membership Show response
secure.winred.com/rnc/
Redirect Chain

https://click.campaigns.rnchq.com/?qs=6c5ef73527251a10d5411942ddaced13373c8b0f33c8b45630a077ff585505633044dbc4559e84bf570a4d788d8a28be38d577033fae8fb4
https://secure.winred.com/rnc/2021-sustaining-membership?utm_medium=email&utm_source=ET_16&utm_campaign=20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincom...

39 KB
12 KB

352ms
176ms

Document
text/html

2606:4700:10::6814:543
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/rnc/2021-sustaining-membership?utm_medium=email&utm_source=ET_16&utm_campaign=20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc&utm_content=gop_direct-ask_text_contribute_bottom_other_all

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6814:543 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c4fad9adc119c68438bae52a48675773d02d7eb814bd1bb566b8c6366c4c6a2e

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: secure.winred.com
:scheme: https
:path: /rnc/2021-sustaining-membership?utm_medium=email&utm_source=ET_16&utm_campaign=20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc&utm_content=gop_direct-ask_text_contribute_bottom_other_all
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Mon, 20 Sep 2021 20:02:00 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
cache-control: no-store, no-cache, must-revalidate, private, max-age=0
x-revv-cache: Hit from Revv
set-cookie: _revv_v3_session=TENUYjNSamkyVk5VSUhDL0FrakhrSHE3aFdOYXVNVzZMV3djZ0lsOUpRdGEzdEZKV3g3aEU4Y3JPRUZJVUpmTXQ2M3ZiMVJQNHBZS0pyei90U0xSci9lSUV4bUNyMmROOW00YXFKZ1NMYzRvR0prSzFYQWc3NHU3VVZ5S1dHZFpzVjZycW5sN0NwL21qUXFidlJTTjFQL0QraFZsSktJaEp5amVWUWExaWtldHdkRlRTckdiNFZLUGxUU0xpdzV0N3hVNWFJM2d1M1l5aTJGK2tqSkVNeStCNGs5dW1GNGs5cFZvckd4SXFENE4xRU5naEFrVHdadEpBWXY2ZFlpQ0xpbHQra05qNTc2UVdaV042MlZBcDUyNnFVMHdraVZpbG4wUVNaUmxwNlVCcXMxcGxNanRKYmxtZHZGNzk0OTlJOFR5YzI4QmdKcEVMK21TS1luc295MFBIMUFNV1BvbldvVXhqemw0STc1ZURxbHFVT3V2bUxjVk9OdVJheWdFZW9Cb3E4SmxiOU84V2Z4dExVOGFuZjc2dTlibVlnb0xrWWVSS3hRaUtma2FJcmlVa3RIaENqai9BOW95dGM1V2ZNbkFYdGN0Y3pIajd6R0JyakFFZG1sakpCaEE3OXh0czM2N3Q3ZXJjQW85ZFpBUWlqVWhZekhwR3RwQk0venhHTFlOMmtCc1NvZHZHNGg2Q1RqQ0ZXdzZVMlY1QkU4UFJSNDRmWWk4QzJsWkREd1Z2UjErWnVmRzVybHpBMHVpcHZTYW5EYXlaTHZrNW5aN1dYSnVaNkdZSzcxV08yTWg2ZU0rYnRIbzhNdlhWUTBBRWxpVHFjQkJ1THdLeHVNUHAvZ2s0R2FrNjdXQS9DMUFGQzV3RUloS1BzcHBEYy94Z0ZKd0dnQ1ZHWms9LS1ZcEVsMWZ6SU80bWlJelpHV05QbnJ3PT0%3D--9d0e0641cc2681767196a0a3c8f1fe719f11504a; domain=.winred.com; path=/; HttpOnly; Secure; SameSite=None; Secure __cf_bm=PCBcx1jh_w4gXRipHRHG6LwB_cd4SgAgAWEJcBJoVNk-1632168120-0-Af3ZDDBtM1uW6znCWn2EpVmaQvatBemlJqsJY6aJNRRP987qrxcBexSNhnE0syRoYUZUfMGPBFP5QnZQqNAt9dspgdcD6g98Qpb5dQPn6pgP; path=/; expires=Mon, 20-Sep-21 20:32:00 GMT; domain=.secure.winred.com; HttpOnly; Secure; SameSite=None
x-request-id: ed03f949-6527-4fa7-934a-b614342966a5
x-runtime: 0.028447
x-rack-cors: miss; no-origin
strict-transport-security: max-age=0; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 691da622ed436946-FRA
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Redirect headers

Cache-Control: private
Content-Type: text/html; charset=utf-8
Location: https://secure.winred.com/rnc/2021-sustaining-membership?utm_medium=email&utm_source=ET_16&utm_campaign=20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc&utm_content=gop_direct-ask_text_contribute_bottom_other_all
Date: Mon, 20 Sep 2021 20:01:59 GMT
Connection: close
Content-Length: 395

GET
H2 200 / Show response
js.stripe.com/v3/ 252 KB
67 KB 265ms
203ms Script
application/javascript 13.224.193.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/rnc/2021-sustaining-membership?utm_medium=email&utm_source=ET_16&utm_campaign=20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc&utm_content=gop_direct-ask_text_contribute_bottom_other_all

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.92 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-92.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

37b3012c96acb80f94f59f98cd21677ed6b1976489157fb4f31d2195eae478e7

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 20:02:02 GMT
content-encoding: gzip
vary: Accept-Encoding
x-amz-request-id: ZHPTAR7E5ZG9TYF8
via: 1.1 2ec3090d74e200e4acdb2780da3c3c44.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
x-amz-id-2: ql+6W/WW3DYd+Cw2/3J/zytW+IbNu82oS7O01xBxPi6jCPNoATXdDPA6kD61FfRf1uu8Eq5bxjs=
last-modified: Mon, 20 Sep 2021 18:31:13 GMT
server: AmazonS3
etag: W/"220d69abb8b583d51e7fcf39fec90fe3"
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
content-security-policy: default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
x-amz-cf-pop: FRA2-C1
timing-allow-origin: *
x-amz-cf-id: GXb4HFB1Z7SDNSrwjTKl0e8ANLdo-jpN2ttohm5mtNGkMDJEBsSXcQ==

GET
H2 200 landing_page-205145a105df0cfe48c31181c82ec93fbef8907bfa527923a4a10936993b1f3a.css
secure.winred.com/assets/ 217 KB
34 KB 32ms
30ms Stylesheet
text/css 2606:4700:10::6814:543
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/assets/landing_page-205145a105df0cfe48c31181c82ec93fbef8907bfa527923a4a10936993b1f3a.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6814:543 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c5d6337e892966edbf8c318256da0fa78ac4fccfbdfcb50a33b616df69666951

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

:path: /assets/landing_page-205145a105df0cfe48c31181c82ec93fbef8907bfa527923a4a10936993b1f3a.css
pragma: no-cache
cookie: _revv_v3_session=TENUYjNSamkyVk5VSUhDL0FrakhrSHE3aFdOYXVNVzZMV3djZ0lsOUpRdGEzdEZKV3g3aEU4Y3JPRUZJVUpmTXQ2M3ZiMVJQNHBZS0pyei90U0xSci9lSUV4bUNyMmROOW00YXFKZ1NMYzRvR0prSzFYQWc3NHU3VVZ5S1dHZFpzVjZycW5sN0NwL21qUXFidlJTTjFQL0QraFZsSktJaEp5amVWUWExaWtldHdkRlRTckdiNFZLUGxUU0xpdzV0N3hVNWFJM2d1M1l5aTJGK2tqSkVNeStCNGs5dW1GNGs5cFZvckd4SXFENE4xRU5naEFrVHdadEpBWXY2ZFlpQ0xpbHQra05qNTc2UVdaV042MlZBcDUyNnFVMHdraVZpbG4wUVNaUmxwNlVCcXMxcGxNanRKYmxtZHZGNzk0OTlJOFR5YzI4QmdKcEVMK21TS1luc295MFBIMUFNV1BvbldvVXhqemw0STc1ZURxbHFVT3V2bUxjVk9OdVJheWdFZW9Cb3E4SmxiOU84V2Z4dExVOGFuZjc2dTlibVlnb0xrWWVSS3hRaUtma2FJcmlVa3RIaENqai9BOW95dGM1V2ZNbkFYdGN0Y3pIajd6R0JyakFFZG1sakpCaEE3OXh0czM2N3Q3ZXJjQW85ZFpBUWlqVWhZekhwR3RwQk0venhHTFlOMmtCc1NvZHZHNGg2Q1RqQ0ZXdzZVMlY1QkU4UFJSNDRmWWk4QzJsWkREd1Z2UjErWnVmRzVybHpBMHVpcHZTYW5EYXlaTHZrNW5aN1dYSnVaNkdZSzcxV08yTWg2ZU0rYnRIbzhNdlhWUTBBRWxpVHFjQkJ1THdLeHVNUHAvZ2s0R2FrNjdXQS9DMUFGQzV3RUloS1BzcHBEYy94Z0ZKd0dnQ1ZHWms9LS1ZcEVsMWZ6SU80bWlJelpHV05QbnJ3PT0%3D--9d0e0641cc2681767196a0a3c8f1fe719f11504a; __cf_bm=PCBcx1jh_w4gXRipHRHG6LwB_cd4SgAgAWEJcBJoVNk-1632168120-0-Af3ZDDBtM1uW6znCWn2EpVmaQvatBemlJqsJY6aJNRRP987qrxcBexSNhnE0syRoYUZUfMGPBFP5QnZQqNAt9dspgdcD6g98Qpb5dQPn6pgP
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: secure.winred.com
referer: https://secure.winred.com/rnc/2021-sustaining-membership?utm_medium=email&utm_source=ET_16&utm_campaign=20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc&utm_content=gop_direct-ask_text_contribute_bottom_other_all
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/rnc/2021-sustaining-membership?utm_medium=email&utm_source=ET_16&utm_campaign=20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc&utm_content=gop_direct-ask_text_contribute_bottom_other_all
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 20:02:01 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 5529
cf-polished: origSize=225416
last-modified: Sun, 01 Aug 2021 04:38:39 GMT
strict-transport-security: max-age=0; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id: 8SSSXTPP5414XNJ8
x-amz-id-2: G7IPT+JdokmZv+R+gDYK6l2RIlbllRmN4ntDVkEIHkWrteKb3/V3SkRNww3WE81ekgwDiZeSk84=
cf-bgj: minify
server: cloudflare
etag: W/"78a9c5647b11f06acfc06f40e6836957"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
x-amz-version-id: 4OZoRJnunIaAaja2aVM1AE6ZASWH6BVu
cf-ray: 691da62428f36946-FRA
expires: Tue, 21 Sep 2021 00:02:01 GMT

GET
H2 200 1615920146.css
secure.winred.com/stylesheets/rv_page_01evw0hqx25by6d8rvk1zbeqkb/ 8 KB
2 KB 25ms
24ms Stylesheet
text/css 2606:4700:10::6814:543
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/stylesheets/rv_page_01evw0hqx25by6d8rvk1zbeqkb/1615920146.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6814:543 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6a51adbdf40f1dd532bdc040298e97d7c6d2b0c568c539c1a87017b6ec9ad0fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /stylesheets/rv_page_01evw0hqx25by6d8rvk1zbeqkb/1615920146.css
pragma: no-cache
cookie: _revv_v3_session=TENUYjNSamkyVk5VSUhDL0FrakhrSHE3aFdOYXVNVzZMV3djZ0lsOUpRdGEzdEZKV3g3aEU4Y3JPRUZJVUpmTXQ2M3ZiMVJQNHBZS0pyei90U0xSci9lSUV4bUNyMmROOW00YXFKZ1NMYzRvR0prSzFYQWc3NHU3VVZ5S1dHZFpzVjZycW5sN0NwL21qUXFidlJTTjFQL0QraFZsSktJaEp5amVWUWExaWtldHdkRlRTckdiNFZLUGxUU0xpdzV0N3hVNWFJM2d1M1l5aTJGK2tqSkVNeStCNGs5dW1GNGs5cFZvckd4SXFENE4xRU5naEFrVHdadEpBWXY2ZFlpQ0xpbHQra05qNTc2UVdaV042MlZBcDUyNnFVMHdraVZpbG4wUVNaUmxwNlVCcXMxcGxNanRKYmxtZHZGNzk0OTlJOFR5YzI4QmdKcEVMK21TS1luc295MFBIMUFNV1BvbldvVXhqemw0STc1ZURxbHFVT3V2bUxjVk9OdVJheWdFZW9Cb3E4SmxiOU84V2Z4dExVOGFuZjc2dTlibVlnb0xrWWVSS3hRaUtma2FJcmlVa3RIaENqai9BOW95dGM1V2ZNbkFYdGN0Y3pIajd6R0JyakFFZG1sakpCaEE3OXh0czM2N3Q3ZXJjQW85ZFpBUWlqVWhZekhwR3RwQk0venhHTFlOMmtCc1NvZHZHNGg2Q1RqQ0ZXdzZVMlY1QkU4UFJSNDRmWWk4QzJsWkREd1Z2UjErWnVmRzVybHpBMHVpcHZTYW5EYXlaTHZrNW5aN1dYSnVaNkdZSzcxV08yTWg2ZU0rYnRIbzhNdlhWUTBBRWxpVHFjQkJ1THdLeHVNUHAvZ2s0R2FrNjdXQS9DMUFGQzV3RUloS1BzcHBEYy94Z0ZKd0dnQ1ZHWms9LS1ZcEVsMWZ6SU80bWlJelpHV05QbnJ3PT0%3D--9d0e0641cc2681767196a0a3c8f1fe719f11504a; __cf_bm=PCBcx1jh_w4gXRipHRHG6LwB_cd4SgAgAWEJcBJoVNk-1632168120-0-Af3ZDDBtM1uW6znCWn2EpVmaQvatBemlJqsJY6aJNRRP987qrxcBexSNhnE0syRoYUZUfMGPBFP5QnZQqNAt9dspgdcD6g98Qpb5dQPn6pgP
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: secure.winred.com
referer: https://secure.winred.com/rnc/2021-sustaining-membership?utm_medium=email&utm_source=ET_16&utm_campaign=20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc&utm_content=gop_direct-ask_text_contribute_bottom_other_all
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/rnc/2021-sustaining-membership?utm_medium=email&utm_source=ET_16&utm_campaign=20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc&utm_content=gop_direct-ask_text_contribute_bottom_other_all
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-rack-cors: miss; no-origin
date: Mon, 20 Sep 2021 20:02:01 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 34312
cf-polished: origSize=8297
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-xss-protection: 1; mode=block
x-request-id: 7cb86205-b022-4540-85ac-caae3a7bd47b
x-runtime: 0.055082
cf-bgj: minify
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains
content-type: text/css; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=31556952
cf-ray: 691da62428f56946-FRA
expires: Wed, 21 Sep 2022 01:51:13 GMT

GET
H2 200 js Show response
maps.googleapis.com/maps/api/ 146 KB
48 KB 56ms
34ms Script
text/javascript 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

mafe /

Resource Hash

f4cfac7f236dac05e3477fddee8ca0029c627696f2a1b7954118fbf1404afe86

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 20:02:01 GMT
content-encoding: gzip
vary: Accept-Language
server: mafe
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1800
cross-origin-resource-policy: cross-origin
server-timing: gfet4t7; dur=18
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48582
x-xss-protection: 0
expires: Mon, 20 Sep 2021 20:32:01 GMT

GET
H2 200 application-landing-page-2b519cf2158dfde8279a9e67e3750b0bfd4e7b401b81ea4b2cad61ff38be873e.js Show response
secure.winred.com/assets/ 602 KB
170 KB 46ms
45ms Script
application/javascript 2606:4700:10::6814:543
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/assets/application-landing-page-2b519cf2158dfde8279a9e67e3750b0bfd4e7b401b81ea4b2cad61ff38be873e.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6814:543 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

71dca7cbcc364183a910631475c55eb8363f6d397e5080a275f98513ecfaee67

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

:path: /assets/application-landing-page-2b519cf2158dfde8279a9e67e3750b0bfd4e7b401b81ea4b2cad61ff38be873e.js
pragma: no-cache
cookie: _revv_v3_session=TENUYjNSamkyVk5VSUhDL0FrakhrSHE3aFdOYXVNVzZMV3djZ0lsOUpRdGEzdEZKV3g3aEU4Y3JPRUZJVUpmTXQ2M3ZiMVJQNHBZS0pyei90U0xSci9lSUV4bUNyMmROOW00YXFKZ1NMYzRvR0prSzFYQWc3NHU3VVZ5S1dHZFpzVjZycW5sN0NwL21qUXFidlJTTjFQL0QraFZsSktJaEp5amVWUWExaWtldHdkRlRTckdiNFZLUGxUU0xpdzV0N3hVNWFJM2d1M1l5aTJGK2tqSkVNeStCNGs5dW1GNGs5cFZvckd4SXFENE4xRU5naEFrVHdadEpBWXY2ZFlpQ0xpbHQra05qNTc2UVdaV042MlZBcDUyNnFVMHdraVZpbG4wUVNaUmxwNlVCcXMxcGxNanRKYmxtZHZGNzk0OTlJOFR5YzI4QmdKcEVMK21TS1luc295MFBIMUFNV1BvbldvVXhqemw0STc1ZURxbHFVT3V2bUxjVk9OdVJheWdFZW9Cb3E4SmxiOU84V2Z4dExVOGFuZjc2dTlibVlnb0xrWWVSS3hRaUtma2FJcmlVa3RIaENqai9BOW95dGM1V2ZNbkFYdGN0Y3pIajd6R0JyakFFZG1sakpCaEE3OXh0czM2N3Q3ZXJjQW85ZFpBUWlqVWhZekhwR3RwQk0venhHTFlOMmtCc1NvZHZHNGg2Q1RqQ0ZXdzZVMlY1QkU4UFJSNDRmWWk4QzJsWkREd1Z2UjErWnVmRzVybHpBMHVpcHZTYW5EYXlaTHZrNW5aN1dYSnVaNkdZSzcxV08yTWg2ZU0rYnRIbzhNdlhWUTBBRWxpVHFjQkJ1THdLeHVNUHAvZ2s0R2FrNjdXQS9DMUFGQzV3RUloS1BzcHBEYy94Z0ZKd0dnQ1ZHWms9LS1ZcEVsMWZ6SU80bWlJelpHV05QbnJ3PT0%3D--9d0e0641cc2681767196a0a3c8f1fe719f11504a; __cf_bm=PCBcx1jh_w4gXRipHRHG6LwB_cd4SgAgAWEJcBJoVNk-1632168120-0-Af3ZDDBtM1uW6znCWn2EpVmaQvatBemlJqsJY6aJNRRP987qrxcBexSNhnE0syRoYUZUfMGPBFP5QnZQqNAt9dspgdcD6g98Qpb5dQPn6pgP
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: secure.winred.com
referer: https://secure.winred.com/rnc/2021-sustaining-membership?utm_medium=email&utm_source=ET_16&utm_campaign=20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc&utm_content=gop_direct-ask_text_contribute_bottom_other_all
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/rnc/2021-sustaining-membership?utm_medium=email&utm_source=ET_16&utm_campaign=20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc&utm_content=gop_direct-ask_text_contribute_bottom_other_all
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 20:02:01 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1667
cf-polished: origSize=616128
last-modified: Thu, 16 Sep 2021 01:53:01 GMT
strict-transport-security: max-age=0; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id: 3YEX177EGQBAHQ3R
x-amz-id-2: e/gfQd7cZaXyhXnkNOFXdCsQjTHRO7L47MUMe57rzYWTobrdlC41lagNQ8ZruWNR9apfKDFYf9s=
cf-bgj: minify
server: cloudflare
etag: W/"b101e631a0e3a86f1fb2f8e08e888066"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=14400
x-amz-version-id: XnvgcnsBNmbZWICg0MhAjxZv5_HiuIh3
cf-ray: 691da62428fa6946-FRA
expires: Tue, 21 Sep 2021 00:02:01 GMT

GET
H2 200 api.js Show response
secure.winred.com/cdn-cgi/bm/cv/669835187/ 35 KB
9 KB 17ms
17ms Script
text/javascript 2606:4700:10::6814:543
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/cdn-cgi/bm/cv/669835187/api.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6814:543 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0d3118e306c6a26f1d2efcb698984e6922c5e7e155c94a84760e36e5592a3c11

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

:path: /cdn-cgi/bm/cv/669835187/api.js
pragma: no-cache
cookie: _revv_v3_session=TENUYjNSamkyVk5VSUhDL0FrakhrSHE3aFdOYXVNVzZMV3djZ0lsOUpRdGEzdEZKV3g3aEU4Y3JPRUZJVUpmTXQ2M3ZiMVJQNHBZS0pyei90U0xSci9lSUV4bUNyMmROOW00YXFKZ1NMYzRvR0prSzFYQWc3NHU3VVZ5S1dHZFpzVjZycW5sN0NwL21qUXFidlJTTjFQL0QraFZsSktJaEp5amVWUWExaWtldHdkRlRTckdiNFZLUGxUU0xpdzV0N3hVNWFJM2d1M1l5aTJGK2tqSkVNeStCNGs5dW1GNGs5cFZvckd4SXFENE4xRU5naEFrVHdadEpBWXY2ZFlpQ0xpbHQra05qNTc2UVdaV042MlZBcDUyNnFVMHdraVZpbG4wUVNaUmxwNlVCcXMxcGxNanRKYmxtZHZGNzk0OTlJOFR5YzI4QmdKcEVMK21TS1luc295MFBIMUFNV1BvbldvVXhqemw0STc1ZURxbHFVT3V2bUxjVk9OdVJheWdFZW9Cb3E4SmxiOU84V2Z4dExVOGFuZjc2dTlibVlnb0xrWWVSS3hRaUtma2FJcmlVa3RIaENqai9BOW95dGM1V2ZNbkFYdGN0Y3pIajd6R0JyakFFZG1sakpCaEE3OXh0czM2N3Q3ZXJjQW85ZFpBUWlqVWhZekhwR3RwQk0venhHTFlOMmtCc1NvZHZHNGg2Q1RqQ0ZXdzZVMlY1QkU4UFJSNDRmWWk4QzJsWkREd1Z2UjErWnVmRzVybHpBMHVpcHZTYW5EYXlaTHZrNW5aN1dYSnVaNkdZSzcxV08yTWg2ZU0rYnRIbzhNdlhWUTBBRWxpVHFjQkJ1THdLeHVNUHAvZ2s0R2FrNjdXQS9DMUFGQzV3RUloS1BzcHBEYy94Z0ZKd0dnQ1ZHWms9LS1ZcEVsMWZ6SU80bWlJelpHV05QbnJ3PT0%3D--9d0e0641cc2681767196a0a3c8f1fe719f11504a; __cf_bm=PCBcx1jh_w4gXRipHRHG6LwB_cd4SgAgAWEJcBJoVNk-1632168120-0-Af3ZDDBtM1uW6znCWn2EpVmaQvatBemlJqsJY6aJNRRP987qrxcBexSNhnE0syRoYUZUfMGPBFP5QnZQqNAt9dspgdcD6g98Qpb5dQPn6pgP
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: secure.winred.com
referer: https://secure.winred.com/rnc/2021-sustaining-membership?utm_medium=email&utm_source=ET_16&utm_campaign=20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc&utm_content=gop_direct-ask_text_contribute_bottom_other_all
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/rnc/2021-sustaining-membership?utm_medium=email&utm_source=ET_16&utm_campaign=20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc&utm_content=gop_direct-ask_text_contribute_bottom_other_all
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 20:02:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains
content-type: text/javascript
vary: Accept-Encoding
cache-control: max-age=604800, public
cf-ray: 691da627bbfd6946-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 20210126_GOP_TMAGAC_EOM_Eom_Web_Pop-Ups_Jan-2021_V1-Joe-Kamala_2450x1628_%281%29.png
d35ligi1n5bgzc.cloudfront.net/widget_images/images/000/072/088/medium/ 108 KB
108 KB 62ms
10ms Image
image/png 13.224.193.4
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d35ligi1n5bgzc.cloudfront.net/widget_images/images/000/072/088/medium/20210126_GOP_TMAGAC_EOM_Eom_Web_Pop-Ups_Jan-2021_V1-Joe-Kamala_2450x1628_%281%29.png
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/rnc/2021-sustaining-membership?utm_medium=email&utm_source=ET_16&utm_campaign=20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc&utm_content=gop_direct-ask_text_contribute_bottom_other_all
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.193.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-193-4.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b5422c2d179ba7e391b254909921a8e862d1b8147b3534e70de801f2dca3d84d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Mon, 20 Sep 2021 02:06:56 GMT
via: 1.1 0e7eb16f335fe24acf3f13c5dee19c88.cloudfront.net (CloudFront)
last-modified: Sat, 17 Jul 2021 13:08:00 GMT
server: AmazonS3
age: 64506
etag: "50a8b7ebe6e7cf7efb3f9f7f95c95b03"
x-edge-origin-shield-skipped: 0
x-amz-version-id: ZfdOxt5hITsW5wZHX8TBzbZI9aDwcMpd
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-type: image/png
content-length: 110248
x-amz-cf-id: UNrgTwmnCLwOdsTvLzztC1afSaoFHZM_qSZnHl4lX4-eH8D2sz2m5A==

GET
H2 200 1200px-Republican_Disc.svg.png
d35ligi1n5bgzc.cloudfront.net/profiles/images/000/012/049/square/ 7 KB
8 KB 8ms
8ms Image
image/png 13.224.193.4
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d35ligi1n5bgzc.cloudfront.net/profiles/images/000/012/049/square/1200px-Republican_Disc.svg.png
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/rnc/2021-sustaining-membership?utm_medium=email&utm_source=ET_16&utm_campaign=20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc&utm_content=gop_direct-ask_text_contribute_bottom_other_all
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.193.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-193-4.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c885ef025f7d73741c3fae1f63830e9beec3f662f0ca17ea7746b534b34ac5d5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-version-id: gbL12paoPRxv210hmmexw4Iij5jW0Goh
via: 1.1 0e7eb16f335fe24acf3f13c5dee19c88.cloudfront.net (CloudFront)
etag: "7c98913b783795d6b02b742196b9a24a"
last-modified: Sat, 17 Jul 2021 18:30:39 GMT
server: AmazonS3
age: 59478
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: image/png
date: Mon, 20 Sep 2021 09:05:30 GMT
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-length: 7348
x-amz-cf-id: 0iDUYydogxJc0cg1z0PnEIOSsYgVNwHsWZ3Zx6VKwPb12UXJwmH-Mg==

GET
H2 200 win-red-mark-small-24c5e97a925e2a929cae4a87ecdfcdf27f56974fd8172bdd34af91145aebca91.png
secure.winred.com/assets/ 9 KB
9 KB 32ms
32ms Image
image/webp 2606:4700:10::6814:543
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.winred.com/assets/win-red-mark-small-24c5e97a925e2a929cae4a87ecdfcdf27f56974fd8172bdd34af91145aebca91.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6814:543 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

36f0bf882a876b13aeb20cf7a495421a43f336da5422072a58f58ce303fb6284

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

:path: /assets/win-red-mark-small-24c5e97a925e2a929cae4a87ecdfcdf27f56974fd8172bdd34af91145aebca91.png
pragma: no-cache
cookie: _revv_v3_session=TENUYjNSamkyVk5VSUhDL0FrakhrSHE3aFdOYXVNVzZMV3djZ0lsOUpRdGEzdEZKV3g3aEU4Y3JPRUZJVUpmTXQ2M3ZiMVJQNHBZS0pyei90U0xSci9lSUV4bUNyMmROOW00YXFKZ1NMYzRvR0prSzFYQWc3NHU3VVZ5S1dHZFpzVjZycW5sN0NwL21qUXFidlJTTjFQL0QraFZsSktJaEp5amVWUWExaWtldHdkRlRTckdiNFZLUGxUU0xpdzV0N3hVNWFJM2d1M1l5aTJGK2tqSkVNeStCNGs5dW1GNGs5cFZvckd4SXFENE4xRU5naEFrVHdadEpBWXY2ZFlpQ0xpbHQra05qNTc2UVdaV042MlZBcDUyNnFVMHdraVZpbG4wUVNaUmxwNlVCcXMxcGxNanRKYmxtZHZGNzk0OTlJOFR5YzI4QmdKcEVMK21TS1luc295MFBIMUFNV1BvbldvVXhqemw0STc1ZURxbHFVT3V2bUxjVk9OdVJheWdFZW9Cb3E4SmxiOU84V2Z4dExVOGFuZjc2dTlibVlnb0xrWWVSS3hRaUtma2FJcmlVa3RIaENqai9BOW95dGM1V2ZNbkFYdGN0Y3pIajd6R0JyakFFZG1sakpCaEE3OXh0czM2N3Q3ZXJjQW85ZFpBUWlqVWhZekhwR3RwQk0venhHTFlOMmtCc1NvZHZHNGg2Q1RqQ0ZXdzZVMlY1QkU4UFJSNDRmWWk4QzJsWkREd1Z2UjErWnVmRzVybHpBMHVpcHZTYW5EYXlaTHZrNW5aN1dYSnVaNkdZSzcxV08yTWg2ZU0rYnRIbzhNdlhWUTBBRWxpVHFjQkJ1THdLeHVNUHAvZ2s0R2FrNjdXQS9DMUFGQzV3RUloS1BzcHBEYy94Z0ZKd0dnQ1ZHWms9LS1ZcEVsMWZ6SU80bWlJelpHV05QbnJ3PT0%3D--9d0e0641cc2681767196a0a3c8f1fe719f11504a; __cf_bm=PCBcx1jh_w4gXRipHRHG6LwB_cd4SgAgAWEJcBJoVNk-1632168120-0-Af3ZDDBtM1uW6znCWn2EpVmaQvatBemlJqsJY6aJNRRP987qrxcBexSNhnE0syRoYUZUfMGPBFP5QnZQqNAt9dspgdcD6g98Qpb5dQPn6pgP
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: secure.winred.com
referer: https://secure.winred.com/rnc/2021-sustaining-membership?utm_medium=email&utm_source=ET_16&utm_campaign=20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc&utm_content=gop_direct-ask_text_contribute_bottom_other_all
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/rnc/2021-sustaining-membership?utm_medium=email&utm_source=ET_16&utm_campaign=20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc&utm_content=gop_direct-ask_text_contribute_bottom_other_all
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 20:02:01 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 6225
cf-polished: origFmt=png, origSize=11635
content-length: 8708
content-disposition: inline; filename="win-red-mark-small-24c5e97a925e2a929cae4a87ecdfcdf27f56974fd8172bdd34af91145aebca91.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id: HVNGQZ87J5FZNVZ3
x-amz-id-2: pXa5Yw98ZGzoJnTJQ2c89aKRYHkMIF2gQ5PENc89YPEmpkMAl/hROwct6oT1742x58MaHkHhCC4=
expires: Tue, 21 Sep 2021 00:02:01 GMT
last-modified: Thu, 19 Aug 2021 01:56:34 GMT
server: cloudflare
etag: "972c0cca8d1e490484e89513f902e847"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains
content-type: image/webp
vary: Accept
cache-control: public, max-age=14400
x-amz-version-id: yp2ulLE7RV1IpSIkV7ALDqESIiBK17aT
accept-ranges: bytes
cf-ray: 691da6286dda6946-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 win-red-full-red-5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848.svg
secure.winred.com/assets/ 19 KB
7 KB 35ms
35ms Image
image/svg+xml 2606:4700:10::6814:543
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.winred.com/assets/win-red-full-red-5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6814:543 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

:path: /assets/win-red-full-red-5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848.svg
pragma: no-cache
cookie: _revv_v3_session=TENUYjNSamkyVk5VSUhDL0FrakhrSHE3aFdOYXVNVzZMV3djZ0lsOUpRdGEzdEZKV3g3aEU4Y3JPRUZJVUpmTXQ2M3ZiMVJQNHBZS0pyei90U0xSci9lSUV4bUNyMmROOW00YXFKZ1NMYzRvR0prSzFYQWc3NHU3VVZ5S1dHZFpzVjZycW5sN0NwL21qUXFidlJTTjFQL0QraFZsSktJaEp5amVWUWExaWtldHdkRlRTckdiNFZLUGxUU0xpdzV0N3hVNWFJM2d1M1l5aTJGK2tqSkVNeStCNGs5dW1GNGs5cFZvckd4SXFENE4xRU5naEFrVHdadEpBWXY2ZFlpQ0xpbHQra05qNTc2UVdaV042MlZBcDUyNnFVMHdraVZpbG4wUVNaUmxwNlVCcXMxcGxNanRKYmxtZHZGNzk0OTlJOFR5YzI4QmdKcEVMK21TS1luc295MFBIMUFNV1BvbldvVXhqemw0STc1ZURxbHFVT3V2bUxjVk9OdVJheWdFZW9Cb3E4SmxiOU84V2Z4dExVOGFuZjc2dTlibVlnb0xrWWVSS3hRaUtma2FJcmlVa3RIaENqai9BOW95dGM1V2ZNbkFYdGN0Y3pIajd6R0JyakFFZG1sakpCaEE3OXh0czM2N3Q3ZXJjQW85ZFpBUWlqVWhZekhwR3RwQk0venhHTFlOMmtCc1NvZHZHNGg2Q1RqQ0ZXdzZVMlY1QkU4UFJSNDRmWWk4QzJsWkREd1Z2UjErWnVmRzVybHpBMHVpcHZTYW5EYXlaTHZrNW5aN1dYSnVaNkdZSzcxV08yTWg2ZU0rYnRIbzhNdlhWUTBBRWxpVHFjQkJ1THdLeHVNUHAvZ2s0R2FrNjdXQS9DMUFGQzV3RUloS1BzcHBEYy94Z0ZKd0dnQ1ZHWms9LS1ZcEVsMWZ6SU80bWlJelpHV05QbnJ3PT0%3D--9d0e0641cc2681767196a0a3c8f1fe719f11504a; __cf_bm=PCBcx1jh_w4gXRipHRHG6LwB_cd4SgAgAWEJcBJoVNk-1632168120-0-Af3ZDDBtM1uW6znCWn2EpVmaQvatBemlJqsJY6aJNRRP987qrxcBexSNhnE0syRoYUZUfMGPBFP5QnZQqNAt9dspgdcD6g98Qpb5dQPn6pgP
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: secure.winred.com
referer: https://secure.winred.com/rnc/2021-sustaining-membership?utm_medium=email&utm_source=ET_16&utm_campaign=20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc&utm_content=gop_direct-ask_text_contribute_bottom_other_all
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/rnc/2021-sustaining-membership?utm_medium=email&utm_source=ET_16&utm_campaign=20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc&utm_content=gop_direct-ask_text_contribute_bottom_other_all
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 20:02:01 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1285
content-type: image/svg+xml
strict-transport-security: max-age=0; includeSubDomains
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id: 00B36D4QTJ8XMC3W
x-amz-id-2: bpN0xLQbnHRv5n/AAbkjrbAH4G6x3l8cyhZX/a5z+lqGim2XXfIM9eqdbZ0qkWSex6DPcWd1AZg=
last-modified: Sun, 01 Aug 2021 04:38:40 GMT
server: cloudflare
etag: W/"d31530d4186af669daf4f47099614593"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: Mx.E1m3nz1bm4vsF8Q.JawodiIk.JRm8
cache-control: public, max-age=14400
cf-ray: 691da6289e9f6946-FRA
expires: Tue, 21 Sep 2021 00:02:01 GMT

GET
H2 200 email-decode.min.js Show response
secure.winred.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
813 B 14ms
14ms Script
application/javascript 2606:4700:10::6814:543
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6814:543 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

:path: /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
pragma: no-cache
cookie: _revv_v3_session=TENUYjNSamkyVk5VSUhDL0FrakhrSHE3aFdOYXVNVzZMV3djZ0lsOUpRdGEzdEZKV3g3aEU4Y3JPRUZJVUpmTXQ2M3ZiMVJQNHBZS0pyei90U0xSci9lSUV4bUNyMmROOW00YXFKZ1NMYzRvR0prSzFYQWc3NHU3VVZ5S1dHZFpzVjZycW5sN0NwL21qUXFidlJTTjFQL0QraFZsSktJaEp5amVWUWExaWtldHdkRlRTckdiNFZLUGxUU0xpdzV0N3hVNWFJM2d1M1l5aTJGK2tqSkVNeStCNGs5dW1GNGs5cFZvckd4SXFENE4xRU5naEFrVHdadEpBWXY2ZFlpQ0xpbHQra05qNTc2UVdaV042MlZBcDUyNnFVMHdraVZpbG4wUVNaUmxwNlVCcXMxcGxNanRKYmxtZHZGNzk0OTlJOFR5YzI4QmdKcEVMK21TS1luc295MFBIMUFNV1BvbldvVXhqemw0STc1ZURxbHFVT3V2bUxjVk9OdVJheWdFZW9Cb3E4SmxiOU84V2Z4dExVOGFuZjc2dTlibVlnb0xrWWVSS3hRaUtma2FJcmlVa3RIaENqai9BOW95dGM1V2ZNbkFYdGN0Y3pIajd6R0JyakFFZG1sakpCaEE3OXh0czM2N3Q3ZXJjQW85ZFpBUWlqVWhZekhwR3RwQk0venhHTFlOMmtCc1NvZHZHNGg2Q1RqQ0ZXdzZVMlY1QkU4UFJSNDRmWWk4QzJsWkREd1Z2UjErWnVmRzVybHpBMHVpcHZTYW5EYXlaTHZrNW5aN1dYSnVaNkdZSzcxV08yTWg2ZU0rYnRIbzhNdlhWUTBBRWxpVHFjQkJ1THdLeHVNUHAvZ2s0R2FrNjdXQS9DMUFGQzV3RUloS1BzcHBEYy94Z0ZKd0dnQ1ZHWms9LS1ZcEVsMWZ6SU80bWlJelpHV05QbnJ3PT0%3D--9d0e0641cc2681767196a0a3c8f1fe719f11504a; __cf_bm=PCBcx1jh_w4gXRipHRHG6LwB_cd4SgAgAWEJcBJoVNk-1632168120-0-Af3ZDDBtM1uW6znCWn2EpVmaQvatBemlJqsJY6aJNRRP987qrxcBexSNhnE0syRoYUZUfMGPBFP5QnZQqNAt9dspgdcD6g98Qpb5dQPn6pgP
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: secure.winred.com
referer: https://secure.winred.com/rnc/2021-sustaining-membership?utm_medium=email&utm_source=ET_16&utm_campaign=20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc&utm_content=gop_direct-ask_text_contribute_bottom_other_all
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/rnc/2021-sustaining-membership?utm_medium=email&utm_source=ET_16&utm_campaign=20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc&utm_content=gop_direct-ask_text_contribute_bottom_other_all
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 20:02:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 17 Sep 2021 09:29:40 GMT
server: cloudflare
etag: W/"61446004-4d7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: DENY
content-type: application/javascript
cache-control: max-age=172800 public
strict-transport-security: max-age=0; includeSubDomains
cf-ray: 691da6276af96946-FRA
vary: Accept-Encoding
expires: Wed, 22 Sep 2021 20:02:01 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 238 KB
55 KB 52ms
31ms Script
application/javascript 2a00:1450:4001:808::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

235eed18eb698427ba39de488eba407c2ae2e426fc605eddbd1f216802e620bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 20:02:01 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 56095
x-xss-protection: 0
last-modified: Mon, 20 Sep 2021 19:16:26 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 20 Sep 2021 20:02:01 GMT

GET
H2 200 8416096648.js Show response
cdn-pci.optimizely.com/js/ 421 KB
108 KB 494ms
429ms Script
text/javascript 104.111.232.208
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-pci.optimizely.com/js/8416096648.js
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/rnc/2021-sustaining-membership?utm_medium=email&utm_source=ET_16&utm_campaign=20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc&utm_content=gop_direct-ask_text_contribute_bottom_other_all
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 104.111.232.208 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-232-208.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: a0f5c152e93a734e753f7fa3fd664fa9f05a0155e65e82f16fd892808b190d38

Request headers

Referer: https://secure.winred.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

x-amz-meta-pci_enabled: True
x-amz-version-id: YkSaUnt1NBOJhSCtnB1YMkACjW1CfwyF
content-encoding: gzip
etag: "573ccbfbc1db9f273941c5d1097e83f1"
x-amz-request-id: C3987HP7KQ87P53C
x-amz-meta-revision: 74491
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 110273
x-amz-id-2: WVyKaxbCiap/0wpv4BUJF1KscM/2HmgXw4mWvxOQeYAk7yfVRzSpm+QfxzKcxpIoGJiGJeurY18=
last-modified: Mon, 20 Sep 2021 01:09:50 GMT
server: AmazonS3
date: Mon, 20 Sep 2021 20:02:01 GMT
access-control-max-age: 86400
access-control-allow-methods: GET, HEAD
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: x-amz-meta-revision
cache-control: max-age=120
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: *

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 270 KB
77 KB 46ms
46ms Script
application/javascript 2a00:1450:4001:808::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-KQQBPQZ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

04839f10aefc8d03d7a8cf83c6d4d0db112b3a87a4c8d59dd0eab9b919459318

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 20:02:01 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 78601
x-xss-protection: 0
last-modified: Mon, 20 Sep 2021 19:46:19 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 20 Sep 2021 20:02:01 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
20 KB 30ms
7ms Script
text/javascript 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NTQZ9N

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 11 Aug 2021 00:32:57 GMT
server: Golfe2
age: 4504
date: Mon, 20 Sep 2021 18:46:57 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19747
expires: Mon, 20 Sep 2021 20:46:57 GMT

GET
H2 200 utag.js Show response
tags.tiqcdn.com/utag/gop/main/prod/ 29 KB
9 KB 314ms
298ms Script
application/x-javascript 184.30.24.194
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/gop/main/prod/utag.js
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/rnc/2021-sustaining-membership?utm_medium=email&utm_source=ET_16&utm_campaign=20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc&utm_content=gop_direct-ask_text_contribute_bottom_other_all
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.30.24.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-24-194.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 626e124aafce560a521c9ce7e4cc884ea850ad2ab2228389ebc02350bcda0e92

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 20:02:02 GMT
content-encoding: gzip
last-modified: Tue, 09 Jun 2020 18:29:15 GMT
server: AkamaiNetStorage
etag: "d3a4917f0b04f7f490bed307234c1b79:1591727355.318358"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=300
accept-ranges: bytes
content-length: 9387
expires: Mon, 20 Sep 2021 20:07:02 GMT

GET
H2 200 20210129_GOP_TMAGAC_Clubs_Trump-100-Club_Web_Winred-Desktop_1920x1200.png
d35ligi1n5bgzc.cloudfront.net/backgrounds/images/000/072/527/large/ 136 KB
137 KB 405ms
404ms Image
binary/octet-stream 13.224.193.4
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d35ligi1n5bgzc.cloudfront.net/backgrounds/images/000/072/527/large/20210129_GOP_TMAGAC_Clubs_Trump-100-Club_Web_Winred-Desktop_1920x1200.png
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/stylesheets/rv_page_01evw0hqx25by6d8rvk1zbeqkb/1615920146.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.193.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-193-4.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e601b8a444a0a13c00221918c30fc739cf7f015494d6bdd884ff006507da8b40

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-version-id: b4OFHT17HYKZzkJQPukMS..5jTjjrbj.
via: 1.1 0e7eb16f335fe24acf3f13c5dee19c88.cloudfront.net (CloudFront)
etag: "ae17223d59515dc8e42b4d191be28d20"
last-modified: Sun, 18 Jul 2021 19:39:34 GMT
server: AmazonS3
x-amz-cf-pop: FRA2-C1
x-amz-server-side-encryption: AES256
x-cache: RefreshHit from cloudfront
content-type: binary/octet-stream
date: Mon, 20 Sep 2021 20:02:03 GMT
accept-ranges: bytes
content-length: 139414
x-amz-cf-id: 3TpDqyd9VBQPuQLzAs7lSwf7kneHAunsnH122h5JvQBHhaFfuGjQ6g==

GET
H2 200 m-outer-9475bd26486e6119b23924eebd3d561a.html Show response
js.stripe.com/v3/ Frame 30D6 215 B
943 B 20ms
20ms Document
text/html 13.224.193.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/m-outer-9475bd26486e6119b23924eebd3d561a.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.92 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-92.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

13e44ac91c0d0e34922532b04d931246156aef649b2ac9cacc69ad75ce63ad00

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src https://m.stripe.network; img-src https://q.stripe.com; font-src 'none'; media-src 'none'; object-src 'none';
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

:method: GET
:authority: js.stripe.com
:scheme: https
:path: /v3/m-outer-9475bd26486e6119b23924eebd3d561a.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://secure.winred.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/

Response headers

content-type: text/html; charset=utf-8
content-length: 215
x-amz-id-2: ay5jsEeYCN8RcAW+FwYUFPua0k+16nIu5J9BU9uUET7rPTLAbOrPtWl1vV81u6k/tjK4Zftdo2k=
x-amz-request-id: RTENWWX1V93NB3PE
last-modified: Wed, 01 Sep 2021 21:34:43 GMT
accept-ranges: bytes
server: AmazonS3
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
access-control-allow-origin: *
content-security-policy: default-src 'self'; connect-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src https://m.stripe.network; img-src https://q.stripe.com; font-src 'none'; media-src 'none'; object-src 'none';
date: Mon, 20 Sep 2021 20:02:01 GMT
cache-control: max-age=60
etag: "9475bd26486e6119b23924eebd3d561a"
x-cache: Hit from cloudfront
via: 1.1 2ec3090d74e200e4acdb2780da3c3c44.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: oYtIMbiffp7Yr8fKZL1RwJrASfKDh8jO-2eD9y10lqzrxSjXfFulNw==
age: 1

GET
H2 200 controller-1e93944d1a9de5801e277dcad979f254.html Show response
js.stripe.com/v3/ Frame 4344 299 B
1 KB 27ms
27ms Document
text/html 13.224.193.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/controller-1e93944d1a9de5801e277dcad979f254.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.92 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-92.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

450ec11a663f294bfe995ea695de0e6d19324441faf2bd3438d24775ecefebbf

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

:method: GET
:authority: js.stripe.com
:scheme: https
:path: /v3/controller-1e93944d1a9de5801e277dcad979f254.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://secure.winred.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/

Response headers

content-type: text/html; charset=utf-8
content-length: 299
x-amz-id-2: DVfg3kiyoFu9wSgtPpKxWIK7LjB0qVwxjYQ623+6D3jvGNHJeQQjeoA9eI4bHg21WihBiJCANAE=
x-amz-request-id: 4MFBWM92A1JJ1H30
last-modified: Mon, 20 Sep 2021 18:12:07 GMT
accept-ranges: bytes
server: AmazonS3
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
access-control-allow-origin: *
content-security-policy: default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
x-edge-origin-shield-skipped: 0
date: Mon, 20 Sep 2021 20:01:40 GMT
cache-control: max-age=60
etag: "1e93944d1a9de5801e277dcad979f254"
x-cache: Hit from cloudfront
via: 1.1 2ec3090d74e200e4acdb2780da3c3c44.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: m4T4cfi6egig50o9zYxBko0WjM0uH3n14UGXC7eL9gBe44yZy2N02g==
age: 22

GET
H2 200 elements-inner-card-58e63ab408e3331b87172d32302f52e5.html Show response
js.stripe.com/v3/ Frame 99AA 5 KB
2 KB 23ms
23ms Document
text/html 13.224.193.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/elements-inner-card-58e63ab408e3331b87172d32302f52e5.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.92 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-92.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

74178e00b0636e5ac392feb3347d28640816c2058b5f1b9e0d1125d3c947ae93

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

:method: GET
:authority: js.stripe.com
:scheme: https
:path: /v3/elements-inner-card-58e63ab408e3331b87172d32302f52e5.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://secure.winred.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/

Response headers

content-type: text/html; charset=utf-8
x-amz-id-2: 9rRcz1w+/RWjTlIYL8Qm8O2+4wh/icVZ6ymKaaZ7yMNy2cQlyFabPbC22KCEZZEZazEYB4PH9Io=
x-amz-request-id: WDDCR7Z5CVE5J5W1
last-modified: Mon, 20 Sep 2021 18:12:06 GMT
server: AmazonS3
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
access-control-allow-origin: *
content-security-policy: default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
content-encoding: gzip
date: Mon, 20 Sep 2021 20:02:01 GMT
cache-control: max-age=60
etag: W/"58e63ab408e3331b87172d32302f52e5"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 2ec3090d74e200e4acdb2780da3c3c44.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: WGhm66VbI5z62wzz8XAxjRUgGiS1CqKvvbvSX0jIxMI9_Hd9HNKvDA==

GET
H2 200 current_with_info Show response
app.revv.co/api/v3/users/ 162 B
1 KB 211ms
158ms XHR
application/vnd.api+json 2606:4700:10::6814:443
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.revv.co/api/v3/users/current_with_info?organization_token=rv_org_6KNvU36Z2qWJ2gfUBWqGZGoc&redirect=https://secure.winred.com/rnc/2021-sustaining-membership?utm_medium=email&utm_source=ET_16&utm_campaign=20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc&utm_content=gop_direct-ask_text_contribute_bottom_other_all

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/assets/application-landing-page-2b519cf2158dfde8279a9e67e3750b0bfd4e7b401b81ea4b2cad61ff38be873e.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6814:443 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b45a15794600b5971a446a1ba104794cc382ff185ae25c38f342e982e9b0b5f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://secure.winred.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-rack-cors-original-access-control-allow-origin: https://secure.winred.com
date: Mon, 20 Sep 2021 20:02:02 GMT
x-rack-cors-original-access-control-max-age: 0
x-rack-cors-original-access-control-allow-credentials: true
cf-cache-status: DYNAMIC
x-rack-cors-original-access-control-allow-methods: GET, POST, OPTIONS
access-control-max-age: 0
x-rack-cors-original-access-control-expose-headers
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-request-id: 4c90aed2-983c-4c4e-a1ab-e96cc52b5632
x-runtime: 0.009579
server: cloudflare
etag: W/"b45a15794600b5971a446a1ba104794c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/vnd.api+json
access-control-allow-origin: https://secure.winred.com
vary: Origin
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
cf-ray: 691da62a9eca42fd-FRA
x-rack-cors: hit
x-content-type-options: nosniff
access-control-expose-headers

GET
H2 200 controller-1e93944d1a9de5801e277dcad979f254.html Show response
js.stripe.com/v3/ Frame D8E2 299 B
1 KB 24ms
24ms Document
text/html 13.224.193.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/controller-1e93944d1a9de5801e277dcad979f254.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.92 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-92.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

450ec11a663f294bfe995ea695de0e6d19324441faf2bd3438d24775ecefebbf

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

:method: GET
:authority: js.stripe.com
:scheme: https
:path: /v3/controller-1e93944d1a9de5801e277dcad979f254.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://secure.winred.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/

Response headers

content-type: text/html; charset=utf-8
content-length: 299
x-amz-id-2: DVfg3kiyoFu9wSgtPpKxWIK7LjB0qVwxjYQ623+6D3jvGNHJeQQjeoA9eI4bHg21WihBiJCANAE=
x-amz-request-id: 4MFBWM92A1JJ1H30
last-modified: Mon, 20 Sep 2021 18:12:07 GMT
accept-ranges: bytes
server: AmazonS3
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
access-control-allow-origin: *
content-security-policy: default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
x-edge-origin-shield-skipped: 0
date: Mon, 20 Sep 2021 20:01:40 GMT
cache-control: max-age=60
etag: "1e93944d1a9de5801e277dcad979f254"
x-cache: Hit from cloudfront
via: 1.1 2ec3090d74e200e4acdb2780da3c3c44.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: oGFv63rjubnUv_sowYY3R2NETTQPGkHnhq190iK0z6Yefk_VPO0oZQ==
age: 22

GET
H2 200 payment-request-inner-google-pay-4ab654d9b723d75a0b2928ca5ebbf577.html Show response
js.stripe.com/v3/ Frame 7C5F 384 B
1 KB 19ms
19ms Document
text/html 13.224.193.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/payment-request-inner-google-pay-4ab654d9b723d75a0b2928ca5ebbf577.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.92 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-92.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

34270cdaeccdbb334855bd613970f79295c7af9d1823795eab35aa1e68a9d6c0

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; connect-src 'self' https://google.com/pay https://pay.google.com; script-src 'self' https://pay.google.com; style-src 'self' 'unsafe-inline'; frame-src https://pay.google.com; img-src https://q.stripe.com https://www.gstatic.com;
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

:method: GET
:authority: js.stripe.com
:scheme: https
:path: /v3/payment-request-inner-google-pay-4ab654d9b723d75a0b2928ca5ebbf577.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://secure.winred.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/

Response headers

content-type: text/html; charset=utf-8
content-length: 384
x-amz-id-2: UYFJmzaNN9kcooxEr0NjI1Ctudezm1suX+ioibM9ob2dyrj+2T5Ws1nlO+fNoARGp8GV5xTmw28=
x-amz-request-id: 4MFC4V4MNNESRRP6
last-modified: Mon, 20 Sep 2021 18:12:06 GMT
accept-ranges: bytes
server: AmazonS3
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
access-control-allow-origin: *
content-security-policy: default-src 'none'; connect-src 'self' https://google.com/pay https://pay.google.com; script-src 'self' https://pay.google.com; style-src 'self' 'unsafe-inline'; frame-src https://pay.google.com; img-src https://q.stripe.com https://www.gstatic.com;
date: Mon, 20 Sep 2021 20:01:45 GMT
cache-control: max-age=60
etag: "4ab654d9b723d75a0b2928ca5ebbf577"
x-cache: Hit from cloudfront
via: 1.1 2ec3090d74e200e4acdb2780da3c3c44.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: Erb_kud1WNAqAND08NmHi__sF2CesCrcGjJV7z44AXFLgdHl0BG9WQ==
age: 20

GET
H2 200 payment-request-inner-browser-56c245eb8dc4e99a2725ad66f94f0ebf.html Show response
js.stripe.com/v3/ Frame 728D 320 B
1 KB 23ms
23ms Document
text/html 13.224.193.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/payment-request-inner-browser-56c245eb8dc4e99a2725ad66f94f0ebf.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.92 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-92.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

13cdbe7a20c8c8fa6bc5ebc24d11ddac1e5f118dc8cb8af002f27a762d15c50f

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://google.com/pay https://pay.google.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com https://www.gstatic.com; font-src data: https:; media-src 'none'; object-src 'self';
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

:method: GET
:authority: js.stripe.com
:scheme: https
:path: /v3/payment-request-inner-browser-56c245eb8dc4e99a2725ad66f94f0ebf.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://secure.winred.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/

Response headers

content-type: text/html; charset=utf-8
content-length: 320
x-amz-id-2: VqBFQ0bmsXmIOvm7dW+H2LdzCXtt9GwFTSXfDhPQj7iIztrIrqsRFtHGmrkoSu9x21H+dIc1DFc=
x-amz-request-id: 4MF5Q7F2QPQ6G4CH
last-modified: Mon, 20 Sep 2021 18:11:39 GMT
accept-ranges: bytes
server: AmazonS3
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
access-control-allow-origin: *
content-security-policy: default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://google.com/pay https://pay.google.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com https://www.gstatic.com; font-src data: https:; media-src 'none'; object-src 'self';
x-edge-origin-shield-skipped: 0
date: Mon, 20 Sep 2021 20:01:58 GMT
cache-control: max-age=60
etag: "56c245eb8dc4e99a2725ad66f94f0ebf"
x-cache: Hit from cloudfront
via: 1.1 2ec3090d74e200e4acdb2780da3c3c44.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: vgU8X2qEjet9U1wYFXuqNGu7Ta675OYrx61egQLdj2tDlcj0__2CDQ==
age: 4

GET
H2 200 a8416096648.html Show response
a8416096648.cdn-pci.optimizely.com/client_storage/ Frame 4DB6 2 KB
1 KB 193ms
114ms Document
text/html 104.111.240.115
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://a8416096648.cdn-pci.optimizely.com/client_storage/a8416096648.html
Requested by: Host: cdn-pci.optimizely.com
URL: https://cdn-pci.optimizely.com/js/8416096648.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 104.111.240.115 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-240-115.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 19d2e43a96b539c5bfee8691baa248a6560e8bacd2bdc2350bc9f740af273a02

Request headers

:method: GET
:authority: a8416096648.cdn-pci.optimizely.com
:scheme: https
:path: /client_storage/a8416096648.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://secure.winred.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/

Response headers

x-amz-id-2: D78xzEy/A5TFJsHaRv9pVBYZku9OvR7/vvkKVDxmzb2DGotM91GM4uoV2iXZu6WLQRT7lD3ZnI8=
x-amz-request-id: 1P8XT238V8EJ17FJ
x-amz-replication-status: COMPLETED
last-modified: Mon, 20 Sep 2021 01:09:09 GMT
etag: "d180e2cac8f43dafe44966882825321a"
x-amz-meta-pci_enabled: True
content-encoding: gzip
x-amz-version-id: wyh83RXWR6er7vYRBTuIVLt6wlSPh6hc
accept-ranges: bytes
content-type: text/html; charset=utf-8
server: AmazonS3
content-length: 891
vary: Accept-Encoding
cache-control: max-age=120
date: Mon, 20 Sep 2021 20:02:02 GMT

GET
H2 200 ec.js Show response
www.google-analytics.com/plugins/ua/ 3 KB
2 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/ec.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 19:53:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 508
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1306
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Mon, 20 Sep 2021 20:53:34 GMT

GET
H2

200

activityi;dc_pre=CP_xiomsjvMCFQrrUQodEugMIQ;src=9323526;type=landi0;cat=gop_d0;ord=3757474134697;gtm=2wg9f0;auiddc=956306649.1632168122;~oref=https%3A%2F%2Fsecure.winred.com%2Frnc%2F2021-sustaining... Show response
9323526.fls.doubleclick.net/ Frame C1CC
Redirect Chain

https://9323526.fls.doubleclick.net/activityi;src=9323526;type=landi0;cat=gop_d0;ord=3757474134697;gtm=2wg9f0;auiddc=956306649.1632168122;~oref=https%3A%2F%2Fsecure.winred.com%2Frnc%2F2021-sustaini...
https://9323526.fls.doubleclick.net/activityi;dc_pre=CP_xiomsjvMCFQrrUQodEugMIQ;src=9323526;type=landi0;cat=gop_d0;ord=3757474134697;gtm=2wg9f0;auiddc=956306649.1632168122;~oref=https%3A%2F%2Fsecur...

739 B
712 B

20ms
18ms

Document
text/html

142.250.185.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://9323526.fls.doubleclick.net/activityi;dc_pre=CP_xiomsjvMCFQrrUQodEugMIQ;src=9323526;type=landi0;cat=gop_d0;ord=3757474134697;gtm=2wg9f0;auiddc=956306649.1632168122;~oref=https%3A%2F%2Fsecure.winred.com%2Frnc%2F2021-sustaining-membership%3Futm_medium%3Demail%26utm_source%3DET_16%26utm_campaign%3D20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc%26utm_content%3Dgop_direct-ask_text_contribute_bottom_other_all?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KQQBPQZ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f6.1e100.net

Software

cafe /

Resource Hash

f1f4e48d598d5505e28c3292f0871a2ee028b223ce46c16d175dfd20ad896fd8

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 9323526.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=CP_xiomsjvMCFQrrUQodEugMIQ;src=9323526;type=landi0;cat=gop_d0;ord=3757474134697;gtm=2wg9f0;auiddc=956306649.1632168122;~oref=https%3A%2F%2Fsecure.winred.com%2Frnc%2F2021-sustaining-membership%3Futm_medium%3Demail%26utm_source%3DET_16%26utm_campaign%3D20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc%26utm_content%3Dgop_direct-ask_text_contribute_bottom_other_all?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://secure.winred.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: about:blank

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Mon, 20 Sep 2021 20:02:02 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
pragma: no-cache
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 535
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Mon, 20-Sep-2021 20:17:02 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Mon, 20 Sep 2021 20:02:02 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://9323526.fls.doubleclick.net/activityi;dc_pre=CP_xiomsjvMCFQrrUQodEugMIQ;src=9323526;type=landi0;cat=gop_d0;ord=3757474134697;gtm=2wg9f0;auiddc=956306649.1632168122;~oref=https%3A%2F%2Fsecure.winred.com%2Frnc%2F2021-sustaining-membership%3Futm_medium%3Demail%26utm_source%3DET_16%26utm_campaign%3D20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc%26utm_content%3Dgop_direct-ask_text_contribute_bottom_other_all?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 collect.js Show response
10964169.collect.igodigital.com/ 9 KB
2 KB 348ms
101ms Script
application/javascript 3.224.144.253
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://10964169.collect.igodigital.com/collect.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KQQBPQZ
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.224.144.253 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-224-144-253.compute-1.amazonaws.com
Software: /
Resource Hash: 4611c34378b1bbbee8890a472c6390137ce8841041a646f0bdc58cf9180eb18a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 20:02:02 GMT
content-encoding: gzip
last-modified: Mon, 20 Sep 2021 17:43:11 GMT
vary: Accept-Encoding
content-type: application/javascript

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 91 KB
37 KB 23ms
23ms Script
application/javascript 2a00:1450:4001:808::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-9323526

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KQQBPQZ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

986b9eebf844fbc21d371c37409a5236bd0e7b38bbdbb9c32a06a7164f74100c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 20:02:02 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37689
x-xss-protection: 0
last-modified: Mon, 20 Sep 2021 19:16:26 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 20 Sep 2021 20:02:02 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 99 KB
26 KB 23ms
7ms Script
application/x-javascript 2a03:2880:f02d:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

335b59e615135313a66319e641cdad6ac3489a600e04d4181c859699bed4babe

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 25999
x-xss-protection: 0
pragma: public
x-fb-debug: +43Mxmz5SctHuxsYjE2aiRSKJkDjM0n8Aoqn21RCTuT+hVVPpgAuHbPyn4egwdUU1JCZ7tto33Sc2KxAsnogDg==
x-fb-trip-id: 917726464
x-frame-options: DENY
date: Mon, 20 Sep 2021 20:02:02 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 m-outer-f045e3b6b64aa0e635a6cabefc84daae.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 30D6 1 KB
2 KB 21ms
21ms Script
application/javascript 13.224.193.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/m-outer-f045e3b6b64aa0e635a6cabefc84daae.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/m-outer-9475bd26486e6119b23924eebd3d561a.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.92 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-92.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

e8e9871cf0af9019f2a0094a2ce12eb7794c104f7f38d9f75e7017c9d26e7cf6

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/v3/m-outer-9475bd26486e6119b23924eebd3d561a.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 20:02:02 GMT
content-encoding: gzip
vary: Accept-Encoding
age: 1
x-cache: Hit from cloudfront
x-edge-origin-shield-skipped: 0
x-amz-request-id: ZHPPFSKEMDT558RN
x-amz-id-2: rIgwQebiOHVq/FRD1PqtKXd5cf9Gd2QOpgNOsHTQPwuje+BuP4P6R6B2d84qlCn8V5EUi33pZB8=
access-control-allow-origin: *
last-modified: Wed, 01 Sep 2021 21:34:46 GMT
server: AmazonS3
etag: W/"01f873d478053c6a0368329ea08f7a10"
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
via: 1.1 2ec3090d74e200e4acdb2780da3c3c44.cloudfront.net (CloudFront)
cache-control: max-age=60
content-security-policy: default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
x-amz-cf-pop: FRA2-C1
timing-allow-origin: *
x-amz-cf-id: I8wPrKOi2jCiUnljV4JrayQHC4pTUYWReyQYYyYnVLtznrc4AMkqiQ==

GET
H2 200 shared-f5eaf0a870d23878716fd1e8f67f52e5.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 4344 179 KB
50 KB 32ms
31ms Script
application/javascript 13.224.193.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-f5eaf0a870d23878716fd1e8f67f52e5.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/controller-1e93944d1a9de5801e277dcad979f254.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.92 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-92.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

8480eb220a7c7d5b98e1b83c56ac821eadc545bed2bf6c47562f7e22bfdd154a

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/v3/controller-1e93944d1a9de5801e277dcad979f254.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
etag: W/"56589cc6bfbec71282a2ac27c86bdfc9"
age: 39
via: 1.1 2ec3090d74e200e4acdb2780da3c3c44.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-request-id: XEGB9TDKJ7H8B5D2
x-amz-id-2: 8/dPdGiX+frsqdAJzGJ9hBwZ63FEch8WWG7MA+IcP0jkutXCXOOQbKOC+g+r0JDV9fYkDOu1f9Q=
last-modified: Mon, 20 Sep 2021 18:11:41 GMT
server: AmazonS3
date: Mon, 20 Sep 2021 20:01:23 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
content-security-policy: default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
x-amz-cf-pop: FRA2-C1
timing-allow-origin: *
x-amz-cf-id: 0j1mk1rbJcKQEpAIZ3tk3AW3qHGMAUEPL6JZYPlKATq4H9dPw5wEig==

GET
H2 200 controller-150bb8806e08e8bf3beda95e906d7991.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 4344 191 KB
48 KB 45ms
44ms Script
application/javascript 13.224.193.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/controller-150bb8806e08e8bf3beda95e906d7991.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/controller-1e93944d1a9de5801e277dcad979f254.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.92 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-92.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

f919ef3d2847b69f2a8f60899caa05789574f07fa8f94ca72b19f38ad6a9a0fd

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/v3/controller-1e93944d1a9de5801e277dcad979f254.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
etag: W/"eaab7815b2eba43ac7af050003e64f56"
age: 32
x-cache: Hit from cloudfront
x-edge-origin-shield-skipped: 0
x-amz-request-id: Z2Y9PKMD0YH9NR6J
x-amz-id-2: j8GRywl1rAO6uOOoTfVfkHAV4Lar9HDtzgshxIOns3dVQggfyab+0bfCKTSjWlebCD5Wwsd9yWI=
access-control-allow-origin: *
last-modified: Fri, 17 Sep 2021 22:15:48 GMT
server: AmazonS3
date: Mon, 20 Sep 2021 20:01:31 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 2ec3090d74e200e4acdb2780da3c3c44.cloudfront.net (CloudFront)
cache-control: max-age=60
content-security-policy: default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
x-amz-cf-pop: FRA2-C1
timing-allow-origin: *
x-amz-cf-id: PtuVycGIGRVUEpVUN4xxrJuvkqbnyHlGSQYQ4Ow48r8iediD2Or1jQ==

GET
H2 200 ui-shared-fbbc6b7fa9d2977c6c9a09143f3027fd.css
js.stripe.com/v3/fingerprinted/css/ Frame 99AA 17 KB
4 KB 37ms
36ms Stylesheet
text/css 13.224.193.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/css/ui-shared-fbbc6b7fa9d2977c6c9a09143f3027fd.css

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-card-58e63ab408e3331b87172d32302f52e5.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.92 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-92.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

50cf3499f3f3e660c8d1a6001308c32306961043c33df07163b8f817b63c930e

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-card-58e63ab408e3331b87172d32302f52e5.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
etag: W/"9a9c2063d7db2d15e1e3281da15b9d41"
age: 55
via: 1.1 2ec3090d74e200e4acdb2780da3c3c44.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-request-id: W3F6SNMHFMGS03FB
x-amz-id-2: +0db1PCqtQrLYvHj9lchm2KnBmW5yTlGfzwYOPDnyGuwTw6r5b7WRKBWSpDCwbjOGPBAeIgJuAw=
last-modified: Wed, 04 Aug 2021 20:44:34 GMT
server: AmazonS3
date: Mon, 20 Sep 2021 20:01:07 GMT
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=60
content-security-policy: default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
x-amz-cf-pop: FRA2-C1
timing-allow-origin: *
x-amz-cf-id: bu7_c_bLOogn5L9ysP5AdZnzCzyFp0W3N62b3bdZtQEPg8MB4g9MYw==

GET
H2 200 shared-f5eaf0a870d23878716fd1e8f67f52e5.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 99AA 179 KB
50 KB 20ms
19ms Script
application/javascript 13.224.193.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-f5eaf0a870d23878716fd1e8f67f52e5.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-card-58e63ab408e3331b87172d32302f52e5.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.92 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-92.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

8480eb220a7c7d5b98e1b83c56ac821eadc545bed2bf6c47562f7e22bfdd154a

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-card-58e63ab408e3331b87172d32302f52e5.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
etag: W/"56589cc6bfbec71282a2ac27c86bdfc9"
age: 38
via: 1.1 2ec3090d74e200e4acdb2780da3c3c44.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-request-id: EWG9JGK5CFF6G0P0
x-amz-id-2: yuUtSVK+t9diVfi+YZ8iG2uWmit+nAwMR9Iy9dJmc6RIlDSRldlJBazm/CZ1aAHwaUERu3pVas0=
last-modified: Mon, 20 Sep 2021 18:11:41 GMT
server: AmazonS3
date: Mon, 20 Sep 2021 20:01:24 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
content-security-policy: default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
x-amz-cf-pop: FRA2-C1
timing-allow-origin: *
x-amz-cf-id: y20MK-hmbK0AsgX7e3CKV7pfUwZIGqM9-2njdUxRdQ0XdTaZ8kmEKw==

GET
H2 200 ui-shared-2c01313336dd31dabdfc1b78387faa1f.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 99AA 218 KB
68 KB 37ms
37ms Script
application/javascript 13.224.193.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/ui-shared-2c01313336dd31dabdfc1b78387faa1f.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-card-58e63ab408e3331b87172d32302f52e5.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.92 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-92.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

a9f6589d04dbb813a65b5d9aafb0c8b9e3a4b02836f06a954fbffdaf92e2d1bd

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-card-58e63ab408e3331b87172d32302f52e5.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
etag: W/"dd5bcda63bd636a7ef1dee9e1ad37bed"
x-amz-request-id: T78M9ZMR08SNT8H3
x-cache: Hit from cloudfront
x-edge-origin-shield-skipped: 0
x-amz-id-2: Z9mUawEjz+0ae9k5oZC6RVF+tygRh3HgWjS1dzw045ji33HzKpkaK3bu06kdlqOhLntQNAwU0rg=
access-control-allow-origin: *
last-modified: Fri, 17 Sep 2021 22:15:46 GMT
server: AmazonS3
date: Mon, 20 Sep 2021 20:02:02 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 2ec3090d74e200e4acdb2780da3c3c44.cloudfront.net (CloudFront)
cache-control: max-age=60
content-security-policy: default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
x-amz-cf-pop: FRA2-C1
timing-allow-origin: *
x-amz-cf-id: 0txveraFRvB8jrKw8MloXiTWAinkVfHZFphebh-Irv9bS0xOpY1TrA==

GET
H2 200 elements-inner-card-a5b43ea2173977e96b2e0aeafa2ebe69.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 99AA 46 KB
13 KB 31ms
31ms Script
application/javascript 13.224.193.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/elements-inner-card-a5b43ea2173977e96b2e0aeafa2ebe69.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-card-58e63ab408e3331b87172d32302f52e5.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.92 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-92.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

819d5419c736070b3a76cc3dc307a1df5039a1f66632c7920ae16993e0492f61

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-card-58e63ab408e3331b87172d32302f52e5.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 20:01:08 GMT
content-encoding: gzip
vary: Accept-Encoding
age: 55
x-cache: Hit from cloudfront
x-edge-origin-shield-skipped: 0
x-amz-request-id: E0CGJBY3V0P3FN7Z
x-amz-id-2: awzi7qx5RLqpq6dGwuYcHKe7TQOzAEpSnEmy+jalT/53Pmf2BYD2z/dHdJaeXLi08G1yzaiapP8=
access-control-allow-origin: *
last-modified: Fri, 17 Sep 2021 22:15:44 GMT
server: AmazonS3
etag: W/"380993da7c1a96b7db2faf39e676c30e"
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
via: 1.1 2ec3090d74e200e4acdb2780da3c3c44.cloudfront.net (CloudFront)
cache-control: max-age=60
content-security-policy: default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
x-amz-cf-pop: FRA2-C1
timing-allow-origin: *
x-amz-cf-id: TsWdL0nlq15vvC5WAw0Z0lGMlGyKbVxBBaWZev-EDyXpT3ZTfj1p1A==

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
414 B 60ms
14ms XHR
text/plain 2a00:1450:400c:c04::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j93&tid=UA-73658561-7&cid=671554296.1632168122&jid=1072723879&gjid=1114328741&_gid=2766536.1632168122&_u=aGBAgEALQAAAAE~&z=1312929127

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c04::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Mon, 20 Sep 2021 20:02:02 GMT
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 js Show response
www.google-analytics.com/gtm/ 119 KB
44 KB 26ms
24ms Script
application/javascript 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/gtm/js?id=OPT-NTPH8CG&t=gtm43&cid=671554296.1632168122

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1ac2771956c267147504b50c5c994b50f82d45f09e6b923957dd3e00e0897d94

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 20:02:02 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44386
x-xss-protection: 0
expires: Mon, 20 Sep 2021 20:02:02 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
194 B 7ms
6ms Image
image/gif 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j93&a=1155772121&t=pageview&_s=1&dl=https%3A%2F%2Fsecure.winred.com%2Frnc%2F2021-sustaining-membership%3Futm_medium%3Demail%26utm_source%3DET_16%26utm_campaign%3D20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc%26utm_content%3Dgop_direct-ask_text_contribute_bottom_other_all&ul=en-us&de=UTF-8&dt=Republican%20National%20Committee&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGBAgEALQ~&jid=1072723879&gjid=1114328741&cid=671554296.1632168122&tid=UA-73658561-7&_gid=2766536.1632168122&gtm=2wg9f0NTQZ9N&z=1410852670

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Sep 2021 04:59:58 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 54124
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
91 B 7ms
7ms Image
image/gif 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j93&a=1155772121&t=event&ni=0&_s=1&dl=https%3A%2F%2Fsecure.winred.com%2Frnc%2F2021-sustaining-membership%3Futm_medium%3Demail%26utm_source%3DET_16%26utm_campaign%3D20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc%26utm_content%3Dgop_direct-ask_text_contribute_bottom_other_all&ul=en-us&de=UTF-8&dt=Republican%20National%20Committee&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=donation%20landing%20page&ea=user%20session%20start&el=landing%20page%20settings&_u=aGDAiEALRAAAAE~&jid=&gjid=&cid=671554296.1632168122&tid=UA-73658561-7&_gid=2766536.1632168122&gtm=2wg9f0NTQZ9N&cd41=anonymous&cd58=t&z=1719119413

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Sep 2021 04:59:58 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 54124
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H2 204 result Show response
secure.winred.com/cdn-cgi/bm/cv/ 0
351 B 26ms
13ms XHR
text/plain 2606:4700:10::6814:543
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.winred.com/cdn-cgi/bm/cv/result?req_id=691da622ed436946

Requested by

Host: secure.winred.com
URL: https://secure.winred.com/cdn-cgi/bm/cv/669835187/api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6814:543 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

sec-fetch-mode: cors
origin: https://secure.winred.com
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
sec-fetch-dest: empty
cookie: _revv_v3_session=TENUYjNSamkyVk5VSUhDL0FrakhrSHE3aFdOYXVNVzZMV3djZ0lsOUpRdGEzdEZKV3g3aEU4Y3JPRUZJVUpmTXQ2M3ZiMVJQNHBZS0pyei90U0xSci9lSUV4bUNyMmROOW00YXFKZ1NMYzRvR0prSzFYQWc3NHU3VVZ5S1dHZFpzVjZycW5sN0NwL21qUXFidlJTTjFQL0QraFZsSktJaEp5amVWUWExaWtldHdkRlRTckdiNFZLUGxUU0xpdzV0N3hVNWFJM2d1M1l5aTJGK2tqSkVNeStCNGs5dW1GNGs5cFZvckd4SXFENE4xRU5naEFrVHdadEpBWXY2ZFlpQ0xpbHQra05qNTc2UVdaV042MlZBcDUyNnFVMHdraVZpbG4wUVNaUmxwNlVCcXMxcGxNanRKYmxtZHZGNzk0OTlJOFR5YzI4QmdKcEVMK21TS1luc295MFBIMUFNV1BvbldvVXhqemw0STc1ZURxbHFVT3V2bUxjVk9OdVJheWdFZW9Cb3E4SmxiOU84V2Z4dExVOGFuZjc2dTlibVlnb0xrWWVSS3hRaUtma2FJcmlVa3RIaENqai9BOW95dGM1V2ZNbkFYdGN0Y3pIajd6R0JyakFFZG1sakpCaEE3OXh0czM2N3Q3ZXJjQW85ZFpBUWlqVWhZekhwR3RwQk0venhHTFlOMmtCc1NvZHZHNGg2Q1RqQ0ZXdzZVMlY1QkU4UFJSNDRmWWk4QzJsWkREd1Z2UjErWnVmRzVybHpBMHVpcHZTYW5EYXlaTHZrNW5aN1dYSnVaNkdZSzcxV08yTWg2ZU0rYnRIbzhNdlhWUTBBRWxpVHFjQkJ1THdLeHVNUHAvZ2s0R2FrNjdXQS9DMUFGQzV3RUloS1BzcHBEYy94Z0ZKd0dnQ1ZHWms9LS1ZcEVsMWZ6SU80bWlJelpHV05QbnJ3PT0%3D--9d0e0641cc2681767196a0a3c8f1fe719f11504a; __cf_bm=PCBcx1jh_w4gXRipHRHG6LwB_cd4SgAgAWEJcBJoVNk-1632168120-0-Af3ZDDBtM1uW6znCWn2EpVmaQvatBemlJqsJY6aJNRRP987qrxcBexSNhnE0syRoYUZUfMGPBFP5QnZQqNAt9dspgdcD6g98Qpb5dQPn6pgP; _gcl_au=1.1.956306649.1632168122; origin_url=https://secure.winred.com/rnc/2021-sustaining-membership?utm_medium=email&utm_source=ET_16&utm_campaign=20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc&utm_content=gop_direct-ask_text_contribute_bottom_other_all; _ga=GA1.2.671554296.1632168122; _gid=GA1.2.2766536.1632168122; _dc_gtm_UA-73658561-7=1
content-length: 744
:path: /cdn-cgi/bm/cv/result?req_id=691da622ed436946
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
content-type: application/json
accept: */*
cache-control: no-cache
:authority: secure.winred.com
referer: https://secure.winred.com/rnc/2021-sustaining-membership?utm_medium=email&utm_source=ET_16&utm_campaign=20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc&utm_content=gop_direct-ask_text_contribute_bottom_other_all
:scheme: https
sec-fetch-site: same-origin
:method: POST
Referer: https://secure.winred.com/rnc/2021-sustaining-membership?utm_medium=email&utm_source=ET_16&utm_campaign=20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc&utm_content=gop_direct-ask_text_contribute_bottom_other_all
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 20 Sep 2021 20:02:02 GMT
x-content-type-options: nosniff
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=0; includeSubDomains
vary: Accept-Encoding
set-cookie: __cf_bm=MNX8g_C7lHpOQhDeGIhLvjuGudZ6sflVMB_TtqkBbqM-1632168122-0-AV7WJ3EOsvQf+NT+wON09Lchs6Q6YkXzIp8wb+ivyyQckC/qBpXAqsDgDjtKYmNsdm4EPKV4mKGR+TxUH6dxoqCotH5zQL7kj6NfPqAjTeDkQcFtAMTQl3GguSx1ix+B07HlUSKEuusgl3Mk5NPCsxcd731lowHENFvhAtMtcuLbIvsSXmIDfZfNKqN6HaNtVw==; path=/; expires=Mon, 20-Sep-21 20:32:02 GMT; domain=.secure.winred.com; HttpOnly; Secure; SameSite=None
cf-ray: 691da62b8ed26946-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 pay.js Show response
pay.google.com/gp/p/js/ Frame 7C5F 95 KB
31 KB 119ms
59ms Script
application/javascript 2a00:1450:400c:c00::5c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pay.google.com/gp/p/js/pay.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/payment-request-inner-google-pay-4ab654d9b723d75a0b2928ca5ebbf577.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::5c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

7b2925e0047244e8725c503e5e7c42cedbee9baa9c57916680312f9a9041f82e

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendHttp/cspreport, script-src 'report-sample' 'nonce-8MN2QZPTg9Cog1Lg3WRmnA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendHttp/cspreport;worker-src 'self', script-src 'nonce-8MN2QZPTg9Cog1Lg3WRmnA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendHttp/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 20:02:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
server: ESF
cross-origin-opener-policy: same-origin; report-to="InstantbuyFrontendHttp"
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
report-to: {"group":"InstantbuyFrontendHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/InstantbuyFrontendHttp/external"}]}
content-type: application/javascript; charset=utf-8
cache-control: private, max-age=600
content-security-policy: require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendHttp/cspreport, script-src 'report-sample' 'nonce-8MN2QZPTg9Cog1Lg3WRmnA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendHttp/cspreport;worker-src 'self', script-src 'nonce-8MN2QZPTg9Cog1Lg3WRmnA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendHttp/cspreport
expires: Mon, 20 Sep 2021 20:02:02 GMT

GET
H2 200 shared-f5eaf0a870d23878716fd1e8f67f52e5.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 7C5F 179 KB
50 KB 47ms
35ms Script
application/javascript 13.224.193.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-f5eaf0a870d23878716fd1e8f67f52e5.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/payment-request-inner-google-pay-4ab654d9b723d75a0b2928ca5ebbf577.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.92 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-92.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

8480eb220a7c7d5b98e1b83c56ac821eadc545bed2bf6c47562f7e22bfdd154a

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/v3/payment-request-inner-google-pay-4ab654d9b723d75a0b2928ca5ebbf577.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
etag: W/"56589cc6bfbec71282a2ac27c86bdfc9"
age: 36
via: 1.1 2ec3090d74e200e4acdb2780da3c3c44.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-request-id: W426442J3E794RAB
x-amz-id-2: zeE2zk+L7TA+rdFG99PV8ZoGvsmG/9cuUUO8CSzAr26Xqvoy5PnRcoD6mRj1nUMMOIIJPpav/yw=
last-modified: Mon, 20 Sep 2021 18:11:41 GMT
server: AmazonS3
date: Mon, 20 Sep 2021 20:01:26 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
content-security-policy: default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
x-amz-cf-pop: FRA2-C1
timing-allow-origin: *
x-amz-cf-id: 0kUOD9rhL59RD97k-il0ppv82I1mZX_Ii1WV-JOHUZHftZLNqtjGfA==

GET
H2 200 payment-request-inner-google-pay-debf79924e96a577a443a8027a271e07.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 7C5F 13 KB
5 KB 47ms
35ms Script
application/javascript 13.224.193.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/payment-request-inner-google-pay-debf79924e96a577a443a8027a271e07.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/payment-request-inner-google-pay-4ab654d9b723d75a0b2928ca5ebbf577.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.92 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-92.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

b83e994295ece94f9bb2a4a640d75f9c80a0b1e078043d407b2fb87970f25055

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/v3/payment-request-inner-google-pay-4ab654d9b723d75a0b2928ca5ebbf577.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
etag: W/"fb61bf982676a3cf6a3f061fc68e782c"
age: 34
via: 1.1 2ec3090d74e200e4acdb2780da3c3c44.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-request-id: MZCSTQFWH6M4YEZQ
x-amz-id-2: MD6EEeEfrmLTxBB2fNlzIMMvZYTJAo3iQqEEDh6tUuTH+8rPT5iayIMPtjRkRBLZuu2tvSmxTm8=
last-modified: Fri, 17 Sep 2021 22:15:47 GMT
server: AmazonS3
date: Mon, 20 Sep 2021 20:01:34 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
content-security-policy: default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
x-amz-cf-pop: FRA2-C1
timing-allow-origin: *
x-amz-cf-id: muK1BW7e1MTctS-2gUTnETyEvIe7lg-nj61yyZ6K8FnB3qRxuM4lBg==

GET
H2 200 shared-f5eaf0a870d23878716fd1e8f67f52e5.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame D8E2 179 KB
50 KB 43ms
30ms Script
application/javascript 13.224.193.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-f5eaf0a870d23878716fd1e8f67f52e5.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/controller-1e93944d1a9de5801e277dcad979f254.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.92 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-92.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

8480eb220a7c7d5b98e1b83c56ac821eadc545bed2bf6c47562f7e22bfdd154a

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/v3/controller-1e93944d1a9de5801e277dcad979f254.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
etag: W/"56589cc6bfbec71282a2ac27c86bdfc9"
age: 40
via: 1.1 2ec3090d74e200e4acdb2780da3c3c44.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-request-id: 5B12S1YJT77ZE02W
x-amz-id-2: Nw3I8/0HFR/rkgrTiEHDF7XcVlncv6NaITnuesXHNSzVUJuxgdJGwcFzan99iFnTUdtyv7F0mFo=
last-modified: Mon, 20 Sep 2021 18:11:41 GMT
server: AmazonS3
date: Mon, 20 Sep 2021 20:01:22 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
content-security-policy: default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
x-amz-cf-pop: FRA2-C1
timing-allow-origin: *
x-amz-cf-id: B2wkJBq6KjK-IqPyQud6ufcXfzHTO2OgDl1fKlwoMIreHXs9xFxknw==

GET
H2 200 controller-150bb8806e08e8bf3beda95e906d7991.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame D8E2 191 KB
48 KB 32ms
24ms Script
application/javascript 13.224.193.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/controller-150bb8806e08e8bf3beda95e906d7991.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/controller-1e93944d1a9de5801e277dcad979f254.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.92 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-92.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

f919ef3d2847b69f2a8f60899caa05789574f07fa8f94ca72b19f38ad6a9a0fd

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/v3/controller-1e93944d1a9de5801e277dcad979f254.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
etag: W/"eaab7815b2eba43ac7af050003e64f56"
age: 37
x-cache: Hit from cloudfront
x-edge-origin-shield-skipped: 0
x-amz-request-id: W9E42WS097K2EW27
x-amz-id-2: t39fKVKN42WgoXStVgoWsRyHH2V9yI3/2qLD4Ew/bz8GujbMpu5pzJOgCcJ6CYvDJzmx14vNMBU=
access-control-allow-origin: *
last-modified: Fri, 17 Sep 2021 22:15:48 GMT
server: AmazonS3
date: Mon, 20 Sep 2021 20:01:26 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 2ec3090d74e200e4acdb2780da3c3c44.cloudfront.net (CloudFront)
cache-control: max-age=60
content-security-policy: default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
x-amz-cf-pop: FRA2-C1
timing-allow-origin: *
x-amz-cf-id: l-l1w36YbXoxagZmS7P_rqKVuuhxf-Srmezn60dAj7fgU3RuO-Qa5g==

GET
H2 200 shared-f5eaf0a870d23878716fd1e8f67f52e5.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 728D 179 KB
50 KB 31ms
19ms Script
application/javascript 13.224.193.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-f5eaf0a870d23878716fd1e8f67f52e5.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/payment-request-inner-browser-56c245eb8dc4e99a2725ad66f94f0ebf.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.92 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-92.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

8480eb220a7c7d5b98e1b83c56ac821eadc545bed2bf6c47562f7e22bfdd154a

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/v3/payment-request-inner-browser-56c245eb8dc4e99a2725ad66f94f0ebf.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
etag: W/"56589cc6bfbec71282a2ac27c86bdfc9"
age: 40
via: 1.1 2ec3090d74e200e4acdb2780da3c3c44.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-request-id: MG9Z37VV9YZA3VX5
x-amz-id-2: deUQxmjiOkZ1VMk6/PjygUU6GKchvPfCtP/yp1iInYkCfbyEKH4Cat4OCZb9JK3RxiuqVmB2q6Q=
last-modified: Mon, 20 Sep 2021 18:11:41 GMT
server: AmazonS3
date: Mon, 20 Sep 2021 20:01:23 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
content-security-policy: default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
x-amz-cf-pop: FRA2-C1
timing-allow-origin: *
x-amz-cf-id: eO_3ievw0HCwkgeOGQs4rsuvs761StcVesRmYCsg3rbWUNWYKLkr4g==

GET
H2 200 payment-request-inner-browser-97d4b52568a2d07eee55c63ea244669d.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame 728D 11 KB
5 KB 44ms
37ms Script
application/javascript 13.224.193.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/payment-request-inner-browser-97d4b52568a2d07eee55c63ea244669d.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/payment-request-inner-browser-56c245eb8dc4e99a2725ad66f94f0ebf.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.92 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-92.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

ac5905cec1854cee1e4237105e3f2f3b0b62a3c58395b2ff2485ef8260b2dc17

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/v3/payment-request-inner-browser-56c245eb8dc4e99a2725ad66f94f0ebf.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
etag: W/"4cbe409f6eded4a11419ad639c5ee5e7"
age: 53
x-cache: Hit from cloudfront
x-edge-origin-shield-skipped: 0
x-amz-request-id: VZ0R4VG57CQ8BRED
x-amz-id-2: vs1+YYyX2vLO5tA5ZK4yQh3iMylPS3wE0WRtQbNZOY9Rypzw5r2DV4s18q2u8WtYISHB/616RV0=
access-control-allow-origin: *
last-modified: Fri, 17 Sep 2021 22:15:48 GMT
server: AmazonS3
date: Mon, 20 Sep 2021 20:01:10 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 2ec3090d74e200e4acdb2780da3c3c44.cloudfront.net (CloudFront)
cache-control: max-age=60
content-security-policy: default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
x-amz-cf-pop: FRA2-C1
timing-allow-origin: *
x-amz-cf-id: f3ftE-E-H81Zu-O2Z3XIHE0TC_Ejc8QmPH37kfIdDtest0DYqThVtA==

GET
H2 200 inner.html Show response
m.stripe.network/ Frame 6428 932 B
2 KB 81ms
7ms Document
text/html 2600:9000:20eb:e000:19:7d10:bd80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.network/inner.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/m-outer-f045e3b6b64aa0e635a6cabefc84daae.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20eb:e000:19:7d10:bd80:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudfront /

Resource Hash

c4a8402fde1e397bcabe7467c0de035e7851eeb1bad9af5d1b67487e7d7f2a4a

Security Headers

Name	Value
Content-Security-Policy	connect-src 'self' https://m.stripe.com; default-src 'self'; font-src data: https:; frame-src 'self' https://js.stripe.com; img-src 'self' https://m.stripe.com; media-src 'none'; object-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

:method: GET
:authority: m.stripe.network
:scheme: https
:path: /inner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://js.stripe.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/

Response headers

content-type: text/html; charset=utf-8
content-length: 932
date: Mon, 20 Sep 2021 19:58:55 GMT
accept-ranges: bytes
server: Cloudfront
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
x-content-type-options: nosniff
cache-control: max-age=300, public
content-security-policy: connect-src 'self' https://m.stripe.com; default-src 'self'; font-src data: https:; frame-src 'self' https://js.stripe.com; img-src 'self' https://m.stripe.com; media-src 'none'; object-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; report-uri https://q.stripe.com/csp-report
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 3b02f73dccc5077f1ad544a27a475ed6.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: xrl4MVYRS_fTFKpdGqJkQVGwEuR5VetzWMgTh1ByzZ6q7qp06Pc2Bw==
age: 188

GET
H2 200 1171422386625841 Show response
connect.facebook.net/signals/config/ 5 KB
3 KB 38ms
38ms Script
application/x-javascript 2a03:2880:f02d:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1171422386625841?v=2.9.45&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d68eb8e1826d9711bd5b411fbce0f61516fb7da1b8dd5d090251e6d3f2bf0cd5

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: yUS0zXeCcdvLXykbdYoWTTBY3lKIj+V6O97D1IW/4EaZK/rNrO7cVbp+Ya5Doz4GIXal4BWnT79N3AhMbQqUYQ==
x-fb-trip-id: 917726464
x-frame-options: DENY
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Mon, 20 Sep 2021 20:02:02 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H2 200 0 Show response
r.stripe.com/ Frame 4344 0
214 B 507ms
164ms XHR
application/octet-stream 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5eaf0a870d23878716fd1e8f67f52e5.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 20 Sep 2021 20:02:02 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

GET
H2 200 countryRanges-ed6f8980af15d82ca172d25916879a5c.json Show response
js.stripe.com/v3/fingerprinted/data/ Frame 99AA 143 KB
36 KB 30ms
30ms XHR
application/json 13.224.193.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/data/countryRanges-ed6f8980af15d82ca172d25916879a5c.json

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5eaf0a870d23878716fd1e8f67f52e5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.92 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-92.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

5785c083b1cf0a752958975ebf6365d60896c3e809e7fd9bd94dc6e11bc75004

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/v3/elements-inner-card-58e63ab408e3331b87172d32302f52e5.html
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
etag: W/"ed6f8980af15d82ca172d25916879a5c"
age: 41
via: 1.1 2ec3090d74e200e4acdb2780da3c3c44.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-request-id: 4RJSA8HGMRPMF51P
x-amz-id-2: BlKAlCWluHDqslHgCHa/Xc7QO4oh84mZaQyBHAsuthxueq5R71ue0fJ01ayYNHRLHRholO5HDTk=
last-modified: Fri, 17 Sep 2021 22:15:57 GMT
server: AmazonS3
date: Mon, 20 Sep 2021 20:01:22 GMT
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=60
content-security-policy: default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
x-amz-cf-pop: FRA2-C1
timing-allow-origin: *
x-amz-cf-id: I9yUE0Ivn43hdK29G6WtRduV4REMdq8aJ-ehZ__E-kzh6Tc_LLjo8g==

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
522 B 58ms
33ms Image
image/gif 2a00:1450:4001:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j93&tid=UA-73658561-7&cid=671554296.1632168122&jid=1072723879&_u=aGBAgEALQAAAAE~&z=159065867

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Sep 2021 20:02:02 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
522 B 55ms
31ms Image
image/gif 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j93&tid=UA-73658561-7&cid=671554296.1632168122&jid=1072723879&_u=aGBAgEALQAAAAE~&z=159065867

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Sep 2021 20:02:02 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
q.stripe.com/ Frame 4344 43 B
286 B 518ms
161ms Image
image/gif 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q.stripe.com/?event=elements.fetch_locale&event_count=2&timestamp=1632168122256&event_id=01c7b136-b2f0-438e-8dc9-2a321ce3e132&os=Windows&browserFamily=Chrome&version=a13e27c60&key=pk_live_JzNU2ovfdQBD0CxSZHjPm5Lv&referrer=https%3A%2F%2Fsecure.winred.com&stripe_js_id=a30b0177-0d04-49d3-857b-fdf16585a4de&controller_load_time=1632168122191&wrapper=unknown&es_module=false&frame_width=1600

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Sep 2021 20:02:02 GMT
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: image/gif
cache-control: no-cache, no-store, private, must-revalidate, max-age=0, max-stale=0, post-check=0, pre-check=0
content-length: 43
expires: 0

GET
H2 200 /
q.stripe.com/ Frame 4344 43 B
285 B 520ms
164ms Image
image/gif 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q.stripe.com/?event=elements.elements&event_count=3&timestamp=1632168122256&event_id=4ce43ffa-fd1a-483c-9f2e-49bf54d19aa7&os=Windows&browserFamily=Chrome&version=a13e27c60&key=pk_live_JzNU2ovfdQBD0CxSZHjPm5Lv&referrer=https%3A%2F%2Fsecure.winred.com&stripe_js_id=a30b0177-0d04-49d3-857b-fdf16585a4de&controller_load_time=1632168122191&wrapper=unknown&es_module=false&frame_width=1600&options-locale=en

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Sep 2021 20:02:02 GMT
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: image/gif
cache-control: no-cache, no-store, private, must-revalidate, max-age=0, max-stale=0, post-check=0, pre-check=0
content-length: 43
expires: 0

GET
H2 200 /
q.stripe.com/ Frame 4344 43 B
285 B 520ms
164ms Image
image/gif 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q.stripe.com/?event=elements.fetch_locale&event_count=4&timestamp=1632168122257&event_id=6c5cee93-c445-4879-96d4-e3e066fa2d44&os=Windows&browserFamily=Chrome&version=a13e27c60&key=pk_live_JzNU2ovfdQBD0CxSZHjPm5Lv&referrer=https%3A%2F%2Fsecure.winred.com&stripe_js_id=a30b0177-0d04-49d3-857b-fdf16585a4de&controller_load_time=1632168122191&wrapper=unknown&es_module=false&frame_width=1600

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Sep 2021 20:02:02 GMT
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: image/gif
cache-control: no-cache, no-store, private, must-revalidate, max-age=0, max-stale=0, post-check=0, pre-check=0
content-length: 43
expires: 0

GET
H2 200 /
q.stripe.com/ Frame 4344 43 B
285 B 520ms
165ms Image
image/gif 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q.stripe.com/?event=elements.timings&event_count=5&timestamp=1632168122258&event_id=e74f790c-8432-4b88-b549-ed9c49096bcd&os=Windows&browserFamily=Chrome&version=a13e27c60&key=pk_live_JzNU2ovfdQBD0CxSZHjPm5Lv&referrer=https%3A%2F%2Fsecure.winred.com&stripe_js_id=a30b0177-0d04-49d3-857b-fdf16585a4de&controller_load_time=1632168122191&wrapper=unknown&es_module=false&frame_width=1600&element=ControllerApp&dom_loading=54&dom_interactive=255&dom_complete=255&since_sjs_load=368&since_stripe_create=263&since_create=263&mount_duration=260&since_fetch=252&load_count=1&match_frame=true&resource_timings-shared.js-transfer_size=50341&resource_timings-shared.js-duration=38&resource_timings-controller.js-transfer_size=48665&resource_timings-controller.js-duration=57

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Sep 2021 20:02:02 GMT
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: image/gif
cache-control: no-cache, no-store, private, must-revalidate, max-age=0, max-stale=0, post-check=0, pre-check=0
content-length: 43
expires: 0

GET
H2 200 /
q.stripe.com/ Frame 4344 43 B
285 B 520ms
166ms Image
image/gif 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q.stripe.com/?event=elements.cross_frame_access&event_count=6&timestamp=1632168122258&event_id=336b1c23-1cad-497d-9466-08dee3bc279e&os=Windows&browserFamily=Chrome&version=a13e27c60&key=pk_live_JzNU2ovfdQBD0CxSZHjPm5Lv&referrer=https%3A%2F%2Fsecure.winred.com&stripe_js_id=a30b0177-0d04-49d3-857b-fdf16585a4de&controller_load_time=1632168122191&wrapper=unknown&es_module=false&frame_width=1600&available=true

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Sep 2021 20:02:02 GMT
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: image/gif
cache-control: no-cache, no-store, private, must-revalidate, max-age=0, max-stale=0, post-check=0, pre-check=0
content-length: 43
expires: 0

POST
H2 200 csp-report
q.stripe.com/ Frame 6428 0
121 B 512ms
166ms Other
text/plain 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://m.stripe.network/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Mon, 20 Sep 2021 20:02:02 GMT
x-envoy-upstream-service-time: 1
server: nginx
content-length: 0
strict-transport-security: max-age=31556926; includeSubDomains; preload

POST
H2 200 0 Show response
r.stripe.com/ Frame D8E2 0
213 B 423ms
166ms XHR
application/octet-stream 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5eaf0a870d23878716fd1e8f67f52e5.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 20 Sep 2021 20:02:02 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 3
content-length: 0

POST
H2 200 collect Show response
www.google-analytics.com/j/ 2 B
119 B 14ms
14ms XHR
text/plain 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j93&a=1155772121&t=pageview&_s=1&dl=https%3A%2F%2Fsecure.winred.com%2Frnc%2F2021-sustaining-membership%3Futm_medium%3Demail%26utm_source%3DET_16%26utm_campaign%3D20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc%26utm_content%3Dgop_direct-ask_text_contribute_bottom_other_all&ul=en-us&de=UTF-8&dt=Republican%20National%20Committee&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aHDACEALRAAAAG~&jid=1909235261&gjid=1796004285&cid=671554296.1632168122&tid=UA-2431644-99&_gid=2766536.1632168122&_r=1&gtm=2wg9f0KQQBPQZ&z=869064146

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 20 Sep 2021 20:02:02 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 Recurring_Uncheck_Popup.jpg
d35ligi1n5bgzc.cloudfront.net/widget_images/images/000/086/541/original/ 74 KB
75 KB 10ms
9ms Image
image/jpeg 13.224.193.4
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d35ligi1n5bgzc.cloudfront.net/widget_images/images/000/086/541/original/Recurring_Uncheck_Popup.jpg
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/rnc/2021-sustaining-membership?utm_medium=email&utm_source=ET_16&utm_campaign=20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc&utm_content=gop_direct-ask_text_contribute_bottom_other_all
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.193.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-193-4.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ebbd3a4b27adf2b4cfb8ff1aeb3f60c0090ee800443cd0b82da7a1874dc6b634

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-version-id: SbmaijjJGZAXrktWwHCqF_pxNnP68RcL
via: 1.1 0e7eb16f335fe24acf3f13c5dee19c88.cloudfront.net (CloudFront)
etag: "6029c4183843891a6eb4e504f9d3d2d5"
last-modified: Sat, 17 Jul 2021 13:34:26 GMT
server: AmazonS3
age: 29842
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: image/jpeg
date: Mon, 20 Sep 2021 11:44:41 GMT
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-length: 76066
x-amz-cf-id: UQBDwlH36Ygf-HkXylAs-vy1I-ifzD8uSknlkXeAKz4pDkS7T-HPdg==

GET
H2 200 /
q.stripe.com/ Frame 4344 43 B
285 B 451ms
165ms Image
image/gif 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q.stripe.com/?event=elements.create&event_count=7&timestamp=1632168122326&event_id=5e822f31-b7eb-4b68-919c-66c16249e350&os=Windows&browserFamily=Chrome&version=a13e27c60&key=pk_live_JzNU2ovfdQBD0CxSZHjPm5Lv&referrer=https%3A%2F%2Fsecure.winred.com&stripe_js_id=a30b0177-0d04-49d3-857b-fdf16585a4de&controller_load_time=1632168122191&wrapper=unknown&es_module=false&frame_width=1600&options-style-base-type=blocks&options-style-base-blocks=%5Bobject+Object%5D+%5Bobject+Object%5D&options-style-invalid-type=blocks&options-style-invalid-blocks=%5Bobject+Object%5D+%5Bobject+Object%5D&options-locale=en&options-betas=&options-componentName=card&options-wait=false&options-rtl=false&element=card

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Sep 2021 20:02:02 GMT
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: image/gif
cache-control: no-cache, no-store, private, must-revalidate, max-age=0, max-stale=0, post-check=0, pre-check=0
content-length: 43
expires: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame 4344 0
213 B 374ms
166ms XHR
application/octet-stream 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5eaf0a870d23878716fd1e8f67f52e5.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 20 Sep 2021 20:02:02 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 3
content-length: 0

GET
H2 200 /
q.stripe.com/ Frame 4344 43 B
285 B 229ms
229ms Image
image/gif 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q.stripe.com/?event=elements.timings&event_count=9&timestamp=1632168122330&event_id=e9f2718b-722f-473f-8527-9bbefbbbfaa1&os=Windows&browserFamily=Chrome&version=a13e27c60&key=pk_live_JzNU2ovfdQBD0CxSZHjPm5Lv&referrer=https%3A%2F%2Fsecure.winred.com&stripe_js_id=a30b0177-0d04-49d3-857b-fdf16585a4de&controller_load_time=1632168122191&wrapper=unknown&es_module=false&frame_width=1600&dom_loading=53&dom_interactive=282&dom_complete=305&since_sjs_load=389&since_stripe_create=274&since_group_create=274&since_create=274&mount_duration=269&since_fetch=268&load_count=1&match_frame=true&resource_timings-ui-shared.css-transfer_size=3348&resource_timings-ui-shared.css-duration=40&resource_timings-shared.js-transfer_size=50501&resource_timings-shared.js-duration=30&resource_timings-ui-shared.js-transfer_size=68808&resource_timings-ui-shared.js-duration=54&resource_timings-elements-inner-card.js-transfer_size=12305&resource_timings-elements-inner-card.js-duration=39&element=card

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Sep 2021 20:02:02 GMT
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: image/gif
cache-control: no-cache, no-store, private, must-revalidate, max-age=0, max-stale=0, post-check=0, pre-check=0
content-length: 43
expires: 0

GET
H2 200 657928937632482 Show response
connect.facebook.net/signals/config/ 306 KB
87 KB 60ms
60ms Script
application/x-javascript 2a03:2880:f02d:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/657928937632482?v=2.9.45&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

53b1c4b49a9fd4fce307c7203ae6939ffc7fc1e69464e19ccadb3aa1768426b4

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: mD84hEnBa7TFyndhSarlxU4bqdQqEv6wOSmBULGRBs/y5q1JUGDGNnB4MR4sdAMZWD/iY5RR6CcDZKfn2epuQQ==
x-fb-trip-id: 917726464
x-frame-options: DENY
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Mon, 20 Sep 2021 20:02:02 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 utag.39.js Show response
tags.tiqcdn.com/utag/gop/main/prod/ 3 KB
2 KB 15ms
14ms Script
application/x-javascript 184.30.24.194
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/gop/main/prod/utag.39.js?utv=ut4.46.201909121401
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gop/main/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.30.24.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-24-194.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: af4b8dcbb0f1beb04e333fb40d352f763415cc15b83b6c79646d773c4d5893b6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 20:02:02 GMT
content-encoding: gzip
last-modified: Thu, 12 Sep 2019 14:01:06 GMT
server: AkamaiNetStorage
etag: "0f7ae16a39aeb401a433557708bafd97:1568296866.396571"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1452
expires: Tue, 05 Oct 2021 20:02:02 GMT

GET
H2 200 utag.5.js Show response
tags.tiqcdn.com/utag/gop/main/prod/ 13 KB
4 KB 15ms
15ms Script
application/x-javascript 184.30.24.194
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/gop/main/prod/utag.5.js?utv=ut4.46.201909102207
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gop/main/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.30.24.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-24-194.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 2646d818e258e85ba1721270d71684413d53dfa2dd8ac6957738d56a86ab1b5f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 20:02:02 GMT
content-encoding: gzip
last-modified: Tue, 10 Sep 2019 22:07:42 GMT
server: AkamaiNetStorage
etag: "606a7fe5adc12f074e7ad290ea7644d9:1568153262.338063"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 4177
expires: Tue, 05 Oct 2021 20:02:02 GMT

GET
H2 200 utag.44.js Show response
tags.tiqcdn.com/utag/gop/main/prod/ 3 KB
1 KB 12ms
12ms Script
application/x-javascript 184.30.24.194
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/gop/main/prod/utag.44.js?utv=ut4.46.202002071856
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gop/main/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.30.24.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-24-194.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 048ab7812899a24caacd50b1921fc17d5a3f7cd1fde2863d439a024a2245c6f8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 20:02:02 GMT
content-encoding: gzip
last-modified: Fri, 07 Feb 2020 18:56:58 GMT
server: AkamaiNetStorage
etag: "624aec441dbcaae3f4aef04be799a630:1581101818.286578"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 1190
expires: Tue, 05 Oct 2021 20:02:02 GMT

GET
H2 200 utag.45.js Show response
tags.tiqcdn.com/utag/gop/main/prod/ 14 KB
5 KB 13ms
12ms Script
application/x-javascript 184.30.24.194
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/gop/main/prod/utag.45.js?utv=ut4.46.202006091829
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gop/main/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.30.24.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-24-194.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: aa920fa4fdea358365f980f78d82a992fa119070a07cb21d3aeee419d88429aa

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 20:02:02 GMT
content-encoding: gzip
last-modified: Tue, 09 Jun 2020 18:29:15 GMT
server: AkamaiNetStorage
etag: "598807775548ec7884f6579c1db8fbdb:1591727355.818648"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 4582
expires: Tue, 05 Oct 2021 20:02:02 GMT

GET
H2 200 /
q.stripe.com/ Frame 4344 43 B
285 B 230ms
229ms Image
image/gif 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q.stripe.com/?event=elements.event.ready&event_count=10&timestamp=1632168122386&event_id=a5a0a8ea-035f-4d06-bb00-755e4fdbfcfb&os=Windows&browserFamily=Chrome&version=a13e27c60&key=pk_live_JzNU2ovfdQBD0CxSZHjPm5Lv&referrer=https%3A%2F%2Fsecure.winred.com&stripe_js_id=a30b0177-0d04-49d3-857b-fdf16585a4de&controller_load_time=1632168122191&wrapper=unknown&es_module=false&frame_width=1600&element=card

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Sep 2021 20:02:02 GMT
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: image/gif
cache-control: no-cache, no-store, private, must-revalidate, max-age=0, max-stale=0, post-check=0, pre-check=0
content-length: 43
expires: 0

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
69 B 315ms
13ms XHR
text/plain 2a00:1450:400c:c04::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j93&tid=UA-2431644-99&cid=671554296.1632168122&jid=1909235261&gjid=1796004285&_gid=2766536.1632168122&_u=aHDACEALRAAAAG~&z=1211941797

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c04::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://secure.winred.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Mon, 20 Sep 2021 20:02:02 GMT
content-type: text/plain
access-control-allow-origin: https://secure.winred.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 payframe Show response
pay.google.com/gp/p/ui/ Frame 8AF0 17 KB
7 KB 362ms
60ms Document
text/html 2a00:1450:400c:c00::5c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pay.google.com/gp/p/ui/payframe?origin=https%3A%2F%2Fjs.stripe.com&mid=

Requested by

Host: pay.google.com
URL: https://pay.google.com/gp/p/js/pay.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::5c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a965217219eb2b12541833216804b612e1e8675b7b7ef8ea34bf891834380dde

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-+QLp8dO14gIHpf0nG73T/A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport;worker-src 'self' script-src 'nonce-+QLp8dO14gIHpf0nG73T/A' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pay.google.com
:scheme: https
:path: /gp/p/ui/payframe?origin=https%3A%2F%2Fjs.stripe.com&mid=
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://js.stripe.com/
accept-encoding: gzip, deflate, br
cookie: NID=224=wyfxfjbnDXV2BdvAJF5HAPg1eQg1xtickijQ7aXSkCQ1f44lxdETfH67TbCOWKXPapcmU9uIEHlTTQW00ydB8o_3tHsahU3e00o-8A1IpMb6y7woPmdA0jdP8AnkQtmBdwQjcjHNG1SU0GfCBZuG9hJtAfpM5XbRYQCDpTxnMk8
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/

Response headers

content-type: text/html; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-ua-compatible: IE=edge
expires: Mon, 20 Sep 2021 20:02:02 GMT
date: Mon, 20 Sep 2021 20:02:02 GMT
cache-control: private, max-age=3600
strict-transport-security: max-age=31536000
content-security-policy: script-src 'report-sample' 'nonce-+QLp8dO14gIHpf0nG73T/A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport;worker-src 'self' script-src 'nonce-+QLp8dO14gIHpf0nG73T/A' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendBuyflowPayframeUi/cspreport
cross-origin-opener-policy: same-origin; report-to="InstantbuyFrontendBuyflowPayframeUi"
cross-origin-resource-policy: same-site
report-to: {"group":"InstantbuyFrontendBuyflowPayframeUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/InstantbuyFrontendBuyflowPayframeUi/external"}]}
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 /
q.stripe.com/ Frame D8E2 43 B
285 B 515ms
315ms Image
image/gif 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q.stripe.com/?event=elements.cross_frame_access&event_count=2&timestamp=1632168122412&event_id=57a39cd1-39b8-4fd5-93cd-8d9b3a415edb&os=Windows&browserFamily=Chrome&version=a13e27c60&key=pk_live_JzNU2ovfdQBD0CxSZHjPm5Lv&referrer=https%3A%2F%2Fsecure.winred.com&stripe_js_id=a30b0177-0d04-49d3-857b-fdf16585a4de&controller_load_time=1632168122278&wrapper=unknown&es_module=false&frame_width=1600&available=true

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Sep 2021 20:02:02 GMT
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: image/gif
cache-control: no-cache, no-store, private, must-revalidate, max-age=0, max-stale=0, post-check=0, pre-check=0
content-length: 43
expires: 0

GET
H2 200 /
q.stripe.com/ Frame D8E2 43 B
285 B 364ms
164ms Image
image/gif 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q.stripe.com/?event=elements.fetch_locale&event_count=3&timestamp=1632168122413&event_id=71dd0177-146e-4db6-b125-7821972ba881&os=Windows&browserFamily=Chrome&version=a13e27c60&key=pk_live_JzNU2ovfdQBD0CxSZHjPm5Lv&referrer=https%3A%2F%2Fsecure.winred.com&stripe_js_id=a30b0177-0d04-49d3-857b-fdf16585a4de&controller_load_time=1632168122278&wrapper=unknown&es_module=false&frame_width=1600

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Sep 2021 20:02:02 GMT
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: image/gif
cache-control: no-cache, no-store, private, must-revalidate, max-age=0, max-stale=0, post-check=0, pre-check=0
content-length: 43
expires: 0

GET
H2 200 /
q.stripe.com/ Frame D8E2 43 B
285 B 515ms
316ms Image
image/gif 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q.stripe.com/?event=elements.pr.options&event_count=4&timestamp=1632168122413&event_id=30279b63-f6d4-4219-b2b6-040b9b05f975&os=Windows&browserFamily=Chrome&version=a13e27c60&key=pk_live_JzNU2ovfdQBD0CxSZHjPm5Lv&referrer=https%3A%2F%2Fsecure.winred.com&stripe_js_id=a30b0177-0d04-49d3-857b-fdf16585a4de&controller_load_time=1632168122278&wrapper=unknown&es_module=false&frame_width=1600&options-country=US&options-currency=usd&options-requestPayerEmail=true&options-requestPayerName=true&options-requestPayerPhone=true&usesButtonElement=false

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Sep 2021 20:02:02 GMT
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: image/gif
cache-control: no-cache, no-store, private, must-revalidate, max-age=0, max-stale=0, post-check=0, pre-check=0
content-length: 43
expires: 0

GET
H2 200 /
q.stripe.com/ Frame D8E2 43 B
285 B 514ms
315ms Image
image/gif 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q.stripe.com/?event=elements.pr.query_strategy&event_count=5&timestamp=1632168122414&event_id=36dff81e-9e6e-4b4a-9e68-e470e840ed90&os=Windows&browserFamily=Chrome&version=a13e27c60&key=pk_live_JzNU2ovfdQBD0CxSZHjPm5Lv&referrer=https%3A%2F%2Fsecure.winred.com&stripe_js_id=a30b0177-0d04-49d3-857b-fdf16585a4de&controller_load_time=1632168122278&wrapper=unknown&es_module=false&frame_width=1600&queryStrategy=GOOGLE_PAY+BROWSER&usesButtonElement=false

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Sep 2021 20:02:02 GMT
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: image/gif
cache-control: no-cache, no-store, private, must-revalidate, max-age=0, max-stale=0, post-check=0, pre-check=0
content-length: 43
expires: 0

GET
H2 200 /
q.stripe.com/ Frame D8E2 43 B
285 B 514ms
316ms Image
image/gif 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q.stripe.com/?event=elements.fetch_locale&event_count=6&timestamp=1632168122414&event_id=fdef5879-6cb0-40cb-bdd3-178539187c50&os=Windows&browserFamily=Chrome&version=a13e27c60&key=pk_live_JzNU2ovfdQBD0CxSZHjPm5Lv&referrer=https%3A%2F%2Fsecure.winred.com&stripe_js_id=a30b0177-0d04-49d3-857b-fdf16585a4de&controller_load_time=1632168122278&wrapper=unknown&es_module=false&frame_width=1600

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Sep 2021 20:02:02 GMT
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: image/gif
cache-control: no-cache, no-store, private, must-revalidate, max-age=0, max-stale=0, post-check=0, pre-check=0
content-length: 43
expires: 0

GET
H2 200 /
q.stripe.com/ Frame D8E2 43 B
285 B 514ms
316ms Image
image/gif 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q.stripe.com/?event=elements.fetch_locale&event_count=7&timestamp=1632168122415&event_id=6ce04bda-054d-4741-9560-57929c8fd267&os=Windows&browserFamily=Chrome&version=a13e27c60&key=pk_live_JzNU2ovfdQBD0CxSZHjPm5Lv&referrer=https%3A%2F%2Fsecure.winred.com&stripe_js_id=a30b0177-0d04-49d3-857b-fdf16585a4de&controller_load_time=1632168122278&wrapper=unknown&es_module=false&frame_width=1600

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Sep 2021 20:02:02 GMT
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: image/gif
cache-control: no-cache, no-store, private, must-revalidate, max-age=0, max-stale=0, post-check=0, pre-check=0
content-length: 43
expires: 0

GET
H2 200 /
q.stripe.com/ Frame D8E2 43 B
285 B 228ms
228ms Image
image/gif 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q.stripe.com/?event=elements.elements&event_count=8&timestamp=1632168122415&event_id=b1e2753a-d49a-4656-ab46-3bbf76dfe469&os=Windows&browserFamily=Chrome&version=a13e27c60&key=pk_live_JzNU2ovfdQBD0CxSZHjPm5Lv&referrer=https%3A%2F%2Fsecure.winred.com&stripe_js_id=a30b0177-0d04-49d3-857b-fdf16585a4de&controller_load_time=1632168122278&wrapper=unknown&es_module=false&frame_width=1600

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Sep 2021 20:02:02 GMT
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: image/gif
cache-control: no-cache, no-store, private, must-revalidate, max-age=0, max-stale=0, post-check=0, pre-check=0
content-length: 43
expires: 0

GET
H2 200 /
q.stripe.com/ Frame D8E2 43 B
285 B 229ms
228ms Image
image/gif 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q.stripe.com/?event=elements.fetch_locale&event_count=9&timestamp=1632168122416&event_id=24b11190-ae08-4518-bd81-9f943795b436&os=Windows&browserFamily=Chrome&version=a13e27c60&key=pk_live_JzNU2ovfdQBD0CxSZHjPm5Lv&referrer=https%3A%2F%2Fsecure.winred.com&stripe_js_id=a30b0177-0d04-49d3-857b-fdf16585a4de&controller_load_time=1632168122278&wrapper=unknown&es_module=false&frame_width=1600

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Sep 2021 20:02:02 GMT
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: image/gif
cache-control: no-cache, no-store, private, must-revalidate, max-age=0, max-stale=0, post-check=0, pre-check=0
content-length: 43
expires: 0

GET
H2 200 /
q.stripe.com/ Frame D8E2 43 B
285 B 229ms
229ms Image
image/gif 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q.stripe.com/?event=elements.pr.can_make_payment&event_count=10&timestamp=1632168122416&event_id=fbd68d08-a680-4ab5-b33c-51d9c55ce6d8&os=Windows&browserFamily=Chrome&version=a13e27c60&key=pk_live_JzNU2ovfdQBD0CxSZHjPm5Lv&referrer=https%3A%2F%2Fsecure.winred.com&stripe_js_id=a30b0177-0d04-49d3-857b-fdf16585a4de&controller_load_time=1632168122278&wrapper=unknown&es_module=false&frame_width=1600&usesButtonElement=true

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Sep 2021 20:02:02 GMT
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: image/gif
cache-control: no-cache, no-store, private, must-revalidate, max-age=0, max-stale=0, post-check=0, pre-check=0
content-length: 43
expires: 0

GET
H2 200 /
q.stripe.com/ Frame D8E2 43 B
285 B 229ms
229ms Image
image/gif 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q.stripe.com/?event=elements.timings&event_count=11&timestamp=1632168122417&event_id=818bd0f3-c6cb-4522-91db-4df7f82b086a&os=Windows&browserFamily=Chrome&version=a13e27c60&key=pk_live_JzNU2ovfdQBD0CxSZHjPm5Lv&referrer=https%3A%2F%2Fsecure.winred.com&stripe_js_id=a30b0177-0d04-49d3-857b-fdf16585a4de&controller_load_time=1632168122278&wrapper=unknown&es_module=false&frame_width=1600&element=ControllerApp&dom_loading=55&dom_interactive=308&dom_complete=308&since_sjs_load=456&since_stripe_create=309&since_create=309&mount_duration=308&since_fetch=307&load_count=1&match_frame=true&resource_timings-shared.js-transfer_size=50446&resource_timings-shared.js-duration=52&resource_timings-controller.js-transfer_size=48625&resource_timings-controller.js-duration=46

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Sep 2021 20:02:02 GMT
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: image/gif
cache-control: no-cache, no-store, private, must-revalidate, max-age=0, max-stale=0, post-check=0, pre-check=0
content-length: 43
expires: 0

GET
H2 200 dc_pre=CP_xiomsjvMCFQrrUQodEugMIQ;src=9323526;type=landi0;cat=gop_d0;ord=3757474134697;gtm=2wg9f0;auiddc=956306649.1632168122;~oref=https%3A%2F%2Fsecure.winred.com%2Frnc%2F2021-sustaining-membershi... Show response
adservice.google.com/ddm/fls/i/ Frame 38BF 738 B
1 KB 70ms
22ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/ddm/fls/i/dc_pre=CP_xiomsjvMCFQrrUQodEugMIQ;src=9323526;type=landi0;cat=gop_d0;ord=3757474134697;gtm=2wg9f0;auiddc=956306649.1632168122;~oref=https%3A%2F%2Fsecure.winred.com%2Frnc%2F2021-sustaining-membership%3Futm_medium%3Demail%26utm_source%3DET_16%26utm_campaign%3D20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc%26utm_content%3Dgop_direct-ask_text_contribute_bottom_other_all

Requested by

Host: 9323526.fls.doubleclick.net
URL: https://9323526.fls.doubleclick.net/activityi;dc_pre=CP_xiomsjvMCFQrrUQodEugMIQ;src=9323526;type=landi0;cat=gop_d0;ord=3757474134697;gtm=2wg9f0;auiddc=956306649.1632168122;~oref=https%3A%2F%2Fsecure.winred.com%2Frnc%2F2021-sustaining-membership%3Futm_medium%3Demail%26utm_source%3DET_16%26utm_campaign%3D20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc%26utm_content%3Dgop_direct-ask_text_contribute_bottom_other_all?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8529ea4473d1a1fb5854d29cc2a00ec989b5264f89b30d024287be7b4cd93878

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: adservice.google.com
:scheme: https
:path: /ddm/fls/i/dc_pre=CP_xiomsjvMCFQrrUQodEugMIQ;src=9323526;type=landi0;cat=gop_d0;ord=3757474134697;gtm=2wg9f0;auiddc=956306649.1632168122;~oref=https%3A%2F%2Fsecure.winred.com%2Frnc%2F2021-sustaining-membership%3Futm_medium%3Demail%26utm_source%3DET_16%26utm_campaign%3D20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc%26utm_content%3Dgop_direct-ask_text_contribute_bottom_other_all
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://9323526.fls.doubleclick.net/
accept-encoding: gzip, deflate, br
cookie: NID=224=wyfxfjbnDXV2BdvAJF5HAPg1eQg1xtickijQ7aXSkCQ1f44lxdETfH67TbCOWKXPapcmU9uIEHlTTQW00ydB8o_3tHsahU3e00o-8A1IpMb6y7woPmdA0jdP8AnkQtmBdwQjcjHNG1SU0GfCBZuG9hJtAfpM5XbRYQCDpTxnMk8
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://9323526.fls.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Mon, 20 Sep 2021 20:02:02 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
content-type: text/html; charset=UTF-8
pragma: no-cache
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 535
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 collect
www.google-analytics.com/ 35 B
91 B 8ms
7ms Image
image/gif 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j93&a=1155772121&t=event&ni=1&_s=1&dl=https%3A%2F%2Fsecure.winred.com%2Frnc%2F2021-sustaining-membership%3Futm_medium%3Demail%26utm_source%3DET_16%26utm_campaign%3D20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc%26utm_content%3Dgop_direct-ask_text_contribute_bottom_other_all&ul=en-us&de=UTF-8&dt=Republican%20National%20Committee&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Google%20Optimize&ea=t2gbJrM9QpmSN5KrZn0uCQ&_u=aHDACEALRAAAAG~&jid=&gjid=&cid=671554296.1632168122&tid=UA-2431644-99&_gid=2766536.1632168122&gtm=2wg9f0KQQBPQZ&z=464096149

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Sep 2021 04:59:58 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 54124
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 out-4.5.40.js Show response
m.stripe.network/ Frame 6428 85 KB
16 KB 12ms
12ms Script
application/javascript 2600:9000:20eb:e000:19:7d10:bd80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.network/out-4.5.40.js

Requested by

Host: m.stripe.network
URL: https://m.stripe.network/inner.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20eb:e000:19:7d10:bd80:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudfront /

Resource Hash

6a6915872afa798395a56c7aa50d086cb325ff7214ad78ada3c7a96350bbad39

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://m.stripe.network/inner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 20:01:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: Cloudfront
age: 29
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-edge-origin-shield-skipped: 0
content-type: application/javascript
via: 1.1 3b02f73dccc5077f1ad544a27a475ed6.cloudfront.net (CloudFront)
cache-control: max-age=300, public
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA2-C1
timing-allow-origin: *
vary: Accept-Encoding,Accept-Encoding
x-amz-cf-id: gZUNXO75t-XP6chR0cdQYjBItgl6oQ6VqwrCZgeSX6-q84lQir9fdA==

GET
H2 200 track_page_view
nova.collect.igodigital.com/c2/10964169/ 43 B
710 B 109ms
108ms Image
image/gif 3.224.144.253
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://nova.collect.igodigital.com/c2/10964169/track_page_view?payload=%7B%22title%22%3A%22Republican%20National%20Committee%22%2C%22url%22%3A%22https%3A%2F%2Fsecure.winred.com%2Frnc%2F2021-sustaining-membership%3Futm_medium%3Demail%26utm_source%3DET_16%26utm_campaign%3D20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc%26utm_content%3Dgop_direct-ask_text_contribute_bottom_other_all%22%2C%22referrer%22%3A%22%22%7D

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.224.144.253 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-224-144-253.compute-1.amazonaws.com

Software

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-runtime: 0.006150
date: Mon, 20 Sep 2021 20:02:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
etag: W/"98b3d9d20e032f90aca49e9b116225d5"
x-frame-options: SAMEORIGIN
content-type: image/gif
cache-control: private
content-transfer-encoding: binary
content-disposition: inline
vary: Accept-Encoding
x-xss-protection: 1; mode=block
x-request-id: 6cfa89f0-60f5-4b3b-90e4-a708ef316b8b

GET
H2

200

i.gif
datacloud.tealiumiq.com/vdata/
Redirect Chain

https://cm.g.doubleclick.net/pixel?tealium_cookie_sync=true&google_nid=tealium_dmp&google_cm&tealium_vid=017c04cd17b30095e3a5ae45502803072010a06a00b08&tealium_account=gop&tealium_profile=main
https://datacloud.tealiumiq.com/vdata/i.gif?tealium_cookie_sync=true&tealium_vid=017c04cd17b30095e3a5ae45502803072010a06a00b08&tealium_account=gop&tealium_profile=main&google_gid=CAESEPlM2X9HORL7UW...

43 B
967 B

32ms
8ms

Image
image/gif

35.157.44.192
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://datacloud.tealiumiq.com/vdata/i.gif?tealium_cookie_sync=true&tealium_vid=017c04cd17b30095e3a5ae45502803072010a06a00b08&tealium_account=gop&tealium_profile=main&google_gid=CAESEPlM2X9HORL7UW2yHL6MJkE&google_cver=1
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/rnc/2021-sustaining-membership?utm_medium=email&utm_source=ET_16&utm_campaign=20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc&utm_content=gop_direct-ask_text_contribute_bottom_other_all
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.157.44.192 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-44-192.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Sep 2021 20:02:02 GMT
x-serverid: uconnect_i-0567e951607c57fbe
x-did: 017c04cd17b30095e3a5ae45502803072010a06a00b08
x-tid: 017c04cd17b30095e3a5ae45502803072010a06a00b08
vary: Origin
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CUR ADM DEV OUR BUS"
x-acc: gop:main:2:vdata
cache-control: no-transform,private,no-cache,no-store,max-age=0,s-maxage=0
x-region: eu-central-1
content-type: image/gif
x-ulver: 5d0a7ac7f391f24eff8e8e0c8f530757a2665e52-SNAPSHOT
content-length: 43
x-uuid: 05cdb0b8-ee23-412f-9bc5-b62cc2fd9824
expires: Mon, 20 Sep 2021 20:02:02 GMT

Redirect headers

pragma: no-cache
date: Mon, 20 Sep 2021 20:02:02 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://datacloud.tealiumiq.com/vdata/i.gif?tealium_cookie_sync=true&tealium_vid=017c04cd17b30095e3a5ae45502803072010a06a00b08&tealium_account=gop&tealium_profile=main&google_gid=CAESEPlM2X9HORL7UW2yHL6MJkE&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 437
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 i.gif Show response
collect.tealiumiq.com/gop/main/2/ 43 B
749 B 42ms
7ms XHR
image/gif 35.157.44.192
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://collect.tealiumiq.com/gop/main/2/i.gif
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gop/main/prod/utag.45.js?utv=ut4.46.202006091829
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.157.44.192 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-44-192.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://secure.winred.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryTLwm7jDgXK8zWifT

Response headers

date: Mon, 20 Sep 2021 20:02:02 GMT
vary: Origin
x-serverid: uconnect_i-0fb6fa7e3e8e1b1f9
x-tid: 017c04cd17b30095e3a5ae45502803072010a06a00b08
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CUR ADM DEV OUR BUS"
x-acc: gop:main:2:datacloud
x-region: eu-central-1
content-length: 43
pragma: no-cache
x-did: 017c04cd17b30095e3a5ae45502803072010a06a00b08
content-type: image/gif
access-control-allow-origin: https://secure.winred.com
access-control-expose-headers: X-Region
cache-control: no-transform,private,no-cache,no-store,max-age=0,s-maxage=0
access-control-allow-credentials: true
x-ulver: 5d0a7ac7f391f24eff8e8e0c8f530757a2665e52-SNAPSHOT
x-uuid: f502e418-e025-4b95-aaeb-12185fd5ecd8
expires: Mon, 20 Sep 2021 20:02:02 GMT

POST
H2 200 i.gif Show response
collect.tealiumiq.com/gop/main/2/ 43 B
748 B 45ms
13ms XHR
image/gif 35.157.44.192
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://collect.tealiumiq.com/gop/main/2/i.gif
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gop/main/prod/utag.5.js?utv=ut4.46.201909102207
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.157.44.192 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-44-192.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://secure.winred.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary0qvzGFYYVJjqrsSz

Response headers

date: Mon, 20 Sep 2021 20:02:02 GMT
vary: Origin
x-serverid: uconnect_i-0b7323fb184480daa
x-tid: 017c04cd17b30095e3a5ae45502803072010a06a00b08
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CUR ADM DEV OUR BUS"
x-acc: gop:main:2:datacloud
x-region: eu-central-1
content-length: 43
pragma: no-cache
x-did: 017c04cd17b30095e3a5ae45502803072010a06a00b08
content-type: image/gif
access-control-allow-origin: https://secure.winred.com
access-control-expose-headers: X-Region
cache-control: no-transform,private,no-cache,no-store,max-age=0,s-maxage=0
access-control-allow-credentials: true
x-ulver: 5d0a7ac7f391f24eff8e8e0c8f530757a2665e52-SNAPSHOT
x-uuid: e2f741c4-edf6-4f64-8c0f-e3df96574a20
expires: Mon, 20 Sep 2021 20:02:02 GMT

GET
H2 200 utag.v.js Show response
tags.tiqcdn.com/utag/tiqapp/ 2 B
202 B 12ms
12ms Script
application/x-javascript 184.30.24.194
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=gop/main/202006091829&cb=1632168122468
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gop/main/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.30.24.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-24-194.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 20:02:02 GMT
last-modified: Thu, 14 Apr 2016 16:57:51 GMT
server: AkamaiNetStorage
etag: "7bc0ee636b3b83484fc3b9348863bd22:1460653071"
content-type: application/x-javascript
cache-control: max-age=600
accept-ranges: bytes
content-length: 2
expires: Mon, 20 Sep 2021 20:12:02 GMT

GET
H2 200 1660815514223309 Show response
connect.facebook.net/signals/config/ 306 KB
87 KB 70ms
70ms Script
application/x-javascript 2a03:2880:f02d:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1660815514223309?v=2.9.45&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

44d3f794ba674180a35b166eb906ad77b2062bd01d584f539be48721fabf6b97

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: 3slXC548tkAc0pcQIMyz7gW7eWBIAG3cKoLoMZMrk6fR2Ta3m+w14GF5ir4aVaoqb2xpTAf6j2IbxJWBhy42ZQ==
x-fb-trip-id: 917726464
x-frame-options: DENY
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Mon, 20 Sep 2021 20:02:02 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H2 200 6 Show response
m.stripe.com/ Frame 6428 156 B
518 B 978ms
188ms XHR
text/plain 35.165.21.246
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.com/6

Requested by

Host: m.stripe.network
URL: https://m.stripe.network/out-4.5.40.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.165.21.246 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-165-21-246.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

38c7781b3312d9116eea893ac6a870e14f877bfd3b891ab7439c011fc3afb5ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://m.stripe.network/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 20 Sep 2021 20:02:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: nginx
vary: Accept-Encoding
content-type: text/plain;charset=utf-8
access-control-allow-origin: https://m.stripe.network
access-control-allow-credentials: true
strict-transport-security: max-age=31556926; includeSubDomains; preload
access-control-allow-headers: Content-Type

GET
H2 200 017c04cd17b30095e3a5ae45502803072010a06a00b08 Show response
visitor-service-eu-central-1.tealiumiq.com/gop/main/ 27 B
243 B 38ms
9ms Script
application/javascript 3.124.235.44
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://visitor-service-eu-central-1.tealiumiq.com/gop/main/017c04cd17b30095e3a5ae45502803072010a06a00b08?callback=utag.ut%5B%22writevamain%22%5D&rnd=1632168122620

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/gop/main/prod/utag.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.124.235.44 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-124-235-44.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e036d4c0bab9dcd3d8ed9d625c2cdd24f4d0474f1a4232f0e7c9471aaf0cf470

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-version: 57a693dbfb7ec11644c471713b0190e17d4d16ec-SNAPSHOT
date: Mon, 20 Sep 2021 20:02:02 GMT
x-region: eu-central-1
content-length: 27
strict-transport-security: max-age=31536000; includeSubdomains
x-nodeid: i-03afe2aa5f86a06c9
content-type: application/javascript; charset=utf-8

GET
H2 200 dc_pre=CP_xiomsjvMCFQrrUQodEugMIQ;src=9323526;type=landi0;cat=gop_d0;ord=3757474134697;gtm=2wg9f0;auiddc=956306649.1632168122;~oref=https%3A%2F%2Fsecure.winred.com%2Frnc%2F2021-sustaining-membershi... Show response
adservice.google.se/ddm/fls/i/ Frame B4B3 194 B
931 B 107ms
20ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.se/ddm/fls/i/dc_pre=CP_xiomsjvMCFQrrUQodEugMIQ;src=9323526;type=landi0;cat=gop_d0;ord=3757474134697;gtm=2wg9f0;auiddc=956306649.1632168122;~oref=https%3A%2F%2Fsecure.winred.com%2Frnc%2F2021-sustaining-membership%3Futm_medium%3Demail%26utm_source%3DET_16%26utm_campaign%3D20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc%26utm_content%3Dgop_direct-ask_text_contribute_bottom_other_all

Requested by

Host: adservice.google.com
URL: https://adservice.google.com/ddm/fls/i/dc_pre=CP_xiomsjvMCFQrrUQodEugMIQ;src=9323526;type=landi0;cat=gop_d0;ord=3757474134697;gtm=2wg9f0;auiddc=956306649.1632168122;~oref=https%3A%2F%2Fsecure.winred.com%2Frnc%2F2021-sustaining-membership%3Futm_medium%3Demail%26utm_source%3DET_16%26utm_campaign%3D20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc%26utm_content%3Dgop_direct-ask_text_contribute_bottom_other_all

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: adservice.google.se
:scheme: https
:path: /ddm/fls/i/dc_pre=CP_xiomsjvMCFQrrUQodEugMIQ;src=9323526;type=landi0;cat=gop_d0;ord=3757474134697;gtm=2wg9f0;auiddc=956306649.1632168122;~oref=https%3A%2F%2Fsecure.winred.com%2Frnc%2F2021-sustaining-membership%3Futm_medium%3Demail%26utm_source%3DET_16%26utm_campaign%3D20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc%26utm_content%3Dgop_direct-ask_text_contribute_bottom_other_all
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://adservice.google.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://adservice.google.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Mon, 20 Sep 2021 20:02:02 GMT
expires: Mon, 20 Sep 2021 20:02:02 GMT
cache-control: private, max-age=0
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 177
x-xss-protection: 0
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"

GET
H2 200 /
www.facebook.com/tr/ 44 B
313 B 27ms
8ms Image
image/gif 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1171422386625841&ev=PageView&dl=https%3A%2F%2Fsecure.winred.com%2Frnc%2F2021-sustaining-membership%3Futm_medium%3Demail%26utm_source%3DET_16%26utm_campaign%3D20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc%26utm_content%3Dgop_direct-ask_text_contribute_bottom_other_all&rl=&if=false&ts=1632168122631&sw=1600&sh=1200&v=2.9.45&r=stable&ec=0&o=28&it=1632168122165&coo=false&exp=p0&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 20:02:02 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Mon, 20 Sep 2021 20:02:02 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
101 B 27ms
8ms Image
image/gif 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=657928937632482&ev=PageView&dl=https%3A%2F%2Fsecure.winred.com%2Frnc%2F2021-sustaining-membership%3Futm_medium%3Demail%26utm_source%3DET_16%26utm_campaign%3D20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc%26utm_content%3Dgop_direct-ask_text_contribute_bottom_other_all&rl=&if=false&ts=1632168122635&sw=1600&sh=1200&v=2.9.45&r=stable&ec=0&o=30&fbp=fb.1.1632168122634.857814914&it=1632168122165&coo=false&exp=p0&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 20:02:02 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Mon, 20 Sep 2021 20:02:02 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
101 B 27ms
8ms Image
image/gif 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1660815514223309&ev=PageView&dl=https%3A%2F%2Fsecure.winred.com%2Frnc%2F2021-sustaining-membership%3Futm_medium%3Demail%26utm_source%3DET_16%26utm_campaign%3D20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc%26utm_content%3Dgop_direct-ask_text_contribute_bottom_other_all&rl=&if=false&ts=1632168122636&sw=1600&sh=1200&v=2.9.45&r=stable&ec=0&o=30&fbp=fb.1.1632168122634.857814914&it=1632168122165&coo=false&exp=p0&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 20:02:02 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Mon, 20 Sep 2021 20:02:02 GMT

POST
H2 404 cspreport
pay.google.com/_/InstantbuyFrontendBuyflowPayframeUi/ Frame 8AF0 2 KB
2 KB 15ms
13ms Other
text/html 2a00:1450:400c:c00::5c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://pay.google.com/_/InstantbuyFrontendBuyflowPayframeUi/cspreport
Requested by: Host: secure.winred.com
URL: https://secure.winred.com/rnc/2021-sustaining-membership?utm_medium=email&utm_source=ET_16&utm_campaign=20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc&utm_content=gop_direct-ask_text_contribute_bottom_other_all
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c00::5c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: d6ff339ddb4525268c21fa26ded66b0703f177e742281dc9bcd558288f8e1101

Request headers

Referer: https://pay.google.com/gp/p/ui/payframe?origin=https%3A%2F%2Fjs.stripe.com&mid=
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Mon, 20 Sep 2021 20:02:02 GMT
referrer-policy: no-referrer
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1608
content-type: text/html; charset=UTF-8

GET
H2 200 m=_b,_tp Show response
www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.-pYYKPINog8.es5.O/am=AoA/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMi... Frame 8AF0 147 KB
52 KB 31ms
8ms Script
text/javascript 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.-pYYKPINog8.es5.O/am=AoA/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrh76oNYrJvxAYJKq9goUCWiECtQBg/m=_b,_tp

Requested by

Host: pay.google.com
URL: https://pay.google.com/gp/p/ui/payframe?origin=https%3A%2F%2Fjs.stripe.com&mid=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

19a773791046645576e48192b5de557eb6c462bfefd052c8e21810496058a6cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 17 Sep 2021 12:19:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 286950
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/payments-consumer-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 52495
x-xss-protection: 0
last-modified: Thu, 16 Sep 2021 03:25:37 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/payments-consumer-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/payments-consumer-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="boq-infra/payments-consumer-boq-js-css-signers"
expires: Sat, 17 Sep 2022 12:19:32 GMT

GET
H2 200 m=byfTOb,lsjVmc,LEikZe Show response
www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.-pYYKPINog8.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.4EL... Frame 8AF0 35 KB
13 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.-pYYKPINog8.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.4ELIibCLNuU.L.B1.O/am=AoA/d=1/exm=_b,_tp/excm=_b,_tp,payframeview/esmo=1/ed=1/wt=2/rs=AMitfrhsWb-LvwKmvz2oyB2vwWCzfRNGmg/m=byfTOb,lsjVmc,LEikZe

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.-pYYKPINog8.es5.O/am=AoA/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrh76oNYrJvxAYJKq9goUCWiECtQBg/m=_b,_tp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cf80403aa6e1c6be6a9e7c8bda2fc854ba61055e9a223f08307e17726ea5683d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 16 Sep 2021 17:19:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 355358
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/payments-consumer-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13257
x-xss-protection: 0
last-modified: Wed, 15 Sep 2021 22:23:16 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/payments-consumer-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/payments-consumer-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="boq-infra/payments-consumer-boq-js-css-signers"
expires: Fri, 16 Sep 2022 17:19:24 GMT

GET
H2 200 m=IZT63,ws9Tlc,p8L0ob,vfuNJf,PrPYRd,Ru0Pgb,hc6Ubd,ZyYHPb,Das5Le Show response
www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.-pYYKPINog8.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.4EL... Frame 8AF0 72 KB
26 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.-pYYKPINog8.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.4ELIibCLNuU.L.B1.O/am=AoA/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,payframeview/esmo=1/ed=1/wt=2/rs=AMitfrhsWb-LvwKmvz2oyB2vwWCzfRNGmg/m=IZT63,ws9Tlc,p8L0ob,vfuNJf,PrPYRd,Ru0Pgb,hc6Ubd,ZyYHPb,Das5Le

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.-pYYKPINog8.es5.O/am=AoA/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrh76oNYrJvxAYJKq9goUCWiECtQBg/m=_b,_tp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2a6a09c2351570f035c528b543d878f287cf37cbb3e07ea16ae50059a7ad4827

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 17 Sep 2021 13:46:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 281704
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/payments-consumer-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 26818
x-xss-protection: 0
last-modified: Wed, 15 Sep 2021 22:23:16 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/payments-consumer-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/payments-consumer-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="boq-infra/payments-consumer-boq-js-css-signers"
expires: Sat, 17 Sep 2022 13:46:58 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ Frame 8AF0 48 KB
19 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.-pYYKPINog8.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.4ELIibCLNuU.L.B1.O/am=AoA/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,payframeview/esmo=1/ed=1/wt=2/rs=AMitfrhsWb-LvwKmvz2oyB2vwWCzfRNGmg/m=IZT63,ws9Tlc,p8L0ob,vfuNJf,PrPYRd,Ru0Pgb,hc6Ubd,ZyYHPb,Das5Le

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 11 Aug 2021 00:32:57 GMT
server: Golfe2
age: 4505
date: Mon, 20 Sep 2021 18:46:57 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19747
expires: Mon, 20 Sep 2021 20:46:57 GMT

GET
H2 200 pay Show response
pay.google.com/gp/p/ui/ Frame 8AF0 1 MB
346 KB 71ms
71ms XHR
text/html 2a00:1450:400c:c00::5c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pay.google.com/gp/p/ui/pay

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.-pYYKPINog8.es5.O/am=AoA/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrh76oNYrJvxAYJKq9goUCWiECtQBg/m=_b,_tp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::5c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4c8142c236ab2a0ac405b8e974b81151006912a352916947ac1f86d6af10364f

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-H2oC09XnxC0oM2uAyDP4og' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport;worker-src 'self', script-src 'nonce-H2oC09XnxC0oM2uAyDP4og' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com https://sandbox.google.com https://payments.google.com https://pay.google.com https://pay.sandbox.google.com;report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport, require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: same-site
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
x-ua-compatible: IE=edge
server: ESF
cross-origin-opener-policy: unsafe-none; report-to="InstantbuyFrontendBuyflowPayUi"
date: Mon, 20 Sep 2021 20:02:02 GMT
x-frame-options: DENY
report-to: {"group":"InstantbuyFrontendBuyflowPayUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/InstantbuyFrontendBuyflowPayUi/external"}]}
content-type: text/html; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
cache-control: private, max-age=3600
content-security-policy: script-src 'report-sample' 'nonce-H2oC09XnxC0oM2uAyDP4og' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport;worker-src 'self', script-src 'nonce-H2oC09XnxC0oM2uAyDP4og' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com https://sandbox.google.com https://payments.google.com https://pay.google.com https://pay.sandbox.google.com;report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport, require-trusted-types-for 'script';report-uri /_/InstantbuyFrontendBuyflowPayUi/cspreport
expires: Mon, 20 Sep 2021 20:02:02 GMT

POST
H2 200 log Show response
play.google.com/ Frame 8AF0 131 B
273 B 344ms
42ms XHR
text/plain 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.-pYYKPINog8.es5.O/am=AoA/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrh76oNYrJvxAYJKq9goUCWiECtQBg/m=_b,_tp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pay.google.com/
X-Goog-AuthUser: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Mon, 20 Sep 2021 20:02:03 GMT
content-encoding: gzip
server: Playlog
access-control-allow-headers: X-Playlog-Web
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
access-control-allow-origin: https://pay.google.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
content-type: text/plain; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131
x-xss-protection: 0
expires: Mon, 20 Sep 2021 20:02:03 GMT

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 86ms
38ms Preflight
text/plain 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: x-goog-authuser
Origin: https://pay.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: https://pay.google.com
access-control-allow-methods: GET, POST, OPTIONS
access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
content-type: text/plain; charset=UTF-8
date: Mon, 20 Sep 2021 20:02:02 GMT
server: Playlog
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 20 Sep 2021 20:02:02 GMT
cache-control: private

POST
H2 200 log Show response
play.google.com/ Frame 8AF0 131 B
273 B 341ms
41ms XHR
text/plain 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.-pYYKPINog8.es5.O/am=AoA/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrh76oNYrJvxAYJKq9goUCWiECtQBg/m=_b,_tp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pay.google.com/
X-Goog-AuthUser: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Mon, 20 Sep 2021 20:02:03 GMT
content-encoding: gzip
server: Playlog
access-control-allow-headers: X-Playlog-Web
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
access-control-allow-origin: https://pay.google.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
content-type: text/plain; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131
x-xss-protection: 0
expires: Mon, 20 Sep 2021 20:02:03 GMT

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 81ms
38ms Preflight
text/plain 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: x-goog-authuser
Origin: https://pay.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: https://pay.google.com
access-control-allow-methods: GET, POST, OPTIONS
access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
content-type: text/plain; charset=UTF-8
date: Mon, 20 Sep 2021 20:02:02 GMT
server: Playlog
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 20 Sep 2021 20:02:02 GMT
cache-control: private

POST
H2 200 log Show response
play.google.com/ Frame 8AF0 131 B
273 B 342ms
42ms XHR
text/plain 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.-pYYKPINog8.es5.O/am=AoA/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrh76oNYrJvxAYJKq9goUCWiECtQBg/m=_b,_tp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pay.google.com/
X-Goog-AuthUser: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Mon, 20 Sep 2021 20:02:03 GMT
content-encoding: gzip
server: Playlog
access-control-allow-headers: X-Playlog-Web
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
access-control-allow-origin: https://pay.google.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
content-type: text/plain; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131
x-xss-protection: 0
expires: Mon, 20 Sep 2021 20:02:03 GMT

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 76ms
38ms Preflight
text/plain 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: x-goog-authuser
Origin: https://pay.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: https://pay.google.com
access-control-allow-methods: GET, POST, OPTIONS
access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
content-type: text/plain; charset=UTF-8
date: Mon, 20 Sep 2021 20:02:02 GMT
server: Playlog
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 20 Sep 2021 20:02:02 GMT
cache-control: private

POST
H2 200 log Show response
play.google.com/ Frame 8AF0 131 B
296 B 340ms
40ms XHR
text/plain 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.-pYYKPINog8.es5.O/am=AoA/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrh76oNYrJvxAYJKq9goUCWiECtQBg/m=_b,_tp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pay.google.com/
X-Goog-AuthUser: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Mon, 20 Sep 2021 20:02:03 GMT
content-encoding: gzip
server: Playlog
access-control-allow-headers: X-Playlog-Web
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
access-control-allow-origin: https://pay.google.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
content-type: text/plain; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131
x-xss-protection: 0
expires: Mon, 20 Sep 2021 20:02:03 GMT

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 72ms
39ms Preflight
text/plain 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: x-goog-authuser
Origin: https://pay.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: https://pay.google.com
access-control-allow-methods: GET, POST, OPTIONS
access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
content-type: text/plain; charset=UTF-8
date: Mon, 20 Sep 2021 20:02:02 GMT
server: Playlog
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 20 Sep 2021 20:02:02 GMT
cache-control: private

POST
H2 200 log Show response
play.google.com/ Frame 8AF0 131 B
273 B 344ms
44ms XHR
text/plain 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.-pYYKPINog8.es5.O/am=AoA/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrh76oNYrJvxAYJKq9goUCWiECtQBg/m=_b,_tp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pay.google.com/
X-Goog-AuthUser: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Mon, 20 Sep 2021 20:02:03 GMT
content-encoding: gzip
server: Playlog
access-control-allow-headers: X-Playlog-Web
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
access-control-allow-origin: https://pay.google.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
content-type: text/plain; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131
x-xss-protection: 0
expires: Mon, 20 Sep 2021 20:02:03 GMT

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 68ms
39ms Preflight
text/plain 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: x-goog-authuser
Origin: https://pay.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: https://pay.google.com
access-control-allow-methods: GET, POST, OPTIONS
access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
content-type: text/plain; charset=UTF-8
date: Mon, 20 Sep 2021 20:02:02 GMT
server: Playlog
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 20 Sep 2021 20:02:02 GMT
cache-control: private

GET
H2 200 /
q.stripe.com/ Frame 4344 43 B
285 B 162ms
162ms Image
image/gif 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q.stripe.com/?event=elements.timings&event_count=11&timestamp=1632168122908&event_id=1c067fe0-8e62-4700-ac64-8d57ced8c71a&os=Windows&browserFamily=Chrome&version=a13e27c60&key=pk_live_JzNU2ovfdQBD0CxSZHjPm5Lv&referrer=https%3A%2F%2Fsecure.winred.com&stripe_js_id=a30b0177-0d04-49d3-857b-fdf16585a4de&controller_load_time=1632168122191&wrapper=unknown&es_module=false&frame_width=1600&element=outer&dom_loading=355&dom_interactive=1259&dom_complete=2274&since_fetch=1215&load_count=1&load_before_dom_content_loaded=true&load_ready_state=loading&first_create_ready_state=interactive&first_mount_readyState=interactive&until_first_create=105&until_first_mount=107&until_first_load=415&resource_timings-stripe.js-transfer_size=67924&resource_timings-stripe.js-duration=828&resource_timings-m-outer.html-transfer_size=515&resource_timings-m-outer.html-duration=21&resource_timings-controller.html-transfer_size=599&resource_timings-controller.html-duration=25&resource_timings-elements-inner-card.html-transfer_size=1645&resource_timings-elements-inner-card.html-duration=25&resource_timings-payment-request-inner-google-pay.html-transfer_size=684&resource_timings-payment-request-inner-google-pay.html-duration=20&resource_timings-payment-request-inner-browser.html-transfer_size=620&resource_timings-payment-request-inner-browser.html-duration=25

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Sep 2021 20:02:02 GMT
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: image/gif
cache-control: no-cache, no-store, private, must-revalidate, max-age=0, max-stale=0, post-check=0, pre-check=0
content-length: 43
expires: 0

GET
H2 200 m=Wt6vjf,_latency,FCpbqb,WhJNk Show response
www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.-pYYKPINog8.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.4EL... Frame 8AF0 17 KB
7 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.-pYYKPINog8.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.4ELIibCLNuU.L.B1.O/am=AoA/d=1/exm=Das5Le,IZT63,LEikZe,PrPYRd,Ru0Pgb,ZyYHPb,_b,_tp,byfTOb,hc6Ubd,lsjVmc,p8L0ob,vfuNJf,ws9Tlc/excm=_b,_tp,payframeview/esmo=1/ed=1/wt=2/rs=AMitfrhsWb-LvwKmvz2oyB2vwWCzfRNGmg/m=Wt6vjf,_latency,FCpbqb,WhJNk

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.-pYYKPINog8.es5.O/am=AoA/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrh76oNYrJvxAYJKq9goUCWiECtQBg/m=_b,_tp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ea05a42b69e5c6706c6fcb7f7c30f5e39e7112d9ffb496758c5d850a560cb462

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 17 Sep 2021 08:02:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 302343
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/payments-consumer-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7309
x-xss-protection: 0
last-modified: Wed, 15 Sep 2021 22:23:16 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/payments-consumer-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/payments-consumer-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="boq-infra/payments-consumer-boq-js-css-signers"
expires: Sat, 17 Sep 2022 08:02:59 GMT

GET
H2 200 m=lwddkf,EFQ78c Show response
www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.-pYYKPINog8.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.4EL... Frame 8AF0 8 KB
3 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.-pYYKPINog8.es5.O/ck=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.4ELIibCLNuU.L.B1.O/am=AoA/d=1/exm=Das5Le,FCpbqb,IZT63,LEikZe,PrPYRd,Ru0Pgb,WhJNk,Wt6vjf,ZyYHPb,_b,_latency,_tp,byfTOb,hc6Ubd,lsjVmc,p8L0ob,vfuNJf,ws9Tlc/excm=_b,_tp,payframeview/esmo=1/ed=1/wt=2/rs=AMitfrhsWb-LvwKmvz2oyB2vwWCzfRNGmg/m=lwddkf,EFQ78c

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.-pYYKPINog8.es5.O/am=AoA/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrh76oNYrJvxAYJKq9goUCWiECtQBg/m=_b,_tp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

905a6e5b6698ef162b06d7aee6cae2540d5466e02d682afdb5e38ee5a4b2e858

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pay.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 16 Sep 2021 17:19:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 355356
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/payments-consumer-boq-js-css-signers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3316
x-xss-protection: 0
last-modified: Wed, 15 Sep 2021 22:23:16 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"boq-infra/payments-consumer-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/payments-consumer-boq-js-css-signers"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="boq-infra/payments-consumer-boq-js-css-signers"
expires: Fri, 16 Sep 2022 17:19:26 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 96 KB
38 KB 30ms
29ms Script
application/javascript 2a00:1450:4001:808::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-855990581

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KQQBPQZ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

36a4217c704795f64655bc5421dbd09476a4b5e0f6969b1606bada18ddfc0a93

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 20:02:02 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39163
x-xss-protection: 0
last-modified: Mon, 20 Sep 2021 19:46:19 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 20 Sep 2021 20:02:02 GMT

POST
H2 200 log Show response
play.google.com/ Frame 8AF0 131 B
273 B 344ms
45ms XHR
text/plain 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.-pYYKPINog8.es5.O/am=AoA/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrh76oNYrJvxAYJKq9goUCWiECtQBg/m=_b,_tp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pay.google.com/
X-Goog-AuthUser: 0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Mon, 20 Sep 2021 20:02:03 GMT
content-encoding: gzip
server: Playlog
access-control-allow-headers: X-Playlog-Web
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
access-control-allow-origin: https://pay.google.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
content-type: text/plain; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131
x-xss-protection: 0
expires: Mon, 20 Sep 2021 20:02:03 GMT

OPTIONS
H2 200 log
play.google.com/ Frame 0
0 55ms
39ms Preflight
text/plain 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true&authuser=0

Protocol

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: x-goog-authuser
Origin: https://pay.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: https://pay.google.com
access-control-allow-methods: GET, POST, OPTIONS
access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-headers: X-Playlog-Web,authorization,origin,x-goog-authuser
content-type: text/plain; charset=UTF-8
date: Mon, 20 Sep 2021 20:02:02 GMT
server: Playlog
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 20 Sep 2021 20:02:02 GMT
cache-control: private

GET
H2 200 /
q.stripe.com/ Frame D8E2 43 B
285 B 161ms
161ms Image
image/gif 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q.stripe.com/?event=elements.pr.google_pay.activity_mode&event_count=12&timestamp=1632168122922&event_id=eb9c9acb-3dbd-416e-b568-46fee08c9682&os=Windows&browserFamily=Chrome&version=a13e27c60&key=pk_live_JzNU2ovfdQBD0CxSZHjPm5Lv&referrer=https%3A%2F%2Fsecure.winred.com&stripe_js_id=a30b0177-0d04-49d3-857b-fdf16585a4de&controller_load_time=1632168122278&wrapper=unknown&es_module=false&frame_width=1600&activityModeName=POPUP&activityMode=2&backingLibrary=GOOGLE_PAY

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Sep 2021 20:02:03 GMT
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: image/gif
cache-control: no-cache, no-store, private, must-revalidate, max-age=0, max-stale=0, post-check=0, pre-check=0
content-length: 43
expires: 0

GET
H2 200 /
q.stripe.com/ Frame D8E2 43 B
285 B 163ms
163ms Image
image/gif 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q.stripe.com/?event=elements.pr.google_pay.can_make_payment_native_response&event_count=13&timestamp=1632168122922&event_id=8ddd51d6-ffab-4ba9-b5b3-0d233667fa83&os=Windows&browserFamily=Chrome&version=a13e27c60&key=pk_live_JzNU2ovfdQBD0CxSZHjPm5Lv&referrer=https%3A%2F%2Fsecure.winred.com&stripe_js_id=a30b0177-0d04-49d3-857b-fdf16585a4de&controller_load_time=1632168122278&wrapper=unknown&es_module=false&frame_width=1600&available=false&backingLibrary=GOOGLE_PAY

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Sep 2021 20:02:03 GMT
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: image/gif
cache-control: no-cache, no-store, private, must-revalidate, max-age=0, max-stale=0, post-check=0, pre-check=0
content-length: 43
expires: 0

GET
H2 200 /
q.stripe.com/ Frame D8E2 43 B
285 B 161ms
161ms Image
image/gif 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q.stripe.com/?event=elements.error.pr.browser.can_make_payment_rate_limited&event_count=14&timestamp=1632168122924&event_id=d3686c16-33b7-482b-9ab9-af9fa88c0e04&os=Windows&browserFamily=Chrome&version=a13e27c60&key=pk_live_JzNU2ovfdQBD0CxSZHjPm5Lv&referrer=https%3A%2F%2Fsecure.winred.com&stripe_js_id=a30b0177-0d04-49d3-857b-fdf16585a4de&controller_load_time=1632168122278&wrapper=unknown&es_module=false&frame_width=1600&error-stack=Error%3A+Failed+to+execute+%27hasEnrolledInstrument%27+on+%27PaymentRequest%27%3A+Cannot+query+payment+request%0A++++at+https%3A%2F%2Fjs.stripe.com%2Fv3%2Ffingerprinted%2Fjs%2Fpayment-request-inner-browser-97d4b52568a2d07eee55c63ea244669d.js%3A1%3A10013%0A++++at+https%3A%2F%2Fjs.stripe.com%2Fv3%2Ffingerprinted%2Fjs%2Fshared-f5eaf0a870d%3Csanitized%3Efd1e8f67f52e5.js%3A1%3A75288%0A++++at+Array.forEach+(%3Canonymous%3E)%0A++++at+t._emit+(https%3A%2F%2Fjs.stripe.com%2Fv3%2Ffingerprinted%2Fjs%2Fshared-f5eaf0a870d%3Csanitized%3Efd1e8f67f52e5.js%3A1%3A75265)%0A++++at+e.value+(https%3A%2F%2Fjs.stripe.com%2Fv3%2Ffingerprinted%2Fjs%2Fshared-f5eaf0a870d%3Csanitized%3Efd1e8f67f52e5.js%3A1%3A54202)%0A++++at+https%3A%2F%2Fjs.stripe.com%2Fv3%2Ffingerprinted%2Fjs%2Fshared-f5eaf0a870d%3Csanitized%3Efd1e8f67f52e5.js%3A1%3A82157%0A++++at+https%3A%2F%2Fjs.stripe.com%2Fv3%2Ffingerprinted%2Fjs%2Fshared-f5eaf0a870d%3Csanitized%3Efd1e8f67f52e5.js%3A1%3A77642%0A++++at+new+Promise+(%3Canonymous%3E)%0A++++at+t.n._respondUsingPromise+(https%3A%2F%2Fjs.stripe.com%2Fv3%2Ffingerprinted%2Fjs%2Fshared-f5eaf0a870d%3Csanitized%3Efd1e8f67f52e5.js%3A1%3A77614)%0A++++at+t.value+(https%3A%2F%2Fjs.stripe.com%2Fv3%2Ffingerprinted%2Fjs%2Fshared-f5eaf0a870d%3Csanitized%3Efd1e8f67f52e5.js%3A1%3A82081)&backingLibrary=BROWSER

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Sep 2021 20:02:03 GMT
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: image/gif
cache-control: no-cache, no-store, private, must-revalidate, max-age=0, max-stale=0, post-check=0, pre-check=0
content-length: 43
expires: 0

GET
H2 200 /
q.stripe.com/ Frame D8E2 43 B
285 B 161ms
161ms Image
image/gif 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q.stripe.com/?event=elements.error.payreq.can_make_payment_rate_limited&event_count=15&timestamp=1632168122925&event_id=3f7270e2-edcd-4ae8-96c3-a2349c3c9458&os=Windows&browserFamily=Chrome&version=a13e27c60&key=pk_live_JzNU2ovfdQBD0CxSZHjPm5Lv&referrer=https%3A%2F%2Fsecure.winred.com&stripe_js_id=a30b0177-0d04-49d3-857b-fdf16585a4de&controller_load_time=1632168122278&wrapper=unknown&es_module=false&frame_width=1600&message=Failed+to+execute+%27hasEnrolledInstrument%27+on+%27PaymentRequest%27%3A+Cannot+query+payment+request&impl=prapi

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Sep 2021 20:02:03 GMT
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: image/gif
cache-control: no-cache, no-store, private, must-revalidate, max-age=0, max-stale=0, post-check=0, pre-check=0
content-length: 43
expires: 0

GET
H2 200 elements-inner-payment-request-ba41c776bf8e1c724faebfdd96840d43.html Show response
js.stripe.com/v3/ Frame BF37 8 KB
3 KB 26ms
26ms Document
text/html 13.224.193.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/elements-inner-payment-request-ba41c776bf8e1c724faebfdd96840d43.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.92 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-92.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

1470f4a91eb78cd2b745bc6e3ea268de6e280e89eb7e71dfcd4fa58e0cd0df4c

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

:method: GET
:authority: js.stripe.com
:scheme: https
:path: /v3/elements-inner-payment-request-ba41c776bf8e1c724faebfdd96840d43.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://secure.winred.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/

Response headers

content-type: text/html; charset=utf-8
x-amz-id-2: 66zEPHowQL/p/MNJGtqP3mFhFrTs0dHoXGoi7ljjabXfy+s09qiozgsPnDagvJoisjw1+0QMNyk=
x-amz-request-id: M5A3TMM07VYVBX2K
last-modified: Mon, 20 Sep 2021 18:12:06 GMT
server: AmazonS3
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
access-control-allow-origin: *
content-security-policy: default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
x-edge-origin-shield-skipped: 0
content-encoding: gzip
date: Mon, 20 Sep 2021 20:01:49 GMT
cache-control: max-age=60
etag: W/"ba41c776bf8e1c724faebfdd96840d43"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 2ec3090d74e200e4acdb2780da3c3c44.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: gzA5noImR4sAY9naG7DcWxgr3iLOlX1RKqjblHFVCVVvDjJyOsIdKA==
age: 43

GET
H2 200 /
q.stripe.com/ Frame D8E2 43 B
285 B 163ms
161ms Image
image/gif 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q.stripe.com/?event=elements.pr.can_make_payment_response&event_count=16&timestamp=1632168122931&event_id=728354e6-08f1-48a3-9113-0baaa7fcc711&os=Windows&browserFamily=Chrome&version=a13e27c60&key=pk_live_JzNU2ovfdQBD0CxSZHjPm5Lv&referrer=https%3A%2F%2Fsecure.winred.com&stripe_js_id=a30b0177-0d04-49d3-857b-fdf16585a4de&controller_load_time=1632168122278&wrapper=unknown&es_module=false&frame_width=1600&response-applePay=false&response-googlePay=false&cached=false&duration=949&activeBackingLibrary=BROWSER&usesButtonElement=true

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Sep 2021 20:02:03 GMT
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: image/gif
cache-control: no-cache, no-store, private, must-revalidate, max-age=0, max-stale=0, post-check=0, pre-check=0
content-length: 43
expires: 0

POST
H2 200 log Show response
play.google.com/ Frame 8AF0 131 B
692 B 62ms
42ms XHR
text/plain 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://play.google.com/log?format=json&hasfast=true

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-payments-consumer/_/js/k=boq-payments-consumer.InstantbuyFrontendBuyflowPayframeUi.en_US.-pYYKPINog8.es5.O/am=AoA/d=1/excm=_b,_tp,payframeview/ed=1/dg=0/wt=2/esmo=1/rs=AMitfrh76oNYrJvxAYJKq9goUCWiECtQBg/m=_b,_tp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://pay.google.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Mon, 20 Sep 2021 20:02:02 GMT
content-encoding: gzip
server: Playlog
access-control-allow-headers: X-Playlog-Web
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
access-control-allow-origin: https://pay.google.com
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
content-type: text/plain; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131
x-xss-protection: 0
expires: Mon, 20 Sep 2021 20:02:02 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 36 KB
14 KB 46ms
25ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-855990581

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

cafe /

Resource Hash

c9b2f25f41b7ff545aff01bca8720881b1f87a4a39980d6ce014fa00969d9c40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 20:02:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14064
x-xss-protection: 0
server: cafe
etag: 13250159043023796785
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 20 Sep 2021 20:02:03 GMT

GET
H2 200 ui-shared-fbbc6b7fa9d2977c6c9a09143f3027fd.css
js.stripe.com/v3/fingerprinted/css/ Frame BF37 17 KB
4 KB 37ms
36ms Stylesheet
text/css 13.224.193.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/css/ui-shared-fbbc6b7fa9d2977c6c9a09143f3027fd.css

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-payment-request-ba41c776bf8e1c724faebfdd96840d43.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.92 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-92.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

50cf3499f3f3e660c8d1a6001308c32306961043c33df07163b8f817b63c930e

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-payment-request-ba41c776bf8e1c724faebfdd96840d43.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 20:01:14 GMT
content-encoding: gzip
vary: Accept-Encoding
age: 49
via: 1.1 2ec3090d74e200e4acdb2780da3c3c44.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-request-id: 00DF5N5SG6KGK9RW
x-amz-id-2: NJL7+FYT4dorgRTCeEwbrSbHiJYnhSGF0ChrKS7+GYGwQXAXnoebAYDE+d2PZ2gH5B4zm54arFM=
last-modified: Wed, 04 Aug 2021 20:44:34 GMT
server: AmazonS3
etag: W/"9a9c2063d7db2d15e1e3281da15b9d41"
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=60
content-security-policy: default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
x-amz-cf-pop: FRA2-C1
timing-allow-origin: *
x-amz-cf-id: O8gkxDIZm-h30eKNYBL2U_NhFrZK0P9xPG7lO--NFIZGpK3bc0HDdw==

GET
H2 200 shared-f5eaf0a870d23878716fd1e8f67f52e5.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame BF37 179 KB
50 KB 25ms
24ms Script
application/javascript 13.224.193.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/shared-f5eaf0a870d23878716fd1e8f67f52e5.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-payment-request-ba41c776bf8e1c724faebfdd96840d43.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.92 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-92.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

8480eb220a7c7d5b98e1b83c56ac821eadc545bed2bf6c47562f7e22bfdd154a

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-payment-request-ba41c776bf8e1c724faebfdd96840d43.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 20:01:30 GMT
content-encoding: gzip
vary: Accept-Encoding
age: 32
via: 1.1 2ec3090d74e200e4acdb2780da3c3c44.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-request-id: YFX33G5YEW1Z7S7B
x-amz-id-2: HW73ElpBj3bgqB5RgPc5rhVtpIfsususouvTH+f9xiJ0uPWD+G/bDIOApv1HgbfX9GJCqbfjWI0=
last-modified: Mon, 20 Sep 2021 18:11:41 GMT
server: AmazonS3
etag: W/"56589cc6bfbec71282a2ac27c86bdfc9"
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=60
content-security-policy: default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
x-amz-cf-pop: FRA2-C1
timing-allow-origin: *
x-amz-cf-id: U60HvLOyr-xWzRI99ZyYKAYYKoNyEBHlR_LrJDxEbs4U0cIALRwjuQ==

GET
H2 200 ui-shared-2c01313336dd31dabdfc1b78387faa1f.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame BF37 218 KB
68 KB 21ms
21ms Script
application/javascript 13.224.193.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/ui-shared-2c01313336dd31dabdfc1b78387faa1f.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-payment-request-ba41c776bf8e1c724faebfdd96840d43.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.92 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-92.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

a9f6589d04dbb813a65b5d9aafb0c8b9e3a4b02836f06a954fbffdaf92e2d1bd

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-payment-request-ba41c776bf8e1c724faebfdd96840d43.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
etag: W/"dd5bcda63bd636a7ef1dee9e1ad37bed"
age: 55
x-cache: Hit from cloudfront
x-edge-origin-shield-skipped: 0
x-amz-request-id: C5BDSH6KEYV0N9T0
x-amz-id-2: hSVGPKz1Aqm/L79hcz67rwJTqjZSl+EBSGh18LSvgFOYdiDQ1enLAAalDMvCuz2EMVvR9lW+3ME=
access-control-allow-origin: *
last-modified: Fri, 17 Sep 2021 22:15:46 GMT
server: AmazonS3
date: Mon, 20 Sep 2021 20:01:12 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 2ec3090d74e200e4acdb2780da3c3c44.cloudfront.net (CloudFront)
cache-control: max-age=60
content-security-policy: default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
x-amz-cf-pop: FRA2-C1
timing-allow-origin: *
x-amz-cf-id: NzOTHZrHzE10MqCSR9Wz1Uk6p8VSWHZfFwPR_2AZET0hbdbhD2FpCA==

GET
H2 200 elements-inner-payment-request-2793b2033e7ec42db09bc8bb47558c6b.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame BF37 35 KB
12 KB 24ms
24ms Script
application/javascript 13.224.193.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/elements-inner-payment-request-2793b2033e7ec42db09bc8bb47558c6b.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/elements-inner-payment-request-ba41c776bf8e1c724faebfdd96840d43.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.193.92 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-193-92.fra2.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

921d53a1e26789bfb9e3719884fad804a9680202c3675c244bc8fc0e6fc1ae64

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/v3/elements-inner-payment-request-ba41c776bf8e1c724faebfdd96840d43.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
etag: W/"56980ff02a3a8cb66be3b30d651a42ce"
age: 54
x-cache: Hit from cloudfront
x-edge-origin-shield-skipped: 0
x-amz-request-id: DKPYER9EFDBK0SB2
x-amz-id-2: HlwIApeGWsFh7gRZqhVc+V6W8KRFyFLFOTTCLVJynULcK/pIEhlj80AEmxEuqbL2SZTtMAsINAM=
access-control-allow-origin: *
last-modified: Wed, 08 Sep 2021 17:49:27 GMT
server: AmazonS3
date: Mon, 20 Sep 2021 20:01:10 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 2ec3090d74e200e4acdb2780da3c3c44.cloudfront.net (CloudFront)
cache-control: max-age=60
content-security-policy: default-src 'self'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://r.stripe.com; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self'; img-src 'self' https://q.stripe.com blob:; font-src data: https:; media-src 'none'; object-src 'self';
x-amz-cf-pop: FRA2-C1
timing-allow-origin: *
x-amz-cf-id: HtK4dGDiMVXB1M9mQ_qbaErQr9dYbf74k1WxKTpvLlm4VihIRfIM2w==

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/855990581/ 3 KB
2 KB 44ms
22ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/855990581/?random=1632168123046&cv=9&fst=1632168123046&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9f0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsecure.winred.com%2Frnc%2F2021-sustaining-membership%3Futm_medium%3Demail%26utm_source%3DET_16%26utm_campaign%3D20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc%26utm_content%3Dgop_direct-ask_text_contribute_bottom_other_all&tiba=Republican%20National%20Committee&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

aa57a9b7cb529b025955b5cd395f2f66bbec4cfebbee8784eb713689bf7d3bbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Sep 2021 20:02:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1203
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
q.stripe.com/ Frame D8E2 43 B
285 B 161ms
161ms Image
image/gif 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q.stripe.com/?event=elements.create&event_count=17&timestamp=1632168123066&event_id=cad3a2b9-c49e-4a61-b504-68827743b247&os=Windows&browserFamily=Chrome&version=a13e27c60&key=pk_live_JzNU2ovfdQBD0CxSZHjPm5Lv&referrer=https%3A%2F%2Fsecure.winred.com&stripe_js_id=a30b0177-0d04-49d3-857b-fdf16585a4de&controller_load_time=1632168122278&wrapper=unknown&es_module=false&frame_width=1600&options-style-paymentRequestButton-type=paymentRequestButton&options-style-paymentRequestButton-buttonTheme=dark&options-style-paymentRequestButton-buttonType=donate&options-style-paymentRequestButton-height-value=52px&options-betas=&options-componentName=paymentRequestButton&options-wait=false&options-rtl=false&element=paymentRequestButton

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Sep 2021 20:02:03 GMT
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: image/gif
cache-control: no-cache, no-store, private, must-revalidate, max-age=0, max-stale=0, post-check=0, pre-check=0
content-length: 43
expires: 0

POST
H2 200 0 Show response
r.stripe.com/ Frame D8E2 0
213 B 166ms
166ms XHR
application/octet-stream 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://r.stripe.com/0

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/shared-f5eaf0a870d23878716fd1e8f67f52e5.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept: application/json
Referer: https://js.stripe.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 20 Sep 2021 20:02:03 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/octet-stream;charset=utf-8
access-control-allow-origin: https://js.stripe.com
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
content-length: 0

GET
H2 200 /
q.stripe.com/ Frame D8E2 43 B
285 B 162ms
161ms Image
image/gif 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q.stripe.com/?event=elements.timings&event_count=19&timestamp=1632168123071&event_id=7d70fdad-2d61-4b2b-8174-959005bde90e&os=Windows&browserFamily=Chrome&version=a13e27c60&key=pk_live_JzNU2ovfdQBD0CxSZHjPm5Lv&referrer=https%3A%2F%2Fsecure.winred.com&stripe_js_id=a30b0177-0d04-49d3-857b-fdf16585a4de&controller_load_time=1632168122278&wrapper=unknown&es_module=false&frame_width=1600&dom_loading=30&dom_interactive=104&dom_complete=118&since_sjs_load=1206&since_stripe_create=1054&since_group_create=1055&since_create=1054&mount_duration=103&since_fetch=103&load_count=1&match_frame=true&resource_timings-ui-shared.css-transfer_size=3348&resource_timings-ui-shared.css-duration=42&resource_timings-shared.js-transfer_size=50468&resource_timings-shared.js-duration=34&resource_timings-ui-shared.js-transfer_size=68810&resource_timings-ui-shared.js-duration=24&resource_timings-elements-inner-payment-request.js-transfer_size=11690&resource_timings-elements-inner-payment-request.js-duration=25&element=paymentRequestButton

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Sep 2021 20:02:03 GMT
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: image/gif
cache-control: no-cache, no-store, private, must-revalidate, max-age=0, max-stale=0, post-check=0, pre-check=0
content-length: 43
expires: 0

GET
H2 200 /
q.stripe.com/ Frame D8E2 43 B
285 B 163ms
163ms Image
image/gif 54.186.23.98
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q.stripe.com/?event=elements.event.ready&event_count=20&timestamp=1632168123072&event_id=69b60684-9b7d-474c-9798-5e608353f57f&os=Windows&browserFamily=Chrome&version=a13e27c60&key=pk_live_JzNU2ovfdQBD0CxSZHjPm5Lv&referrer=https%3A%2F%2Fsecure.winred.com&stripe_js_id=a30b0177-0d04-49d3-857b-fdf16585a4de&controller_load_time=1632168122278&wrapper=unknown&es_module=false&frame_width=1600&element=paymentRequestButton

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-186-23-98.stripe.com

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Sep 2021 20:02:03 GMT
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: image/gif
cache-control: no-cache, no-store, private, must-revalidate, max-age=0, max-stale=0, post-check=0, pre-check=0
content-length: 43
expires: 0

GET
H2 200 /
www.google.com/pagead/1p-user-list/855990581/ 42 B
154 B 325ms
23ms Image
image/gif 2a00:1450:4001:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/855990581/?random=1632168123046&cv=9&fst=1632168000000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9f0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsecure.winred.com%2Frnc%2F2021-sustaining-membership%3Futm_medium%3Demail%26utm_source%3DET_16%26utm_campaign%3D20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc%26utm_content%3Dgop_direct-ask_text_contribute_bottom_other_all&tiba=Republican%20National%20Committee&async=1&fmt=3&is_vtc=1&random=1312401391&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Sep 2021 20:02:03 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.se/pagead/1p-user-list/855990581/ 42 B
569 B 40ms
18ms Image
image/gif 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.se/pagead/1p-user-list/855990581/?random=1632168123046&cv=9&fst=1632168000000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9f0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsecure.winred.com%2Frnc%2F2021-sustaining-membership%3Futm_medium%3Demail%26utm_source%3DET_16%26utm_campaign%3D20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc%26utm_content%3Dgop_direct-ask_text_contribute_bottom_other_all&tiba=Republican%20National%20Committee&async=1&fmt=3&is_vtc=1&random=1312401391&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Sep 2021 20:02:03 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 / Show response
www.facebook.com/tr/ Frame 1ED2 0
108 B 7ms
7ms Document
text/plain 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: POST
:authority: www.facebook.com
:scheme: https
:path: /tr/
content-length: 2142
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
origin: https://secure.winred.com
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://secure.winred.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Origin: https://secure.winred.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/

Response headers

content-type: text/plain
access-control-allow-origin: https://secure.winred.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
date: Mon, 20 Sep 2021 20:02:03 GMT

POST
H2 200 / Show response
www.facebook.com/tr/ Frame FB86 0
31 B 7ms
6ms Document
text/plain 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: POST
:authority: www.facebook.com
:scheme: https
:path: /tr/
content-length: 2143
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
origin: https://secure.winred.com
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://secure.winred.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Origin: https://secure.winred.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/

Response headers

content-type: text/plain
access-control-allow-origin: https://secure.winred.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
date: Mon, 20 Sep 2021 20:02:03 GMT

POST
H/1.1 204
No Content events Show response
logx.optimizely.com/v1/ 0
362 B 426ms
101ms XHR
text/plain 52.45.207.82
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://logx.optimizely.com/v1/events
Requested by: Host: cdn-pci.optimizely.com
URL: https://cdn-pci.optimizely.com/js/8416096648.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.45.207.82 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-45-207-82.compute-1.amazonaws.com
Software: nginx/1.17.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://secure.winred.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Mon, 20 Sep 2021 20:02:03 GMT
Server: nginx/1.17.2
Content-Type: text/plain
Access-Control-Allow-Origin: https://secure.winred.com
Access-Control-Expose-Headers: X-Results-Data-Source
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
X-Request-Id: 881317e5-790f-4872-8b2e-aeea8ac12baf

GET
H2 200 common.js Show response
maps.googleapis.com/maps-api-v3/api/js/46/5/intl/de_ALL/ 86 KB
32 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps-api-v3/api/js/46/5/intl/de_ALL/common.js

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

51851a21c509338ed5929ff2697da8a2618c44ed6fc30f4b74afd6cf131dd5e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 15 Sep 2021 20:02:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 432003
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32060
x-xss-protection: 0
last-modified: Mon, 13 Sep 2021 21:30:12 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="maps-api-js"
expires: Thu, 15 Sep 2022 20:02:03 GMT

GET
H2 200 util.js Show response
maps.googleapis.com/maps-api-v3/api/js/46/5/intl/de_ALL/ 288 KB
88 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps-api-v3/api/js/46/5/intl/de_ALL/util.js

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&libraries=places

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8bc39e9e059dcc0542cba0dcb785648490f8a89782431afbd1a8a232947c296c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 15 Sep 2021 20:02:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 432003
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 90355
x-xss-protection: 0
last-modified: Mon, 13 Sep 2021 21:30:12 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="maps-api-js"
expires: Thu, 15 Sep 2022 20:02:03 GMT

GET
H2 200 AuthenticationService.Authenticate Show response
maps.googleapis.com/maps/api/js/ 62 B
208 B 36ms
35ms Script
text/javascript 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/js/AuthenticationService.Authenticate?1shttps%3A%2F%2Fsecure.winred.com%2Frnc%2F2021-sustaining-membership&4sAIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&callback=_xdc_._lz4hu7&key=AIzaSyDGBR6MmEzkdkem9Ci2VrraiYLneizw9Rg&token=43646

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps-api-v3/api/js/46/5/intl/de_ALL/common.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

mafe /

Resource Hash

cea53ee18ddff691e741dfeaa386277be994bed820a88e9ff9530263de0d18a5

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://secure.winred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 20 Sep 2021 20:02:06 GMT
content-encoding: gzip
server: mafe
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment
server-timing: gfet4t7; dur=21
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 63
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

75 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

27 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
app.revv.co/api/v3/users	1970-01-21 17:12:14	Name: rvid Value: 3fd31ce6-7a11-4332-b7a3-92caf2f962fb
.winred.com/	1969-12-31 23:59:59	Name: _revv_v3_session Value: TENUYjNSamkyVk5VSUhDL0FrakhrSHE3aFdOYXVNVzZMV3djZ0lsOUpRdGEzdEZKV3g3aEU4Y3JPRUZJVUpmTXQ2M3ZiMVJQNHBZS0pyei90U0xSci9lSUV4bUNyMmROOW00YXFKZ1NMYzRvR0prSzFYQWc3NHU3VVZ5S1dHZFpzVjZycW5sN0NwL21qUXFidlJTTjFQL0QraFZsSktJaEp5amVWUWExaWtldHdkRlRTckdiNFZLUGxUU0xpdzV0N3hVNWFJM2d1M1l5aTJGK2tqSkVNeStCNGs5dW1GNGs5cFZvckd4SXFENE4xRU5naEFrVHdadEpBWXY2ZFlpQ0xpbHQra05qNTc2UVdaV042MlZBcDUyNnFVMHdraVZpbG4wUVNaUmxwNlVCcXMxcGxNanRKYmxtZHZGNzk0OTlJOFR5YzI4QmdKcEVMK21TS1luc295MFBIMUFNV1BvbldvVXhqemw0STc1ZURxbHFVT3V2bUxjVk9OdVJheWdFZW9Cb3E4SmxiOU84V2Z4dExVOGFuZjc2dTlibVlnb0xrWWVSS3hRaUtma2FJcmlVa3RIaENqai9BOW95dGM1V2ZNbkFYdGN0Y3pIajd6R0JyakFFZG1sakpCaEE3OXh0czM2N3Q3ZXJjQW85ZFpBUWlqVWhZekhwR3RwQk0venhHTFlOMmtCc1NvZHZHNGg2Q1RqQ0ZXdzZVMlY1QkU4UFJSNDRmWWk4QzJsWkREd1Z2UjErWnVmRzVybHpBMHVpcHZTYW5EYXlaTHZrNW5aN1dYSnVaNkdZSzcxV08yTWg2ZU0rYnRIbzhNdlhWUTBBRWxpVHFjQkJ1THdLeHVNUHAvZ2s0R2FrNjdXQS9DMUFGQzV3RUloS1BzcHBEYy94Z0ZKd0dnQ1ZHWms9LS1ZcEVsMWZ6SU80bWlJelpHV05QbnJ3PT0%3D--9d0e0641cc2681767196a0a3c8f1fe719f11504a
.winred.com/	1970-01-19 23:32:24	Name: _gcl_au Value: 1.1.956306649.1632168122
secure.winred.com/	1969-12-31 23:59:59	Name: origin_url Value: https://secure.winred.com/rnc/2021-sustaining-membership?utm_medium=email&utm_source=ET_16&utm_campaign=20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc&utm_content=gop_direct-ask_text_contribute_bottom_other_all
.winred.com/	1970-01-20 14:54:00	Name: _ga Value: GA1.2.671554296.1632168122
.winred.com/	1970-01-19 21:24:14	Name: _gid Value: GA1.2.2766536.1632168122
.winred.com/	1970-01-19 21:22:48	Name: _dc_gtm_UA-73658561-7 Value: 1
.secure.winred.com/	1970-01-19 21:22:49	Name: __cf_bm Value: MNX8g_C7lHpOQhDeGIhLvjuGudZ6sflVMB_TtqkBbqM-1632168122-0-AV7WJ3EOsvQf+NT+wON09Lchs6Q6YkXzIp8wb+ivyyQckC/qBpXAqsDgDjtKYmNsdm4EPKV4mKGR+TxUH6dxoqCotH5zQL7kj6NfPqAjTeDkQcFtAMTQl3GguSx1ix+B07HlUSKEuusgl3Mk5NPCsxcd731lowHENFvhAtMtcuLbIvsSXmIDfZfNKqN6HaNtVw==
.revv.co/	1969-12-31 23:59:59	Name: _revv_v3_session Value: V01zMVZkVlhpS3NMZ29ScU0xWDFoTURIOHk5RWxPUzVQYUZ2MVFJeUErbTEvbmpWSEZkdXVhZVZRVFZJcGM1MUpwZ2dabXMrRURDQzdqUkJCZ0UwSmc9PS0talMyOS9ZSlp6Z2NQZktzN25MSUdJQT09--0b6b647492a54d11fb944f5f1263a0302dcfdd63
.revv.co/	1970-01-19 21:22:49	Name: __cf_bm Value: SsZMxuqQW5eVqq4_7eKYAEArNpTbKMbOeU1uhnCicD0-1632168122-0-AQsW5juRhYPoMncsVcxua8nLorDHrk+aLUeOIzwNJQm9GGBBLwhDB345TSmNMj1aIF25xlGuCNbVvVh5AfrJaUb+yk8A02xztlSry5YW5FoZ
secure.winred.com/	1969-12-31 23:59:59	Name: sso_tries Value: 1
secure.winred.com/	1970-01-21 17:10:48	Name: rvid Value: 3fd31ce6-7a11-4332-b7a3-92caf2f962fb
.google.com/	1970-01-20 01:46:19	Name: NID Value: 224=wyfxfjbnDXV2BdvAJF5HAPg1eQg1xtickijQ7aXSkCQ1f44lxdETfH67TbCOWKXPapcmU9uIEHlTTQW00ydB8o_3tHsahU3e00o-8A1IpMb6y7woPmdA0jdP8AnkQtmBdwQjcjHNG1SU0GfCBZuG9hJtAfpM5XbRYQCDpTxnMk8
.winred.com/	1970-01-19 21:22:48	Name: _gat_UA-2431644-99 Value: 1
.tealiumiq.com/	1970-01-20 06:08:24	Name: TAPID Value: gop/main>017c04cd17b30095e3a5ae45502803072010a06a00b08\|
.doubleclick.net/	1970-01-20 06:44:24	Name: IDE Value: AHWqTUkmi7cYpgTgIzOdVuiu2UHemIcm4RPtD4SXVEcvNsB6yAzYmYvRNlzbtnZp18s
.winred.com/	1970-01-20 06:08:24	Name: utag_main Value: v_id:017c04cd17b30095e3a5ae45502803072010a06a00b08$_sn:1$_se:1$_ss:1$_st:1632169922292$ses_id:1632168122292%3Bexp-session$_pn:1%3Bexp-session$dcsyncran:1%3Bexp-session$dc_visit:1$dc_event:2%3Bexp-session$dc_region:eu-central-1%3Bexp-session
.igodigital.com/	1970-01-23 13:01:40	Name: igodigitaltc2 Value: 9f0f0d62-1a4d-11ec-aa1e-8aad5b422287
.igodigital.com/	1970-01-19 21:22:51	Name: igodigitalst_10964169 Value: 9f0f14b0-1a4d-11ec-aa1e-8aad5b422287
.igodigital.com/	1970-01-19 21:22:51	Name: igodigitalstdomain Value: 31640
.winred.com/	1970-01-20 01:42:00	Name: optimizelyEndUserId Value: oeu1632168122564r0.9354942133288879
.tealiumiq.com/	1970-01-20 01:44:52	Name: tcs.google_gid Value: eyJnb3AvbWFpbiI6IkNBRVNFUGxNMlg5SE9STDdVVzJ5SEw2TUprRXwxNjMyMTY4MTIyNTgzIn0=
.tealiumiq.com/	1970-01-20 01:44:52	Name: tcs.google_cver Value: eyJnb3AvbWFpbiI6IjF8MTYzMjE2ODEyMjU4MyJ9
.winred.com/	1970-01-19 23:32:24	Name: _fbp Value: fb.1.1632168122634.857814914
m.stripe.com/	1970-01-20 14:54:00	Name: m Value: fc766d46-fe99-414a-9133-92488e0861419bb06e
.secure.winred.com/	1970-01-20 06:08:24	Name: __stripe_mid Value: d2c217e3-78d1-4047-9962-732656322d7b9ad042
.secure.winred.com/	1970-01-19 21:22:49	Name: __stripe_sid Value: 70ca7ec7-fbe8-4970-91c5-c1c0f8e7831b8f18b6

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://secure.winred.com/rnc/2021-sustaining-membership?utm_medium=email&utm_source=ET_16&utm_campaign=20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc&utm_content=gop_direct-ask_text_contribute_bottom_other_all(Line 53) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdn-pci.optimizely.com/js/8416096648.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://secure.winred.com/rnc/2021-sustaining-membership?utm_medium=email&utm_source=ET_16&utm_campaign=20210920_106163_2021-trump-life-membership-payment-incomplete-rs12-lpd-nd_warningpaymentincomplete_rnc&utm_content=gop_direct-ask_text_contribute_bottom_other_all(Line 53) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdn-pci.optimizely.com/js/8416096648.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
security	error	(Line 6) Message: This document requires 'TrustedScript' assignment.
network	error	URL: https://pay.google.com/_/InstantbuyFrontendBuyflowPayframeUi/cspreport Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

10964169.collect.igodigital.com
9323526.fls.doubleclick.net
a8416096648.cdn-pci.optimizely.com
adservice.google.com
adservice.google.se
app.revv.co
cdn-pci.optimizely.com
click.campaigns.rnchq.com
cm.g.doubleclick.net
collect.tealiumiq.com
connect.facebook.net
d35ligi1n5bgzc.cloudfront.net
datacloud.tealiumiq.com
googleads.g.doubleclick.net
js.stripe.com
logx.optimizely.com
m.stripe.com
m.stripe.network
maps.googleapis.com
nova.collect.igodigital.com
pay.google.com
play.google.com
q.stripe.com
r.stripe.com
secure.winred.com
stats.g.doubleclick.net
tags.tiqcdn.com
visitor-service-eu-central-1.tealiumiq.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.google.se
www.googleadservices.com
www.googletagmanager.com
www.gstatic.com
104.111.232.208
104.111.240.115
13.111.145.38
13.224.193.4
13.224.193.92
142.250.185.134
142.250.185.98
142.250.186.162
184.30.24.194
2600:9000:20eb:e000:19:7d10:bd80:93a1
2606:4700:10::6814:443
2606:4700:10::6814:543
2a00:1450:4001:808::2008
2a00:1450:4001:80e::2003
2a00:1450:4001:80f::2002
2a00:1450:4001:80f::2004
2a00:1450:4001:810::2003
2a00:1450:4001:810::200e
2a00:1450:4001:812::2002
2a00:1450:4001:829::200e
2a00:1450:4001:82b::2003
2a00:1450:4001:831::200a
2a00:1450:400c:c00::5c
2a00:1450:400c:c04::9c
2a03:2880:f02d:100:face:b00c:0:3
2a03:2880:f12d:181:face:b00c:0:25de
3.124.235.44
3.224.144.253
35.157.44.192
35.165.21.246
52.45.207.82
54.186.23.98
04839f10aefc8d03d7a8cf83c6d4d0db112b3a87a4c8d59dd0eab9b919459318
048ab7812899a24caacd50b1921fc17d5a3f7cd1fde2863d439a024a2245c6f8
058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c
05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf
0d3118e306c6a26f1d2efcb698984e6922c5e7e155c94a84760e36e5592a3c11
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
13cdbe7a20c8c8fa6bc5ebc24d11ddac1e5f118dc8cb8af002f27a762d15c50f
13e44ac91c0d0e34922532b04d931246156aef649b2ac9cacc69ad75ce63ad00
1470f4a91eb78cd2b745bc6e3ea268de6e280e89eb7e71dfcd4fa58e0cd0df4c
19a773791046645576e48192b5de557eb6c462bfefd052c8e21810496058a6cf
19d2e43a96b539c5bfee8691baa248a6560e8bacd2bdc2350bc9f740af273a02
1ac2771956c267147504b50c5c994b50f82d45f09e6b923957dd3e00e0897d94
235eed18eb698427ba39de488eba407c2ae2e426fc605eddbd1f216802e620bc
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
2646d818e258e85ba1721270d71684413d53dfa2dd8ac6957738d56a86ab1b5f
2a6a09c2351570f035c528b543d878f287cf37cbb3e07ea16ae50059a7ad4827
335b59e615135313a66319e641cdad6ac3489a600e04d4181c859699bed4babe
34270cdaeccdbb334855bd613970f79295c7af9d1823795eab35aa1e68a9d6c0
36a4217c704795f64655bc5421dbd09476a4b5e0f6969b1606bada18ddfc0a93
36f0bf882a876b13aeb20cf7a495421a43f336da5422072a58f58ce303fb6284
37b3012c96acb80f94f59f98cd21677ed6b1976489157fb4f31d2195eae478e7
38c7781b3312d9116eea893ac6a870e14f877bfd3b891ab7439c011fc3afb5ff
44d3f794ba674180a35b166eb906ad77b2062bd01d584f539be48721fabf6b97
450ec11a663f294bfe995ea695de0e6d19324441faf2bd3438d24775ecefebbf
4611c34378b1bbbee8890a472c6390137ce8841041a646f0bdc58cf9180eb18a
4c8142c236ab2a0ac405b8e974b81151006912a352916947ac1f86d6af10364f
502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358
50cf3499f3f3e660c8d1a6001308c32306961043c33df07163b8f817b63c930e
51851a21c509338ed5929ff2697da8a2618c44ed6fc30f4b74afd6cf131dd5e8
53b1c4b49a9fd4fce307c7203ae6939ffc7fc1e69464e19ccadb3aa1768426b4
5785c083b1cf0a752958975ebf6365d60896c3e809e7fd9bd94dc6e11bc75004
5c68c8aaba76ec9fb516f84adaf0f4b53240d5730f4ab8339417725a536ea848
626e124aafce560a521c9ce7e4cc884ea850ad2ab2228389ebc02350bcda0e92
6a51adbdf40f1dd532bdc040298e97d7c6d2b0c568c539c1a87017b6ec9ad0fd
6a6915872afa798395a56c7aa50d086cb325ff7214ad78ada3c7a96350bbad39
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
71dca7cbcc364183a910631475c55eb8363f6d397e5080a275f98513ecfaee67
74178e00b0636e5ac392feb3347d28640816c2058b5f1b9e0d1125d3c947ae93
7b2925e0047244e8725c503e5e7c42cedbee9baa9c57916680312f9a9041f82e
819d5419c736070b3a76cc3dc307a1df5039a1f66632c7920ae16993e0492f61
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8480eb220a7c7d5b98e1b83c56ac821eadc545bed2bf6c47562f7e22bfdd154a
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8529ea4473d1a1fb5854d29cc2a00ec989b5264f89b30d024287be7b4cd93878
8bc39e9e059dcc0542cba0dcb785648490f8a89782431afbd1a8a232947c296c
905a6e5b6698ef162b06d7aee6cae2540d5466e02d682afdb5e38ee5a4b2e858
921d53a1e26789bfb9e3719884fad804a9680202c3675c244bc8fc0e6fc1ae64
986b9eebf844fbc21d371c37409a5236bd0e7b38bbdbb9c32a06a7164f74100c
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a0f5c152e93a734e753f7fa3fd664fa9f05a0155e65e82f16fd892808b190d38
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
a965217219eb2b12541833216804b612e1e8675b7b7ef8ea34bf891834380dde
a9f6589d04dbb813a65b5d9aafb0c8b9e3a4b02836f06a954fbffdaf92e2d1bd
aa57a9b7cb529b025955b5cd395f2f66bbec4cfebbee8784eb713689bf7d3bbb
aa920fa4fdea358365f980f78d82a992fa119070a07cb21d3aeee419d88429aa
ac5905cec1854cee1e4237105e3f2f3b0b62a3c58395b2ff2485ef8260b2dc17
af4b8dcbb0f1beb04e333fb40d352f763415cc15b83b6c79646d773c4d5893b6
b45a15794600b5971a446a1ba104794cc382ff185ae25c38f342e982e9b0b5f7
b5422c2d179ba7e391b254909921a8e862d1b8147b3534e70de801f2dca3d84d
b83e994295ece94f9bb2a4a640d75f9c80a0b1e078043d407b2fb87970f25055
c4a8402fde1e397bcabe7467c0de035e7851eeb1bad9af5d1b67487e7d7f2a4a
c4fad9adc119c68438bae52a48675773d02d7eb814bd1bb566b8c6366c4c6a2e
c5d6337e892966edbf8c318256da0fa78ac4fccfbdfcb50a33b616df69666951
c885ef025f7d73741c3fae1f63830e9beec3f662f0ca17ea7746b534b34ac5d5
c9b2f25f41b7ff545aff01bca8720881b1f87a4a39980d6ce014fa00969d9c40
cea53ee18ddff691e741dfeaa386277be994bed820a88e9ff9530263de0d18a5
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cf80403aa6e1c6be6a9e7c8bda2fc854ba61055e9a223f08307e17726ea5683d
d68eb8e1826d9711bd5b411fbce0f61516fb7da1b8dd5d090251e6d3f2bf0cd5
d6ff339ddb4525268c21fa26ded66b0703f177e742281dc9bcd558288f8e1101
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e036d4c0bab9dcd3d8ed9d625c2cdd24f4d0474f1a4232f0e7c9471aaf0cf470
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e601b8a444a0a13c00221918c30fc739cf7f015494d6bdd884ff006507da8b40
e8e9871cf0af9019f2a0094a2ce12eb7794c104f7f38d9f75e7017c9d26e7cf6
ea05a42b69e5c6706c6fcb7f7c30f5e39e7112d9ffb496758c5d850a560cb462
ebbd3a4b27adf2b4cfb8ff1aeb3f60c0090ee800443cd0b82da7a1874dc6b634
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f1f4e48d598d5505e28c3292f0871a2ee028b223ce46c16d175dfd20ad896fd8
f4cfac7f236dac05e3477fddee8ca0029c627696f2a1b7954118fbf1404afe86
f919ef3d2847b69f2a8f60899caa05789574f07fa8f94ca72b19f38ad6a9a0fd
fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62

secure.winred.com Open in urlscan Pro 2606:4700:10::6814:543 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

148 Requests

100 %HTTPS

53 %IPv6

21 Domains

36 Subdomains

30 IPs

3 Countries

2601 kBTransfer

8130 kBSize

27 Cookies

7 Outgoing links

Page URL History

Redirected requests

148 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

secure.winred.com Open in urlscan Pro
2606:4700:10::6814:543 Public Scan

Screenshot
Live screenshot

Full Image

148
Requests

100 %
HTTPS

53 %
IPv6

21
Domains

36
Subdomains

30
IPs

3
Countries

2601 kB
Transfer

8130 kB
Size

27
Cookies

148 HTTP transactions
0 data transactions